xref: /freebsd/sys/netinet/sctp_output.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  * a) Redistributions of source code must retain the above copyright notice,
8  *   this list of conditions and the following disclaimer.
9  *
10  * b) Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *   the documentation and/or other materials provided with the distribution.
13  *
14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15  *    contributors may be used to endorse or promote products derived
16  *    from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28  * THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 /* $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $	 */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <netinet/sctp_os.h>
37 #include <sys/proc.h>
38 #include <netinet/sctp_var.h>
39 #include <netinet/sctp_sysctl.h>
40 #include <netinet/sctp_header.h>
41 #include <netinet/sctp_pcb.h>
42 #include <netinet/sctputil.h>
43 #include <netinet/sctp_output.h>
44 #include <netinet/sctp_uio.h>
45 #include <netinet/sctputil.h>
46 #include <netinet/sctp_auth.h>
47 #include <netinet/sctp_timer.h>
48 #include <netinet/sctp_asconf.h>
49 #include <netinet/sctp_indata.h>
50 #include <netinet/sctp_bsd_addr.h>
51 #include <netinet/sctp_input.h>
52 
53 
54 
55 #define SCTP_MAX_GAPS_INARRAY 4
56 struct sack_track {
57 	uint8_t right_edge;	/* mergable on the right edge */
58 	uint8_t left_edge;	/* mergable on the left edge */
59 	uint8_t num_entries;
60 	uint8_t spare;
61 	struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY];
62 };
63 
64 struct sack_track sack_array[256] = {
65 	{0, 0, 0, 0,		/* 0x00 */
66 		{{0, 0},
67 		{0, 0},
68 		{0, 0},
69 		{0, 0}
70 		}
71 	},
72 	{1, 0, 1, 0,		/* 0x01 */
73 		{{0, 0},
74 		{0, 0},
75 		{0, 0},
76 		{0, 0}
77 		}
78 	},
79 	{0, 0, 1, 0,		/* 0x02 */
80 		{{1, 1},
81 		{0, 0},
82 		{0, 0},
83 		{0, 0}
84 		}
85 	},
86 	{1, 0, 1, 0,		/* 0x03 */
87 		{{0, 1},
88 		{0, 0},
89 		{0, 0},
90 		{0, 0}
91 		}
92 	},
93 	{0, 0, 1, 0,		/* 0x04 */
94 		{{2, 2},
95 		{0, 0},
96 		{0, 0},
97 		{0, 0}
98 		}
99 	},
100 	{1, 0, 2, 0,		/* 0x05 */
101 		{{0, 0},
102 		{2, 2},
103 		{0, 0},
104 		{0, 0}
105 		}
106 	},
107 	{0, 0, 1, 0,		/* 0x06 */
108 		{{1, 2},
109 		{0, 0},
110 		{0, 0},
111 		{0, 0}
112 		}
113 	},
114 	{1, 0, 1, 0,		/* 0x07 */
115 		{{0, 2},
116 		{0, 0},
117 		{0, 0},
118 		{0, 0}
119 		}
120 	},
121 	{0, 0, 1, 0,		/* 0x08 */
122 		{{3, 3},
123 		{0, 0},
124 		{0, 0},
125 		{0, 0}
126 		}
127 	},
128 	{1, 0, 2, 0,		/* 0x09 */
129 		{{0, 0},
130 		{3, 3},
131 		{0, 0},
132 		{0, 0}
133 		}
134 	},
135 	{0, 0, 2, 0,		/* 0x0a */
136 		{{1, 1},
137 		{3, 3},
138 		{0, 0},
139 		{0, 0}
140 		}
141 	},
142 	{1, 0, 2, 0,		/* 0x0b */
143 		{{0, 1},
144 		{3, 3},
145 		{0, 0},
146 		{0, 0}
147 		}
148 	},
149 	{0, 0, 1, 0,		/* 0x0c */
150 		{{2, 3},
151 		{0, 0},
152 		{0, 0},
153 		{0, 0}
154 		}
155 	},
156 	{1, 0, 2, 0,		/* 0x0d */
157 		{{0, 0},
158 		{2, 3},
159 		{0, 0},
160 		{0, 0}
161 		}
162 	},
163 	{0, 0, 1, 0,		/* 0x0e */
164 		{{1, 3},
165 		{0, 0},
166 		{0, 0},
167 		{0, 0}
168 		}
169 	},
170 	{1, 0, 1, 0,		/* 0x0f */
171 		{{0, 3},
172 		{0, 0},
173 		{0, 0},
174 		{0, 0}
175 		}
176 	},
177 	{0, 0, 1, 0,		/* 0x10 */
178 		{{4, 4},
179 		{0, 0},
180 		{0, 0},
181 		{0, 0}
182 		}
183 	},
184 	{1, 0, 2, 0,		/* 0x11 */
185 		{{0, 0},
186 		{4, 4},
187 		{0, 0},
188 		{0, 0}
189 		}
190 	},
191 	{0, 0, 2, 0,		/* 0x12 */
192 		{{1, 1},
193 		{4, 4},
194 		{0, 0},
195 		{0, 0}
196 		}
197 	},
198 	{1, 0, 2, 0,		/* 0x13 */
199 		{{0, 1},
200 		{4, 4},
201 		{0, 0},
202 		{0, 0}
203 		}
204 	},
205 	{0, 0, 2, 0,		/* 0x14 */
206 		{{2, 2},
207 		{4, 4},
208 		{0, 0},
209 		{0, 0}
210 		}
211 	},
212 	{1, 0, 3, 0,		/* 0x15 */
213 		{{0, 0},
214 		{2, 2},
215 		{4, 4},
216 		{0, 0}
217 		}
218 	},
219 	{0, 0, 2, 0,		/* 0x16 */
220 		{{1, 2},
221 		{4, 4},
222 		{0, 0},
223 		{0, 0}
224 		}
225 	},
226 	{1, 0, 2, 0,		/* 0x17 */
227 		{{0, 2},
228 		{4, 4},
229 		{0, 0},
230 		{0, 0}
231 		}
232 	},
233 	{0, 0, 1, 0,		/* 0x18 */
234 		{{3, 4},
235 		{0, 0},
236 		{0, 0},
237 		{0, 0}
238 		}
239 	},
240 	{1, 0, 2, 0,		/* 0x19 */
241 		{{0, 0},
242 		{3, 4},
243 		{0, 0},
244 		{0, 0}
245 		}
246 	},
247 	{0, 0, 2, 0,		/* 0x1a */
248 		{{1, 1},
249 		{3, 4},
250 		{0, 0},
251 		{0, 0}
252 		}
253 	},
254 	{1, 0, 2, 0,		/* 0x1b */
255 		{{0, 1},
256 		{3, 4},
257 		{0, 0},
258 		{0, 0}
259 		}
260 	},
261 	{0, 0, 1, 0,		/* 0x1c */
262 		{{2, 4},
263 		{0, 0},
264 		{0, 0},
265 		{0, 0}
266 		}
267 	},
268 	{1, 0, 2, 0,		/* 0x1d */
269 		{{0, 0},
270 		{2, 4},
271 		{0, 0},
272 		{0, 0}
273 		}
274 	},
275 	{0, 0, 1, 0,		/* 0x1e */
276 		{{1, 4},
277 		{0, 0},
278 		{0, 0},
279 		{0, 0}
280 		}
281 	},
282 	{1, 0, 1, 0,		/* 0x1f */
283 		{{0, 4},
284 		{0, 0},
285 		{0, 0},
286 		{0, 0}
287 		}
288 	},
289 	{0, 0, 1, 0,		/* 0x20 */
290 		{{5, 5},
291 		{0, 0},
292 		{0, 0},
293 		{0, 0}
294 		}
295 	},
296 	{1, 0, 2, 0,		/* 0x21 */
297 		{{0, 0},
298 		{5, 5},
299 		{0, 0},
300 		{0, 0}
301 		}
302 	},
303 	{0, 0, 2, 0,		/* 0x22 */
304 		{{1, 1},
305 		{5, 5},
306 		{0, 0},
307 		{0, 0}
308 		}
309 	},
310 	{1, 0, 2, 0,		/* 0x23 */
311 		{{0, 1},
312 		{5, 5},
313 		{0, 0},
314 		{0, 0}
315 		}
316 	},
317 	{0, 0, 2, 0,		/* 0x24 */
318 		{{2, 2},
319 		{5, 5},
320 		{0, 0},
321 		{0, 0}
322 		}
323 	},
324 	{1, 0, 3, 0,		/* 0x25 */
325 		{{0, 0},
326 		{2, 2},
327 		{5, 5},
328 		{0, 0}
329 		}
330 	},
331 	{0, 0, 2, 0,		/* 0x26 */
332 		{{1, 2},
333 		{5, 5},
334 		{0, 0},
335 		{0, 0}
336 		}
337 	},
338 	{1, 0, 2, 0,		/* 0x27 */
339 		{{0, 2},
340 		{5, 5},
341 		{0, 0},
342 		{0, 0}
343 		}
344 	},
345 	{0, 0, 2, 0,		/* 0x28 */
346 		{{3, 3},
347 		{5, 5},
348 		{0, 0},
349 		{0, 0}
350 		}
351 	},
352 	{1, 0, 3, 0,		/* 0x29 */
353 		{{0, 0},
354 		{3, 3},
355 		{5, 5},
356 		{0, 0}
357 		}
358 	},
359 	{0, 0, 3, 0,		/* 0x2a */
360 		{{1, 1},
361 		{3, 3},
362 		{5, 5},
363 		{0, 0}
364 		}
365 	},
366 	{1, 0, 3, 0,		/* 0x2b */
367 		{{0, 1},
368 		{3, 3},
369 		{5, 5},
370 		{0, 0}
371 		}
372 	},
373 	{0, 0, 2, 0,		/* 0x2c */
374 		{{2, 3},
375 		{5, 5},
376 		{0, 0},
377 		{0, 0}
378 		}
379 	},
380 	{1, 0, 3, 0,		/* 0x2d */
381 		{{0, 0},
382 		{2, 3},
383 		{5, 5},
384 		{0, 0}
385 		}
386 	},
387 	{0, 0, 2, 0,		/* 0x2e */
388 		{{1, 3},
389 		{5, 5},
390 		{0, 0},
391 		{0, 0}
392 		}
393 	},
394 	{1, 0, 2, 0,		/* 0x2f */
395 		{{0, 3},
396 		{5, 5},
397 		{0, 0},
398 		{0, 0}
399 		}
400 	},
401 	{0, 0, 1, 0,		/* 0x30 */
402 		{{4, 5},
403 		{0, 0},
404 		{0, 0},
405 		{0, 0}
406 		}
407 	},
408 	{1, 0, 2, 0,		/* 0x31 */
409 		{{0, 0},
410 		{4, 5},
411 		{0, 0},
412 		{0, 0}
413 		}
414 	},
415 	{0, 0, 2, 0,		/* 0x32 */
416 		{{1, 1},
417 		{4, 5},
418 		{0, 0},
419 		{0, 0}
420 		}
421 	},
422 	{1, 0, 2, 0,		/* 0x33 */
423 		{{0, 1},
424 		{4, 5},
425 		{0, 0},
426 		{0, 0}
427 		}
428 	},
429 	{0, 0, 2, 0,		/* 0x34 */
430 		{{2, 2},
431 		{4, 5},
432 		{0, 0},
433 		{0, 0}
434 		}
435 	},
436 	{1, 0, 3, 0,		/* 0x35 */
437 		{{0, 0},
438 		{2, 2},
439 		{4, 5},
440 		{0, 0}
441 		}
442 	},
443 	{0, 0, 2, 0,		/* 0x36 */
444 		{{1, 2},
445 		{4, 5},
446 		{0, 0},
447 		{0, 0}
448 		}
449 	},
450 	{1, 0, 2, 0,		/* 0x37 */
451 		{{0, 2},
452 		{4, 5},
453 		{0, 0},
454 		{0, 0}
455 		}
456 	},
457 	{0, 0, 1, 0,		/* 0x38 */
458 		{{3, 5},
459 		{0, 0},
460 		{0, 0},
461 		{0, 0}
462 		}
463 	},
464 	{1, 0, 2, 0,		/* 0x39 */
465 		{{0, 0},
466 		{3, 5},
467 		{0, 0},
468 		{0, 0}
469 		}
470 	},
471 	{0, 0, 2, 0,		/* 0x3a */
472 		{{1, 1},
473 		{3, 5},
474 		{0, 0},
475 		{0, 0}
476 		}
477 	},
478 	{1, 0, 2, 0,		/* 0x3b */
479 		{{0, 1},
480 		{3, 5},
481 		{0, 0},
482 		{0, 0}
483 		}
484 	},
485 	{0, 0, 1, 0,		/* 0x3c */
486 		{{2, 5},
487 		{0, 0},
488 		{0, 0},
489 		{0, 0}
490 		}
491 	},
492 	{1, 0, 2, 0,		/* 0x3d */
493 		{{0, 0},
494 		{2, 5},
495 		{0, 0},
496 		{0, 0}
497 		}
498 	},
499 	{0, 0, 1, 0,		/* 0x3e */
500 		{{1, 5},
501 		{0, 0},
502 		{0, 0},
503 		{0, 0}
504 		}
505 	},
506 	{1, 0, 1, 0,		/* 0x3f */
507 		{{0, 5},
508 		{0, 0},
509 		{0, 0},
510 		{0, 0}
511 		}
512 	},
513 	{0, 0, 1, 0,		/* 0x40 */
514 		{{6, 6},
515 		{0, 0},
516 		{0, 0},
517 		{0, 0}
518 		}
519 	},
520 	{1, 0, 2, 0,		/* 0x41 */
521 		{{0, 0},
522 		{6, 6},
523 		{0, 0},
524 		{0, 0}
525 		}
526 	},
527 	{0, 0, 2, 0,		/* 0x42 */
528 		{{1, 1},
529 		{6, 6},
530 		{0, 0},
531 		{0, 0}
532 		}
533 	},
534 	{1, 0, 2, 0,		/* 0x43 */
535 		{{0, 1},
536 		{6, 6},
537 		{0, 0},
538 		{0, 0}
539 		}
540 	},
541 	{0, 0, 2, 0,		/* 0x44 */
542 		{{2, 2},
543 		{6, 6},
544 		{0, 0},
545 		{0, 0}
546 		}
547 	},
548 	{1, 0, 3, 0,		/* 0x45 */
549 		{{0, 0},
550 		{2, 2},
551 		{6, 6},
552 		{0, 0}
553 		}
554 	},
555 	{0, 0, 2, 0,		/* 0x46 */
556 		{{1, 2},
557 		{6, 6},
558 		{0, 0},
559 		{0, 0}
560 		}
561 	},
562 	{1, 0, 2, 0,		/* 0x47 */
563 		{{0, 2},
564 		{6, 6},
565 		{0, 0},
566 		{0, 0}
567 		}
568 	},
569 	{0, 0, 2, 0,		/* 0x48 */
570 		{{3, 3},
571 		{6, 6},
572 		{0, 0},
573 		{0, 0}
574 		}
575 	},
576 	{1, 0, 3, 0,		/* 0x49 */
577 		{{0, 0},
578 		{3, 3},
579 		{6, 6},
580 		{0, 0}
581 		}
582 	},
583 	{0, 0, 3, 0,		/* 0x4a */
584 		{{1, 1},
585 		{3, 3},
586 		{6, 6},
587 		{0, 0}
588 		}
589 	},
590 	{1, 0, 3, 0,		/* 0x4b */
591 		{{0, 1},
592 		{3, 3},
593 		{6, 6},
594 		{0, 0}
595 		}
596 	},
597 	{0, 0, 2, 0,		/* 0x4c */
598 		{{2, 3},
599 		{6, 6},
600 		{0, 0},
601 		{0, 0}
602 		}
603 	},
604 	{1, 0, 3, 0,		/* 0x4d */
605 		{{0, 0},
606 		{2, 3},
607 		{6, 6},
608 		{0, 0}
609 		}
610 	},
611 	{0, 0, 2, 0,		/* 0x4e */
612 		{{1, 3},
613 		{6, 6},
614 		{0, 0},
615 		{0, 0}
616 		}
617 	},
618 	{1, 0, 2, 0,		/* 0x4f */
619 		{{0, 3},
620 		{6, 6},
621 		{0, 0},
622 		{0, 0}
623 		}
624 	},
625 	{0, 0, 2, 0,		/* 0x50 */
626 		{{4, 4},
627 		{6, 6},
628 		{0, 0},
629 		{0, 0}
630 		}
631 	},
632 	{1, 0, 3, 0,		/* 0x51 */
633 		{{0, 0},
634 		{4, 4},
635 		{6, 6},
636 		{0, 0}
637 		}
638 	},
639 	{0, 0, 3, 0,		/* 0x52 */
640 		{{1, 1},
641 		{4, 4},
642 		{6, 6},
643 		{0, 0}
644 		}
645 	},
646 	{1, 0, 3, 0,		/* 0x53 */
647 		{{0, 1},
648 		{4, 4},
649 		{6, 6},
650 		{0, 0}
651 		}
652 	},
653 	{0, 0, 3, 0,		/* 0x54 */
654 		{{2, 2},
655 		{4, 4},
656 		{6, 6},
657 		{0, 0}
658 		}
659 	},
660 	{1, 0, 4, 0,		/* 0x55 */
661 		{{0, 0},
662 		{2, 2},
663 		{4, 4},
664 		{6, 6}
665 		}
666 	},
667 	{0, 0, 3, 0,		/* 0x56 */
668 		{{1, 2},
669 		{4, 4},
670 		{6, 6},
671 		{0, 0}
672 		}
673 	},
674 	{1, 0, 3, 0,		/* 0x57 */
675 		{{0, 2},
676 		{4, 4},
677 		{6, 6},
678 		{0, 0}
679 		}
680 	},
681 	{0, 0, 2, 0,		/* 0x58 */
682 		{{3, 4},
683 		{6, 6},
684 		{0, 0},
685 		{0, 0}
686 		}
687 	},
688 	{1, 0, 3, 0,		/* 0x59 */
689 		{{0, 0},
690 		{3, 4},
691 		{6, 6},
692 		{0, 0}
693 		}
694 	},
695 	{0, 0, 3, 0,		/* 0x5a */
696 		{{1, 1},
697 		{3, 4},
698 		{6, 6},
699 		{0, 0}
700 		}
701 	},
702 	{1, 0, 3, 0,		/* 0x5b */
703 		{{0, 1},
704 		{3, 4},
705 		{6, 6},
706 		{0, 0}
707 		}
708 	},
709 	{0, 0, 2, 0,		/* 0x5c */
710 		{{2, 4},
711 		{6, 6},
712 		{0, 0},
713 		{0, 0}
714 		}
715 	},
716 	{1, 0, 3, 0,		/* 0x5d */
717 		{{0, 0},
718 		{2, 4},
719 		{6, 6},
720 		{0, 0}
721 		}
722 	},
723 	{0, 0, 2, 0,		/* 0x5e */
724 		{{1, 4},
725 		{6, 6},
726 		{0, 0},
727 		{0, 0}
728 		}
729 	},
730 	{1, 0, 2, 0,		/* 0x5f */
731 		{{0, 4},
732 		{6, 6},
733 		{0, 0},
734 		{0, 0}
735 		}
736 	},
737 	{0, 0, 1, 0,		/* 0x60 */
738 		{{5, 6},
739 		{0, 0},
740 		{0, 0},
741 		{0, 0}
742 		}
743 	},
744 	{1, 0, 2, 0,		/* 0x61 */
745 		{{0, 0},
746 		{5, 6},
747 		{0, 0},
748 		{0, 0}
749 		}
750 	},
751 	{0, 0, 2, 0,		/* 0x62 */
752 		{{1, 1},
753 		{5, 6},
754 		{0, 0},
755 		{0, 0}
756 		}
757 	},
758 	{1, 0, 2, 0,		/* 0x63 */
759 		{{0, 1},
760 		{5, 6},
761 		{0, 0},
762 		{0, 0}
763 		}
764 	},
765 	{0, 0, 2, 0,		/* 0x64 */
766 		{{2, 2},
767 		{5, 6},
768 		{0, 0},
769 		{0, 0}
770 		}
771 	},
772 	{1, 0, 3, 0,		/* 0x65 */
773 		{{0, 0},
774 		{2, 2},
775 		{5, 6},
776 		{0, 0}
777 		}
778 	},
779 	{0, 0, 2, 0,		/* 0x66 */
780 		{{1, 2},
781 		{5, 6},
782 		{0, 0},
783 		{0, 0}
784 		}
785 	},
786 	{1, 0, 2, 0,		/* 0x67 */
787 		{{0, 2},
788 		{5, 6},
789 		{0, 0},
790 		{0, 0}
791 		}
792 	},
793 	{0, 0, 2, 0,		/* 0x68 */
794 		{{3, 3},
795 		{5, 6},
796 		{0, 0},
797 		{0, 0}
798 		}
799 	},
800 	{1, 0, 3, 0,		/* 0x69 */
801 		{{0, 0},
802 		{3, 3},
803 		{5, 6},
804 		{0, 0}
805 		}
806 	},
807 	{0, 0, 3, 0,		/* 0x6a */
808 		{{1, 1},
809 		{3, 3},
810 		{5, 6},
811 		{0, 0}
812 		}
813 	},
814 	{1, 0, 3, 0,		/* 0x6b */
815 		{{0, 1},
816 		{3, 3},
817 		{5, 6},
818 		{0, 0}
819 		}
820 	},
821 	{0, 0, 2, 0,		/* 0x6c */
822 		{{2, 3},
823 		{5, 6},
824 		{0, 0},
825 		{0, 0}
826 		}
827 	},
828 	{1, 0, 3, 0,		/* 0x6d */
829 		{{0, 0},
830 		{2, 3},
831 		{5, 6},
832 		{0, 0}
833 		}
834 	},
835 	{0, 0, 2, 0,		/* 0x6e */
836 		{{1, 3},
837 		{5, 6},
838 		{0, 0},
839 		{0, 0}
840 		}
841 	},
842 	{1, 0, 2, 0,		/* 0x6f */
843 		{{0, 3},
844 		{5, 6},
845 		{0, 0},
846 		{0, 0}
847 		}
848 	},
849 	{0, 0, 1, 0,		/* 0x70 */
850 		{{4, 6},
851 		{0, 0},
852 		{0, 0},
853 		{0, 0}
854 		}
855 	},
856 	{1, 0, 2, 0,		/* 0x71 */
857 		{{0, 0},
858 		{4, 6},
859 		{0, 0},
860 		{0, 0}
861 		}
862 	},
863 	{0, 0, 2, 0,		/* 0x72 */
864 		{{1, 1},
865 		{4, 6},
866 		{0, 0},
867 		{0, 0}
868 		}
869 	},
870 	{1, 0, 2, 0,		/* 0x73 */
871 		{{0, 1},
872 		{4, 6},
873 		{0, 0},
874 		{0, 0}
875 		}
876 	},
877 	{0, 0, 2, 0,		/* 0x74 */
878 		{{2, 2},
879 		{4, 6},
880 		{0, 0},
881 		{0, 0}
882 		}
883 	},
884 	{1, 0, 3, 0,		/* 0x75 */
885 		{{0, 0},
886 		{2, 2},
887 		{4, 6},
888 		{0, 0}
889 		}
890 	},
891 	{0, 0, 2, 0,		/* 0x76 */
892 		{{1, 2},
893 		{4, 6},
894 		{0, 0},
895 		{0, 0}
896 		}
897 	},
898 	{1, 0, 2, 0,		/* 0x77 */
899 		{{0, 2},
900 		{4, 6},
901 		{0, 0},
902 		{0, 0}
903 		}
904 	},
905 	{0, 0, 1, 0,		/* 0x78 */
906 		{{3, 6},
907 		{0, 0},
908 		{0, 0},
909 		{0, 0}
910 		}
911 	},
912 	{1, 0, 2, 0,		/* 0x79 */
913 		{{0, 0},
914 		{3, 6},
915 		{0, 0},
916 		{0, 0}
917 		}
918 	},
919 	{0, 0, 2, 0,		/* 0x7a */
920 		{{1, 1},
921 		{3, 6},
922 		{0, 0},
923 		{0, 0}
924 		}
925 	},
926 	{1, 0, 2, 0,		/* 0x7b */
927 		{{0, 1},
928 		{3, 6},
929 		{0, 0},
930 		{0, 0}
931 		}
932 	},
933 	{0, 0, 1, 0,		/* 0x7c */
934 		{{2, 6},
935 		{0, 0},
936 		{0, 0},
937 		{0, 0}
938 		}
939 	},
940 	{1, 0, 2, 0,		/* 0x7d */
941 		{{0, 0},
942 		{2, 6},
943 		{0, 0},
944 		{0, 0}
945 		}
946 	},
947 	{0, 0, 1, 0,		/* 0x7e */
948 		{{1, 6},
949 		{0, 0},
950 		{0, 0},
951 		{0, 0}
952 		}
953 	},
954 	{1, 0, 1, 0,		/* 0x7f */
955 		{{0, 6},
956 		{0, 0},
957 		{0, 0},
958 		{0, 0}
959 		}
960 	},
961 	{0, 1, 1, 0,		/* 0x80 */
962 		{{7, 7},
963 		{0, 0},
964 		{0, 0},
965 		{0, 0}
966 		}
967 	},
968 	{1, 1, 2, 0,		/* 0x81 */
969 		{{0, 0},
970 		{7, 7},
971 		{0, 0},
972 		{0, 0}
973 		}
974 	},
975 	{0, 1, 2, 0,		/* 0x82 */
976 		{{1, 1},
977 		{7, 7},
978 		{0, 0},
979 		{0, 0}
980 		}
981 	},
982 	{1, 1, 2, 0,		/* 0x83 */
983 		{{0, 1},
984 		{7, 7},
985 		{0, 0},
986 		{0, 0}
987 		}
988 	},
989 	{0, 1, 2, 0,		/* 0x84 */
990 		{{2, 2},
991 		{7, 7},
992 		{0, 0},
993 		{0, 0}
994 		}
995 	},
996 	{1, 1, 3, 0,		/* 0x85 */
997 		{{0, 0},
998 		{2, 2},
999 		{7, 7},
1000 		{0, 0}
1001 		}
1002 	},
1003 	{0, 1, 2, 0,		/* 0x86 */
1004 		{{1, 2},
1005 		{7, 7},
1006 		{0, 0},
1007 		{0, 0}
1008 		}
1009 	},
1010 	{1, 1, 2, 0,		/* 0x87 */
1011 		{{0, 2},
1012 		{7, 7},
1013 		{0, 0},
1014 		{0, 0}
1015 		}
1016 	},
1017 	{0, 1, 2, 0,		/* 0x88 */
1018 		{{3, 3},
1019 		{7, 7},
1020 		{0, 0},
1021 		{0, 0}
1022 		}
1023 	},
1024 	{1, 1, 3, 0,		/* 0x89 */
1025 		{{0, 0},
1026 		{3, 3},
1027 		{7, 7},
1028 		{0, 0}
1029 		}
1030 	},
1031 	{0, 1, 3, 0,		/* 0x8a */
1032 		{{1, 1},
1033 		{3, 3},
1034 		{7, 7},
1035 		{0, 0}
1036 		}
1037 	},
1038 	{1, 1, 3, 0,		/* 0x8b */
1039 		{{0, 1},
1040 		{3, 3},
1041 		{7, 7},
1042 		{0, 0}
1043 		}
1044 	},
1045 	{0, 1, 2, 0,		/* 0x8c */
1046 		{{2, 3},
1047 		{7, 7},
1048 		{0, 0},
1049 		{0, 0}
1050 		}
1051 	},
1052 	{1, 1, 3, 0,		/* 0x8d */
1053 		{{0, 0},
1054 		{2, 3},
1055 		{7, 7},
1056 		{0, 0}
1057 		}
1058 	},
1059 	{0, 1, 2, 0,		/* 0x8e */
1060 		{{1, 3},
1061 		{7, 7},
1062 		{0, 0},
1063 		{0, 0}
1064 		}
1065 	},
1066 	{1, 1, 2, 0,		/* 0x8f */
1067 		{{0, 3},
1068 		{7, 7},
1069 		{0, 0},
1070 		{0, 0}
1071 		}
1072 	},
1073 	{0, 1, 2, 0,		/* 0x90 */
1074 		{{4, 4},
1075 		{7, 7},
1076 		{0, 0},
1077 		{0, 0}
1078 		}
1079 	},
1080 	{1, 1, 3, 0,		/* 0x91 */
1081 		{{0, 0},
1082 		{4, 4},
1083 		{7, 7},
1084 		{0, 0}
1085 		}
1086 	},
1087 	{0, 1, 3, 0,		/* 0x92 */
1088 		{{1, 1},
1089 		{4, 4},
1090 		{7, 7},
1091 		{0, 0}
1092 		}
1093 	},
1094 	{1, 1, 3, 0,		/* 0x93 */
1095 		{{0, 1},
1096 		{4, 4},
1097 		{7, 7},
1098 		{0, 0}
1099 		}
1100 	},
1101 	{0, 1, 3, 0,		/* 0x94 */
1102 		{{2, 2},
1103 		{4, 4},
1104 		{7, 7},
1105 		{0, 0}
1106 		}
1107 	},
1108 	{1, 1, 4, 0,		/* 0x95 */
1109 		{{0, 0},
1110 		{2, 2},
1111 		{4, 4},
1112 		{7, 7}
1113 		}
1114 	},
1115 	{0, 1, 3, 0,		/* 0x96 */
1116 		{{1, 2},
1117 		{4, 4},
1118 		{7, 7},
1119 		{0, 0}
1120 		}
1121 	},
1122 	{1, 1, 3, 0,		/* 0x97 */
1123 		{{0, 2},
1124 		{4, 4},
1125 		{7, 7},
1126 		{0, 0}
1127 		}
1128 	},
1129 	{0, 1, 2, 0,		/* 0x98 */
1130 		{{3, 4},
1131 		{7, 7},
1132 		{0, 0},
1133 		{0, 0}
1134 		}
1135 	},
1136 	{1, 1, 3, 0,		/* 0x99 */
1137 		{{0, 0},
1138 		{3, 4},
1139 		{7, 7},
1140 		{0, 0}
1141 		}
1142 	},
1143 	{0, 1, 3, 0,		/* 0x9a */
1144 		{{1, 1},
1145 		{3, 4},
1146 		{7, 7},
1147 		{0, 0}
1148 		}
1149 	},
1150 	{1, 1, 3, 0,		/* 0x9b */
1151 		{{0, 1},
1152 		{3, 4},
1153 		{7, 7},
1154 		{0, 0}
1155 		}
1156 	},
1157 	{0, 1, 2, 0,		/* 0x9c */
1158 		{{2, 4},
1159 		{7, 7},
1160 		{0, 0},
1161 		{0, 0}
1162 		}
1163 	},
1164 	{1, 1, 3, 0,		/* 0x9d */
1165 		{{0, 0},
1166 		{2, 4},
1167 		{7, 7},
1168 		{0, 0}
1169 		}
1170 	},
1171 	{0, 1, 2, 0,		/* 0x9e */
1172 		{{1, 4},
1173 		{7, 7},
1174 		{0, 0},
1175 		{0, 0}
1176 		}
1177 	},
1178 	{1, 1, 2, 0,		/* 0x9f */
1179 		{{0, 4},
1180 		{7, 7},
1181 		{0, 0},
1182 		{0, 0}
1183 		}
1184 	},
1185 	{0, 1, 2, 0,		/* 0xa0 */
1186 		{{5, 5},
1187 		{7, 7},
1188 		{0, 0},
1189 		{0, 0}
1190 		}
1191 	},
1192 	{1, 1, 3, 0,		/* 0xa1 */
1193 		{{0, 0},
1194 		{5, 5},
1195 		{7, 7},
1196 		{0, 0}
1197 		}
1198 	},
1199 	{0, 1, 3, 0,		/* 0xa2 */
1200 		{{1, 1},
1201 		{5, 5},
1202 		{7, 7},
1203 		{0, 0}
1204 		}
1205 	},
1206 	{1, 1, 3, 0,		/* 0xa3 */
1207 		{{0, 1},
1208 		{5, 5},
1209 		{7, 7},
1210 		{0, 0}
1211 		}
1212 	},
1213 	{0, 1, 3, 0,		/* 0xa4 */
1214 		{{2, 2},
1215 		{5, 5},
1216 		{7, 7},
1217 		{0, 0}
1218 		}
1219 	},
1220 	{1, 1, 4, 0,		/* 0xa5 */
1221 		{{0, 0},
1222 		{2, 2},
1223 		{5, 5},
1224 		{7, 7}
1225 		}
1226 	},
1227 	{0, 1, 3, 0,		/* 0xa6 */
1228 		{{1, 2},
1229 		{5, 5},
1230 		{7, 7},
1231 		{0, 0}
1232 		}
1233 	},
1234 	{1, 1, 3, 0,		/* 0xa7 */
1235 		{{0, 2},
1236 		{5, 5},
1237 		{7, 7},
1238 		{0, 0}
1239 		}
1240 	},
1241 	{0, 1, 3, 0,		/* 0xa8 */
1242 		{{3, 3},
1243 		{5, 5},
1244 		{7, 7},
1245 		{0, 0}
1246 		}
1247 	},
1248 	{1, 1, 4, 0,		/* 0xa9 */
1249 		{{0, 0},
1250 		{3, 3},
1251 		{5, 5},
1252 		{7, 7}
1253 		}
1254 	},
1255 	{0, 1, 4, 0,		/* 0xaa */
1256 		{{1, 1},
1257 		{3, 3},
1258 		{5, 5},
1259 		{7, 7}
1260 		}
1261 	},
1262 	{1, 1, 4, 0,		/* 0xab */
1263 		{{0, 1},
1264 		{3, 3},
1265 		{5, 5},
1266 		{7, 7}
1267 		}
1268 	},
1269 	{0, 1, 3, 0,		/* 0xac */
1270 		{{2, 3},
1271 		{5, 5},
1272 		{7, 7},
1273 		{0, 0}
1274 		}
1275 	},
1276 	{1, 1, 4, 0,		/* 0xad */
1277 		{{0, 0},
1278 		{2, 3},
1279 		{5, 5},
1280 		{7, 7}
1281 		}
1282 	},
1283 	{0, 1, 3, 0,		/* 0xae */
1284 		{{1, 3},
1285 		{5, 5},
1286 		{7, 7},
1287 		{0, 0}
1288 		}
1289 	},
1290 	{1, 1, 3, 0,		/* 0xaf */
1291 		{{0, 3},
1292 		{5, 5},
1293 		{7, 7},
1294 		{0, 0}
1295 		}
1296 	},
1297 	{0, 1, 2, 0,		/* 0xb0 */
1298 		{{4, 5},
1299 		{7, 7},
1300 		{0, 0},
1301 		{0, 0}
1302 		}
1303 	},
1304 	{1, 1, 3, 0,		/* 0xb1 */
1305 		{{0, 0},
1306 		{4, 5},
1307 		{7, 7},
1308 		{0, 0}
1309 		}
1310 	},
1311 	{0, 1, 3, 0,		/* 0xb2 */
1312 		{{1, 1},
1313 		{4, 5},
1314 		{7, 7},
1315 		{0, 0}
1316 		}
1317 	},
1318 	{1, 1, 3, 0,		/* 0xb3 */
1319 		{{0, 1},
1320 		{4, 5},
1321 		{7, 7},
1322 		{0, 0}
1323 		}
1324 	},
1325 	{0, 1, 3, 0,		/* 0xb4 */
1326 		{{2, 2},
1327 		{4, 5},
1328 		{7, 7},
1329 		{0, 0}
1330 		}
1331 	},
1332 	{1, 1, 4, 0,		/* 0xb5 */
1333 		{{0, 0},
1334 		{2, 2},
1335 		{4, 5},
1336 		{7, 7}
1337 		}
1338 	},
1339 	{0, 1, 3, 0,		/* 0xb6 */
1340 		{{1, 2},
1341 		{4, 5},
1342 		{7, 7},
1343 		{0, 0}
1344 		}
1345 	},
1346 	{1, 1, 3, 0,		/* 0xb7 */
1347 		{{0, 2},
1348 		{4, 5},
1349 		{7, 7},
1350 		{0, 0}
1351 		}
1352 	},
1353 	{0, 1, 2, 0,		/* 0xb8 */
1354 		{{3, 5},
1355 		{7, 7},
1356 		{0, 0},
1357 		{0, 0}
1358 		}
1359 	},
1360 	{1, 1, 3, 0,		/* 0xb9 */
1361 		{{0, 0},
1362 		{3, 5},
1363 		{7, 7},
1364 		{0, 0}
1365 		}
1366 	},
1367 	{0, 1, 3, 0,		/* 0xba */
1368 		{{1, 1},
1369 		{3, 5},
1370 		{7, 7},
1371 		{0, 0}
1372 		}
1373 	},
1374 	{1, 1, 3, 0,		/* 0xbb */
1375 		{{0, 1},
1376 		{3, 5},
1377 		{7, 7},
1378 		{0, 0}
1379 		}
1380 	},
1381 	{0, 1, 2, 0,		/* 0xbc */
1382 		{{2, 5},
1383 		{7, 7},
1384 		{0, 0},
1385 		{0, 0}
1386 		}
1387 	},
1388 	{1, 1, 3, 0,		/* 0xbd */
1389 		{{0, 0},
1390 		{2, 5},
1391 		{7, 7},
1392 		{0, 0}
1393 		}
1394 	},
1395 	{0, 1, 2, 0,		/* 0xbe */
1396 		{{1, 5},
1397 		{7, 7},
1398 		{0, 0},
1399 		{0, 0}
1400 		}
1401 	},
1402 	{1, 1, 2, 0,		/* 0xbf */
1403 		{{0, 5},
1404 		{7, 7},
1405 		{0, 0},
1406 		{0, 0}
1407 		}
1408 	},
1409 	{0, 1, 1, 0,		/* 0xc0 */
1410 		{{6, 7},
1411 		{0, 0},
1412 		{0, 0},
1413 		{0, 0}
1414 		}
1415 	},
1416 	{1, 1, 2, 0,		/* 0xc1 */
1417 		{{0, 0},
1418 		{6, 7},
1419 		{0, 0},
1420 		{0, 0}
1421 		}
1422 	},
1423 	{0, 1, 2, 0,		/* 0xc2 */
1424 		{{1, 1},
1425 		{6, 7},
1426 		{0, 0},
1427 		{0, 0}
1428 		}
1429 	},
1430 	{1, 1, 2, 0,		/* 0xc3 */
1431 		{{0, 1},
1432 		{6, 7},
1433 		{0, 0},
1434 		{0, 0}
1435 		}
1436 	},
1437 	{0, 1, 2, 0,		/* 0xc4 */
1438 		{{2, 2},
1439 		{6, 7},
1440 		{0, 0},
1441 		{0, 0}
1442 		}
1443 	},
1444 	{1, 1, 3, 0,		/* 0xc5 */
1445 		{{0, 0},
1446 		{2, 2},
1447 		{6, 7},
1448 		{0, 0}
1449 		}
1450 	},
1451 	{0, 1, 2, 0,		/* 0xc6 */
1452 		{{1, 2},
1453 		{6, 7},
1454 		{0, 0},
1455 		{0, 0}
1456 		}
1457 	},
1458 	{1, 1, 2, 0,		/* 0xc7 */
1459 		{{0, 2},
1460 		{6, 7},
1461 		{0, 0},
1462 		{0, 0}
1463 		}
1464 	},
1465 	{0, 1, 2, 0,		/* 0xc8 */
1466 		{{3, 3},
1467 		{6, 7},
1468 		{0, 0},
1469 		{0, 0}
1470 		}
1471 	},
1472 	{1, 1, 3, 0,		/* 0xc9 */
1473 		{{0, 0},
1474 		{3, 3},
1475 		{6, 7},
1476 		{0, 0}
1477 		}
1478 	},
1479 	{0, 1, 3, 0,		/* 0xca */
1480 		{{1, 1},
1481 		{3, 3},
1482 		{6, 7},
1483 		{0, 0}
1484 		}
1485 	},
1486 	{1, 1, 3, 0,		/* 0xcb */
1487 		{{0, 1},
1488 		{3, 3},
1489 		{6, 7},
1490 		{0, 0}
1491 		}
1492 	},
1493 	{0, 1, 2, 0,		/* 0xcc */
1494 		{{2, 3},
1495 		{6, 7},
1496 		{0, 0},
1497 		{0, 0}
1498 		}
1499 	},
1500 	{1, 1, 3, 0,		/* 0xcd */
1501 		{{0, 0},
1502 		{2, 3},
1503 		{6, 7},
1504 		{0, 0}
1505 		}
1506 	},
1507 	{0, 1, 2, 0,		/* 0xce */
1508 		{{1, 3},
1509 		{6, 7},
1510 		{0, 0},
1511 		{0, 0}
1512 		}
1513 	},
1514 	{1, 1, 2, 0,		/* 0xcf */
1515 		{{0, 3},
1516 		{6, 7},
1517 		{0, 0},
1518 		{0, 0}
1519 		}
1520 	},
1521 	{0, 1, 2, 0,		/* 0xd0 */
1522 		{{4, 4},
1523 		{6, 7},
1524 		{0, 0},
1525 		{0, 0}
1526 		}
1527 	},
1528 	{1, 1, 3, 0,		/* 0xd1 */
1529 		{{0, 0},
1530 		{4, 4},
1531 		{6, 7},
1532 		{0, 0}
1533 		}
1534 	},
1535 	{0, 1, 3, 0,		/* 0xd2 */
1536 		{{1, 1},
1537 		{4, 4},
1538 		{6, 7},
1539 		{0, 0}
1540 		}
1541 	},
1542 	{1, 1, 3, 0,		/* 0xd3 */
1543 		{{0, 1},
1544 		{4, 4},
1545 		{6, 7},
1546 		{0, 0}
1547 		}
1548 	},
1549 	{0, 1, 3, 0,		/* 0xd4 */
1550 		{{2, 2},
1551 		{4, 4},
1552 		{6, 7},
1553 		{0, 0}
1554 		}
1555 	},
1556 	{1, 1, 4, 0,		/* 0xd5 */
1557 		{{0, 0},
1558 		{2, 2},
1559 		{4, 4},
1560 		{6, 7}
1561 		}
1562 	},
1563 	{0, 1, 3, 0,		/* 0xd6 */
1564 		{{1, 2},
1565 		{4, 4},
1566 		{6, 7},
1567 		{0, 0}
1568 		}
1569 	},
1570 	{1, 1, 3, 0,		/* 0xd7 */
1571 		{{0, 2},
1572 		{4, 4},
1573 		{6, 7},
1574 		{0, 0}
1575 		}
1576 	},
1577 	{0, 1, 2, 0,		/* 0xd8 */
1578 		{{3, 4},
1579 		{6, 7},
1580 		{0, 0},
1581 		{0, 0}
1582 		}
1583 	},
1584 	{1, 1, 3, 0,		/* 0xd9 */
1585 		{{0, 0},
1586 		{3, 4},
1587 		{6, 7},
1588 		{0, 0}
1589 		}
1590 	},
1591 	{0, 1, 3, 0,		/* 0xda */
1592 		{{1, 1},
1593 		{3, 4},
1594 		{6, 7},
1595 		{0, 0}
1596 		}
1597 	},
1598 	{1, 1, 3, 0,		/* 0xdb */
1599 		{{0, 1},
1600 		{3, 4},
1601 		{6, 7},
1602 		{0, 0}
1603 		}
1604 	},
1605 	{0, 1, 2, 0,		/* 0xdc */
1606 		{{2, 4},
1607 		{6, 7},
1608 		{0, 0},
1609 		{0, 0}
1610 		}
1611 	},
1612 	{1, 1, 3, 0,		/* 0xdd */
1613 		{{0, 0},
1614 		{2, 4},
1615 		{6, 7},
1616 		{0, 0}
1617 		}
1618 	},
1619 	{0, 1, 2, 0,		/* 0xde */
1620 		{{1, 4},
1621 		{6, 7},
1622 		{0, 0},
1623 		{0, 0}
1624 		}
1625 	},
1626 	{1, 1, 2, 0,		/* 0xdf */
1627 		{{0, 4},
1628 		{6, 7},
1629 		{0, 0},
1630 		{0, 0}
1631 		}
1632 	},
1633 	{0, 1, 1, 0,		/* 0xe0 */
1634 		{{5, 7},
1635 		{0, 0},
1636 		{0, 0},
1637 		{0, 0}
1638 		}
1639 	},
1640 	{1, 1, 2, 0,		/* 0xe1 */
1641 		{{0, 0},
1642 		{5, 7},
1643 		{0, 0},
1644 		{0, 0}
1645 		}
1646 	},
1647 	{0, 1, 2, 0,		/* 0xe2 */
1648 		{{1, 1},
1649 		{5, 7},
1650 		{0, 0},
1651 		{0, 0}
1652 		}
1653 	},
1654 	{1, 1, 2, 0,		/* 0xe3 */
1655 		{{0, 1},
1656 		{5, 7},
1657 		{0, 0},
1658 		{0, 0}
1659 		}
1660 	},
1661 	{0, 1, 2, 0,		/* 0xe4 */
1662 		{{2, 2},
1663 		{5, 7},
1664 		{0, 0},
1665 		{0, 0}
1666 		}
1667 	},
1668 	{1, 1, 3, 0,		/* 0xe5 */
1669 		{{0, 0},
1670 		{2, 2},
1671 		{5, 7},
1672 		{0, 0}
1673 		}
1674 	},
1675 	{0, 1, 2, 0,		/* 0xe6 */
1676 		{{1, 2},
1677 		{5, 7},
1678 		{0, 0},
1679 		{0, 0}
1680 		}
1681 	},
1682 	{1, 1, 2, 0,		/* 0xe7 */
1683 		{{0, 2},
1684 		{5, 7},
1685 		{0, 0},
1686 		{0, 0}
1687 		}
1688 	},
1689 	{0, 1, 2, 0,		/* 0xe8 */
1690 		{{3, 3},
1691 		{5, 7},
1692 		{0, 0},
1693 		{0, 0}
1694 		}
1695 	},
1696 	{1, 1, 3, 0,		/* 0xe9 */
1697 		{{0, 0},
1698 		{3, 3},
1699 		{5, 7},
1700 		{0, 0}
1701 		}
1702 	},
1703 	{0, 1, 3, 0,		/* 0xea */
1704 		{{1, 1},
1705 		{3, 3},
1706 		{5, 7},
1707 		{0, 0}
1708 		}
1709 	},
1710 	{1, 1, 3, 0,		/* 0xeb */
1711 		{{0, 1},
1712 		{3, 3},
1713 		{5, 7},
1714 		{0, 0}
1715 		}
1716 	},
1717 	{0, 1, 2, 0,		/* 0xec */
1718 		{{2, 3},
1719 		{5, 7},
1720 		{0, 0},
1721 		{0, 0}
1722 		}
1723 	},
1724 	{1, 1, 3, 0,		/* 0xed */
1725 		{{0, 0},
1726 		{2, 3},
1727 		{5, 7},
1728 		{0, 0}
1729 		}
1730 	},
1731 	{0, 1, 2, 0,		/* 0xee */
1732 		{{1, 3},
1733 		{5, 7},
1734 		{0, 0},
1735 		{0, 0}
1736 		}
1737 	},
1738 	{1, 1, 2, 0,		/* 0xef */
1739 		{{0, 3},
1740 		{5, 7},
1741 		{0, 0},
1742 		{0, 0}
1743 		}
1744 	},
1745 	{0, 1, 1, 0,		/* 0xf0 */
1746 		{{4, 7},
1747 		{0, 0},
1748 		{0, 0},
1749 		{0, 0}
1750 		}
1751 	},
1752 	{1, 1, 2, 0,		/* 0xf1 */
1753 		{{0, 0},
1754 		{4, 7},
1755 		{0, 0},
1756 		{0, 0}
1757 		}
1758 	},
1759 	{0, 1, 2, 0,		/* 0xf2 */
1760 		{{1, 1},
1761 		{4, 7},
1762 		{0, 0},
1763 		{0, 0}
1764 		}
1765 	},
1766 	{1, 1, 2, 0,		/* 0xf3 */
1767 		{{0, 1},
1768 		{4, 7},
1769 		{0, 0},
1770 		{0, 0}
1771 		}
1772 	},
1773 	{0, 1, 2, 0,		/* 0xf4 */
1774 		{{2, 2},
1775 		{4, 7},
1776 		{0, 0},
1777 		{0, 0}
1778 		}
1779 	},
1780 	{1, 1, 3, 0,		/* 0xf5 */
1781 		{{0, 0},
1782 		{2, 2},
1783 		{4, 7},
1784 		{0, 0}
1785 		}
1786 	},
1787 	{0, 1, 2, 0,		/* 0xf6 */
1788 		{{1, 2},
1789 		{4, 7},
1790 		{0, 0},
1791 		{0, 0}
1792 		}
1793 	},
1794 	{1, 1, 2, 0,		/* 0xf7 */
1795 		{{0, 2},
1796 		{4, 7},
1797 		{0, 0},
1798 		{0, 0}
1799 		}
1800 	},
1801 	{0, 1, 1, 0,		/* 0xf8 */
1802 		{{3, 7},
1803 		{0, 0},
1804 		{0, 0},
1805 		{0, 0}
1806 		}
1807 	},
1808 	{1, 1, 2, 0,		/* 0xf9 */
1809 		{{0, 0},
1810 		{3, 7},
1811 		{0, 0},
1812 		{0, 0}
1813 		}
1814 	},
1815 	{0, 1, 2, 0,		/* 0xfa */
1816 		{{1, 1},
1817 		{3, 7},
1818 		{0, 0},
1819 		{0, 0}
1820 		}
1821 	},
1822 	{1, 1, 2, 0,		/* 0xfb */
1823 		{{0, 1},
1824 		{3, 7},
1825 		{0, 0},
1826 		{0, 0}
1827 		}
1828 	},
1829 	{0, 1, 1, 0,		/* 0xfc */
1830 		{{2, 7},
1831 		{0, 0},
1832 		{0, 0},
1833 		{0, 0}
1834 		}
1835 	},
1836 	{1, 1, 2, 0,		/* 0xfd */
1837 		{{0, 0},
1838 		{2, 7},
1839 		{0, 0},
1840 		{0, 0}
1841 		}
1842 	},
1843 	{0, 1, 1, 0,		/* 0xfe */
1844 		{{1, 7},
1845 		{0, 0},
1846 		{0, 0},
1847 		{0, 0}
1848 		}
1849 	},
1850 	{1, 1, 1, 0,		/* 0xff */
1851 		{{0, 7},
1852 		{0, 0},
1853 		{0, 0},
1854 		{0, 0}
1855 		}
1856 	}
1857 };
1858 
1859 
1860 int
1861 sctp_is_address_in_scope(struct sctp_ifa *ifa,
1862     int ipv4_addr_legal,
1863     int ipv6_addr_legal,
1864     int loopback_scope,
1865     int ipv4_local_scope,
1866     int local_scope,
1867     int site_scope,
1868     int do_update)
1869 {
1870 	if ((loopback_scope == 0) &&
1871 	    (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) {
1872 		/*
1873 		 * skip loopback if not in scope *
1874 		 */
1875 		return (0);
1876 	}
1877 	if ((ifa->address.sa.sa_family == AF_INET) && ipv4_addr_legal) {
1878 		struct sockaddr_in *sin;
1879 
1880 		sin = (struct sockaddr_in *)&ifa->address.sin;
1881 		if (sin->sin_addr.s_addr == 0) {
1882 			/* not in scope , unspecified */
1883 			return (0);
1884 		}
1885 		if ((ipv4_local_scope == 0) &&
1886 		    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
1887 			/* private address not in scope */
1888 			return (0);
1889 		}
1890 	} else if ((ifa->address.sa.sa_family == AF_INET6) && ipv6_addr_legal) {
1891 		struct sockaddr_in6 *sin6;
1892 
1893 		/*
1894 		 * Must update the flags,  bummer, which means any IFA locks
1895 		 * must now be applied HERE <->
1896 		 */
1897 		if (do_update) {
1898 			sctp_gather_internal_ifa_flags(ifa);
1899 		}
1900 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1901 			return (0);
1902 		}
1903 		/* ok to use deprecated addresses? */
1904 		sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1905 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1906 			/* skip unspecifed addresses */
1907 			return (0);
1908 		}
1909 		if (		/* (local_scope == 0) && */
1910 		    (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
1911 			return (0);
1912 		}
1913 		if ((site_scope == 0) &&
1914 		    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
1915 			return (0);
1916 		}
1917 	} else {
1918 		return (0);
1919 	}
1920 	return (1);
1921 }
1922 
1923 static struct mbuf *
1924 sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa)
1925 {
1926 	struct sctp_paramhdr *parmh;
1927 	struct mbuf *mret;
1928 	int len;
1929 
1930 	if (ifa->address.sa.sa_family == AF_INET) {
1931 		len = sizeof(struct sctp_ipv4addr_param);
1932 	} else if (ifa->address.sa.sa_family == AF_INET6) {
1933 		len = sizeof(struct sctp_ipv6addr_param);
1934 	} else {
1935 		/* unknown type */
1936 		return (m);
1937 	}
1938 	if (M_TRAILINGSPACE(m) >= len) {
1939 		/* easy side we just drop it on the end */
1940 		parmh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m)));
1941 		mret = m;
1942 	} else {
1943 		/* Need more space */
1944 		mret = m;
1945 		while (SCTP_BUF_NEXT(mret) != NULL) {
1946 			mret = SCTP_BUF_NEXT(mret);
1947 		}
1948 		SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(len, 0, M_DONTWAIT, 1, MT_DATA);
1949 		if (SCTP_BUF_NEXT(mret) == NULL) {
1950 			/* We are hosed, can't add more addresses */
1951 			return (m);
1952 		}
1953 		mret = SCTP_BUF_NEXT(mret);
1954 		parmh = mtod(mret, struct sctp_paramhdr *);
1955 	}
1956 	/* now add the parameter */
1957 	if (ifa->address.sa.sa_family == AF_INET) {
1958 		struct sctp_ipv4addr_param *ipv4p;
1959 		struct sockaddr_in *sin;
1960 
1961 		sin = (struct sockaddr_in *)&ifa->address.sin;
1962 		ipv4p = (struct sctp_ipv4addr_param *)parmh;
1963 		parmh->param_type = htons(SCTP_IPV4_ADDRESS);
1964 		parmh->param_length = htons(len);
1965 		ipv4p->addr = sin->sin_addr.s_addr;
1966 		SCTP_BUF_LEN(mret) += len;
1967 	} else if (ifa->address.sa.sa_family == AF_INET6) {
1968 		struct sctp_ipv6addr_param *ipv6p;
1969 		struct sockaddr_in6 *sin6;
1970 
1971 		sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1972 		ipv6p = (struct sctp_ipv6addr_param *)parmh;
1973 		parmh->param_type = htons(SCTP_IPV6_ADDRESS);
1974 		parmh->param_length = htons(len);
1975 		memcpy(ipv6p->addr, &sin6->sin6_addr,
1976 		    sizeof(ipv6p->addr));
1977 		/* clear embedded scope in the address */
1978 		in6_clearscope((struct in6_addr *)ipv6p->addr);
1979 		SCTP_BUF_LEN(mret) += len;
1980 	} else {
1981 		return (m);
1982 	}
1983 	return (mret);
1984 }
1985 
1986 
1987 struct mbuf *
1988 sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_scoping *scope,
1989     struct mbuf *m_at, int cnt_inits_to)
1990 {
1991 	struct sctp_vrf *vrf = NULL;
1992 	int cnt, limit_out = 0, total_count;
1993 	uint32_t vrf_id;
1994 
1995 	vrf_id = inp->def_vrf_id;
1996 	SCTP_IPI_ADDR_RLOCK();
1997 	vrf = sctp_find_vrf(vrf_id);
1998 	if (vrf == NULL) {
1999 		SCTP_IPI_ADDR_RUNLOCK();
2000 		return (m_at);
2001 	}
2002 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
2003 		struct sctp_ifa *sctp_ifap;
2004 		struct sctp_ifn *sctp_ifnp;
2005 
2006 		cnt = cnt_inits_to;
2007 		if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) {
2008 			limit_out = 1;
2009 			cnt = SCTP_ADDRESS_LIMIT;
2010 			goto skip_count;
2011 		}
2012 		LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
2013 			if ((scope->loopback_scope == 0) &&
2014 			    SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) {
2015 				/*
2016 				 * Skip loopback devices if loopback_scope
2017 				 * not set
2018 				 */
2019 				continue;
2020 			}
2021 			LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
2022 				if (sctp_is_address_in_scope(sctp_ifap,
2023 				    scope->ipv4_addr_legal,
2024 				    scope->ipv6_addr_legal,
2025 				    scope->loopback_scope,
2026 				    scope->ipv4_local_scope,
2027 				    scope->local_scope,
2028 				    scope->site_scope, 1) == 0) {
2029 					continue;
2030 				}
2031 				cnt++;
2032 				if (cnt > SCTP_ADDRESS_LIMIT) {
2033 					break;
2034 				}
2035 			}
2036 			if (cnt > SCTP_ADDRESS_LIMIT) {
2037 				break;
2038 			}
2039 		}
2040 skip_count:
2041 		if (cnt > 1) {
2042 			total_count = 0;
2043 			LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
2044 				cnt = 0;
2045 				if ((scope->loopback_scope == 0) &&
2046 				    SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) {
2047 					/*
2048 					 * Skip loopback devices if
2049 					 * loopback_scope not set
2050 					 */
2051 					continue;
2052 				}
2053 				LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
2054 					if (sctp_is_address_in_scope(sctp_ifap,
2055 					    scope->ipv4_addr_legal,
2056 					    scope->ipv6_addr_legal,
2057 					    scope->loopback_scope,
2058 					    scope->ipv4_local_scope,
2059 					    scope->local_scope,
2060 					    scope->site_scope, 0) == 0) {
2061 						continue;
2062 					}
2063 					m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap);
2064 					if (limit_out) {
2065 						cnt++;
2066 						total_count++;
2067 						if (cnt >= 2) {
2068 							/*
2069 							 * two from each
2070 							 * address
2071 							 */
2072 							break;
2073 						}
2074 						if (total_count > SCTP_ADDRESS_LIMIT) {
2075 							/* No more addresses */
2076 							break;
2077 						}
2078 					}
2079 				}
2080 			}
2081 		}
2082 	} else {
2083 		struct sctp_laddr *laddr;
2084 
2085 		cnt = cnt_inits_to;
2086 		/* First, how many ? */
2087 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2088 			if (laddr->ifa == NULL) {
2089 				continue;
2090 			}
2091 			if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
2092 				/*
2093 				 * Address being deleted by the system, dont
2094 				 * list.
2095 				 */
2096 				continue;
2097 			if (laddr->action == SCTP_DEL_IP_ADDRESS) {
2098 				/*
2099 				 * Address being deleted on this ep don't
2100 				 * list.
2101 				 */
2102 				continue;
2103 			}
2104 			if (sctp_is_address_in_scope(laddr->ifa,
2105 			    scope->ipv4_addr_legal,
2106 			    scope->ipv6_addr_legal,
2107 			    scope->loopback_scope,
2108 			    scope->ipv4_local_scope,
2109 			    scope->local_scope,
2110 			    scope->site_scope, 1) == 0) {
2111 				continue;
2112 			}
2113 			cnt++;
2114 		}
2115 		if (cnt > SCTP_ADDRESS_LIMIT) {
2116 			limit_out = 1;
2117 		}
2118 		/*
2119 		 * To get through a NAT we only list addresses if we have
2120 		 * more than one. That way if you just bind a single address
2121 		 * we let the source of the init dictate our address.
2122 		 */
2123 		if (cnt > 1) {
2124 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2125 				cnt = 0;
2126 				if (laddr->ifa == NULL) {
2127 					continue;
2128 				}
2129 				if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
2130 					continue;
2131 
2132 				if (sctp_is_address_in_scope(laddr->ifa,
2133 				    scope->ipv4_addr_legal,
2134 				    scope->ipv6_addr_legal,
2135 				    scope->loopback_scope,
2136 				    scope->ipv4_local_scope,
2137 				    scope->local_scope,
2138 				    scope->site_scope, 0) == 0) {
2139 					continue;
2140 				}
2141 				m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
2142 				cnt++;
2143 				if (cnt >= SCTP_ADDRESS_LIMIT) {
2144 					break;
2145 				}
2146 			}
2147 		}
2148 	}
2149 	SCTP_IPI_ADDR_RUNLOCK();
2150 	return (m_at);
2151 }
2152 
2153 static struct sctp_ifa *
2154 sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa,
2155     uint8_t dest_is_loop,
2156     uint8_t dest_is_priv,
2157     sa_family_t fam)
2158 {
2159 	uint8_t dest_is_global = 0;
2160 
2161 	/* dest_is_priv is true if destination is a private address */
2162 	/* dest_is_loop is true if destination is a loopback addresses */
2163 
2164 	/*
2165 	 * Here we determine if its a preferred address. A preferred address
2166 	 * means it is the same scope or higher scope then the destination.
2167 	 * L = loopback, P = private, G = global
2168 	 * ----------------------------------------- src    |  dest | result
2169 	 * ---------------------------------------- L     |    L  |    yes
2170 	 * ----------------------------------------- P     |    L  |
2171 	 * yes-v4 no-v6 ----------------------------------------- G     |
2172 	 * L  |    yes-v4 no-v6 ----------------------------------------- L
2173 	 * |    P  |    no ----------------------------------------- P     |
2174 	 * P  |    yes ----------------------------------------- G     |
2175 	 * P  |    no ----------------------------------------- L     |    G
2176 	 * |    no ----------------------------------------- P     |    G  |
2177 	 * no ----------------------------------------- G     |    G  |
2178 	 * yes -----------------------------------------
2179 	 */
2180 
2181 	if (ifa->address.sa.sa_family != fam) {
2182 		/* forget mis-matched family */
2183 		return (NULL);
2184 	}
2185 	if ((dest_is_priv == 0) && (dest_is_loop == 0)) {
2186 		dest_is_global = 1;
2187 	}
2188 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:");
2189 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa);
2190 	/* Ok the address may be ok */
2191 	if (fam == AF_INET6) {
2192 		/* ok to use deprecated addresses? */
2193 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2194 			SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n");
2195 			return (NULL);
2196 		}
2197 		if (ifa->src_is_priv) {
2198 			if (dest_is_loop) {
2199 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n");
2200 				return (NULL);
2201 			}
2202 		}
2203 		if (ifa->src_is_glob) {
2204 			if (dest_is_loop) {
2205 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n");
2206 				return (NULL);
2207 			}
2208 		}
2209 	}
2210 	/*
2211 	 * Now that we know what is what, implement or table this could in
2212 	 * theory be done slicker (it used to be), but this is
2213 	 * straightforward and easier to validate :-)
2214 	 */
2215 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n",
2216 	    ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob);
2217 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n",
2218 	    dest_is_loop, dest_is_priv, dest_is_global);
2219 
2220 	if ((ifa->src_is_loop) && (dest_is_priv)) {
2221 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n");
2222 		return (NULL);
2223 	}
2224 	if ((ifa->src_is_glob) && (dest_is_priv)) {
2225 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n");
2226 		return (NULL);
2227 	}
2228 	if ((ifa->src_is_loop) && (dest_is_global)) {
2229 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n");
2230 		return (NULL);
2231 	}
2232 	if ((ifa->src_is_priv) && (dest_is_global)) {
2233 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n");
2234 		return (NULL);
2235 	}
2236 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n");
2237 	/* its a preferred address */
2238 	return (ifa);
2239 }
2240 
2241 static struct sctp_ifa *
2242 sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa,
2243     uint8_t dest_is_loop,
2244     uint8_t dest_is_priv,
2245     sa_family_t fam)
2246 {
2247 	uint8_t dest_is_global = 0;
2248 
2249 
2250 	/*
2251 	 * Here we determine if its a acceptable address. A acceptable
2252 	 * address means it is the same scope or higher scope but we can
2253 	 * allow for NAT which means its ok to have a global dest and a
2254 	 * private src.
2255 	 *
2256 	 * L = loopback, P = private, G = global
2257 	 * ----------------------------------------- src    |  dest | result
2258 	 * ----------------------------------------- L     |   L   |    yes
2259 	 * ----------------------------------------- P     |   L   |
2260 	 * yes-v4 no-v6 ----------------------------------------- G     |
2261 	 * L   |    yes ----------------------------------------- L     |
2262 	 * P   |    no ----------------------------------------- P     |   P
2263 	 * |    yes ----------------------------------------- G     |   P
2264 	 * |    yes - May not work -----------------------------------------
2265 	 * L     |   G   |    no ----------------------------------------- P
2266 	 * |   G   |    yes - May not work
2267 	 * ----------------------------------------- G     |   G   |    yes
2268 	 * -----------------------------------------
2269 	 */
2270 
2271 	if (ifa->address.sa.sa_family != fam) {
2272 		/* forget non matching family */
2273 		return (NULL);
2274 	}
2275 	/* Ok the address may be ok */
2276 	if ((dest_is_loop == 0) && (dest_is_priv == 0)) {
2277 		dest_is_global = 1;
2278 	}
2279 	if (fam == AF_INET6) {
2280 		/* ok to use deprecated addresses? */
2281 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2282 			return (NULL);
2283 		}
2284 		if (ifa->src_is_priv) {
2285 			/* Special case, linklocal to loop */
2286 			if (dest_is_loop)
2287 				return (NULL);
2288 		}
2289 	}
2290 	/*
2291 	 * Now that we know what is what, implement our table. This could in
2292 	 * theory be done slicker (it used to be), but this is
2293 	 * straightforward and easier to validate :-)
2294 	 */
2295 	if ((ifa->src_is_loop == 1) && (dest_is_priv)) {
2296 		return (NULL);
2297 	}
2298 	if ((ifa->src_is_loop == 1) && (dest_is_global)) {
2299 		return (NULL);
2300 	}
2301 	/* its an acceptable address */
2302 	return (ifa);
2303 }
2304 
2305 int
2306 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
2307 {
2308 	struct sctp_laddr *laddr;
2309 
2310 	if (stcb == NULL) {
2311 		/* There are no restrictions, no TCB :-) */
2312 		return (0);
2313 	}
2314 	LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) {
2315 		if (laddr->ifa == NULL) {
2316 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n",
2317 			    __FUNCTION__);
2318 			continue;
2319 		}
2320 		if (laddr->ifa == ifa) {
2321 			/* Yes it is on the list */
2322 			return (1);
2323 		}
2324 	}
2325 	return (0);
2326 }
2327 
2328 
2329 int
2330 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa)
2331 {
2332 	struct sctp_laddr *laddr;
2333 
2334 	if (ifa == NULL)
2335 		return (0);
2336 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2337 		if (laddr->ifa == NULL) {
2338 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n",
2339 			    __FUNCTION__);
2340 			continue;
2341 		}
2342 		if ((laddr->ifa == ifa) && laddr->action == 0)
2343 			/* same pointer */
2344 			return (1);
2345 	}
2346 	return (0);
2347 }
2348 
2349 
2350 
2351 static struct sctp_ifa *
2352 sctp_choose_boundspecific_inp(struct sctp_inpcb *inp,
2353     sctp_route_t * ro,
2354     uint32_t vrf_id,
2355     int non_asoc_addr_ok,
2356     uint8_t dest_is_priv,
2357     uint8_t dest_is_loop,
2358     sa_family_t fam)
2359 {
2360 	struct sctp_laddr *laddr, *starting_point;
2361 	void *ifn;
2362 	int resettotop = 0;
2363 	struct sctp_ifn *sctp_ifn;
2364 	struct sctp_ifa *sctp_ifa, *sifa;
2365 	struct sctp_vrf *vrf;
2366 	uint32_t ifn_index;
2367 
2368 	vrf = sctp_find_vrf(vrf_id);
2369 	if (vrf == NULL)
2370 		return (NULL);
2371 
2372 	ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
2373 	ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro);
2374 	sctp_ifn = sctp_find_ifn(ifn, ifn_index);
2375 	/*
2376 	 * first question, is the ifn we will emit on in our list, if so, we
2377 	 * want such an address. Note that we first looked for a preferred
2378 	 * address.
2379 	 */
2380 	if (sctp_ifn) {
2381 		/* is a preferred one on the interface we route out? */
2382 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2383 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
2384 			    (non_asoc_addr_ok == 0))
2385 				continue;
2386 			sifa = sctp_is_ifa_addr_preferred(sctp_ifa,
2387 			    dest_is_loop,
2388 			    dest_is_priv, fam);
2389 			if (sifa == NULL)
2390 				continue;
2391 			if (sctp_is_addr_in_ep(inp, sifa)) {
2392 				atomic_add_int(&sifa->refcount, 1);
2393 				return (sifa);
2394 			}
2395 		}
2396 	}
2397 	/*
2398 	 * ok, now we now need to find one on the list of the addresses. We
2399 	 * can't get one on the emitting interface so let's find first a
2400 	 * preferred one. If not that an acceptable one otherwise... we
2401 	 * return NULL.
2402 	 */
2403 	starting_point = inp->next_addr_touse;
2404 once_again:
2405 	if (inp->next_addr_touse == NULL) {
2406 		inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list);
2407 		resettotop = 1;
2408 	}
2409 	for (laddr = inp->next_addr_touse; laddr;
2410 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
2411 		if (laddr->ifa == NULL) {
2412 			/* address has been removed */
2413 			continue;
2414 		}
2415 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
2416 			/* address is being deleted */
2417 			continue;
2418 		}
2419 		sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop,
2420 		    dest_is_priv, fam);
2421 		if (sifa == NULL)
2422 			continue;
2423 		atomic_add_int(&sifa->refcount, 1);
2424 		return (sifa);
2425 	}
2426 	if (resettotop == 0) {
2427 		inp->next_addr_touse = NULL;
2428 		goto once_again;
2429 	}
2430 	inp->next_addr_touse = starting_point;
2431 	resettotop = 0;
2432 once_again_too:
2433 	if (inp->next_addr_touse == NULL) {
2434 		inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list);
2435 		resettotop = 1;
2436 	}
2437 	/* ok, what about an acceptable address in the inp */
2438 	for (laddr = inp->next_addr_touse; laddr;
2439 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
2440 		if (laddr->ifa == NULL) {
2441 			/* address has been removed */
2442 			continue;
2443 		}
2444 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
2445 			/* address is being deleted */
2446 			continue;
2447 		}
2448 		sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop,
2449 		    dest_is_priv, fam);
2450 		if (sifa == NULL)
2451 			continue;
2452 		atomic_add_int(&sifa->refcount, 1);
2453 		return (sifa);
2454 	}
2455 	if (resettotop == 0) {
2456 		inp->next_addr_touse = NULL;
2457 		goto once_again_too;
2458 	}
2459 	/*
2460 	 * no address bound can be a source for the destination we are in
2461 	 * trouble
2462 	 */
2463 	return (NULL);
2464 }
2465 
2466 
2467 
2468 static struct sctp_ifa *
2469 sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp,
2470     struct sctp_tcb *stcb,
2471     struct sctp_nets *net,
2472     sctp_route_t * ro,
2473     uint32_t vrf_id,
2474     uint8_t dest_is_priv,
2475     uint8_t dest_is_loop,
2476     int non_asoc_addr_ok,
2477     sa_family_t fam)
2478 {
2479 	struct sctp_laddr *laddr, *starting_point;
2480 	void *ifn;
2481 	struct sctp_ifn *sctp_ifn;
2482 	struct sctp_ifa *sctp_ifa, *sifa;
2483 	uint8_t start_at_beginning = 0;
2484 	struct sctp_vrf *vrf;
2485 	uint32_t ifn_index;
2486 
2487 	/*
2488 	 * first question, is the ifn we will emit on in our list, if so, we
2489 	 * want that one.
2490 	 */
2491 	vrf = sctp_find_vrf(vrf_id);
2492 	if (vrf == NULL)
2493 		return (NULL);
2494 
2495 	ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
2496 	ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro);
2497 	sctp_ifn = sctp_find_ifn(ifn, ifn_index);
2498 
2499 	/*
2500 	 * first question, is the ifn we will emit on in our list?  If so,
2501 	 * we want that one. First we look for a preferred. Second, we go
2502 	 * for an acceptable.
2503 	 */
2504 	if (sctp_ifn) {
2505 		/* first try for a preferred address on the ep */
2506 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2507 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0))
2508 				continue;
2509 			if (sctp_is_addr_in_ep(inp, sctp_ifa)) {
2510 				sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam);
2511 				if (sifa == NULL)
2512 					continue;
2513 				if ((non_asoc_addr_ok == 0) &&
2514 				    (sctp_is_addr_restricted(stcb, sifa))) {
2515 					/* on the no-no list */
2516 					continue;
2517 				}
2518 				atomic_add_int(&sifa->refcount, 1);
2519 				return (sifa);
2520 			}
2521 		}
2522 		/* next try for an acceptable address on the ep */
2523 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2524 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0))
2525 				continue;
2526 			if (sctp_is_addr_in_ep(inp, sctp_ifa)) {
2527 				sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam);
2528 				if (sifa == NULL)
2529 					continue;
2530 				if ((non_asoc_addr_ok == 0) &&
2531 				    (sctp_is_addr_restricted(stcb, sifa))) {
2532 					/* on the no-no list */
2533 					continue;
2534 				}
2535 				atomic_add_int(&sifa->refcount, 1);
2536 				return (sifa);
2537 			}
2538 		}
2539 
2540 	}
2541 	/*
2542 	 * if we can't find one like that then we must look at all addresses
2543 	 * bound to pick one at first preferable then secondly acceptable.
2544 	 */
2545 	starting_point = stcb->asoc.last_used_address;
2546 sctp_from_the_top:
2547 	if (stcb->asoc.last_used_address == NULL) {
2548 		start_at_beginning = 1;
2549 		stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
2550 	}
2551 	/* search beginning with the last used address */
2552 	for (laddr = stcb->asoc.last_used_address; laddr;
2553 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
2554 		if (laddr->ifa == NULL) {
2555 			/* address has been removed */
2556 			continue;
2557 		}
2558 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
2559 			/* address is being deleted */
2560 			continue;
2561 		}
2562 		sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam);
2563 		if (sifa == NULL)
2564 			continue;
2565 		if ((non_asoc_addr_ok == 0) &&
2566 		    (sctp_is_addr_restricted(stcb, sifa))) {
2567 			/* on the no-no list */
2568 			continue;
2569 		}
2570 		stcb->asoc.last_used_address = laddr;
2571 		atomic_add_int(&sifa->refcount, 1);
2572 		return (sifa);
2573 	}
2574 	if (start_at_beginning == 0) {
2575 		stcb->asoc.last_used_address = NULL;
2576 		goto sctp_from_the_top;
2577 	}
2578 	/* now try for any higher scope than the destination */
2579 	stcb->asoc.last_used_address = starting_point;
2580 	start_at_beginning = 0;
2581 sctp_from_the_top2:
2582 	if (stcb->asoc.last_used_address == NULL) {
2583 		start_at_beginning = 1;
2584 		stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
2585 	}
2586 	/* search beginning with the last used address */
2587 	for (laddr = stcb->asoc.last_used_address; laddr;
2588 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
2589 		if (laddr->ifa == NULL) {
2590 			/* address has been removed */
2591 			continue;
2592 		}
2593 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
2594 			/* address is being deleted */
2595 			continue;
2596 		}
2597 		sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop,
2598 		    dest_is_priv, fam);
2599 		if (sifa == NULL)
2600 			continue;
2601 		if ((non_asoc_addr_ok == 0) &&
2602 		    (sctp_is_addr_restricted(stcb, sifa))) {
2603 			/* on the no-no list */
2604 			continue;
2605 		}
2606 		stcb->asoc.last_used_address = laddr;
2607 		atomic_add_int(&sifa->refcount, 1);
2608 		return (sifa);
2609 	}
2610 	if (start_at_beginning == 0) {
2611 		stcb->asoc.last_used_address = NULL;
2612 		goto sctp_from_the_top2;
2613 	}
2614 	return (NULL);
2615 }
2616 
2617 static struct sctp_ifa *
2618 sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn,
2619     struct sctp_tcb *stcb,
2620     int non_asoc_addr_ok,
2621     uint8_t dest_is_loop,
2622     uint8_t dest_is_priv,
2623     int addr_wanted,
2624     sa_family_t fam,
2625     sctp_route_t * ro
2626 )
2627 {
2628 	struct sctp_ifa *ifa, *sifa;
2629 	int num_eligible_addr = 0;
2630 
2631 	LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) {
2632 		if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
2633 		    (non_asoc_addr_ok == 0))
2634 			continue;
2635 		sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop,
2636 		    dest_is_priv, fam);
2637 		if (sifa == NULL)
2638 			continue;
2639 		/*
2640 		 * Check if the IPv6 address matches to next-hop. In the
2641 		 * mobile case, old IPv6 address may be not deleted from the
2642 		 * interface. Then, the interface has previous and new
2643 		 * addresses.  We should use one corresponding to the
2644 		 * next-hop.  (by micchie)
2645 		 */
2646 		if (stcb && fam == AF_INET6 &&
2647 		    sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) {
2648 			if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro)
2649 			    == 0) {
2650 				continue;
2651 			}
2652 		}
2653 		/* Avoid topologically incorrect IPv4 address */
2654 		if (stcb && fam == AF_INET &&
2655 		    sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) {
2656 			if (sctp_v4src_match_nexthop(sifa, ro) == 0) {
2657 				continue;
2658 			}
2659 		}
2660 		if (stcb) {
2661 			if ((non_asoc_addr_ok == 0) &&
2662 			    sctp_is_addr_restricted(stcb, sifa)) {
2663 				/*
2664 				 * It is restricted for some reason..
2665 				 * probably not yet added.
2666 				 */
2667 				continue;
2668 			}
2669 		}
2670 		if (num_eligible_addr >= addr_wanted) {
2671 			return (sifa);
2672 		}
2673 		num_eligible_addr++;
2674 	}
2675 	return (NULL);
2676 }
2677 
2678 
2679 static int
2680 sctp_count_num_preferred_boundall(struct sctp_ifn *ifn,
2681     struct sctp_tcb *stcb,
2682     int non_asoc_addr_ok,
2683     uint8_t dest_is_loop,
2684     uint8_t dest_is_priv,
2685     sa_family_t fam)
2686 {
2687 	struct sctp_ifa *ifa, *sifa;
2688 	int num_eligible_addr = 0;
2689 
2690 	LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) {
2691 		if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
2692 		    (non_asoc_addr_ok == 0)) {
2693 			continue;
2694 		}
2695 		sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop,
2696 		    dest_is_priv, fam);
2697 		if (sifa == NULL) {
2698 			continue;
2699 		}
2700 		if (stcb) {
2701 			if ((non_asoc_addr_ok == 0) &&
2702 			    sctp_is_addr_restricted(stcb, sifa)) {
2703 				/*
2704 				 * It is restricted for some reason..
2705 				 * probably not yet added.
2706 				 */
2707 				continue;
2708 			}
2709 		}
2710 		num_eligible_addr++;
2711 	}
2712 	return (num_eligible_addr);
2713 }
2714 
2715 static struct sctp_ifa *
2716 sctp_choose_boundall(struct sctp_inpcb *inp,
2717     struct sctp_tcb *stcb,
2718     struct sctp_nets *net,
2719     sctp_route_t * ro,
2720     uint32_t vrf_id,
2721     uint8_t dest_is_priv,
2722     uint8_t dest_is_loop,
2723     int non_asoc_addr_ok,
2724     sa_family_t fam)
2725 {
2726 	int cur_addr_num = 0, num_preferred = 0;
2727 	void *ifn;
2728 	struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn;
2729 	struct sctp_ifa *sctp_ifa, *sifa;
2730 	uint32_t ifn_index;
2731 	struct sctp_vrf *vrf;
2732 
2733 	/*-
2734 	 * For boundall we can use any address in the association.
2735 	 * If non_asoc_addr_ok is set we can use any address (at least in
2736 	 * theory). So we look for preferred addresses first. If we find one,
2737 	 * we use it. Otherwise we next try to get an address on the
2738 	 * interface, which we should be able to do (unless non_asoc_addr_ok
2739 	 * is false and we are routed out that way). In these cases where we
2740 	 * can't use the address of the interface we go through all the
2741 	 * ifn's looking for an address we can use and fill that in. Punting
2742 	 * means we send back address 0, which will probably cause problems
2743 	 * actually since then IP will fill in the address of the route ifn,
2744 	 * which means we probably already rejected it.. i.e. here comes an
2745 	 * abort :-<.
2746 	 */
2747 	vrf = sctp_find_vrf(vrf_id);
2748 	if (vrf == NULL)
2749 		return (NULL);
2750 
2751 	ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
2752 	ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro);
2753 	emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index);
2754 	if (sctp_ifn == NULL) {
2755 		/* ?? We don't have this guy ?? */
2756 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n");
2757 		goto bound_all_plan_b;
2758 	}
2759 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n",
2760 	    ifn_index, sctp_ifn->ifn_name);
2761 
2762 	if (net) {
2763 		cur_addr_num = net->indx_of_eligible_next_to_use;
2764 	}
2765 	num_preferred = sctp_count_num_preferred_boundall(sctp_ifn,
2766 	    stcb,
2767 	    non_asoc_addr_ok,
2768 	    dest_is_loop,
2769 	    dest_is_priv, fam);
2770 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n",
2771 	    num_preferred, sctp_ifn->ifn_name);
2772 	if (num_preferred == 0) {
2773 		/*
2774 		 * no eligible addresses, we must use some other interface
2775 		 * address if we can find one.
2776 		 */
2777 		goto bound_all_plan_b;
2778 	}
2779 	/*
2780 	 * Ok we have num_eligible_addr set with how many we can use, this
2781 	 * may vary from call to call due to addresses being deprecated
2782 	 * etc..
2783 	 */
2784 	if (cur_addr_num >= num_preferred) {
2785 		cur_addr_num = 0;
2786 	}
2787 	/*
2788 	 * select the nth address from the list (where cur_addr_num is the
2789 	 * nth) and 0 is the first one, 1 is the second one etc...
2790 	 */
2791 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num);
2792 
2793 	sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, stcb, non_asoc_addr_ok, dest_is_loop,
2794 	    dest_is_priv, cur_addr_num, fam, ro);
2795 
2796 	/* if sctp_ifa is NULL something changed??, fall to plan b. */
2797 	if (sctp_ifa) {
2798 		atomic_add_int(&sctp_ifa->refcount, 1);
2799 		if (net) {
2800 			/* save off where the next one we will want */
2801 			net->indx_of_eligible_next_to_use = cur_addr_num + 1;
2802 		}
2803 		return (sctp_ifa);
2804 	}
2805 	/*
2806 	 * plan_b: Look at all interfaces and find a preferred address. If
2807 	 * no preferred fall through to plan_c.
2808 	 */
2809 bound_all_plan_b:
2810 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n");
2811 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2812 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n",
2813 		    sctp_ifn->ifn_name);
2814 		if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2815 			/* wrong base scope */
2816 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n");
2817 			continue;
2818 		}
2819 		if ((sctp_ifn == looked_at) && looked_at) {
2820 			/* already looked at this guy */
2821 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n");
2822 			continue;
2823 		}
2824 		num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, stcb, non_asoc_addr_ok,
2825 		    dest_is_loop, dest_is_priv, fam);
2826 		SCTPDBG(SCTP_DEBUG_OUTPUT2,
2827 		    "Found ifn:%p %d preferred source addresses\n",
2828 		    ifn, num_preferred);
2829 		if (num_preferred == 0) {
2830 			/* None on this interface. */
2831 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefered -- skipping to next\n");
2832 			continue;
2833 		}
2834 		SCTPDBG(SCTP_DEBUG_OUTPUT2,
2835 		    "num preferred:%d on interface:%p cur_addr_num:%d\n",
2836 		    num_preferred, sctp_ifn, cur_addr_num);
2837 
2838 		/*
2839 		 * Ok we have num_eligible_addr set with how many we can
2840 		 * use, this may vary from call to call due to addresses
2841 		 * being deprecated etc..
2842 		 */
2843 		if (cur_addr_num >= num_preferred) {
2844 			cur_addr_num = 0;
2845 		}
2846 		sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, stcb, non_asoc_addr_ok, dest_is_loop,
2847 		    dest_is_priv, cur_addr_num, fam, ro);
2848 		if (sifa == NULL)
2849 			continue;
2850 		if (net) {
2851 			net->indx_of_eligible_next_to_use = cur_addr_num + 1;
2852 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n",
2853 			    cur_addr_num);
2854 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:");
2855 			SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa);
2856 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:");
2857 			SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa);
2858 		}
2859 		atomic_add_int(&sifa->refcount, 1);
2860 		return (sifa);
2861 
2862 	}
2863 
2864 	/* plan_c: do we have an acceptable address on the emit interface */
2865 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n");
2866 	if (emit_ifn == NULL) {
2867 		goto plan_d;
2868 	}
2869 	LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) {
2870 		if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
2871 		    (non_asoc_addr_ok == 0))
2872 			continue;
2873 		sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop,
2874 		    dest_is_priv, fam);
2875 		if (sifa == NULL)
2876 			continue;
2877 		if (stcb) {
2878 			if ((non_asoc_addr_ok == 0) &&
2879 			    sctp_is_addr_restricted(stcb, sifa)) {
2880 				/*
2881 				 * It is restricted for some reason..
2882 				 * probably not yet added.
2883 				 */
2884 				continue;
2885 			}
2886 		}
2887 		atomic_add_int(&sifa->refcount, 1);
2888 		return (sifa);
2889 	}
2890 plan_d:
2891 	/*
2892 	 * plan_d: We are in trouble. No preferred address on the emit
2893 	 * interface. And not even a preferred address on all interfaces. Go
2894 	 * out and see if we can find an acceptable address somewhere
2895 	 * amongst all interfaces.
2896 	 */
2897 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D\n");
2898 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2899 		if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2900 			/* wrong base scope */
2901 			continue;
2902 		}
2903 		if ((sctp_ifn == looked_at) && looked_at)
2904 			/* already looked at this guy */
2905 			continue;
2906 
2907 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2908 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
2909 			    (non_asoc_addr_ok == 0))
2910 				continue;
2911 			sifa = sctp_is_ifa_addr_acceptable(sctp_ifa,
2912 			    dest_is_loop,
2913 			    dest_is_priv, fam);
2914 			if (sifa == NULL)
2915 				continue;
2916 			if (stcb) {
2917 				if ((non_asoc_addr_ok == 0) &&
2918 				    sctp_is_addr_restricted(stcb, sifa)) {
2919 					/*
2920 					 * It is restricted for some
2921 					 * reason.. probably not yet added.
2922 					 */
2923 					continue;
2924 				}
2925 			}
2926 			atomic_add_int(&sifa->refcount, 1);
2927 			return (sifa);
2928 		}
2929 	}
2930 	/*
2931 	 * Ok we can find NO address to source from that is not on our
2932 	 * restricted list and non_asoc_address is NOT ok, or it is on our
2933 	 * restricted list. We can't source to it :-(
2934 	 */
2935 	return (NULL);
2936 }
2937 
2938 
2939 
2940 /* tcb may be NULL */
2941 struct sctp_ifa *
2942 sctp_source_address_selection(struct sctp_inpcb *inp,
2943     struct sctp_tcb *stcb,
2944     sctp_route_t * ro,
2945     struct sctp_nets *net,
2946     int non_asoc_addr_ok, uint32_t vrf_id)
2947 {
2948 	struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
2949 	struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst;
2950 	struct sctp_ifa *answer;
2951 	uint8_t dest_is_priv, dest_is_loop;
2952 	sa_family_t fam;
2953 
2954 	/*-
2955 	 * Rules: - Find the route if needed, cache if I can. - Look at
2956 	 * interface address in route, Is it in the bound list. If so we
2957 	 * have the best source. - If not we must rotate amongst the
2958 	 * addresses.
2959 	 *
2960 	 * Cavets and issues
2961 	 *
2962 	 * Do we need to pay attention to scope. We can have a private address
2963 	 * or a global address we are sourcing or sending to. So if we draw
2964 	 * it out
2965 	 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
2966 	 * For V4
2967          *------------------------------------------
2968 	 *      source     *      dest  *  result
2969 	 * -----------------------------------------
2970 	 * <a>  Private    *    Global  *  NAT
2971 	 * -----------------------------------------
2972 	 * <b>  Private    *    Private *  No problem
2973 	 * -----------------------------------------
2974          * <c>  Global     *    Private *  Huh, How will this work?
2975 	 * -----------------------------------------
2976          * <d>  Global     *    Global  *  No Problem
2977          *------------------------------------------
2978 	 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
2979 	 * For V6
2980          *------------------------------------------
2981 	 *      source     *      dest  *  result
2982 	 * -----------------------------------------
2983 	 * <a>  Linklocal  *    Global  *
2984 	 * -----------------------------------------
2985 	 * <b>  Linklocal  * Linklocal  *  No problem
2986 	 * -----------------------------------------
2987          * <c>  Global     * Linklocal  *  Huh, How will this work?
2988 	 * -----------------------------------------
2989          * <d>  Global     *    Global  *  No Problem
2990          *------------------------------------------
2991 	 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
2992          *
2993 	 * And then we add to that what happens if there are multiple addresses
2994 	 * assigned to an interface. Remember the ifa on a ifn is a linked
2995 	 * list of addresses. So one interface can have more than one IP
2996 	 * address. What happens if we have both a private and a global
2997 	 * address? Do we then use context of destination to sort out which
2998 	 * one is best? And what about NAT's sending P->G may get you a NAT
2999 	 * translation, or should you select the G thats on the interface in
3000 	 * preference.
3001 	 *
3002 	 * Decisions:
3003 	 *
3004 	 * - count the number of addresses on the interface.
3005          * - if it is one, no problem except case <c>.
3006          *   For <a> we will assume a NAT out there.
3007 	 * - if there are more than one, then we need to worry about scope P
3008 	 *   or G. We should prefer G -> G and P -> P if possible.
3009 	 *   Then as a secondary fall back to mixed types G->P being a last
3010 	 *   ditch one.
3011          * - The above all works for bound all, but bound specific we need to
3012 	 *   use the same concept but instead only consider the bound
3013 	 *   addresses. If the bound set is NOT assigned to the interface then
3014 	 *   we must use rotation amongst the bound addresses..
3015 	 */
3016 	if (ro->ro_rt == NULL) {
3017 		/*
3018 		 * Need a route to cache.
3019 		 */
3020 		SCTP_RTALLOC(ro, vrf_id);
3021 	}
3022 	if (ro->ro_rt == NULL) {
3023 		return (NULL);
3024 	}
3025 	fam = to->sin_family;
3026 	dest_is_priv = dest_is_loop = 0;
3027 	/* Setup our scopes for the destination */
3028 	if (fam == AF_INET) {
3029 		/* Scope based on outbound address */
3030 		if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
3031 			dest_is_priv = 1;
3032 		} else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3033 			dest_is_loop = 1;
3034 			if (net != NULL) {
3035 				/* mark it as local */
3036 				net->addr_is_local = 1;
3037 			}
3038 		}
3039 	} else if (fam == AF_INET6) {
3040 		/* Scope based on outbound address */
3041 		if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3042 			/*
3043 			 * If the route goes to the loopback address OR the
3044 			 * address is a loopback address, we are loopback
3045 			 * scope. But we don't use dest_is_priv (link local
3046 			 * addresses).
3047 			 */
3048 			dest_is_loop = 1;
3049 			if (net != NULL) {
3050 				/* mark it as local */
3051 				net->addr_is_local = 1;
3052 			}
3053 		} else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3054 			dest_is_priv = 1;
3055 		}
3056 	}
3057 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:");
3058 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)to);
3059 	SCTP_IPI_ADDR_RLOCK();
3060 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3061 		/*
3062 		 * Bound all case
3063 		 */
3064 		answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id,
3065 		    dest_is_priv, dest_is_loop,
3066 		    non_asoc_addr_ok, fam);
3067 		SCTP_IPI_ADDR_RUNLOCK();
3068 		return (answer);
3069 	}
3070 	/*
3071 	 * Subset bound case
3072 	 */
3073 	if (stcb) {
3074 		answer = sctp_choose_boundspecific_stcb(inp, stcb, net, ro,
3075 		    vrf_id, dest_is_priv,
3076 		    dest_is_loop,
3077 		    non_asoc_addr_ok, fam);
3078 	} else {
3079 		answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id,
3080 		    non_asoc_addr_ok,
3081 		    dest_is_priv,
3082 		    dest_is_loop, fam);
3083 	}
3084 	SCTP_IPI_ADDR_RUNLOCK();
3085 	return (answer);
3086 }
3087 
3088 static int
3089 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
3090 {
3091 	struct cmsghdr cmh;
3092 	int tlen, at;
3093 
3094 	tlen = SCTP_BUF_LEN(control);
3095 	at = 0;
3096 	/*
3097 	 * Independent of how many mbufs, find the c_type inside the control
3098 	 * structure and copy out the data.
3099 	 */
3100 	while (at < tlen) {
3101 		if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) {
3102 			/* not enough room for one more we are done. */
3103 			return (0);
3104 		}
3105 		m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
3106 		if (((int)cmh.cmsg_len + at) > tlen) {
3107 			/*
3108 			 * this is real messed up since there is not enough
3109 			 * data here to cover the cmsg header. We are done.
3110 			 */
3111 			return (0);
3112 		}
3113 		if ((cmh.cmsg_level == IPPROTO_SCTP) &&
3114 		    (c_type == cmh.cmsg_type)) {
3115 			/* found the one we want, copy it out */
3116 			at += CMSG_ALIGN(sizeof(struct cmsghdr));
3117 			if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
3118 				/*
3119 				 * space of cmsg_len after header not big
3120 				 * enough
3121 				 */
3122 				return (0);
3123 			}
3124 			m_copydata(control, at, cpsize, data);
3125 			return (1);
3126 		} else {
3127 			at += CMSG_ALIGN(cmh.cmsg_len);
3128 			if (cmh.cmsg_len == 0) {
3129 				break;
3130 			}
3131 		}
3132 	}
3133 	/* not found */
3134 	return (0);
3135 }
3136 
3137 static struct mbuf *
3138 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
3139     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t ** signature)
3140 {
3141 	struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
3142 	struct sctp_state_cookie *stc;
3143 	struct sctp_paramhdr *ph;
3144 	uint8_t *foo;
3145 	int sig_offset;
3146 	uint16_t cookie_sz;
3147 
3148 	mret = NULL;
3149 	mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) +
3150 	    sizeof(struct sctp_paramhdr)), 0,
3151 	    M_DONTWAIT, 1, MT_DATA);
3152 	if (mret == NULL) {
3153 		return (NULL);
3154 	}
3155 	copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_DONTWAIT);
3156 	if (copy_init == NULL) {
3157 		sctp_m_freem(mret);
3158 		return (NULL);
3159 	}
3160 	copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL,
3161 	    M_DONTWAIT);
3162 	if (copy_initack == NULL) {
3163 		sctp_m_freem(mret);
3164 		sctp_m_freem(copy_init);
3165 		return (NULL);
3166 	}
3167 	/* easy side we just drop it on the end */
3168 	ph = mtod(mret, struct sctp_paramhdr *);
3169 	SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) +
3170 	    sizeof(struct sctp_paramhdr);
3171 	stc = (struct sctp_state_cookie *)((caddr_t)ph +
3172 	    sizeof(struct sctp_paramhdr));
3173 	ph->param_type = htons(SCTP_STATE_COOKIE);
3174 	ph->param_length = 0;	/* fill in at the end */
3175 	/* Fill in the stc cookie data */
3176 	memcpy(stc, stc_in, sizeof(struct sctp_state_cookie));
3177 
3178 	/* tack the INIT and then the INIT-ACK onto the chain */
3179 	cookie_sz = 0;
3180 	m_at = mret;
3181 	for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3182 		cookie_sz += SCTP_BUF_LEN(m_at);
3183 		if (SCTP_BUF_NEXT(m_at) == NULL) {
3184 			SCTP_BUF_NEXT(m_at) = copy_init;
3185 			break;
3186 		}
3187 	}
3188 
3189 	for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3190 		cookie_sz += SCTP_BUF_LEN(m_at);
3191 		if (SCTP_BUF_NEXT(m_at) == NULL) {
3192 			SCTP_BUF_NEXT(m_at) = copy_initack;
3193 			break;
3194 		}
3195 	}
3196 
3197 	for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3198 		cookie_sz += SCTP_BUF_LEN(m_at);
3199 		if (SCTP_BUF_NEXT(m_at) == NULL) {
3200 			break;
3201 		}
3202 	}
3203 	sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_DONTWAIT, 1, MT_DATA);
3204 	if (sig == NULL) {
3205 		/* no space, so free the entire chain */
3206 		sctp_m_freem(mret);
3207 		return (NULL);
3208 	}
3209 	SCTP_BUF_LEN(sig) = 0;
3210 	SCTP_BUF_NEXT(m_at) = sig;
3211 	sig_offset = 0;
3212 	foo = (uint8_t *) (mtod(sig, caddr_t)+sig_offset);
3213 	memset(foo, 0, SCTP_SIGNATURE_SIZE);
3214 	*signature = foo;
3215 	SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE;
3216 	cookie_sz += SCTP_SIGNATURE_SIZE;
3217 	ph->param_length = htons(cookie_sz);
3218 	return (mret);
3219 }
3220 
3221 
3222 static uint8_t
3223 sctp_get_ect(struct sctp_tcb *stcb,
3224     struct sctp_tmit_chunk *chk)
3225 {
3226 	uint8_t this_random;
3227 
3228 	/* Huh? */
3229 	if (sctp_ecn_enable == 0)
3230 		return (0);
3231 
3232 	if (sctp_ecn_nonce == 0)
3233 		/* no nonce, always return ECT0 */
3234 		return (SCTP_ECT0_BIT);
3235 
3236 	if (stcb->asoc.peer_supports_ecn_nonce == 0) {
3237 		/* Peer does NOT support it, so we send a ECT0 only */
3238 		return (SCTP_ECT0_BIT);
3239 	}
3240 	if (chk == NULL)
3241 		return (SCTP_ECT0_BIT);
3242 
3243 	if ((stcb->asoc.hb_random_idx > 3) ||
3244 	    ((stcb->asoc.hb_random_idx == 3) &&
3245 	    (stcb->asoc.hb_ect_randombit > 7))) {
3246 		uint32_t rndval;
3247 
3248 warp_drive_sa:
3249 		rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
3250 		memcpy(stcb->asoc.hb_random_values, &rndval,
3251 		    sizeof(stcb->asoc.hb_random_values));
3252 		this_random = stcb->asoc.hb_random_values[0];
3253 		stcb->asoc.hb_random_idx = 0;
3254 		stcb->asoc.hb_ect_randombit = 0;
3255 	} else {
3256 		if (stcb->asoc.hb_ect_randombit > 7) {
3257 			stcb->asoc.hb_ect_randombit = 0;
3258 			stcb->asoc.hb_random_idx++;
3259 			if (stcb->asoc.hb_random_idx > 3) {
3260 				goto warp_drive_sa;
3261 			}
3262 		}
3263 		this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
3264 	}
3265 	if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
3266 		if (chk != NULL)
3267 			/* ECN Nonce stuff */
3268 			chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
3269 		stcb->asoc.hb_ect_randombit++;
3270 		return (SCTP_ECT1_BIT);
3271 	} else {
3272 		stcb->asoc.hb_ect_randombit++;
3273 		return (SCTP_ECT0_BIT);
3274 	}
3275 }
3276 
3277 static int
3278 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
3279     struct sctp_tcb *stcb,	/* may be NULL */
3280     struct sctp_nets *net,
3281     struct sockaddr *to,
3282     struct mbuf *m,
3283     uint32_t auth_offset,
3284     struct sctp_auth_chunk *auth,
3285     int nofragment_flag,
3286     int ecn_ok,
3287     struct sctp_tmit_chunk *chk,
3288     int out_of_asoc_ok,
3289     int so_locked
3290 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3291     SCTP_UNUSED
3292 #endif
3293 )
3294 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
3295 {
3296 	/*
3297 	 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet
3298 	 * header WITH an SCTPHDR but no IP header, endpoint inp and sa
3299 	 * structure: - fill in the HMAC digest of any AUTH chunk in the
3300 	 * packet. - calculate and fill in the SCTP checksum. - prepend an
3301 	 * IP address header. - if boundall use INADDR_ANY. - if
3302 	 * boundspecific do source address selection. - set fragmentation
3303 	 * option for ipV4. - On return from IP output, check/adjust mtu
3304 	 * size of output interface and smallest_mtu size as well.
3305 	 */
3306 	/* Will need ifdefs around this */
3307 	struct mbuf *o_pak;
3308 	struct mbuf *newm;
3309 	struct sctphdr *sctphdr;
3310 	int packet_length;
3311 	uint32_t csum;
3312 	int ret;
3313 	uint32_t vrf_id;
3314 	sctp_route_t *ro = NULL;
3315 
3316 	if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
3317 		SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT);
3318 		sctp_m_freem(m);
3319 		return (EFAULT);
3320 	}
3321 	if (stcb) {
3322 		vrf_id = stcb->asoc.vrf_id;
3323 	} else {
3324 		vrf_id = inp->def_vrf_id;
3325 	}
3326 
3327 	/* fill in the HMAC digest for any AUTH chunk in the packet */
3328 	if ((auth != NULL) && (stcb != NULL)) {
3329 		sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb);
3330 	}
3331 	/* Calculate the csum and fill in the length of the packet */
3332 	sctphdr = mtod(m, struct sctphdr *);
3333 	if (sctp_no_csum_on_loopback &&
3334 	    (stcb) &&
3335 	    (to->sa_family == AF_INET) &&
3336 	    (stcb->asoc.loopback_scope)) {
3337 		sctphdr->checksum = 0;
3338 		/*
3339 		 * This can probably now be taken out since my audit shows
3340 		 * no more bad pktlen's coming in. But we will wait a while
3341 		 * yet.
3342 		 */
3343 		packet_length = sctp_calculate_len(m);
3344 	} else {
3345 		sctphdr->checksum = 0;
3346 		csum = sctp_calculate_sum(m, &packet_length, 0);
3347 		sctphdr->checksum = csum;
3348 	}
3349 
3350 	if (to->sa_family == AF_INET) {
3351 		struct ip *ip = NULL;
3352 		sctp_route_t iproute;
3353 		uint8_t tos_value;
3354 
3355 		newm = sctp_get_mbuf_for_msg(sizeof(struct ip), 1, M_DONTWAIT, 1, MT_DATA);
3356 		if (newm == NULL) {
3357 			sctp_m_freem(m);
3358 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
3359 			return (ENOMEM);
3360 		}
3361 		SCTP_ALIGN_TO_END(newm, sizeof(struct ip));
3362 		SCTP_BUF_LEN(newm) = sizeof(struct ip);
3363 		packet_length += sizeof(struct ip);
3364 		SCTP_BUF_NEXT(newm) = m;
3365 		m = newm;
3366 		ip = mtod(m, struct ip *);
3367 		ip->ip_v = IPVERSION;
3368 		ip->ip_hl = (sizeof(struct ip) >> 2);
3369 		if (net) {
3370 			tos_value = net->tos_flowlabel & 0x000000ff;
3371 		} else {
3372 			tos_value = inp->ip_inp.inp.inp_ip_tos;
3373 		}
3374 		if (nofragment_flag) {
3375 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__APPLE__)
3376 			ip->ip_off = IP_DF;
3377 #else
3378 			ip->ip_off = htons(IP_DF);
3379 #endif
3380 		} else
3381 			ip->ip_off = 0;
3382 
3383 		/* FreeBSD has a function for ip_id's */
3384 		ip->ip_id = ip_newid();
3385 
3386 		ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
3387 		ip->ip_len = packet_length;
3388 		if (stcb) {
3389 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
3390 				/* Enable ECN */
3391 				ip->ip_tos = ((u_char)(tos_value & 0xfc) | sctp_get_ect(stcb, chk));
3392 			} else {
3393 				/* No ECN */
3394 				ip->ip_tos = (u_char)(tos_value & 0xfc);
3395 			}
3396 		} else {
3397 			/* no association at all */
3398 			ip->ip_tos = (tos_value & 0xfc);
3399 		}
3400 		ip->ip_p = IPPROTO_SCTP;
3401 		ip->ip_sum = 0;
3402 		if (net == NULL) {
3403 			ro = &iproute;
3404 			memset(&iproute, 0, sizeof(iproute));
3405 			memcpy(&ro->ro_dst, to, to->sa_len);
3406 		} else {
3407 			ro = (sctp_route_t *) & net->ro;
3408 		}
3409 		/* Now the address selection part */
3410 		ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
3411 
3412 		/* call the routine to select the src address */
3413 		if (net) {
3414 			if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) {
3415 				sctp_free_ifa(net->ro._s_addr);
3416 				net->ro._s_addr = NULL;
3417 				net->src_addr_selected = 0;
3418 				if (ro->ro_rt) {
3419 					RTFREE(ro->ro_rt);
3420 					ro->ro_rt = NULL;
3421 				}
3422 			}
3423 			if (net->src_addr_selected == 0) {
3424 				if (out_of_asoc_ok) {
3425 					/* do not cache */
3426 					goto temp_v4_src;
3427 				}
3428 				/* Cache the source address */
3429 				net->ro._s_addr = sctp_source_address_selection(inp, stcb,
3430 				    ro, net, out_of_asoc_ok,
3431 				    vrf_id);
3432 				net->src_addr_selected = 1;
3433 			}
3434 			if (net->ro._s_addr == NULL) {
3435 				/* No route to host */
3436 				net->src_addr_selected = 0;
3437 				goto no_route;
3438 			}
3439 			ip->ip_src = net->ro._s_addr->address.sin.sin_addr;
3440 		} else {
3441 			struct sctp_ifa *_lsrc;
3442 
3443 	temp_v4_src:
3444 			_lsrc = sctp_source_address_selection(inp, stcb, ro,
3445 			    net,
3446 			    out_of_asoc_ok,
3447 			    vrf_id);
3448 			if (_lsrc == NULL) {
3449 				goto no_route;
3450 			}
3451 			ip->ip_src = _lsrc->address.sin.sin_addr;
3452 			sctp_free_ifa(_lsrc);
3453 		}
3454 
3455 		/*
3456 		 * If source address selection fails and we find no route
3457 		 * then the ip_output should fail as well with a
3458 		 * NO_ROUTE_TO_HOST type error. We probably should catch
3459 		 * that somewhere and abort the association right away
3460 		 * (assuming this is an INIT being sent).
3461 		 */
3462 		if ((ro->ro_rt == NULL)) {
3463 			/*
3464 			 * src addr selection failed to find a route (or
3465 			 * valid source addr), so we can't get there from
3466 			 * here (yet)!
3467 			 */
3468 	no_route:
3469 			SCTPDBG(SCTP_DEBUG_OUTPUT1,
3470 			    "%s: dropped packet - no valid source addr\n",
3471 			    __FUNCTION__);
3472 			if (net) {
3473 				SCTPDBG(SCTP_DEBUG_OUTPUT1,
3474 				    "Destination was ");
3475 				SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1,
3476 				    &net->ro._l_addr.sa);
3477 				if (net->dest_state & SCTP_ADDR_CONFIRMED) {
3478 					if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) {
3479 						SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", net);
3480 						sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
3481 						    stcb,
3482 						    SCTP_FAILED_THRESHOLD,
3483 						    (void *)net,
3484 						    so_locked);
3485 						net->dest_state &= ~SCTP_ADDR_REACHABLE;
3486 						net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
3487 						/*
3488 						 * JRS 5/14/07 - If a
3489 						 * destination is
3490 						 * unreachable, the PF bit
3491 						 * is turned off.  This
3492 						 * allows an unambiguous use
3493 						 * of the PF bit for
3494 						 * destinations that are
3495 						 * reachable but potentially
3496 						 * failed. If the
3497 						 * destination is set to the
3498 						 * unreachable state, also
3499 						 * set the destination to
3500 						 * the PF state.
3501 						 */
3502 						/*
3503 						 * Add debug message here if
3504 						 * destination is not in PF
3505 						 * state.
3506 						 */
3507 						/*
3508 						 * Stop any running T3
3509 						 * timers here?
3510 						 */
3511 						if (sctp_cmt_on_off && sctp_cmt_pf) {
3512 							net->dest_state &= ~SCTP_ADDR_PF;
3513 							SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination %p moved from PF to unreachable.\n",
3514 							    net);
3515 						}
3516 					}
3517 				}
3518 				if (stcb) {
3519 					if (net == stcb->asoc.primary_destination) {
3520 						/* need a new primary */
3521 						struct sctp_nets *alt;
3522 
3523 						alt = sctp_find_alternate_net(stcb, net, 0);
3524 						if (alt != net) {
3525 							if (sctp_set_primary_addr(stcb,
3526 							    (struct sockaddr *)NULL,
3527 							    alt) == 0) {
3528 								net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
3529 								if (net->ro._s_addr) {
3530 									sctp_free_ifa(net->ro._s_addr);
3531 									net->ro._s_addr = NULL;
3532 								}
3533 								net->src_addr_selected = 0;
3534 							}
3535 						}
3536 					}
3537 				}
3538 			}
3539 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH);
3540 			sctp_m_freem(m);
3541 			return (EHOSTUNREACH);
3542 		}
3543 		if (ro != &iproute) {
3544 			memcpy(&iproute, ro, sizeof(*ro));
3545 		}
3546 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n",
3547 		    (uint32_t) (ntohl(ip->ip_src.s_addr)));
3548 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n",
3549 		    (uint32_t) (ntohl(ip->ip_dst.s_addr)));
3550 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n",
3551 		    ro->ro_rt);
3552 
3553 		if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
3554 			/* failed to prepend data, give up */
3555 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
3556 			sctp_m_freem(m);
3557 			return (ENOMEM);
3558 		}
3559 #ifdef  SCTP_PACKET_LOGGING
3560 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
3561 			sctp_packet_log(m, packet_length);
3562 #endif
3563 		SCTP_ATTACH_CHAIN(o_pak, m, packet_length);
3564 
3565 		/* send it out.  table id is taken from stcb */
3566 		SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id);
3567 
3568 		SCTP_STAT_INCR(sctps_sendpackets);
3569 		SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
3570 		if (ret)
3571 			SCTP_STAT_INCR(sctps_senderrors);
3572 
3573 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret);
3574 		if (net == NULL) {
3575 			/* free tempy routes */
3576 			if (ro->ro_rt) {
3577 				RTFREE(ro->ro_rt);
3578 				ro->ro_rt = NULL;
3579 			}
3580 		} else {
3581 			/* PMTU check versus smallest asoc MTU goes here */
3582 			if ((ro->ro_rt != NULL) &&
3583 			    (net->ro._s_addr)) {
3584 				uint32_t mtu;
3585 
3586 				mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt);
3587 				if (mtu &&
3588 				    (stcb->asoc.smallest_mtu > mtu)) {
3589 #ifdef SCTP_PRINT_FOR_B_AND_M
3590 					SCTP_PRINTF("sctp_mtu_size_reset called after ip_output mtu-change:%d\n",
3591 					    mtu);
3592 #endif
3593 					sctp_mtu_size_reset(inp, &stcb->asoc, mtu);
3594 					net->mtu = mtu;
3595 				}
3596 			} else if (ro->ro_rt == NULL) {
3597 				/* route was freed */
3598 				if (net->ro._s_addr &&
3599 				    net->src_addr_selected) {
3600 					sctp_free_ifa(net->ro._s_addr);
3601 					net->ro._s_addr = NULL;
3602 				}
3603 				net->src_addr_selected = 0;
3604 			}
3605 		}
3606 		return (ret);
3607 	}
3608 #ifdef INET6
3609 	else if (to->sa_family == AF_INET6) {
3610 		uint32_t flowlabel;
3611 		struct ip6_hdr *ip6h;
3612 		struct route_in6 ip6route;
3613 		struct ifnet *ifp;
3614 		u_char flowTop;
3615 		uint16_t flowBottom;
3616 		u_char tosBottom, tosTop;
3617 		struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
3618 		int prev_scope = 0;
3619 		struct sockaddr_in6 lsa6_storage;
3620 		int error;
3621 		u_short prev_port = 0;
3622 
3623 		if (net != NULL) {
3624 			flowlabel = net->tos_flowlabel;
3625 		} else {
3626 			flowlabel = ((struct in6pcb *)inp)->in6p_flowinfo;
3627 		}
3628 
3629 		newm = sctp_get_mbuf_for_msg(sizeof(struct ip6_hdr), 1, M_DONTWAIT, 1, MT_DATA);
3630 		if (newm == NULL) {
3631 			sctp_m_freem(m);
3632 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
3633 			return (ENOMEM);
3634 		}
3635 		SCTP_ALIGN_TO_END(newm, sizeof(struct ip6_hdr));
3636 		SCTP_BUF_LEN(newm) = sizeof(struct ip6_hdr);
3637 		packet_length += sizeof(struct ip6_hdr);
3638 		SCTP_BUF_NEXT(newm) = m;
3639 		m = newm;
3640 
3641 		ip6h = mtod(m, struct ip6_hdr *);
3642 		/*
3643 		 * We assume here that inp_flow is in host byte order within
3644 		 * the TCB!
3645 		 */
3646 		flowBottom = flowlabel & 0x0000ffff;
3647 		flowTop = ((flowlabel & 0x000f0000) >> 16);
3648 		tosTop = (((flowlabel & 0xf0) >> 4) | IPV6_VERSION);
3649 		/* protect *sin6 from overwrite */
3650 		sin6 = (struct sockaddr_in6 *)to;
3651 		tmp = *sin6;
3652 		sin6 = &tmp;
3653 
3654 		/* KAME hack: embed scopeid */
3655 		if (sa6_embedscope(sin6, ip6_use_defzone) != 0) {
3656 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
3657 			return (EINVAL);
3658 		}
3659 		if (net == NULL) {
3660 			memset(&ip6route, 0, sizeof(ip6route));
3661 			ro = (sctp_route_t *) & ip6route;
3662 			memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
3663 		} else {
3664 			ro = (sctp_route_t *) & net->ro;
3665 		}
3666 		if (stcb != NULL) {
3667 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
3668 				/* Enable ECN */
3669 				tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
3670 			} else {
3671 				/* No ECN */
3672 				tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
3673 			}
3674 		} else {
3675 			/* we could get no asoc if it is a O-O-T-B packet */
3676 			tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
3677 		}
3678 		ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom | flowTop) << 16) | flowBottom));
3679 		ip6h->ip6_nxt = IPPROTO_SCTP;
3680 		ip6h->ip6_plen = (packet_length - sizeof(struct ip6_hdr));
3681 		ip6h->ip6_dst = sin6->sin6_addr;
3682 
3683 		/*
3684 		 * Add SRC address selection here: we can only reuse to a
3685 		 * limited degree the kame src-addr-sel, since we can try
3686 		 * their selection but it may not be bound.
3687 		 */
3688 		bzero(&lsa6_tmp, sizeof(lsa6_tmp));
3689 		lsa6_tmp.sin6_family = AF_INET6;
3690 		lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
3691 		lsa6 = &lsa6_tmp;
3692 		if (net) {
3693 			if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) {
3694 				sctp_free_ifa(net->ro._s_addr);
3695 				net->ro._s_addr = NULL;
3696 				net->src_addr_selected = 0;
3697 				if (ro->ro_rt) {
3698 					RTFREE(ro->ro_rt);
3699 					ro->ro_rt = NULL;
3700 				}
3701 			}
3702 			if (net->src_addr_selected == 0) {
3703 				if (out_of_asoc_ok) {
3704 					/* do not cache */
3705 					goto temp_v6_src;
3706 				}
3707 				/* Cache the source address */
3708 				net->ro._s_addr = sctp_source_address_selection(inp,
3709 				    stcb,
3710 				    ro,
3711 				    net,
3712 				    out_of_asoc_ok,
3713 				    vrf_id);
3714 				net->src_addr_selected = 1;
3715 			}
3716 			if (net->ro._s_addr == NULL) {
3717 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n");
3718 				net->src_addr_selected = 0;
3719 				goto no_route;
3720 			}
3721 			lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr;
3722 		} else {
3723 			struct sctp_ifa *_lsrc;
3724 
3725 	temp_v6_src:
3726 			_lsrc = sctp_source_address_selection(inp, stcb, ro,
3727 			    net,
3728 			    out_of_asoc_ok,
3729 			    vrf_id);
3730 			if (_lsrc == NULL) {
3731 				goto no_route;
3732 			}
3733 			lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr;
3734 			sctp_free_ifa(_lsrc);
3735 		}
3736 		lsa6->sin6_port = inp->sctp_lport;
3737 
3738 		if ((ro->ro_rt == NULL)) {
3739 			/*
3740 			 * src addr selection failed to find a route (or
3741 			 * valid source addr), so we can't get there from
3742 			 * here!
3743 			 */
3744 			goto no_route;
3745 		}
3746 		/*
3747 		 * XXX: sa6 may not have a valid sin6_scope_id in the
3748 		 * non-SCOPEDROUTING case.
3749 		 */
3750 		bzero(&lsa6_storage, sizeof(lsa6_storage));
3751 		lsa6_storage.sin6_family = AF_INET6;
3752 		lsa6_storage.sin6_len = sizeof(lsa6_storage);
3753 		if ((error = sa6_recoverscope(&lsa6_storage)) != 0) {
3754 			SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error);
3755 			sctp_m_freem(m);
3756 			return (error);
3757 		}
3758 		/* XXX */
3759 		lsa6_storage.sin6_addr = lsa6->sin6_addr;
3760 		lsa6_storage.sin6_port = inp->sctp_lport;
3761 		lsa6 = &lsa6_storage;
3762 		ip6h->ip6_src = lsa6->sin6_addr;
3763 
3764 		/*
3765 		 * We set the hop limit now since there is a good chance
3766 		 * that our ro pointer is now filled
3767 		 */
3768 		ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro);
3769 		ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
3770 
3771 #ifdef SCTP_DEBUG
3772 		/* Copy to be sure something bad is not happening */
3773 		sin6->sin6_addr = ip6h->ip6_dst;
3774 		lsa6->sin6_addr = ip6h->ip6_src;
3775 #endif
3776 
3777 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n");
3778 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: ");
3779 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6);
3780 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: ");
3781 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6);
3782 		if (net) {
3783 			sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
3784 			/* preserve the port and scope for link local send */
3785 			prev_scope = sin6->sin6_scope_id;
3786 			prev_port = sin6->sin6_port;
3787 		}
3788 		if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
3789 			/* failed to prepend data, give up */
3790 			sctp_m_freem(m);
3791 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
3792 			return (ENOMEM);
3793 		}
3794 #ifdef  SCTP_PACKET_LOGGING
3795 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
3796 			sctp_packet_log(m, packet_length);
3797 #endif
3798 		SCTP_ATTACH_CHAIN(o_pak, m, packet_length);
3799 
3800 		/* send it out. table id is taken from stcb */
3801 		SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp,
3802 		    stcb, vrf_id);
3803 
3804 		if (net) {
3805 			/* for link local this must be done */
3806 			sin6->sin6_scope_id = prev_scope;
3807 			sin6->sin6_port = prev_port;
3808 		}
3809 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret);
3810 		SCTP_STAT_INCR(sctps_sendpackets);
3811 		SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
3812 		if (ret) {
3813 			SCTP_STAT_INCR(sctps_senderrors);
3814 		}
3815 		if (net == NULL) {
3816 			/* Now if we had a temp route free it */
3817 			if (ro->ro_rt) {
3818 				RTFREE(ro->ro_rt);
3819 			}
3820 		} else {
3821 			/* PMTU check versus smallest asoc MTU goes here */
3822 			if (ro->ro_rt == NULL) {
3823 				/* Route was freed */
3824 				if (net->ro._s_addr &&
3825 				    net->src_addr_selected) {
3826 					sctp_free_ifa(net->ro._s_addr);
3827 					net->ro._s_addr = NULL;
3828 				}
3829 				net->src_addr_selected = 0;
3830 			}
3831 			if ((ro->ro_rt != NULL) &&
3832 			    (net->ro._s_addr)) {
3833 				uint32_t mtu;
3834 
3835 				mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt);
3836 				if (mtu &&
3837 				    (stcb->asoc.smallest_mtu > mtu)) {
3838 #ifdef SCTP_PRINT_FOR_B_AND_M
3839 					SCTP_PRINTF("sctp_mtu_size_reset called after ip6_output mtu-change:%d\n",
3840 					    mtu);
3841 #endif
3842 					sctp_mtu_size_reset(inp, &stcb->asoc, mtu);
3843 					net->mtu = mtu;
3844 				}
3845 			} else if (ifp) {
3846 				if (ND_IFINFO(ifp)->linkmtu &&
3847 				    (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
3848 #ifdef SCTP_PRINT_FOR_B_AND_M
3849 					SCTP_PRINTF("sctp_mtu_size_reset called via ifp ND_IFINFO() linkmtu:%d\n",
3850 					    ND_IFINFO(ifp)->linkmtu);
3851 #endif
3852 					sctp_mtu_size_reset(inp,
3853 					    &stcb->asoc,
3854 					    ND_IFINFO(ifp)->linkmtu);
3855 				}
3856 			}
3857 		}
3858 		return (ret);
3859 	}
3860 #endif
3861 	else {
3862 		SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n",
3863 		    ((struct sockaddr *)to)->sa_family);
3864 		sctp_m_freem(m);
3865 		SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT);
3866 		return (EFAULT);
3867 	}
3868 }
3869 
3870 
3871 void
3872 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked
3873 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3874     SCTP_UNUSED
3875 #endif
3876 )
3877 {
3878 	struct mbuf *m, *m_at, *mp_last;
3879 	struct sctp_nets *net;
3880 	struct sctp_init_msg *initm;
3881 	struct sctp_supported_addr_param *sup_addr;
3882 	struct sctp_ecn_supported_param *ecn;
3883 	struct sctp_prsctp_supported_param *prsctp;
3884 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
3885 	struct sctp_supported_chunk_types_param *pr_supported;
3886 	int cnt_inits_to = 0;
3887 	int padval, ret;
3888 	int num_ext;
3889 	int p_len;
3890 
3891 	/* INIT's always go to the primary (and usually ONLY address) */
3892 	mp_last = NULL;
3893 	net = stcb->asoc.primary_destination;
3894 	if (net == NULL) {
3895 		net = TAILQ_FIRST(&stcb->asoc.nets);
3896 		if (net == NULL) {
3897 			/* TSNH */
3898 			return;
3899 		}
3900 		/* we confirm any address we send an INIT to */
3901 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
3902 		(void)sctp_set_primary_addr(stcb, NULL, net);
3903 	} else {
3904 		/* we confirm any address we send an INIT to */
3905 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
3906 	}
3907 	SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n");
3908 	if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
3909 		/*
3910 		 * special hook, if we are sending to link local it will not
3911 		 * show up in our private address count.
3912 		 */
3913 		struct sockaddr_in6 *sin6l;
3914 
3915 		sin6l = &net->ro._l_addr.sin6;
3916 		if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
3917 			cnt_inits_to = 1;
3918 	}
3919 	if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
3920 		/* This case should not happen */
3921 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n");
3922 		return;
3923 	}
3924 	/* start the INIT timer */
3925 	sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
3926 
3927 	m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA);
3928 	if (m == NULL) {
3929 		/* No memory, INIT timer will re-attempt. */
3930 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n");
3931 		return;
3932 	}
3933 	SCTP_BUF_LEN(m) = sizeof(struct sctp_init_msg);
3934 	/*
3935 	 * assume peer supports asconf in order to be able to queue local
3936 	 * address changes while an INIT is in flight and before the assoc
3937 	 * is established.
3938 	 */
3939 	stcb->asoc.peer_supports_asconf = 1;
3940 	/* Now lets put the SCTP header in place */
3941 	initm = mtod(m, struct sctp_init_msg *);
3942 	initm->sh.src_port = inp->sctp_lport;
3943 	initm->sh.dest_port = stcb->rport;
3944 	initm->sh.v_tag = 0;
3945 	initm->sh.checksum = 0;	/* calculate later */
3946 	/* now the chunk header */
3947 	initm->msg.ch.chunk_type = SCTP_INITIATION;
3948 	initm->msg.ch.chunk_flags = 0;
3949 	/* fill in later from mbuf we build */
3950 	initm->msg.ch.chunk_length = 0;
3951 	/* place in my tag */
3952 	initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
3953 	/* set up some of the credits. */
3954 	initm->msg.init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(inp->sctp_socket),
3955 	    SCTP_MINIMAL_RWND));
3956 
3957 	initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
3958 	initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
3959 	initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
3960 	/* now the address restriction */
3961 	sup_addr = (struct sctp_supported_addr_param *)((caddr_t)initm +
3962 	    sizeof(*initm));
3963 	sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
3964 	/* we support 2 types IPv6/IPv4 */
3965 	sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
3966 	    sizeof(uint16_t));
3967 	sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
3968 	sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
3969 	SCTP_BUF_LEN(m) += sizeof(*sup_addr) + sizeof(uint16_t);
3970 
3971 	if (inp->sctp_ep.adaptation_layer_indicator) {
3972 		struct sctp_adaptation_layer_indication *ali;
3973 
3974 		ali = (struct sctp_adaptation_layer_indication *)(
3975 		    (caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
3976 		ali->ph.param_type = htons(SCTP_ULP_ADAPTATION);
3977 		ali->ph.param_length = htons(sizeof(*ali));
3978 		ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator);
3979 		SCTP_BUF_LEN(m) += sizeof(*ali);
3980 		ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
3981 		    sizeof(*ali));
3982 	} else {
3983 		ecn = (struct sctp_ecn_supported_param *)((caddr_t)sup_addr +
3984 		    sizeof(*sup_addr) + sizeof(uint16_t));
3985 	}
3986 
3987 	/* now any cookie time extensions */
3988 	if (stcb->asoc.cookie_preserve_req) {
3989 		struct sctp_cookie_perserve_param *cookie_preserve;
3990 
3991 		cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
3992 		cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
3993 		cookie_preserve->ph.param_length = htons(
3994 		    sizeof(*cookie_preserve));
3995 		cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
3996 		SCTP_BUF_LEN(m) += sizeof(*cookie_preserve);
3997 		ecn = (struct sctp_ecn_supported_param *)(
3998 		    (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
3999 		stcb->asoc.cookie_preserve_req = 0;
4000 	}
4001 	/* ECN parameter */
4002 	if (sctp_ecn_enable == 1) {
4003 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
4004 		ecn->ph.param_length = htons(sizeof(*ecn));
4005 		SCTP_BUF_LEN(m) += sizeof(*ecn);
4006 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
4007 		    sizeof(*ecn));
4008 	} else {
4009 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
4010 	}
4011 	/* And now tell the peer we do pr-sctp */
4012 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
4013 	prsctp->ph.param_length = htons(sizeof(*prsctp));
4014 	SCTP_BUF_LEN(m) += sizeof(*prsctp);
4015 
4016 	/* And now tell the peer we do all the extensions */
4017 	pr_supported = (struct sctp_supported_chunk_types_param *)
4018 	    ((caddr_t)prsctp + sizeof(*prsctp));
4019 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
4020 	num_ext = 0;
4021 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF;
4022 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK;
4023 	pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN;
4024 	pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED;
4025 	pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET;
4026 	if (!sctp_auth_disable)
4027 		pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION;
4028 	p_len = sizeof(*pr_supported) + num_ext;
4029 	pr_supported->ph.param_length = htons(p_len);
4030 	bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len);
4031 	SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
4032 
4033 	/* ECN nonce: And now tell the peer we support ECN nonce */
4034 	if (sctp_ecn_nonce) {
4035 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)
4036 		    ((caddr_t)pr_supported + SCTP_SIZE32(p_len));
4037 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
4038 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
4039 		SCTP_BUF_LEN(m) += sizeof(*ecn_nonce);
4040 	}
4041 	/* add authentication parameters */
4042 	if (!sctp_auth_disable) {
4043 		struct sctp_auth_random *randp;
4044 		struct sctp_auth_hmac_algo *hmacs;
4045 		struct sctp_auth_chunk_list *chunks;
4046 
4047 		/* attach RANDOM parameter, if available */
4048 		if (stcb->asoc.authinfo.random != NULL) {
4049 			randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
4050 			p_len = sizeof(*randp) + stcb->asoc.authinfo.random_len;
4051 #ifdef SCTP_AUTH_DRAFT_04
4052 			randp->ph.param_type = htons(SCTP_RANDOM);
4053 			randp->ph.param_length = htons(p_len);
4054 			bcopy(stcb->asoc.authinfo.random->key,
4055 			    randp->random_data,
4056 			    stcb->asoc.authinfo.random_len);
4057 #else
4058 			/* random key already contains the header */
4059 			bcopy(stcb->asoc.authinfo.random->key, randp, p_len);
4060 #endif
4061 			/* zero out any padding required */
4062 			bzero((caddr_t)randp + p_len, SCTP_SIZE32(p_len) - p_len);
4063 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
4064 		}
4065 		/* add HMAC_ALGO parameter */
4066 		hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
4067 		p_len = sctp_serialize_hmaclist(stcb->asoc.local_hmacs,
4068 		    (uint8_t *) hmacs->hmac_ids);
4069 		if (p_len > 0) {
4070 			p_len += sizeof(*hmacs);
4071 			hmacs->ph.param_type = htons(SCTP_HMAC_LIST);
4072 			hmacs->ph.param_length = htons(p_len);
4073 			/* zero out any padding required */
4074 			bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len);
4075 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
4076 		}
4077 		/* add CHUNKS parameter */
4078 		chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
4079 		p_len = sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks,
4080 		    chunks->chunk_types);
4081 		if (p_len > 0) {
4082 			p_len += sizeof(*chunks);
4083 			chunks->ph.param_type = htons(SCTP_CHUNK_LIST);
4084 			chunks->ph.param_length = htons(p_len);
4085 			/* zero out any padding required */
4086 			bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len);
4087 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
4088 		}
4089 	}
4090 	m_at = m;
4091 	/* now the addresses */
4092 	{
4093 		struct sctp_scoping scp;
4094 
4095 		/*
4096 		 * To optimize this we could put the scoping stuff into a
4097 		 * structure and remove the individual uint8's from the
4098 		 * assoc structure. Then we could just sifa in the address
4099 		 * within the stcb.. but for now this is a quick hack to get
4100 		 * the address stuff teased apart.
4101 		 */
4102 		scp.ipv4_addr_legal = stcb->asoc.ipv4_addr_legal;
4103 		scp.ipv6_addr_legal = stcb->asoc.ipv6_addr_legal;
4104 		scp.loopback_scope = stcb->asoc.loopback_scope;
4105 		scp.ipv4_local_scope = stcb->asoc.ipv4_local_scope;
4106 		scp.local_scope = stcb->asoc.local_scope;
4107 		scp.site_scope = stcb->asoc.site_scope;
4108 
4109 		m_at = sctp_add_addresses_to_i_ia(inp, &scp, m_at, cnt_inits_to);
4110 	}
4111 
4112 	/* calulate the size and update pkt header and chunk header */
4113 	p_len = 0;
4114 	for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
4115 		if (SCTP_BUF_NEXT(m_at) == NULL)
4116 			mp_last = m_at;
4117 		p_len += SCTP_BUF_LEN(m_at);
4118 	}
4119 	initm->msg.ch.chunk_length = htons((p_len - sizeof(struct sctphdr)));
4120 	/*
4121 	 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return
4122 	 * here since the timer will drive a retranmission.
4123 	 */
4124 
4125 	/* I don't expect this to execute but we will be safe here */
4126 	padval = p_len % 4;
4127 	if ((padval) && (mp_last)) {
4128 		/*
4129 		 * The compiler worries that mp_last may not be set even
4130 		 * though I think it is impossible :-> however we add
4131 		 * mp_last here just in case.
4132 		 */
4133 		ret = sctp_add_pad_tombuf(mp_last, (4 - padval));
4134 		if (ret) {
4135 			/* Houston we have a problem, no space */
4136 			sctp_m_freem(m);
4137 			return;
4138 		}
4139 		p_len += padval;
4140 	}
4141 	SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n");
4142 	ret = sctp_lowlevel_chunk_output(inp, stcb, net,
4143 	    (struct sockaddr *)&net->ro._l_addr,
4144 	    m, 0, NULL, 0, 0, NULL, 0, so_locked);
4145 	SCTPDBG(SCTP_DEBUG_OUTPUT4, "lowlevel_output - %d\n", ret);
4146 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
4147 	sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
4148 	(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
4149 }
4150 
4151 struct mbuf *
4152 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
4153     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
4154 {
4155 	/*
4156 	 * Given a mbuf containing an INIT or INIT-ACK with the param_offset
4157 	 * being equal to the beginning of the params i.e. (iphlen +
4158 	 * sizeof(struct sctp_init_msg) parse through the parameters to the
4159 	 * end of the mbuf verifying that all parameters are known.
4160 	 *
4161 	 * For unknown parameters build and return a mbuf with
4162 	 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop
4163 	 * processing this chunk stop, and set *abort_processing to 1.
4164 	 *
4165 	 * By having param_offset be pre-set to where parameters begin it is
4166 	 * hoped that this routine may be reused in the future by new
4167 	 * features.
4168 	 */
4169 	struct sctp_paramhdr *phdr, params;
4170 
4171 	struct mbuf *mat, *op_err;
4172 	char tempbuf[SCTP_PARAM_BUFFER_SIZE];
4173 	int at, limit, pad_needed;
4174 	uint16_t ptype, plen, padded_size;
4175 	int err_at;
4176 
4177 	*abort_processing = 0;
4178 	mat = in_initpkt;
4179 	err_at = 0;
4180 	limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
4181 	at = param_offset;
4182 	op_err = NULL;
4183 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n");
4184 	phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
4185 	while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
4186 		ptype = ntohs(phdr->param_type);
4187 		plen = ntohs(phdr->param_length);
4188 		if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) {
4189 			/* wacked parameter */
4190 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen);
4191 			goto invalid_size;
4192 		}
4193 		limit -= SCTP_SIZE32(plen);
4194 		/*-
4195 		 * All parameters for all chunks that we know/understand are
4196 		 * listed here. We process them other places and make
4197 		 * appropriate stop actions per the upper bits. However this
4198 		 * is the generic routine processor's can call to get back
4199 		 * an operr.. to either incorporate (init-ack) or send.
4200 		 */
4201 		padded_size = SCTP_SIZE32(plen);
4202 		switch (ptype) {
4203 			/* Param's with variable size */
4204 		case SCTP_HEARTBEAT_INFO:
4205 		case SCTP_STATE_COOKIE:
4206 		case SCTP_UNRECOG_PARAM:
4207 		case SCTP_ERROR_CAUSE_IND:
4208 			/* ok skip fwd */
4209 			at += padded_size;
4210 			break;
4211 			/* Param's with variable size within a range */
4212 		case SCTP_CHUNK_LIST:
4213 		case SCTP_SUPPORTED_CHUNK_EXT:
4214 			if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) {
4215 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen);
4216 				goto invalid_size;
4217 			}
4218 			at += padded_size;
4219 			break;
4220 		case SCTP_SUPPORTED_ADDRTYPE:
4221 			if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) {
4222 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen);
4223 				goto invalid_size;
4224 			}
4225 			at += padded_size;
4226 			break;
4227 		case SCTP_RANDOM:
4228 			if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) {
4229 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen);
4230 				goto invalid_size;
4231 			}
4232 			at += padded_size;
4233 			break;
4234 		case SCTP_SET_PRIM_ADDR:
4235 		case SCTP_DEL_IP_ADDRESS:
4236 		case SCTP_ADD_IP_ADDRESS:
4237 			if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) &&
4238 			    (padded_size != sizeof(struct sctp_asconf_addr_param))) {
4239 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen);
4240 				goto invalid_size;
4241 			}
4242 			at += padded_size;
4243 			break;
4244 			/* Param's with a fixed size */
4245 		case SCTP_IPV4_ADDRESS:
4246 			if (padded_size != sizeof(struct sctp_ipv4addr_param)) {
4247 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen);
4248 				goto invalid_size;
4249 			}
4250 			at += padded_size;
4251 			break;
4252 		case SCTP_IPV6_ADDRESS:
4253 			if (padded_size != sizeof(struct sctp_ipv6addr_param)) {
4254 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen);
4255 				goto invalid_size;
4256 			}
4257 			at += padded_size;
4258 			break;
4259 		case SCTP_COOKIE_PRESERVE:
4260 			if (padded_size != sizeof(struct sctp_cookie_perserve_param)) {
4261 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen);
4262 				goto invalid_size;
4263 			}
4264 			at += padded_size;
4265 			break;
4266 		case SCTP_ECN_NONCE_SUPPORTED:
4267 		case SCTP_PRSCTP_SUPPORTED:
4268 			if (padded_size != sizeof(struct sctp_paramhdr)) {
4269 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecnnonce/prsctp %d\n", plen);
4270 				goto invalid_size;
4271 			}
4272 			at += padded_size;
4273 			break;
4274 		case SCTP_ECN_CAPABLE:
4275 			if (padded_size != sizeof(struct sctp_ecn_supported_param)) {
4276 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen);
4277 				goto invalid_size;
4278 			}
4279 			at += padded_size;
4280 			break;
4281 		case SCTP_ULP_ADAPTATION:
4282 			if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) {
4283 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen);
4284 				goto invalid_size;
4285 			}
4286 			at += padded_size;
4287 			break;
4288 		case SCTP_SUCCESS_REPORT:
4289 			if (padded_size != sizeof(struct sctp_asconf_paramhdr)) {
4290 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen);
4291 				goto invalid_size;
4292 			}
4293 			at += padded_size;
4294 			break;
4295 		case SCTP_HOSTNAME_ADDRESS:
4296 			{
4297 				/* We can NOT handle HOST NAME addresses!! */
4298 				int l_len;
4299 
4300 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n");
4301 				*abort_processing = 1;
4302 				if (op_err == NULL) {
4303 					/* Ok need to try to get a mbuf */
4304 					l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
4305 					l_len += plen;
4306 					l_len += sizeof(struct sctp_paramhdr);
4307 					op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA);
4308 					if (op_err) {
4309 						SCTP_BUF_LEN(op_err) = 0;
4310 						/*
4311 						 * pre-reserve space for ip
4312 						 * and sctp header  and
4313 						 * chunk hdr
4314 						 */
4315 						SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
4316 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
4317 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
4318 					}
4319 				}
4320 				if (op_err) {
4321 					/* If we have space */
4322 					struct sctp_paramhdr s;
4323 
4324 					if (err_at % 4) {
4325 						uint32_t cpthis = 0;
4326 
4327 						pad_needed = 4 - (err_at % 4);
4328 						m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
4329 						err_at += pad_needed;
4330 					}
4331 					s.param_type = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR);
4332 					s.param_length = htons(sizeof(s) + plen);
4333 					m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
4334 					err_at += sizeof(s);
4335 					phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen));
4336 					if (phdr == NULL) {
4337 						sctp_m_freem(op_err);
4338 						/*
4339 						 * we are out of memory but
4340 						 * we still need to have a
4341 						 * look at what to do (the
4342 						 * system is in trouble
4343 						 * though).
4344 						 */
4345 						return (NULL);
4346 					}
4347 					m_copyback(op_err, err_at, plen, (caddr_t)phdr);
4348 					err_at += plen;
4349 				}
4350 				return (op_err);
4351 				break;
4352 			}
4353 		default:
4354 			/*
4355 			 * we do not recognize the parameter figure out what
4356 			 * we do.
4357 			 */
4358 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype);
4359 			if ((ptype & 0x4000) == 0x4000) {
4360 				/* Report bit is set?? */
4361 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n");
4362 				if (op_err == NULL) {
4363 					int l_len;
4364 
4365 					/* Ok need to try to get an mbuf */
4366 					l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
4367 					l_len += plen;
4368 					l_len += sizeof(struct sctp_paramhdr);
4369 					op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA);
4370 					if (op_err) {
4371 						SCTP_BUF_LEN(op_err) = 0;
4372 						SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
4373 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
4374 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
4375 					}
4376 				}
4377 				if (op_err) {
4378 					/* If we have space */
4379 					struct sctp_paramhdr s;
4380 
4381 					if (err_at % 4) {
4382 						uint32_t cpthis = 0;
4383 
4384 						pad_needed = 4 - (err_at % 4);
4385 						m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
4386 						err_at += pad_needed;
4387 					}
4388 					s.param_type = htons(SCTP_UNRECOG_PARAM);
4389 					s.param_length = htons(sizeof(s) + plen);
4390 					m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
4391 					err_at += sizeof(s);
4392 					if (plen > sizeof(tempbuf)) {
4393 						plen = sizeof(tempbuf);
4394 					}
4395 					phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen));
4396 					if (phdr == NULL) {
4397 						sctp_m_freem(op_err);
4398 						/*
4399 						 * we are out of memory but
4400 						 * we still need to have a
4401 						 * look at what to do (the
4402 						 * system is in trouble
4403 						 * though).
4404 						 */
4405 						op_err = NULL;
4406 						goto more_processing;
4407 					}
4408 					m_copyback(op_err, err_at, plen, (caddr_t)phdr);
4409 					err_at += plen;
4410 				}
4411 			}
4412 	more_processing:
4413 			if ((ptype & 0x8000) == 0x0000) {
4414 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n");
4415 				return (op_err);
4416 			} else {
4417 				/* skip this chunk and continue processing */
4418 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n");
4419 				at += SCTP_SIZE32(plen);
4420 			}
4421 			break;
4422 
4423 		}
4424 		phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
4425 	}
4426 	return (op_err);
4427 invalid_size:
4428 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n");
4429 	*abort_processing = 1;
4430 	if ((op_err == NULL) && phdr) {
4431 		int l_len;
4432 
4433 		l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
4434 		l_len += (2 * sizeof(struct sctp_paramhdr));
4435 		op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA);
4436 		if (op_err) {
4437 			SCTP_BUF_LEN(op_err) = 0;
4438 			SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
4439 			SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
4440 			SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
4441 		}
4442 	}
4443 	if ((op_err) && phdr) {
4444 		struct sctp_paramhdr s;
4445 
4446 		if (err_at % 4) {
4447 			uint32_t cpthis = 0;
4448 
4449 			pad_needed = 4 - (err_at % 4);
4450 			m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
4451 			err_at += pad_needed;
4452 		}
4453 		s.param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
4454 		s.param_length = htons(sizeof(s) + sizeof(struct sctp_paramhdr));
4455 		m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
4456 		err_at += sizeof(s);
4457 		/* Only copy back the p-hdr that caused the issue */
4458 		m_copyback(op_err, err_at, sizeof(struct sctp_paramhdr), (caddr_t)phdr);
4459 	}
4460 	return (op_err);
4461 }
4462 
4463 static int
4464 sctp_are_there_new_addresses(struct sctp_association *asoc,
4465     struct mbuf *in_initpkt, int iphlen, int offset)
4466 {
4467 	/*
4468 	 * Given a INIT packet, look through the packet to verify that there
4469 	 * are NO new addresses. As we go through the parameters add reports
4470 	 * of any un-understood parameters that require an error.  Also we
4471 	 * must return (1) to drop the packet if we see a un-understood
4472 	 * parameter that tells us to drop the chunk.
4473 	 */
4474 	struct sockaddr_in sin4, *sa4;
4475 	struct sockaddr_in6 sin6, *sa6;
4476 	struct sockaddr *sa_touse;
4477 	struct sockaddr *sa;
4478 	struct sctp_paramhdr *phdr, params;
4479 	struct ip *iph;
4480 	struct mbuf *mat;
4481 	uint16_t ptype, plen;
4482 	int err_at;
4483 	uint8_t fnd;
4484 	struct sctp_nets *net;
4485 
4486 	memset(&sin4, 0, sizeof(sin4));
4487 	memset(&sin6, 0, sizeof(sin6));
4488 	sin4.sin_family = AF_INET;
4489 	sin4.sin_len = sizeof(sin4);
4490 	sin6.sin6_family = AF_INET6;
4491 	sin6.sin6_len = sizeof(sin6);
4492 
4493 	sa_touse = NULL;
4494 	/* First what about the src address of the pkt ? */
4495 	iph = mtod(in_initpkt, struct ip *);
4496 	if (iph->ip_v == IPVERSION) {
4497 		/* source addr is IPv4 */
4498 		sin4.sin_addr = iph->ip_src;
4499 		sa_touse = (struct sockaddr *)&sin4;
4500 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
4501 		/* source addr is IPv6 */
4502 		struct ip6_hdr *ip6h;
4503 
4504 		ip6h = mtod(in_initpkt, struct ip6_hdr *);
4505 		sin6.sin6_addr = ip6h->ip6_src;
4506 		sa_touse = (struct sockaddr *)&sin6;
4507 	} else {
4508 		return (1);
4509 	}
4510 
4511 	fnd = 0;
4512 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4513 		sa = (struct sockaddr *)&net->ro._l_addr;
4514 		if (sa->sa_family == sa_touse->sa_family) {
4515 			if (sa->sa_family == AF_INET) {
4516 				sa4 = (struct sockaddr_in *)sa;
4517 				if (sa4->sin_addr.s_addr ==
4518 				    sin4.sin_addr.s_addr) {
4519 					fnd = 1;
4520 					break;
4521 				}
4522 			} else if (sa->sa_family == AF_INET6) {
4523 				sa6 = (struct sockaddr_in6 *)sa;
4524 				if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
4525 				    &sin6.sin6_addr)) {
4526 					fnd = 1;
4527 					break;
4528 				}
4529 			}
4530 		}
4531 	}
4532 	if (fnd == 0) {
4533 		/* New address added! no need to look futher. */
4534 		return (1);
4535 	}
4536 	/* Ok so far lets munge through the rest of the packet */
4537 	mat = in_initpkt;
4538 	err_at = 0;
4539 	sa_touse = NULL;
4540 	offset += sizeof(struct sctp_init_chunk);
4541 	phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
4542 	while (phdr) {
4543 		ptype = ntohs(phdr->param_type);
4544 		plen = ntohs(phdr->param_length);
4545 		if (ptype == SCTP_IPV4_ADDRESS) {
4546 			struct sctp_ipv4addr_param *p4, p4_buf;
4547 
4548 			phdr = sctp_get_next_param(mat, offset,
4549 			    (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
4550 			if (plen != sizeof(struct sctp_ipv4addr_param) ||
4551 			    phdr == NULL) {
4552 				return (1);
4553 			}
4554 			p4 = (struct sctp_ipv4addr_param *)phdr;
4555 			sin4.sin_addr.s_addr = p4->addr;
4556 			sa_touse = (struct sockaddr *)&sin4;
4557 		} else if (ptype == SCTP_IPV6_ADDRESS) {
4558 			struct sctp_ipv6addr_param *p6, p6_buf;
4559 
4560 			phdr = sctp_get_next_param(mat, offset,
4561 			    (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
4562 			if (plen != sizeof(struct sctp_ipv6addr_param) ||
4563 			    phdr == NULL) {
4564 				return (1);
4565 			}
4566 			p6 = (struct sctp_ipv6addr_param *)phdr;
4567 			memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
4568 			    sizeof(p6->addr));
4569 			sa_touse = (struct sockaddr *)&sin4;
4570 		}
4571 		if (sa_touse) {
4572 			/* ok, sa_touse points to one to check */
4573 			fnd = 0;
4574 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4575 				sa = (struct sockaddr *)&net->ro._l_addr;
4576 				if (sa->sa_family != sa_touse->sa_family) {
4577 					continue;
4578 				}
4579 				if (sa->sa_family == AF_INET) {
4580 					sa4 = (struct sockaddr_in *)sa;
4581 					if (sa4->sin_addr.s_addr ==
4582 					    sin4.sin_addr.s_addr) {
4583 						fnd = 1;
4584 						break;
4585 					}
4586 				} else if (sa->sa_family == AF_INET6) {
4587 					sa6 = (struct sockaddr_in6 *)sa;
4588 					if (SCTP6_ARE_ADDR_EQUAL(
4589 					    &sa6->sin6_addr, &sin6.sin6_addr)) {
4590 						fnd = 1;
4591 						break;
4592 					}
4593 				}
4594 			}
4595 			if (!fnd) {
4596 				/* New addr added! no need to look further */
4597 				return (1);
4598 			}
4599 		}
4600 		offset += SCTP_SIZE32(plen);
4601 		phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
4602 	}
4603 	return (0);
4604 }
4605 
4606 /*
4607  * Given a MBUF chain that was sent into us containing an INIT. Build a
4608  * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done
4609  * a pullup to include IPv6/4header, SCTP header and initial part of INIT
4610  * message (i.e. the struct sctp_init_msg).
4611  */
4612 void
4613 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4614     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
4615     struct sctp_init_chunk *init_chk, uint32_t vrf_id, int hold_inp_lock)
4616 {
4617 	struct sctp_association *asoc;
4618 	struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *mp_last;
4619 	struct sctp_init_msg *initackm_out;
4620 	struct sctp_ecn_supported_param *ecn;
4621 	struct sctp_prsctp_supported_param *prsctp;
4622 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
4623 	struct sctp_supported_chunk_types_param *pr_supported;
4624 	struct sockaddr_storage store;
4625 	struct sockaddr_in *sin;
4626 	struct sockaddr_in6 *sin6;
4627 	sctp_route_t *ro;
4628 	struct ip *iph;
4629 	struct ip6_hdr *ip6;
4630 	struct sockaddr *to;
4631 	struct sctp_state_cookie stc;
4632 	struct sctp_nets *net = NULL;
4633 	uint8_t *signature = NULL;
4634 	int cnt_inits_to = 0;
4635 	uint16_t his_limit, i_want;
4636 	int abort_flag, padval;
4637 	int num_ext;
4638 	int p_len;
4639 	struct socket *so;
4640 
4641 	if (stcb)
4642 		asoc = &stcb->asoc;
4643 	else
4644 		asoc = NULL;
4645 	mp_last = NULL;
4646 	if ((asoc != NULL) &&
4647 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
4648 	    (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
4649 		/* new addresses, out of here in non-cookie-wait states */
4650 		/*
4651 		 * Send a ABORT, we don't add the new address error clause
4652 		 * though we even set the T bit and copy in the 0 tag.. this
4653 		 * looks no different than if no listener was present.
4654 		 */
4655 		sctp_send_abort(init_pkt, iphlen, sh, 0, NULL, vrf_id);
4656 		return;
4657 	}
4658 	abort_flag = 0;
4659 	op_err = sctp_arethere_unrecognized_parameters(init_pkt,
4660 	    (offset + sizeof(struct sctp_init_chunk)),
4661 	    &abort_flag, (struct sctp_chunkhdr *)init_chk);
4662 	if (abort_flag) {
4663 		sctp_send_abort(init_pkt, iphlen, sh,
4664 		    init_chk->init.initiate_tag, op_err, vrf_id);
4665 		return;
4666 	}
4667 	m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
4668 	if (m == NULL) {
4669 		/* No memory, INIT timer will re-attempt. */
4670 		if (op_err)
4671 			sctp_m_freem(op_err);
4672 		return;
4673 	}
4674 	SCTP_BUF_LEN(m) = sizeof(struct sctp_init_msg);
4675 
4676 	/* the time I built cookie */
4677 	(void)SCTP_GETTIME_TIMEVAL(&stc.time_entered);
4678 
4679 	/* populate any tie tags */
4680 	if (asoc != NULL) {
4681 		/* unlock before tag selections */
4682 		stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
4683 		stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
4684 		stc.cookie_life = asoc->cookie_life;
4685 		net = asoc->primary_destination;
4686 	} else {
4687 		stc.tie_tag_my_vtag = 0;
4688 		stc.tie_tag_peer_vtag = 0;
4689 		/* life I will award this cookie */
4690 		stc.cookie_life = inp->sctp_ep.def_cookie_life;
4691 	}
4692 
4693 	/* copy in the ports for later check */
4694 	stc.myport = sh->dest_port;
4695 	stc.peerport = sh->src_port;
4696 
4697 	/*
4698 	 * If we wanted to honor cookie life extentions, we would add to
4699 	 * stc.cookie_life. For now we should NOT honor any extension
4700 	 */
4701 	stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
4702 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
4703 		struct inpcb *in_inp;
4704 
4705 		/* Its a V6 socket */
4706 		in_inp = (struct inpcb *)inp;
4707 		stc.ipv6_addr_legal = 1;
4708 		/* Now look at the binding flag to see if V4 will be legal */
4709 		if (SCTP_IPV6_V6ONLY(in_inp) == 0) {
4710 			stc.ipv4_addr_legal = 1;
4711 		} else {
4712 			/* V4 addresses are NOT legal on the association */
4713 			stc.ipv4_addr_legal = 0;
4714 		}
4715 	} else {
4716 		/* Its a V4 socket, no - V6 */
4717 		stc.ipv4_addr_legal = 1;
4718 		stc.ipv6_addr_legal = 0;
4719 	}
4720 
4721 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
4722 	stc.ipv4_scope = 1;
4723 #else
4724 	stc.ipv4_scope = 0;
4725 #endif
4726 	/* now for scope setup */
4727 	memset((caddr_t)&store, 0, sizeof(store));
4728 	sin = (struct sockaddr_in *)&store;
4729 	sin6 = (struct sockaddr_in6 *)&store;
4730 	if (net == NULL) {
4731 		to = (struct sockaddr *)&store;
4732 		iph = mtod(init_pkt, struct ip *);
4733 		if (iph->ip_v == IPVERSION) {
4734 			struct sctp_ifa *addr;
4735 			sctp_route_t iproute;
4736 
4737 			sin->sin_family = AF_INET;
4738 			sin->sin_len = sizeof(struct sockaddr_in);
4739 			sin->sin_port = sh->src_port;
4740 			sin->sin_addr = iph->ip_src;
4741 			/* lookup address */
4742 			stc.address[0] = sin->sin_addr.s_addr;
4743 			stc.address[1] = 0;
4744 			stc.address[2] = 0;
4745 			stc.address[3] = 0;
4746 			stc.addr_type = SCTP_IPV4_ADDRESS;
4747 			/* local from address */
4748 			memset(&iproute, 0, sizeof(iproute));
4749 			ro = &iproute;
4750 			memcpy(&ro->ro_dst, sin, sizeof(*sin));
4751 			addr = sctp_source_address_selection(inp, NULL,
4752 			    ro, NULL, 0,
4753 			    vrf_id);
4754 			if (addr == NULL)
4755 				return;
4756 
4757 			if (ro->ro_rt) {
4758 				RTFREE(ro->ro_rt);
4759 				ro->ro_rt = NULL;
4760 			}
4761 			stc.laddress[0] = addr->address.sin.sin_addr.s_addr;
4762 			stc.laddress[1] = 0;
4763 			stc.laddress[2] = 0;
4764 			stc.laddress[3] = 0;
4765 			stc.laddr_type = SCTP_IPV4_ADDRESS;
4766 			/* scope_id is only for v6 */
4767 			stc.scope_id = 0;
4768 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
4769 			if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
4770 				stc.ipv4_scope = 1;
4771 			}
4772 #else
4773 			stc.ipv4_scope = 1;
4774 #endif				/* SCTP_DONT_DO_PRIVADDR_SCOPE */
4775 			/* Must use the address in this case */
4776 			if (sctp_is_address_on_local_host((struct sockaddr *)sin, vrf_id)) {
4777 				stc.loopback_scope = 1;
4778 				stc.ipv4_scope = 1;
4779 				stc.site_scope = 1;
4780 				stc.local_scope = 0;
4781 			}
4782 			sctp_free_ifa(addr);
4783 		} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
4784 			struct sctp_ifa *addr;
4785 			struct route_in6 iproute6;
4786 
4787 			ip6 = mtod(init_pkt, struct ip6_hdr *);
4788 			sin6->sin6_family = AF_INET6;
4789 			sin6->sin6_len = sizeof(struct sockaddr_in6);
4790 			sin6->sin6_port = sh->src_port;
4791 			sin6->sin6_addr = ip6->ip6_src;
4792 			/* lookup address */
4793 			memcpy(&stc.address, &sin6->sin6_addr,
4794 			    sizeof(struct in6_addr));
4795 			sin6->sin6_scope_id = 0;
4796 			stc.addr_type = SCTP_IPV6_ADDRESS;
4797 			stc.scope_id = 0;
4798 			if (sctp_is_address_on_local_host((struct sockaddr *)sin6, vrf_id)) {
4799 				stc.loopback_scope = 1;
4800 				stc.local_scope = 0;
4801 				stc.site_scope = 1;
4802 				stc.ipv4_scope = 1;
4803 			} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
4804 				/*
4805 				 * If the new destination is a LINK_LOCAL we
4806 				 * must have common both site and local
4807 				 * scope. Don't set local scope though since
4808 				 * we must depend on the source to be added
4809 				 * implicitly. We cannot assure just because
4810 				 * we share one link that all links are
4811 				 * common.
4812 				 */
4813 				stc.local_scope = 0;
4814 				stc.site_scope = 1;
4815 				stc.ipv4_scope = 1;
4816 				/*
4817 				 * we start counting for the private address
4818 				 * stuff at 1. since the link local we
4819 				 * source from won't show up in our scoped
4820 				 * count.
4821 				 */
4822 				cnt_inits_to = 1;
4823 				/* pull out the scope_id from incoming pkt */
4824 				/* FIX ME: does this have scope from rcvif? */
4825 				(void)sa6_recoverscope(sin6);
4826 
4827 				sa6_embedscope(sin6, ip6_use_defzone);
4828 				stc.scope_id = sin6->sin6_scope_id;
4829 			} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
4830 				/*
4831 				 * If the new destination is SITE_LOCAL then
4832 				 * we must have site scope in common.
4833 				 */
4834 				stc.site_scope = 1;
4835 			}
4836 			/* local from address */
4837 			memset(&iproute6, 0, sizeof(iproute6));
4838 			ro = (sctp_route_t *) & iproute6;
4839 			memcpy(&ro->ro_dst, sin6, sizeof(*sin6));
4840 			addr = sctp_source_address_selection(inp, NULL,
4841 			    ro, NULL, 0, vrf_id);
4842 			if (addr == NULL)
4843 				return;
4844 
4845 			if (ro->ro_rt) {
4846 				RTFREE(ro->ro_rt);
4847 				ro->ro_rt = NULL;
4848 			}
4849 			memcpy(&stc.laddress, &addr->address.sin6.sin6_addr, sizeof(struct in6_addr));
4850 			stc.laddr_type = SCTP_IPV6_ADDRESS;
4851 			sctp_free_ifa(addr);
4852 		}
4853 	} else {
4854 		/* set the scope per the existing tcb */
4855 		struct sctp_nets *lnet;
4856 
4857 		stc.loopback_scope = asoc->loopback_scope;
4858 		stc.ipv4_scope = asoc->ipv4_local_scope;
4859 		stc.site_scope = asoc->site_scope;
4860 		stc.local_scope = asoc->local_scope;
4861 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
4862 			if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
4863 				if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
4864 					/*
4865 					 * if we have a LL address, start
4866 					 * counting at 1.
4867 					 */
4868 					cnt_inits_to = 1;
4869 				}
4870 			}
4871 		}
4872 
4873 		/* use the net pointer */
4874 		to = (struct sockaddr *)&net->ro._l_addr;
4875 		if (to->sa_family == AF_INET) {
4876 			sin = (struct sockaddr_in *)to;
4877 			stc.address[0] = sin->sin_addr.s_addr;
4878 			stc.address[1] = 0;
4879 			stc.address[2] = 0;
4880 			stc.address[3] = 0;
4881 			stc.addr_type = SCTP_IPV4_ADDRESS;
4882 			if (net->src_addr_selected == 0) {
4883 				/*
4884 				 * strange case here, the INIT should have
4885 				 * did the selection.
4886 				 */
4887 				net->ro._s_addr = sctp_source_address_selection(inp,
4888 				    stcb, (sctp_route_t *) & net->ro,
4889 				    net, 0, vrf_id);
4890 				if (net->ro._s_addr == NULL)
4891 					return;
4892 
4893 				net->src_addr_selected = 1;
4894 
4895 			}
4896 			stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr;
4897 			stc.laddress[1] = 0;
4898 			stc.laddress[2] = 0;
4899 			stc.laddress[3] = 0;
4900 			stc.laddr_type = SCTP_IPV4_ADDRESS;
4901 		} else if (to->sa_family == AF_INET6) {
4902 			sin6 = (struct sockaddr_in6 *)to;
4903 			memcpy(&stc.address, &sin6->sin6_addr,
4904 			    sizeof(struct in6_addr));
4905 			stc.addr_type = SCTP_IPV6_ADDRESS;
4906 			if (net->src_addr_selected == 0) {
4907 				/*
4908 				 * strange case here, the INIT should have
4909 				 * did the selection.
4910 				 */
4911 				net->ro._s_addr = sctp_source_address_selection(inp,
4912 				    stcb, (sctp_route_t *) & net->ro,
4913 				    net, 0, vrf_id);
4914 				if (net->ro._s_addr == NULL)
4915 					return;
4916 
4917 				net->src_addr_selected = 1;
4918 			}
4919 			memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr,
4920 			    sizeof(struct in6_addr));
4921 			stc.laddr_type = SCTP_IPV6_ADDRESS;
4922 		}
4923 	}
4924 	/* Now lets put the SCTP header in place */
4925 	initackm_out = mtod(m, struct sctp_init_msg *);
4926 	initackm_out->sh.src_port = inp->sctp_lport;
4927 	initackm_out->sh.dest_port = sh->src_port;
4928 	initackm_out->sh.v_tag = init_chk->init.initiate_tag;
4929 	/* Save it off for quick ref */
4930 	stc.peers_vtag = init_chk->init.initiate_tag;
4931 	initackm_out->sh.checksum = 0;	/* calculate later */
4932 	/* who are we */
4933 	memcpy(stc.identification, SCTP_VERSION_STRING,
4934 	    min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
4935 	/* now the chunk header */
4936 	initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
4937 	initackm_out->msg.ch.chunk_flags = 0;
4938 	/* fill in later from mbuf we build */
4939 	initackm_out->msg.ch.chunk_length = 0;
4940 	/* place in my tag */
4941 	if ((asoc != NULL) &&
4942 	    ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
4943 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_INUSE) ||
4944 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
4945 		/* re-use the v-tags and init-seq here */
4946 		initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
4947 		initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
4948 	} else {
4949 		uint32_t vtag, itsn;
4950 
4951 		if (hold_inp_lock) {
4952 			SCTP_INP_INCR_REF(inp);
4953 			SCTP_INP_RUNLOCK(inp);
4954 		}
4955 		if (asoc) {
4956 			atomic_add_int(&asoc->refcnt, 1);
4957 			SCTP_TCB_UNLOCK(stcb);
4958 			vtag = sctp_select_a_tag(inp, 1);
4959 			initackm_out->msg.init.initiate_tag = htonl(vtag);
4960 			/* get a TSN to use too */
4961 			itsn = sctp_select_initial_TSN(&inp->sctp_ep);
4962 			initackm_out->msg.init.initial_tsn = htonl(itsn);
4963 			SCTP_TCB_LOCK(stcb);
4964 			atomic_add_int(&asoc->refcnt, -1);
4965 		} else {
4966 			vtag = sctp_select_a_tag(inp, 1);
4967 			initackm_out->msg.init.initiate_tag = htonl(vtag);
4968 			/* get a TSN to use too */
4969 			initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
4970 		}
4971 		if (hold_inp_lock) {
4972 			SCTP_INP_RLOCK(inp);
4973 			SCTP_INP_DECR_REF(inp);
4974 		}
4975 	}
4976 	/* save away my tag to */
4977 	stc.my_vtag = initackm_out->msg.init.initiate_tag;
4978 
4979 	/* set up some of the credits. */
4980 	so = inp->sctp_socket;
4981 	if (so == NULL) {
4982 		/* memory problem */
4983 		sctp_m_freem(m);
4984 		return;
4985 	} else {
4986 		initackm_out->msg.init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND));
4987 	}
4988 	/* set what I want */
4989 	his_limit = ntohs(init_chk->init.num_inbound_streams);
4990 	/* choose what I want */
4991 	if (asoc != NULL) {
4992 		if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
4993 			i_want = asoc->streamoutcnt;
4994 		} else {
4995 			i_want = inp->sctp_ep.pre_open_stream_count;
4996 		}
4997 	} else {
4998 		i_want = inp->sctp_ep.pre_open_stream_count;
4999 	}
5000 	if (his_limit < i_want) {
5001 		/* I Want more :< */
5002 		initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
5003 	} else {
5004 		/* I can have what I want :> */
5005 		initackm_out->msg.init.num_outbound_streams = htons(i_want);
5006 	}
5007 	/* tell him his limt. */
5008 	initackm_out->msg.init.num_inbound_streams =
5009 	    htons(inp->sctp_ep.max_open_streams_intome);
5010 	/* setup the ECN pointer */
5011 
5012 	if (inp->sctp_ep.adaptation_layer_indicator) {
5013 		struct sctp_adaptation_layer_indication *ali;
5014 
5015 		ali = (struct sctp_adaptation_layer_indication *)(
5016 		    (caddr_t)initackm_out + sizeof(*initackm_out));
5017 		ali->ph.param_type = htons(SCTP_ULP_ADAPTATION);
5018 		ali->ph.param_length = htons(sizeof(*ali));
5019 		ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator);
5020 		SCTP_BUF_LEN(m) += sizeof(*ali);
5021 		ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali +
5022 		    sizeof(*ali));
5023 	} else {
5024 		ecn = (struct sctp_ecn_supported_param *)(
5025 		    (caddr_t)initackm_out + sizeof(*initackm_out));
5026 	}
5027 
5028 	/* ECN parameter */
5029 	if (sctp_ecn_enable == 1) {
5030 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
5031 		ecn->ph.param_length = htons(sizeof(*ecn));
5032 		SCTP_BUF_LEN(m) += sizeof(*ecn);
5033 
5034 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
5035 		    sizeof(*ecn));
5036 	} else {
5037 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
5038 	}
5039 	/* And now tell the peer we do  pr-sctp */
5040 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
5041 	prsctp->ph.param_length = htons(sizeof(*prsctp));
5042 	SCTP_BUF_LEN(m) += sizeof(*prsctp);
5043 
5044 	/* And now tell the peer we do all the extensions */
5045 	pr_supported = (struct sctp_supported_chunk_types_param *)
5046 	    ((caddr_t)prsctp + sizeof(*prsctp));
5047 
5048 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
5049 	num_ext = 0;
5050 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF;
5051 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK;
5052 	pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN;
5053 	pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED;
5054 	pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET;
5055 	if (!sctp_auth_disable)
5056 		pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION;
5057 	p_len = sizeof(*pr_supported) + num_ext;
5058 	pr_supported->ph.param_length = htons(p_len);
5059 	bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len);
5060 	SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
5061 
5062 	/* ECN nonce: And now tell the peer we support ECN nonce */
5063 	if (sctp_ecn_nonce) {
5064 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)
5065 		    ((caddr_t)pr_supported + SCTP_SIZE32(p_len));
5066 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
5067 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
5068 		SCTP_BUF_LEN(m) += sizeof(*ecn_nonce);
5069 	}
5070 	/* add authentication parameters */
5071 	if (!sctp_auth_disable) {
5072 		struct sctp_auth_random *randp;
5073 		struct sctp_auth_hmac_algo *hmacs;
5074 		struct sctp_auth_chunk_list *chunks;
5075 		uint16_t random_len;
5076 
5077 		/* generate and add RANDOM parameter */
5078 		random_len = SCTP_AUTH_RANDOM_SIZE_DEFAULT;
5079 		randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
5080 		randp->ph.param_type = htons(SCTP_RANDOM);
5081 		p_len = sizeof(*randp) + random_len;
5082 		randp->ph.param_length = htons(p_len);
5083 		SCTP_READ_RANDOM(randp->random_data, random_len);
5084 		/* zero out any padding required */
5085 		bzero((caddr_t)randp + p_len, SCTP_SIZE32(p_len) - p_len);
5086 		SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
5087 
5088 		/* add HMAC_ALGO parameter */
5089 		hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
5090 		p_len = sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs,
5091 		    (uint8_t *) hmacs->hmac_ids);
5092 		if (p_len > 0) {
5093 			p_len += sizeof(*hmacs);
5094 			hmacs->ph.param_type = htons(SCTP_HMAC_LIST);
5095 			hmacs->ph.param_length = htons(p_len);
5096 			/* zero out any padding required */
5097 			bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len);
5098 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
5099 		}
5100 		/* add CHUNKS parameter */
5101 		chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
5102 		p_len = sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks,
5103 		    chunks->chunk_types);
5104 		if (p_len > 0) {
5105 			p_len += sizeof(*chunks);
5106 			chunks->ph.param_type = htons(SCTP_CHUNK_LIST);
5107 			chunks->ph.param_length = htons(p_len);
5108 			/* zero out any padding required */
5109 			bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len);
5110 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
5111 		}
5112 	}
5113 	m_at = m;
5114 	/* now the addresses */
5115 	{
5116 		struct sctp_scoping scp;
5117 
5118 		/*
5119 		 * To optimize this we could put the scoping stuff into a
5120 		 * structure and remove the individual uint8's from the stc
5121 		 * structure. Then we could just sifa in the address within
5122 		 * the stc.. but for now this is a quick hack to get the
5123 		 * address stuff teased apart.
5124 		 */
5125 		scp.ipv4_addr_legal = stc.ipv4_addr_legal;
5126 		scp.ipv6_addr_legal = stc.ipv6_addr_legal;
5127 		scp.loopback_scope = stc.loopback_scope;
5128 		scp.ipv4_local_scope = stc.ipv4_scope;
5129 		scp.local_scope = stc.local_scope;
5130 		scp.site_scope = stc.site_scope;
5131 		m_at = sctp_add_addresses_to_i_ia(inp, &scp, m_at, cnt_inits_to);
5132 	}
5133 
5134 	/* tack on the operational error if present */
5135 	if (op_err) {
5136 		struct mbuf *ol;
5137 		int llen;
5138 
5139 		llen = 0;
5140 		ol = op_err;
5141 		while (ol) {
5142 			llen += SCTP_BUF_LEN(ol);
5143 			ol = SCTP_BUF_NEXT(ol);
5144 		}
5145 		if (llen % 4) {
5146 			/* must add a pad to the param */
5147 			uint32_t cpthis = 0;
5148 			int padlen;
5149 
5150 			padlen = 4 - (llen % 4);
5151 			m_copyback(op_err, llen, padlen, (caddr_t)&cpthis);
5152 		}
5153 		while (SCTP_BUF_NEXT(m_at) != NULL) {
5154 			m_at = SCTP_BUF_NEXT(m_at);
5155 		}
5156 		SCTP_BUF_NEXT(m_at) = op_err;
5157 		while (SCTP_BUF_NEXT(m_at) != NULL) {
5158 			m_at = SCTP_BUF_NEXT(m_at);
5159 		}
5160 	}
5161 	/* pre-calulate the size and update pkt header and chunk header */
5162 	p_len = 0;
5163 	for (m_tmp = m; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) {
5164 		p_len += SCTP_BUF_LEN(m_tmp);
5165 		if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5166 			/* m_tmp should now point to last one */
5167 			break;
5168 		}
5169 	}
5170 
5171 	/* Now we must build a cookie */
5172 	m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
5173 	    sizeof(struct sctphdr), &stc, &signature);
5174 	if (m_cookie == NULL) {
5175 		/* memory problem */
5176 		sctp_m_freem(m);
5177 		return;
5178 	}
5179 	/* Now append the cookie to the end and update the space/size */
5180 	SCTP_BUF_NEXT(m_tmp) = m_cookie;
5181 
5182 	for (m_tmp = m_cookie; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) {
5183 		p_len += SCTP_BUF_LEN(m_tmp);
5184 		if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5185 			/* m_tmp should now point to last one */
5186 			mp_last = m_tmp;
5187 			break;
5188 		}
5189 	}
5190 	/*
5191 	 * Place in the size, but we don't include the last pad (if any) in
5192 	 * the INIT-ACK.
5193 	 */
5194 	initackm_out->msg.ch.chunk_length = htons((p_len - sizeof(struct sctphdr)));
5195 
5196 	/*
5197 	 * Time to sign the cookie, we don't sign over the cookie signature
5198 	 * though thus we set trailer.
5199 	 */
5200 	(void)sctp_hmac_m(SCTP_HMAC,
5201 	    (uint8_t *) inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)],
5202 	    SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr),
5203 	    (uint8_t *) signature, SCTP_SIGNATURE_SIZE);
5204 	/*
5205 	 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return
5206 	 * here since the timer will drive a retranmission.
5207 	 */
5208 	padval = p_len % 4;
5209 	if ((padval) && (mp_last)) {
5210 		/* see my previous comments on mp_last */
5211 		int ret;
5212 
5213 		ret = sctp_add_pad_tombuf(mp_last, (4 - padval));
5214 		if (ret) {
5215 			/* Houston we have a problem, no space */
5216 			sctp_m_freem(m);
5217 			return;
5218 		}
5219 		p_len += padval;
5220 	}
5221 	(void)sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0,
5222 	    NULL, 0, SCTP_SO_NOT_LOCKED);
5223 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
5224 }
5225 
5226 
5227 void
5228 sctp_insert_on_wheel(struct sctp_tcb *stcb,
5229     struct sctp_association *asoc,
5230     struct sctp_stream_out *strq, int holds_lock)
5231 {
5232 	struct sctp_stream_out *stre, *strn;
5233 
5234 	if (holds_lock == 0) {
5235 		SCTP_TCB_SEND_LOCK(stcb);
5236 	}
5237 	if ((strq->next_spoke.tqe_next) ||
5238 	    (strq->next_spoke.tqe_prev)) {
5239 		/* already on wheel */
5240 		goto outof_here;
5241 	}
5242 	stre = TAILQ_FIRST(&asoc->out_wheel);
5243 	if (stre == NULL) {
5244 		/* only one on wheel */
5245 		TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
5246 		goto outof_here;
5247 	}
5248 	for (; stre; stre = strn) {
5249 		strn = TAILQ_NEXT(stre, next_spoke);
5250 		if (stre->stream_no > strq->stream_no) {
5251 			TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
5252 			goto outof_here;
5253 		} else if (stre->stream_no == strq->stream_no) {
5254 			/* huh, should not happen */
5255 			goto outof_here;
5256 		} else if (strn == NULL) {
5257 			/* next one is null */
5258 			TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
5259 			    next_spoke);
5260 		}
5261 	}
5262 outof_here:
5263 	if (holds_lock == 0) {
5264 		SCTP_TCB_SEND_UNLOCK(stcb);
5265 	}
5266 }
5267 
5268 static void
5269 sctp_remove_from_wheel(struct sctp_tcb *stcb,
5270     struct sctp_association *asoc,
5271     struct sctp_stream_out *strq)
5272 {
5273 	/* take off and then setup so we know it is not on the wheel */
5274 	SCTP_TCB_SEND_LOCK(stcb);
5275 	if (TAILQ_FIRST(&strq->outqueue)) {
5276 		/* more was added */
5277 		SCTP_TCB_SEND_UNLOCK(stcb);
5278 		return;
5279 	}
5280 	TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
5281 	strq->next_spoke.tqe_next = NULL;
5282 	strq->next_spoke.tqe_prev = NULL;
5283 	SCTP_TCB_SEND_UNLOCK(stcb);
5284 }
5285 
5286 static void
5287 sctp_prune_prsctp(struct sctp_tcb *stcb,
5288     struct sctp_association *asoc,
5289     struct sctp_sndrcvinfo *srcv,
5290     int dataout)
5291 {
5292 	int freed_spc = 0;
5293 	struct sctp_tmit_chunk *chk, *nchk;
5294 
5295 	SCTP_TCB_LOCK_ASSERT(stcb);
5296 	if ((asoc->peer_supports_prsctp) &&
5297 	    (asoc->sent_queue_cnt_removeable > 0)) {
5298 		TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
5299 			/*
5300 			 * Look for chunks marked with the PR_SCTP flag AND
5301 			 * the buffer space flag. If the one being sent is
5302 			 * equal or greater priority then purge the old one
5303 			 * and free some space.
5304 			 */
5305 			if (PR_SCTP_BUF_ENABLED(chk->flags)) {
5306 				/*
5307 				 * This one is PR-SCTP AND buffer space
5308 				 * limited type
5309 				 */
5310 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
5311 					/*
5312 					 * Lower numbers equates to higher
5313 					 * priority so if the one we are
5314 					 * looking at has a larger or equal
5315 					 * priority we want to drop the data
5316 					 * and NOT retransmit it.
5317 					 */
5318 					if (chk->data) {
5319 						/*
5320 						 * We release the book_size
5321 						 * if the mbuf is here
5322 						 */
5323 						int ret_spc;
5324 						int cause;
5325 
5326 						if (chk->sent > SCTP_DATAGRAM_UNSENT)
5327 							cause = SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT;
5328 						else
5329 							cause = SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_UNSENT;
5330 						ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
5331 						    cause,
5332 						    &asoc->sent_queue, SCTP_SO_LOCKED);
5333 						freed_spc += ret_spc;
5334 						if (freed_spc >= dataout) {
5335 							return;
5336 						}
5337 					}	/* if chunk was present */
5338 				}	/* if of sufficent priority */
5339 			}	/* if chunk has enabled */
5340 		}		/* tailqforeach */
5341 
5342 		chk = TAILQ_FIRST(&asoc->send_queue);
5343 		while (chk) {
5344 			nchk = TAILQ_NEXT(chk, sctp_next);
5345 			/* Here we must move to the sent queue and mark */
5346 			if (PR_SCTP_TTL_ENABLED(chk->flags)) {
5347 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
5348 					if (chk->data) {
5349 						/*
5350 						 * We release the book_size
5351 						 * if the mbuf is here
5352 						 */
5353 						int ret_spc;
5354 
5355 						ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
5356 						    SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_UNSENT,
5357 						    &asoc->send_queue, SCTP_SO_LOCKED);
5358 
5359 						freed_spc += ret_spc;
5360 						if (freed_spc >= dataout) {
5361 							return;
5362 						}
5363 					}	/* end if chk->data */
5364 				}	/* end if right class */
5365 			}	/* end if chk pr-sctp */
5366 			chk = nchk;
5367 		}		/* end while (chk) */
5368 	}			/* if enabled in asoc */
5369 }
5370 
5371 int
5372 sctp_get_frag_point(struct sctp_tcb *stcb,
5373     struct sctp_association *asoc)
5374 {
5375 	int siz, ovh;
5376 
5377 	/*
5378 	 * For endpoints that have both v6 and v4 addresses we must reserve
5379 	 * room for the ipv6 header, for those that are only dealing with V4
5380 	 * we use a larger frag point.
5381 	 */
5382 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
5383 		ovh = SCTP_MED_OVERHEAD;
5384 	} else {
5385 		ovh = SCTP_MED_V4_OVERHEAD;
5386 	}
5387 
5388 	if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu)
5389 		siz = asoc->smallest_mtu - ovh;
5390 	else
5391 		siz = (stcb->asoc.sctp_frag_point - ovh);
5392 	/*
5393 	 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) {
5394 	 */
5395 	/* A data chunk MUST fit in a cluster */
5396 	/* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */
5397 	/* } */
5398 
5399 	/* adjust for an AUTH chunk if DATA requires auth */
5400 	if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks))
5401 		siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
5402 
5403 	if (siz % 4) {
5404 		/* make it an even word boundary please */
5405 		siz -= (siz % 4);
5406 	}
5407 	return (siz);
5408 }
5409 
5410 static void
5411 sctp_set_prsctp_policy(struct sctp_tcb *stcb,
5412     struct sctp_stream_queue_pending *sp)
5413 {
5414 	sp->pr_sctp_on = 0;
5415 	if (stcb->asoc.peer_supports_prsctp) {
5416 		/*
5417 		 * We assume that the user wants PR_SCTP_TTL if the user
5418 		 * provides a positive lifetime but does not specify any
5419 		 * PR_SCTP policy. This is a BAD assumption and causes
5420 		 * problems at least with the U-Vancovers MPI folks. I will
5421 		 * change this to be no policy means NO PR-SCTP.
5422 		 */
5423 		if (PR_SCTP_ENABLED(sp->sinfo_flags)) {
5424 			sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags);
5425 			sp->pr_sctp_on = 1;
5426 		} else {
5427 			return;
5428 		}
5429 		switch (PR_SCTP_POLICY(sp->sinfo_flags)) {
5430 		case CHUNK_FLAGS_PR_SCTP_BUF:
5431 			/*
5432 			 * Time to live is a priority stored in tv_sec when
5433 			 * doing the buffer drop thing.
5434 			 */
5435 			sp->ts.tv_sec = sp->timetolive;
5436 			sp->ts.tv_usec = 0;
5437 			break;
5438 		case CHUNK_FLAGS_PR_SCTP_TTL:
5439 			{
5440 				struct timeval tv;
5441 
5442 				(void)SCTP_GETTIME_TIMEVAL(&sp->ts);
5443 				tv.tv_sec = sp->timetolive / 1000;
5444 				tv.tv_usec = (sp->timetolive * 1000) % 1000000;
5445 				timevaladd(&sp->ts, &tv);
5446 			}
5447 			break;
5448 		case CHUNK_FLAGS_PR_SCTP_RTX:
5449 			/*
5450 			 * Time to live is a the number or retransmissions
5451 			 * stored in tv_sec.
5452 			 */
5453 			sp->ts.tv_sec = sp->timetolive;
5454 			sp->ts.tv_usec = 0;
5455 			break;
5456 		default:
5457 			SCTPDBG(SCTP_DEBUG_USRREQ1,
5458 			    "Unknown PR_SCTP policy %u.\n",
5459 			    PR_SCTP_POLICY(sp->sinfo_flags));
5460 			break;
5461 		}
5462 	}
5463 }
5464 
5465 static int
5466 sctp_msg_append(struct sctp_tcb *stcb,
5467     struct sctp_nets *net,
5468     struct mbuf *m,
5469     struct sctp_sndrcvinfo *srcv, int hold_stcb_lock)
5470 {
5471 	int error = 0, holds_lock;
5472 	struct mbuf *at;
5473 	struct sctp_stream_queue_pending *sp = NULL;
5474 	struct sctp_stream_out *strm;
5475 
5476 	/*
5477 	 * Given an mbuf chain, put it into the association send queue and
5478 	 * place it on the wheel
5479 	 */
5480 	holds_lock = hold_stcb_lock;
5481 	if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) {
5482 		/* Invalid stream number */
5483 		SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
5484 		error = EINVAL;
5485 		goto out_now;
5486 	}
5487 	if ((stcb->asoc.stream_locked) &&
5488 	    (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) {
5489 		SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
5490 		error = EINVAL;
5491 		goto out_now;
5492 	}
5493 	strm = &stcb->asoc.strmout[srcv->sinfo_stream];
5494 	/* Now can we send this? */
5495 	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
5496 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5497 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
5498 	    (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) {
5499 		/* got data while shutting down */
5500 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
5501 		error = ECONNRESET;
5502 		goto out_now;
5503 	}
5504 	sctp_alloc_a_strmoq(stcb, sp);
5505 	if (sp == NULL) {
5506 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
5507 		error = ENOMEM;
5508 		goto out_now;
5509 	}
5510 	sp->sinfo_flags = srcv->sinfo_flags;
5511 	sp->timetolive = srcv->sinfo_timetolive;
5512 	sp->ppid = srcv->sinfo_ppid;
5513 	sp->context = srcv->sinfo_context;
5514 	sp->strseq = 0;
5515 	if (sp->sinfo_flags & SCTP_ADDR_OVER) {
5516 		sp->net = net;
5517 		sp->addr_over = 1;
5518 	} else {
5519 		sp->net = stcb->asoc.primary_destination;
5520 		sp->addr_over = 0;
5521 	}
5522 	atomic_add_int(&sp->net->ref_count, 1);
5523 	(void)SCTP_GETTIME_TIMEVAL(&sp->ts);
5524 	sp->stream = srcv->sinfo_stream;
5525 	sp->msg_is_complete = 1;
5526 	sp->sender_all_done = 1;
5527 	sp->some_taken = 0;
5528 	sp->data = m;
5529 	sp->tail_mbuf = NULL;
5530 	sp->length = 0;
5531 	at = m;
5532 	sctp_set_prsctp_policy(stcb, sp);
5533 	/*
5534 	 * We could in theory (for sendall) sifa the length in, but we would
5535 	 * still have to hunt through the chain since we need to setup the
5536 	 * tail_mbuf
5537 	 */
5538 	while (at) {
5539 		if (SCTP_BUF_NEXT(at) == NULL)
5540 			sp->tail_mbuf = at;
5541 		sp->length += SCTP_BUF_LEN(at);
5542 		at = SCTP_BUF_NEXT(at);
5543 	}
5544 	SCTP_TCB_SEND_LOCK(stcb);
5545 	sctp_snd_sb_alloc(stcb, sp->length);
5546 	atomic_add_int(&stcb->asoc.stream_queue_cnt, 1);
5547 	TAILQ_INSERT_TAIL(&strm->outqueue, sp, next);
5548 	if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
5549 		sp->strseq = strm->next_sequence_sent;
5550 		strm->next_sequence_sent++;
5551 	}
5552 	if ((strm->next_spoke.tqe_next == NULL) &&
5553 	    (strm->next_spoke.tqe_prev == NULL)) {
5554 		/* Not on wheel, insert */
5555 		sctp_insert_on_wheel(stcb, &stcb->asoc, strm, 1);
5556 	}
5557 	m = NULL;
5558 	SCTP_TCB_SEND_UNLOCK(stcb);
5559 out_now:
5560 	if (m) {
5561 		sctp_m_freem(m);
5562 	}
5563 	return (error);
5564 }
5565 
5566 
5567 static struct mbuf *
5568 sctp_copy_mbufchain(struct mbuf *clonechain,
5569     struct mbuf *outchain,
5570     struct mbuf **endofchain,
5571     int can_take_mbuf,
5572     int sizeofcpy,
5573     uint8_t copy_by_ref)
5574 {
5575 	struct mbuf *m;
5576 	struct mbuf *appendchain;
5577 	caddr_t cp;
5578 	int len;
5579 
5580 	if (endofchain == NULL) {
5581 		/* error */
5582 error_out:
5583 		if (outchain)
5584 			sctp_m_freem(outchain);
5585 		return (NULL);
5586 	}
5587 	if (can_take_mbuf) {
5588 		appendchain = clonechain;
5589 	} else {
5590 		if (!copy_by_ref &&
5591 		    (sizeofcpy <= (int)((((sctp_mbuf_threshold_count - 1) * MLEN) + MHLEN)))
5592 		    ) {
5593 			/* Its not in a cluster */
5594 			if (*endofchain == NULL) {
5595 				/* lets get a mbuf cluster */
5596 				if (outchain == NULL) {
5597 					/* This is the general case */
5598 			new_mbuf:
5599 					outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER);
5600 					if (outchain == NULL) {
5601 						goto error_out;
5602 					}
5603 					SCTP_BUF_LEN(outchain) = 0;
5604 					*endofchain = outchain;
5605 					/* get the prepend space */
5606 					SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4));
5607 				} else {
5608 					/*
5609 					 * We really should not get a NULL
5610 					 * in endofchain
5611 					 */
5612 					/* find end */
5613 					m = outchain;
5614 					while (m) {
5615 						if (SCTP_BUF_NEXT(m) == NULL) {
5616 							*endofchain = m;
5617 							break;
5618 						}
5619 						m = SCTP_BUF_NEXT(m);
5620 					}
5621 					/* sanity */
5622 					if (*endofchain == NULL) {
5623 						/*
5624 						 * huh, TSNH XXX maybe we
5625 						 * should panic
5626 						 */
5627 						sctp_m_freem(outchain);
5628 						goto new_mbuf;
5629 					}
5630 				}
5631 				/* get the new end of length */
5632 				len = M_TRAILINGSPACE(*endofchain);
5633 			} else {
5634 				/* how much is left at the end? */
5635 				len = M_TRAILINGSPACE(*endofchain);
5636 			}
5637 			/* Find the end of the data, for appending */
5638 			cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain)));
5639 
5640 			/* Now lets copy it out */
5641 			if (len >= sizeofcpy) {
5642 				/* It all fits, copy it in */
5643 				m_copydata(clonechain, 0, sizeofcpy, cp);
5644 				SCTP_BUF_LEN((*endofchain)) += sizeofcpy;
5645 			} else {
5646 				/* fill up the end of the chain */
5647 				if (len > 0) {
5648 					m_copydata(clonechain, 0, len, cp);
5649 					SCTP_BUF_LEN((*endofchain)) += len;
5650 					/* now we need another one */
5651 					sizeofcpy -= len;
5652 				}
5653 				m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER);
5654 				if (m == NULL) {
5655 					/* We failed */
5656 					goto error_out;
5657 				}
5658 				SCTP_BUF_NEXT((*endofchain)) = m;
5659 				*endofchain = m;
5660 				cp = mtod((*endofchain), caddr_t);
5661 				m_copydata(clonechain, len, sizeofcpy, cp);
5662 				SCTP_BUF_LEN((*endofchain)) += sizeofcpy;
5663 			}
5664 			return (outchain);
5665 		} else {
5666 			/* copy the old fashion way */
5667 			appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_DONTWAIT);
5668 		}
5669 	}
5670 	if (appendchain == NULL) {
5671 		/* error */
5672 		if (outchain)
5673 			sctp_m_freem(outchain);
5674 		return (NULL);
5675 	}
5676 	if (outchain) {
5677 		/* tack on to the end */
5678 		if (*endofchain != NULL) {
5679 			SCTP_BUF_NEXT(((*endofchain))) = appendchain;
5680 		} else {
5681 			m = outchain;
5682 			while (m) {
5683 				if (SCTP_BUF_NEXT(m) == NULL) {
5684 					SCTP_BUF_NEXT(m) = appendchain;
5685 					break;
5686 				}
5687 				m = SCTP_BUF_NEXT(m);
5688 			}
5689 		}
5690 		/*
5691 		 * save off the end and update the end-chain postion
5692 		 */
5693 		m = appendchain;
5694 		while (m) {
5695 			if (SCTP_BUF_NEXT(m) == NULL) {
5696 				*endofchain = m;
5697 				break;
5698 			}
5699 			m = SCTP_BUF_NEXT(m);
5700 		}
5701 		return (outchain);
5702 	} else {
5703 		/* save off the end and update the end-chain postion */
5704 		m = appendchain;
5705 		while (m) {
5706 			if (SCTP_BUF_NEXT(m) == NULL) {
5707 				*endofchain = m;
5708 				break;
5709 			}
5710 			m = SCTP_BUF_NEXT(m);
5711 		}
5712 		return (appendchain);
5713 	}
5714 }
5715 
5716 int
5717 sctp_med_chunk_output(struct sctp_inpcb *inp,
5718     struct sctp_tcb *stcb,
5719     struct sctp_association *asoc,
5720     int *num_out,
5721     int *reason_code,
5722     int control_only, int *cwnd_full, int from_where,
5723     struct timeval *now, int *now_filled, int frag_point, int so_locked
5724 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
5725     SCTP_UNUSED
5726 #endif
5727 );
5728 
5729 static void
5730 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr,
5731     uint32_t val)
5732 {
5733 	struct sctp_copy_all *ca;
5734 	struct mbuf *m;
5735 	int ret = 0;
5736 	int added_control = 0;
5737 	int un_sent, do_chunk_output = 1;
5738 	struct sctp_association *asoc;
5739 
5740 	ca = (struct sctp_copy_all *)ptr;
5741 	if (ca->m == NULL) {
5742 		return;
5743 	}
5744 	if (ca->inp != inp) {
5745 		/* TSNH */
5746 		return;
5747 	}
5748 	if ((ca->m) && ca->sndlen) {
5749 		m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_DONTWAIT);
5750 		if (m == NULL) {
5751 			/* can't copy so we are done */
5752 			ca->cnt_failed++;
5753 			return;
5754 		}
5755 	} else {
5756 		m = NULL;
5757 	}
5758 	SCTP_TCB_LOCK_ASSERT(stcb);
5759 	if (ca->sndrcv.sinfo_flags & SCTP_ABORT) {
5760 		/* Abort this assoc with m as the user defined reason */
5761 		if (m) {
5762 			struct sctp_paramhdr *ph;
5763 
5764 			SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT);
5765 			if (m) {
5766 				ph = mtod(m, struct sctp_paramhdr *);
5767 				ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
5768 				ph->param_length = htons(ca->sndlen);
5769 			}
5770 			/*
5771 			 * We add one here to keep the assoc from
5772 			 * dis-appearing on us.
5773 			 */
5774 			atomic_add_int(&stcb->asoc.refcnt, 1);
5775 			sctp_abort_an_association(inp, stcb,
5776 			    SCTP_RESPONSE_TO_USER_REQ,
5777 			    m, SCTP_SO_NOT_LOCKED);
5778 			/*
5779 			 * sctp_abort_an_association calls sctp_free_asoc()
5780 			 * free association will NOT free it since we
5781 			 * incremented the refcnt .. we do this to prevent
5782 			 * it being freed and things getting tricky since we
5783 			 * could end up (from free_asoc) calling inpcb_free
5784 			 * which would get a recursive lock call to the
5785 			 * iterator lock.. But as a consequence of that the
5786 			 * stcb will return to us un-locked.. since
5787 			 * free_asoc returns with either no TCB or the TCB
5788 			 * unlocked, we must relock.. to unlock in the
5789 			 * iterator timer :-0
5790 			 */
5791 			SCTP_TCB_LOCK(stcb);
5792 			atomic_add_int(&stcb->asoc.refcnt, -1);
5793 			goto no_chunk_output;
5794 		}
5795 	} else {
5796 		if (m) {
5797 			ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
5798 			    &ca->sndrcv, 1);
5799 		}
5800 		asoc = &stcb->asoc;
5801 		if (ca->sndrcv.sinfo_flags & SCTP_EOF) {
5802 			/* shutdown this assoc */
5803 			int cnt;
5804 
5805 			cnt = sctp_is_there_unsent_data(stcb);
5806 
5807 			if (TAILQ_EMPTY(&asoc->send_queue) &&
5808 			    TAILQ_EMPTY(&asoc->sent_queue) &&
5809 			    (cnt == 0)) {
5810 				if (asoc->locked_on_sending) {
5811 					goto abort_anyway;
5812 				}
5813 				/*
5814 				 * there is nothing queued to send, so I'm
5815 				 * done...
5816 				 */
5817 				if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
5818 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
5819 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5820 					/*
5821 					 * only send SHUTDOWN the first time
5822 					 * through
5823 					 */
5824 					sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
5825 					if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
5826 						SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5827 					}
5828 					SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
5829 					SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
5830 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
5831 					    asoc->primary_destination);
5832 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
5833 					    asoc->primary_destination);
5834 					added_control = 1;
5835 					do_chunk_output = 0;
5836 				}
5837 			} else {
5838 				/*
5839 				 * we still got (or just got) data to send,
5840 				 * so set SHUTDOWN_PENDING
5841 				 */
5842 				/*
5843 				 * XXX sockets draft says that SCTP_EOF
5844 				 * should be sent with no data.  currently,
5845 				 * we will allow user data to be sent first
5846 				 * and move to SHUTDOWN-PENDING
5847 				 */
5848 				if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
5849 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
5850 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5851 					if (asoc->locked_on_sending) {
5852 						/*
5853 						 * Locked to send out the
5854 						 * data
5855 						 */
5856 						struct sctp_stream_queue_pending *sp;
5857 
5858 						sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead);
5859 						if (sp) {
5860 							if ((sp->length == 0) && (sp->msg_is_complete == 0))
5861 								asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
5862 						}
5863 					}
5864 					asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
5865 					if (TAILQ_EMPTY(&asoc->send_queue) &&
5866 					    TAILQ_EMPTY(&asoc->sent_queue) &&
5867 					    (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
5868 				abort_anyway:
5869 						atomic_add_int(&stcb->asoc.refcnt, 1);
5870 						sctp_abort_an_association(stcb->sctp_ep, stcb,
5871 						    SCTP_RESPONSE_TO_USER_REQ,
5872 						    NULL, SCTP_SO_NOT_LOCKED);
5873 						atomic_add_int(&stcb->asoc.refcnt, -1);
5874 						goto no_chunk_output;
5875 					}
5876 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
5877 					    asoc->primary_destination);
5878 				}
5879 			}
5880 
5881 		}
5882 	}
5883 	un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
5884 	    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)));
5885 
5886 	if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) &&
5887 	    (stcb->asoc.total_flight > 0) &&
5888 	    (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))
5889 	    ) {
5890 		do_chunk_output = 0;
5891 	}
5892 	if (do_chunk_output)
5893 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED);
5894 	else if (added_control) {
5895 		int num_out = 0, reason = 0, cwnd_full = 0, now_filled = 0;
5896 		struct timeval now;
5897 		int frag_point;
5898 
5899 		frag_point = sctp_get_frag_point(stcb, &stcb->asoc);
5900 		(void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
5901 		    &reason, 1, &cwnd_full, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED);
5902 	}
5903 no_chunk_output:
5904 	if (ret) {
5905 		ca->cnt_failed++;
5906 	} else {
5907 		ca->cnt_sent++;
5908 	}
5909 }
5910 
5911 static void
5912 sctp_sendall_completes(void *ptr, uint32_t val)
5913 {
5914 	struct sctp_copy_all *ca;
5915 
5916 	ca = (struct sctp_copy_all *)ptr;
5917 	/*
5918 	 * Do a notify here? Kacheong suggests that the notify be done at
5919 	 * the send time.. so you would push up a notification if any send
5920 	 * failed. Don't know if this is feasable since the only failures we
5921 	 * have is "memory" related and if you cannot get an mbuf to send
5922 	 * the data you surely can't get an mbuf to send up to notify the
5923 	 * user you can't send the data :->
5924 	 */
5925 
5926 	/* now free everything */
5927 	sctp_m_freem(ca->m);
5928 	SCTP_FREE(ca, SCTP_M_COPYAL);
5929 }
5930 
5931 
5932 #define	MC_ALIGN(m, len) do {						\
5933 	SCTP_BUF_RESV_UF(m, ((MCLBYTES - (len)) & ~(sizeof(long) - 1));	\
5934 } while (0)
5935 
5936 
5937 
5938 static struct mbuf *
5939 sctp_copy_out_all(struct uio *uio, int len)
5940 {
5941 	struct mbuf *ret, *at;
5942 	int left, willcpy, cancpy, error;
5943 
5944 	ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAIT, 1, MT_DATA);
5945 	if (ret == NULL) {
5946 		/* TSNH */
5947 		return (NULL);
5948 	}
5949 	left = len;
5950 	SCTP_BUF_LEN(ret) = 0;
5951 	/* save space for the data chunk header */
5952 	cancpy = M_TRAILINGSPACE(ret);
5953 	willcpy = min(cancpy, left);
5954 	at = ret;
5955 	while (left > 0) {
5956 		/* Align data to the end */
5957 		error = uiomove(mtod(at, caddr_t), willcpy, uio);
5958 		if (error) {
5959 	err_out_now:
5960 			sctp_m_freem(at);
5961 			return (NULL);
5962 		}
5963 		SCTP_BUF_LEN(at) = willcpy;
5964 		SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0;
5965 		left -= willcpy;
5966 		if (left > 0) {
5967 			SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 1, MT_DATA);
5968 			if (SCTP_BUF_NEXT(at) == NULL) {
5969 				goto err_out_now;
5970 			}
5971 			at = SCTP_BUF_NEXT(at);
5972 			SCTP_BUF_LEN(at) = 0;
5973 			cancpy = M_TRAILINGSPACE(at);
5974 			willcpy = min(cancpy, left);
5975 		}
5976 	}
5977 	return (ret);
5978 }
5979 
5980 static int
5981 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m,
5982     struct sctp_sndrcvinfo *srcv)
5983 {
5984 	int ret;
5985 	struct sctp_copy_all *ca;
5986 
5987 	SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all),
5988 	    SCTP_M_COPYAL);
5989 	if (ca == NULL) {
5990 		sctp_m_freem(m);
5991 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
5992 		return (ENOMEM);
5993 	}
5994 	memset(ca, 0, sizeof(struct sctp_copy_all));
5995 
5996 	ca->inp = inp;
5997 	memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo));
5998 	/*
5999 	 * take off the sendall flag, it would be bad if we failed to do
6000 	 * this :-0
6001 	 */
6002 	ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL;
6003 	/* get length and mbuf chain */
6004 	if (uio) {
6005 		ca->sndlen = uio->uio_resid;
6006 		ca->m = sctp_copy_out_all(uio, ca->sndlen);
6007 		if (ca->m == NULL) {
6008 			SCTP_FREE(ca, SCTP_M_COPYAL);
6009 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
6010 			return (ENOMEM);
6011 		}
6012 	} else {
6013 		/* Gather the length of the send */
6014 		struct mbuf *mat;
6015 
6016 		mat = m;
6017 		ca->sndlen = 0;
6018 		while (m) {
6019 			ca->sndlen += SCTP_BUF_LEN(m);
6020 			m = SCTP_BUF_NEXT(m);
6021 		}
6022 		ca->m = mat;
6023 	}
6024 	ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL,
6025 	    SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES,
6026 	    SCTP_ASOC_ANY_STATE,
6027 	    (void *)ca, 0,
6028 	    sctp_sendall_completes, inp, 1);
6029 	if (ret) {
6030 		SCTP_PRINTF("Failed to initiate iterator for sendall\n");
6031 		SCTP_FREE(ca, SCTP_M_COPYAL);
6032 		SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
6033 		return (EFAULT);
6034 	}
6035 	return (0);
6036 }
6037 
6038 
6039 void
6040 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc)
6041 {
6042 	struct sctp_tmit_chunk *chk, *nchk;
6043 
6044 	chk = TAILQ_FIRST(&asoc->control_send_queue);
6045 	while (chk) {
6046 		nchk = TAILQ_NEXT(chk, sctp_next);
6047 		if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
6048 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
6049 			if (chk->data) {
6050 				sctp_m_freem(chk->data);
6051 				chk->data = NULL;
6052 			}
6053 			asoc->ctrl_queue_cnt--;
6054 			sctp_free_a_chunk(stcb, chk);
6055 		}
6056 		chk = nchk;
6057 	}
6058 }
6059 
6060 void
6061 sctp_toss_old_asconf(struct sctp_tcb *stcb)
6062 {
6063 	struct sctp_association *asoc;
6064 	struct sctp_tmit_chunk *chk, *chk_tmp;
6065 
6066 	asoc = &stcb->asoc;
6067 	for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
6068 	    chk = chk_tmp) {
6069 		/* get next chk */
6070 		chk_tmp = TAILQ_NEXT(chk, sctp_next);
6071 		/* find SCTP_ASCONF chunk in queue (only one ever in queue) */
6072 		if (chk->rec.chunk_id.id == SCTP_ASCONF) {
6073 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
6074 			if (chk->data) {
6075 				sctp_m_freem(chk->data);
6076 				chk->data = NULL;
6077 			}
6078 			asoc->ctrl_queue_cnt--;
6079 			sctp_free_a_chunk(stcb, chk);
6080 		}
6081 	}
6082 }
6083 
6084 
6085 static void
6086 sctp_clean_up_datalist(struct sctp_tcb *stcb,
6087 
6088     struct sctp_association *asoc,
6089     struct sctp_tmit_chunk **data_list,
6090     int bundle_at,
6091     struct sctp_nets *net)
6092 {
6093 	int i;
6094 	struct sctp_tmit_chunk *tp1;
6095 
6096 	for (i = 0; i < bundle_at; i++) {
6097 		/* off of the send queue */
6098 		if (i) {
6099 			/*
6100 			 * Any chunk NOT 0 you zap the time chunk 0 gets
6101 			 * zapped or set based on if a RTO measurment is
6102 			 * needed.
6103 			 */
6104 			data_list[i]->do_rtt = 0;
6105 		}
6106 		/* record time */
6107 		data_list[i]->sent_rcv_time = net->last_sent_time;
6108 		data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.TSN_seq;
6109 		TAILQ_REMOVE(&asoc->send_queue,
6110 		    data_list[i],
6111 		    sctp_next);
6112 		/* on to the sent queue */
6113 		tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead);
6114 		if ((tp1) && (compare_with_wrap(tp1->rec.data.TSN_seq,
6115 		    data_list[i]->rec.data.TSN_seq, MAX_TSN))) {
6116 			struct sctp_tmit_chunk *tpp;
6117 
6118 			/* need to move back */
6119 	back_up_more:
6120 			tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next);
6121 			if (tpp == NULL) {
6122 				TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next);
6123 				goto all_done;
6124 			}
6125 			tp1 = tpp;
6126 			if (compare_with_wrap(tp1->rec.data.TSN_seq,
6127 			    data_list[i]->rec.data.TSN_seq, MAX_TSN)) {
6128 				goto back_up_more;
6129 			}
6130 			TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next);
6131 		} else {
6132 			TAILQ_INSERT_TAIL(&asoc->sent_queue,
6133 			    data_list[i],
6134 			    sctp_next);
6135 		}
6136 all_done:
6137 		/* This does not lower until the cum-ack passes it */
6138 		asoc->sent_queue_cnt++;
6139 		asoc->send_queue_cnt--;
6140 		if ((asoc->peers_rwnd <= 0) &&
6141 		    (asoc->total_flight == 0) &&
6142 		    (bundle_at == 1)) {
6143 			/* Mark the chunk as being a window probe */
6144 			SCTP_STAT_INCR(sctps_windowprobed);
6145 		}
6146 #ifdef SCTP_AUDITING_ENABLED
6147 		sctp_audit_log(0xC2, 3);
6148 #endif
6149 		data_list[i]->sent = SCTP_DATAGRAM_SENT;
6150 		data_list[i]->snd_count = 1;
6151 		data_list[i]->rec.data.chunk_was_revoked = 0;
6152 		if (sctp_logging_level & SCTP_FLIGHT_LOGGING_ENABLE) {
6153 			sctp_misc_ints(SCTP_FLIGHT_LOG_UP,
6154 			    data_list[i]->whoTo->flight_size,
6155 			    data_list[i]->book_size,
6156 			    (uintptr_t) data_list[i]->whoTo,
6157 			    data_list[i]->rec.data.TSN_seq);
6158 		}
6159 		sctp_flight_size_increase(data_list[i]);
6160 		sctp_total_flight_increase(stcb, data_list[i]);
6161 		if (sctp_logging_level & SCTP_LOG_RWND_ENABLE) {
6162 			sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
6163 			    asoc->peers_rwnd, data_list[i]->send_size, sctp_peer_chunk_oh);
6164 		}
6165 		asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
6166 		    (uint32_t) (data_list[i]->send_size + sctp_peer_chunk_oh));
6167 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
6168 			/* SWS sender side engages */
6169 			asoc->peers_rwnd = 0;
6170 		}
6171 	}
6172 }
6173 
6174 static void
6175 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc)
6176 {
6177 	struct sctp_tmit_chunk *chk, *nchk;
6178 
6179 	for (chk = TAILQ_FIRST(&asoc->control_send_queue);
6180 	    chk; chk = nchk) {
6181 		nchk = TAILQ_NEXT(chk, sctp_next);
6182 		if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) ||
6183 		    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) ||
6184 		    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) ||
6185 		    (chk->rec.chunk_id.id == SCTP_SHUTDOWN) ||
6186 		    (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) ||
6187 		    (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) ||
6188 		    (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) ||
6189 		    (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) ||
6190 		    (chk->rec.chunk_id.id == SCTP_ECN_CWR) ||
6191 		    (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) {
6192 			/* Stray chunks must be cleaned up */
6193 	clean_up_anyway:
6194 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
6195 			if (chk->data) {
6196 				sctp_m_freem(chk->data);
6197 				chk->data = NULL;
6198 			}
6199 			asoc->ctrl_queue_cnt--;
6200 			sctp_free_a_chunk(stcb, chk);
6201 		} else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) {
6202 			/* special handling, we must look into the param */
6203 			if (chk != asoc->str_reset) {
6204 				goto clean_up_anyway;
6205 			}
6206 		}
6207 	}
6208 }
6209 
6210 
6211 static int
6212 sctp_can_we_split_this(struct sctp_tcb *stcb,
6213     uint32_t length,
6214     uint32_t goal_mtu, uint32_t frag_point, int eeor_on)
6215 {
6216 	/*
6217 	 * Make a decision on if I should split a msg into multiple parts.
6218 	 * This is only asked of incomplete messages.
6219 	 */
6220 	if (eeor_on) {
6221 		/*
6222 		 * If we are doing EEOR we need to always send it if its the
6223 		 * entire thing, since it might be all the guy is putting in
6224 		 * the hopper.
6225 		 */
6226 		if (goal_mtu >= length) {
6227 			/*-
6228 			 * If we have data outstanding,
6229 			 * we get another chance when the sack
6230 			 * arrives to transmit - wait for more data
6231 			 */
6232 			if (stcb->asoc.total_flight == 0) {
6233 				/*
6234 				 * If nothing is in flight, we zero the
6235 				 * packet counter.
6236 				 */
6237 				return (length);
6238 			}
6239 			return (0);
6240 
6241 		} else {
6242 			/* You can fill the rest */
6243 			return (goal_mtu);
6244 		}
6245 	}
6246 	/*-
6247 	 * For those strange folk that make the send buffer
6248 	 * smaller than our fragmentation point, we can't
6249 	 * get a full msg in so we have to allow splitting.
6250 	 */
6251 	if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) {
6252 		return (length);
6253 	}
6254 	if ((length <= goal_mtu) ||
6255 	    ((length - goal_mtu) < sctp_min_residual)) {
6256 		/* Sub-optimial residual don't split in non-eeor mode. */
6257 		return (0);
6258 	}
6259 	/*
6260 	 * If we reach here length is larger than the goal_mtu. Do we wish
6261 	 * to split it for the sake of packet putting together?
6262 	 */
6263 	if (goal_mtu >= min(sctp_min_split_point, frag_point)) {
6264 		/* Its ok to split it */
6265 		return (min(goal_mtu, frag_point));
6266 	}
6267 	/* Nope, can't split */
6268 	return (0);
6269 
6270 }
6271 
6272 static uint32_t
6273 sctp_move_to_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net,
6274     struct sctp_stream_out *strq,
6275     uint32_t goal_mtu,
6276     uint32_t frag_point,
6277     int *locked,
6278     int *giveup,
6279     int eeor_mode,
6280     int *bail)
6281 {
6282 	/* Move from the stream to the send_queue keeping track of the total */
6283 	struct sctp_association *asoc;
6284 	struct sctp_stream_queue_pending *sp;
6285 	struct sctp_tmit_chunk *chk;
6286 	struct sctp_data_chunk *dchkh;
6287 	uint32_t to_move, length;
6288 	uint8_t rcv_flags = 0;
6289 	uint8_t some_taken;
6290 	uint8_t send_lock_up = 0;
6291 
6292 	SCTP_TCB_LOCK_ASSERT(stcb);
6293 	asoc = &stcb->asoc;
6294 one_more_time:
6295 	/* sa_ignore FREED_MEMORY */
6296 	sp = TAILQ_FIRST(&strq->outqueue);
6297 	if (sp == NULL) {
6298 		*locked = 0;
6299 		if (send_lock_up == 0) {
6300 			SCTP_TCB_SEND_LOCK(stcb);
6301 			send_lock_up = 1;
6302 		}
6303 		sp = TAILQ_FIRST(&strq->outqueue);
6304 		if (sp) {
6305 			goto one_more_time;
6306 		}
6307 		if (strq->last_msg_incomplete) {
6308 			SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n",
6309 			    strq->stream_no,
6310 			    strq->last_msg_incomplete);
6311 			strq->last_msg_incomplete = 0;
6312 		}
6313 		to_move = 0;
6314 		if (send_lock_up) {
6315 			SCTP_TCB_SEND_UNLOCK(stcb);
6316 			send_lock_up = 0;
6317 		}
6318 		goto out_of;
6319 	}
6320 	if ((sp->msg_is_complete) && (sp->length == 0)) {
6321 		if (sp->sender_all_done) {
6322 			/*
6323 			 * We are doing differed cleanup. Last time through
6324 			 * when we took all the data the sender_all_done was
6325 			 * not set.
6326 			 */
6327 			if (sp->put_last_out == 0) {
6328 				SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
6329 				SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n",
6330 				    sp->sender_all_done,
6331 				    sp->length,
6332 				    sp->msg_is_complete,
6333 				    sp->put_last_out,
6334 				    send_lock_up);
6335 			}
6336 			if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) {
6337 				SCTP_TCB_SEND_LOCK(stcb);
6338 				send_lock_up = 1;
6339 			}
6340 			atomic_subtract_int(&asoc->stream_queue_cnt, 1);
6341 			TAILQ_REMOVE(&strq->outqueue, sp, next);
6342 			sctp_free_remote_addr(sp->net);
6343 			if (sp->data) {
6344 				sctp_m_freem(sp->data);
6345 				sp->data = NULL;
6346 			}
6347 			sctp_free_a_strmoq(stcb, sp);
6348 
6349 			/* we can't be locked to it */
6350 			*locked = 0;
6351 			stcb->asoc.locked_on_sending = NULL;
6352 			if (send_lock_up) {
6353 				SCTP_TCB_SEND_UNLOCK(stcb);
6354 				send_lock_up = 0;
6355 			}
6356 			/* back to get the next msg */
6357 			goto one_more_time;
6358 		} else {
6359 			/*
6360 			 * sender just finished this but still holds a
6361 			 * reference
6362 			 */
6363 			*locked = 1;
6364 			*giveup = 1;
6365 			to_move = 0;
6366 			goto out_of;
6367 		}
6368 	} else {
6369 		/* is there some to get */
6370 		if (sp->length == 0) {
6371 			/* no */
6372 			*locked = 1;
6373 			*giveup = 1;
6374 			to_move = 0;
6375 			goto out_of;
6376 		}
6377 	}
6378 	some_taken = sp->some_taken;
6379 	if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
6380 		sp->msg_is_complete = 1;
6381 	}
6382 re_look:
6383 	length = sp->length;
6384 	if (sp->msg_is_complete) {
6385 		/* The message is complete */
6386 		to_move = min(length, frag_point);
6387 		if (to_move == length) {
6388 			/* All of it fits in the MTU */
6389 			if (sp->some_taken) {
6390 				rcv_flags |= SCTP_DATA_LAST_FRAG;
6391 				sp->put_last_out = 1;
6392 			} else {
6393 				rcv_flags |= SCTP_DATA_NOT_FRAG;
6394 				sp->put_last_out = 1;
6395 			}
6396 		} else {
6397 			/* Not all of it fits, we fragment */
6398 			if (sp->some_taken == 0) {
6399 				rcv_flags |= SCTP_DATA_FIRST_FRAG;
6400 			}
6401 			sp->some_taken = 1;
6402 		}
6403 	} else {
6404 		to_move = sctp_can_we_split_this(stcb, length, goal_mtu,
6405 		    frag_point, eeor_mode);
6406 		if (to_move) {
6407 			/*-
6408 		         * We use a snapshot of length in case it
6409 		         * is expanding during the compare.
6410 		         */
6411 			uint32_t llen;
6412 
6413 			llen = length;
6414 			if (to_move >= llen) {
6415 				to_move = llen;
6416 				if (send_lock_up == 0) {
6417 					/*-
6418 				         * We are taking all of an incomplete msg
6419 				         * thus we need a send lock.
6420 				         */
6421 					SCTP_TCB_SEND_LOCK(stcb);
6422 					send_lock_up = 1;
6423 					if (sp->msg_is_complete) {
6424 						/*
6425 						 * the sender finished the
6426 						 * msg
6427 						 */
6428 						goto re_look;
6429 					}
6430 				}
6431 			}
6432 			if (sp->some_taken == 0) {
6433 				rcv_flags |= SCTP_DATA_FIRST_FRAG;
6434 				sp->some_taken = 1;
6435 			}
6436 		} else {
6437 			/* Nothing to take. */
6438 			if (sp->some_taken) {
6439 				*locked = 1;
6440 			}
6441 			*giveup = 1;
6442 			to_move = 0;
6443 			goto out_of;
6444 		}
6445 	}
6446 
6447 	/* If we reach here, we can copy out a chunk */
6448 	sctp_alloc_a_chunk(stcb, chk);
6449 	if (chk == NULL) {
6450 		/* No chunk memory */
6451 		*giveup = 1;
6452 		to_move = 0;
6453 		goto out_of;
6454 	}
6455 	/*
6456 	 * Setup for unordered if needed by looking at the user sent info
6457 	 * flags.
6458 	 */
6459 	if (sp->sinfo_flags & SCTP_UNORDERED) {
6460 		rcv_flags |= SCTP_DATA_UNORDERED;
6461 	}
6462 	/* clear out the chunk before setting up */
6463 	memset(chk, 0, sizeof(*chk));
6464 	chk->rec.data.rcv_flags = rcv_flags;
6465 
6466 	if (to_move >= length) {
6467 		/* we think we can steal the whole thing */
6468 		if ((sp->sender_all_done == 0) && (send_lock_up == 0)) {
6469 			SCTP_TCB_SEND_LOCK(stcb);
6470 			send_lock_up = 1;
6471 		}
6472 		if (to_move < sp->length) {
6473 			/* bail, it changed */
6474 			goto dont_do_it;
6475 		}
6476 		chk->data = sp->data;
6477 		chk->last_mbuf = sp->tail_mbuf;
6478 		/* register the stealing */
6479 		sp->data = sp->tail_mbuf = NULL;
6480 	} else {
6481 		struct mbuf *m;
6482 
6483 dont_do_it:
6484 		chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_DONTWAIT);
6485 		chk->last_mbuf = NULL;
6486 		if (chk->data == NULL) {
6487 			sp->some_taken = some_taken;
6488 			sctp_free_a_chunk(stcb, chk);
6489 			*bail = 1;
6490 			to_move = 0;
6491 			goto out_of;
6492 		}
6493 		/* Pull off the data */
6494 		m_adj(sp->data, to_move);
6495 		/* Now lets work our way down and compact it */
6496 		m = sp->data;
6497 		while (m && (SCTP_BUF_LEN(m) == 0)) {
6498 			sp->data = SCTP_BUF_NEXT(m);
6499 			SCTP_BUF_NEXT(m) = NULL;
6500 			if (sp->tail_mbuf == m) {
6501 				/*-
6502 				 * Freeing tail? TSNH since
6503 				 * we supposedly were taking less
6504 				 * than the sp->length.
6505 				 */
6506 #ifdef INVARIANTS
6507 				panic("Huh, freing tail? - TSNH");
6508 #else
6509 				SCTP_PRINTF("Huh, freeing tail? - TSNH\n");
6510 				sp->tail_mbuf = sp->data = NULL;
6511 				sp->length = 0;
6512 #endif
6513 
6514 			}
6515 			sctp_m_free(m);
6516 			m = sp->data;
6517 		}
6518 	}
6519 	if (SCTP_BUF_IS_EXTENDED(chk->data)) {
6520 		chk->copy_by_ref = 1;
6521 	} else {
6522 		chk->copy_by_ref = 0;
6523 	}
6524 	/*
6525 	 * get last_mbuf and counts of mb useage This is ugly but hopefully
6526 	 * its only one mbuf.
6527 	 */
6528 	if (chk->last_mbuf == NULL) {
6529 		chk->last_mbuf = chk->data;
6530 		while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) {
6531 			chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf);
6532 		}
6533 	}
6534 	if (to_move > length) {
6535 		/*- This should not happen either
6536 		 * since we always lower to_move to the size
6537 		 * of sp->length if its larger.
6538 		 */
6539 #ifdef INVARIANTS
6540 		panic("Huh, how can to_move be larger?");
6541 #else
6542 		SCTP_PRINTF("Huh, how can to_move be larger?\n");
6543 		sp->length = 0;
6544 #endif
6545 	} else {
6546 		atomic_subtract_int(&sp->length, to_move);
6547 	}
6548 	if (M_LEADINGSPACE(chk->data) < (int)sizeof(struct sctp_data_chunk)) {
6549 		/* Not enough room for a chunk header, get some */
6550 		struct mbuf *m;
6551 
6552 		m = sctp_get_mbuf_for_msg(1, 0, M_DONTWAIT, 0, MT_DATA);
6553 		if (m == NULL) {
6554 			/*
6555 			 * we're in trouble here. _PREPEND below will free
6556 			 * all the data if there is no leading space, so we
6557 			 * must put the data back and restore.
6558 			 */
6559 			if (send_lock_up == 0) {
6560 				SCTP_TCB_SEND_LOCK(stcb);
6561 				send_lock_up = 1;
6562 			}
6563 			if (chk->data == NULL) {
6564 				/* unsteal the data */
6565 				sp->data = chk->data;
6566 				sp->tail_mbuf = chk->last_mbuf;
6567 			} else {
6568 				struct mbuf *m_tmp;
6569 
6570 				/* reassemble the data */
6571 				m_tmp = sp->data;
6572 				sp->data = chk->data;
6573 				SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp;
6574 			}
6575 			sp->some_taken = some_taken;
6576 			atomic_add_int(&sp->length, to_move);
6577 			chk->data = NULL;
6578 			*bail = 1;
6579 			sctp_free_a_chunk(stcb, chk);
6580 			to_move = 0;
6581 			goto out_of;
6582 		} else {
6583 			SCTP_BUF_LEN(m) = 0;
6584 			SCTP_BUF_NEXT(m) = chk->data;
6585 			chk->data = m;
6586 			M_ALIGN(chk->data, 4);
6587 		}
6588 	}
6589 	SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT);
6590 	if (chk->data == NULL) {
6591 		/* HELP, TSNH since we assured it would not above? */
6592 #ifdef INVARIANTS
6593 		panic("prepend failes HELP?");
6594 #else
6595 		SCTP_PRINTF("prepend fails HELP?\n");
6596 		sctp_free_a_chunk(stcb, chk);
6597 #endif
6598 		*bail = 1;
6599 		to_move = 0;
6600 		goto out_of;
6601 	}
6602 	sctp_snd_sb_alloc(stcb, sizeof(struct sctp_data_chunk));
6603 	chk->book_size = chk->send_size = (to_move +
6604 	    sizeof(struct sctp_data_chunk));
6605 	chk->book_size_scale = 0;
6606 	chk->sent = SCTP_DATAGRAM_UNSENT;
6607 
6608 	chk->flags = 0;
6609 	chk->asoc = &stcb->asoc;
6610 	chk->pad_inplace = 0;
6611 	chk->no_fr_allowed = 0;
6612 	chk->rec.data.stream_seq = sp->strseq;
6613 	chk->rec.data.stream_number = sp->stream;
6614 	chk->rec.data.payloadtype = sp->ppid;
6615 	chk->rec.data.context = sp->context;
6616 	chk->rec.data.doing_fast_retransmit = 0;
6617 	chk->rec.data.ect_nonce = 0;	/* ECN Nonce */
6618 
6619 	chk->rec.data.timetodrop = sp->ts;
6620 	chk->flags = sp->act_flags;
6621 	chk->addr_over = sp->addr_over;
6622 
6623 	chk->whoTo = net;
6624 	atomic_add_int(&chk->whoTo->ref_count, 1);
6625 
6626 	chk->rec.data.TSN_seq = atomic_fetchadd_int(&asoc->sending_seq, 1);
6627 	if (sctp_logging_level & SCTP_LOG_AT_SEND_2_OUTQ) {
6628 		sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
6629 		    (uintptr_t) stcb, sp->length,
6630 		    (uint32_t) ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq),
6631 		    chk->rec.data.TSN_seq);
6632 	}
6633 	dchkh = mtod(chk->data, struct sctp_data_chunk *);
6634 	/*
6635 	 * Put the rest of the things in place now. Size was done earlier in
6636 	 * previous loop prior to padding.
6637 	 */
6638 
6639 #ifdef SCTP_ASOCLOG_OF_TSNS
6640 	SCTP_TCB_LOCK_ASSERT(stcb);
6641 	if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) {
6642 		asoc->tsn_out_at = 0;
6643 		asoc->tsn_out_wrapped = 1;
6644 	}
6645 	asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.TSN_seq;
6646 	asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.stream_number;
6647 	asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.stream_seq;
6648 	asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size;
6649 	asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags;
6650 	asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb;
6651 	asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at;
6652 	asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2;
6653 	asoc->tsn_out_at++;
6654 #endif
6655 
6656 	dchkh->ch.chunk_type = SCTP_DATA;
6657 	dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
6658 	dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
6659 	dchkh->dp.stream_id = htons(strq->stream_no);
6660 	dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
6661 	dchkh->dp.protocol_id = chk->rec.data.payloadtype;
6662 	dchkh->ch.chunk_length = htons(chk->send_size);
6663 	/* Now advance the chk->send_size by the actual pad needed. */
6664 	if (chk->send_size < SCTP_SIZE32(chk->book_size)) {
6665 		/* need a pad */
6666 		struct mbuf *lm;
6667 		int pads;
6668 
6669 		pads = SCTP_SIZE32(chk->book_size) - chk->send_size;
6670 		if (sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf) == 0) {
6671 			chk->pad_inplace = 1;
6672 		}
6673 		if ((lm = SCTP_BUF_NEXT(chk->last_mbuf)) != NULL) {
6674 			/* pad added an mbuf */
6675 			chk->last_mbuf = lm;
6676 		}
6677 		chk->send_size += pads;
6678 	}
6679 	/* We only re-set the policy if it is on */
6680 	if (sp->pr_sctp_on) {
6681 		sctp_set_prsctp_policy(stcb, sp);
6682 		asoc->pr_sctp_cnt++;
6683 		chk->pr_sctp_on = 1;
6684 	} else {
6685 		chk->pr_sctp_on = 0;
6686 	}
6687 	if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) {
6688 		/* All done pull and kill the message */
6689 		atomic_subtract_int(&asoc->stream_queue_cnt, 1);
6690 		if (sp->put_last_out == 0) {
6691 			SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n");
6692 			SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n",
6693 			    sp->sender_all_done,
6694 			    sp->length,
6695 			    sp->msg_is_complete,
6696 			    sp->put_last_out,
6697 			    send_lock_up);
6698 		}
6699 		if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) {
6700 			SCTP_TCB_SEND_LOCK(stcb);
6701 			send_lock_up = 1;
6702 		}
6703 		TAILQ_REMOVE(&strq->outqueue, sp, next);
6704 		sctp_free_remote_addr(sp->net);
6705 		if (sp->data) {
6706 			sctp_m_freem(sp->data);
6707 			sp->data = NULL;
6708 		}
6709 		sctp_free_a_strmoq(stcb, sp);
6710 
6711 		/* we can't be locked to it */
6712 		*locked = 0;
6713 		stcb->asoc.locked_on_sending = NULL;
6714 	} else {
6715 		/* more to go, we are locked */
6716 		*locked = 1;
6717 	}
6718 	asoc->chunks_on_out_queue++;
6719 	TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
6720 	asoc->send_queue_cnt++;
6721 out_of:
6722 	if (send_lock_up) {
6723 		SCTP_TCB_SEND_UNLOCK(stcb);
6724 		send_lock_up = 0;
6725 	}
6726 	return (to_move);
6727 }
6728 
6729 
6730 static struct sctp_stream_out *
6731 sctp_select_a_stream(struct sctp_tcb *stcb, struct sctp_association *asoc)
6732 {
6733 	struct sctp_stream_out *strq;
6734 
6735 	/* Find the next stream to use */
6736 	if (asoc->last_out_stream == NULL) {
6737 		strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
6738 		if (asoc->last_out_stream == NULL) {
6739 			/* huh nothing on the wheel, TSNH */
6740 			return (NULL);
6741 		}
6742 		goto done_it;
6743 	}
6744 	strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
6745 done_it:
6746 	if (strq == NULL) {
6747 		strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
6748 	}
6749 	/* Save off the last stream */
6750 	asoc->last_out_stream = strq;
6751 	return (strq);
6752 
6753 }
6754 
6755 
6756 static void
6757 sctp_fill_outqueue(struct sctp_tcb *stcb,
6758     struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now)
6759 {
6760 	struct sctp_association *asoc;
6761 	struct sctp_stream_out *strq, *strqn, *strqt;
6762 	int goal_mtu, moved_how_much, total_moved = 0, bail = 0;
6763 	int locked, giveup;
6764 	struct sctp_stream_queue_pending *sp;
6765 
6766 	SCTP_TCB_LOCK_ASSERT(stcb);
6767 	asoc = &stcb->asoc;
6768 #ifdef INET6
6769 	if (net->ro._l_addr.sin6.sin6_family == AF_INET6) {
6770 		goal_mtu = net->mtu - SCTP_MIN_OVERHEAD;
6771 	} else {
6772 		/* ?? not sure what else to do */
6773 		goal_mtu = net->mtu - SCTP_MIN_V4_OVERHEAD;
6774 	}
6775 #else
6776 	goal_mtu = net->mtu - SCTP_MIN_OVERHEAD;
6777 	mtu_fromwheel = 0;
6778 #endif
6779 	/* Need an allowance for the data chunk header too */
6780 	goal_mtu -= sizeof(struct sctp_data_chunk);
6781 
6782 	/* must make even word boundary */
6783 	goal_mtu &= 0xfffffffc;
6784 	if (asoc->locked_on_sending) {
6785 		/* We are stuck on one stream until the message completes. */
6786 		strqn = strq = asoc->locked_on_sending;
6787 		locked = 1;
6788 	} else {
6789 		strqn = strq = sctp_select_a_stream(stcb, asoc);
6790 		locked = 0;
6791 	}
6792 
6793 	while ((goal_mtu > 0) && strq) {
6794 		sp = TAILQ_FIRST(&strq->outqueue);
6795 		/*
6796 		 * If CMT is off, we must validate that the stream in
6797 		 * question has the first item pointed towards are network
6798 		 * destionation requested by the caller. Note that if we
6799 		 * turn out to be locked to a stream (assigning TSN's then
6800 		 * we must stop, since we cannot look for another stream
6801 		 * with data to send to that destination). In CMT's case, by
6802 		 * skipping this check, we will send one data packet towards
6803 		 * the requested net.
6804 		 */
6805 		if (sp == NULL) {
6806 			break;
6807 		}
6808 		if ((sp->net != net) && (sctp_cmt_on_off == 0)) {
6809 			/* none for this network */
6810 			if (locked) {
6811 				break;
6812 			} else {
6813 				strq = sctp_select_a_stream(stcb, asoc);
6814 				if (strq == NULL)
6815 					/* none left */
6816 					break;
6817 				if (strqn == strq) {
6818 					/* I have circled */
6819 					break;
6820 				}
6821 				continue;
6822 			}
6823 		}
6824 		giveup = 0;
6825 		bail = 0;
6826 		moved_how_much = sctp_move_to_outqueue(stcb, net, strq, goal_mtu, frag_point, &locked,
6827 		    &giveup, eeor_mode, &bail);
6828 		asoc->last_out_stream = strq;
6829 		if (locked) {
6830 			asoc->locked_on_sending = strq;
6831 			if ((moved_how_much == 0) || (giveup) || bail)
6832 				/* no more to move for now */
6833 				break;
6834 		} else {
6835 			asoc->locked_on_sending = NULL;
6836 			strqt = sctp_select_a_stream(stcb, asoc);
6837 			if (TAILQ_FIRST(&strq->outqueue) == NULL) {
6838 				if (strq == strqn) {
6839 					/* Must move start to next one */
6840 					strqn = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
6841 					if (strqn == NULL) {
6842 						strqn = TAILQ_FIRST(&asoc->out_wheel);
6843 						if (strqn == NULL) {
6844 							break;
6845 						}
6846 					}
6847 				}
6848 				sctp_remove_from_wheel(stcb, asoc, strq);
6849 			}
6850 			if ((giveup) || bail) {
6851 				break;
6852 			}
6853 			strq = strqt;
6854 			if (strq == NULL) {
6855 				break;
6856 			}
6857 		}
6858 		total_moved += moved_how_much;
6859 		goal_mtu -= (moved_how_much + sizeof(struct sctp_data_chunk));
6860 		goal_mtu &= 0xfffffffc;
6861 	}
6862 	if (bail)
6863 		*quit_now = 1;
6864 
6865 	if (total_moved == 0) {
6866 		if ((sctp_cmt_on_off == 0) &&
6867 		    (net == stcb->asoc.primary_destination)) {
6868 			/* ran dry for primary network net */
6869 			SCTP_STAT_INCR(sctps_primary_randry);
6870 		} else if (sctp_cmt_on_off) {
6871 			/* ran dry with CMT on */
6872 			SCTP_STAT_INCR(sctps_cmt_randry);
6873 		}
6874 	}
6875 }
6876 
6877 void
6878 sctp_fix_ecn_echo(struct sctp_association *asoc)
6879 {
6880 	struct sctp_tmit_chunk *chk;
6881 
6882 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
6883 		if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) {
6884 			chk->sent = SCTP_DATAGRAM_UNSENT;
6885 		}
6886 	}
6887 }
6888 
6889 static void
6890 sctp_move_to_an_alt(struct sctp_tcb *stcb,
6891     struct sctp_association *asoc,
6892     struct sctp_nets *net)
6893 {
6894 	struct sctp_tmit_chunk *chk;
6895 	struct sctp_nets *a_net;
6896 
6897 	SCTP_TCB_LOCK_ASSERT(stcb);
6898 	/*
6899 	 * JRS 5/14/07 - If CMT PF is turned on, find an alternate
6900 	 * destination using the PF algorithm for finding alternate
6901 	 * destinations.
6902 	 */
6903 	if (sctp_cmt_on_off && sctp_cmt_pf) {
6904 		a_net = sctp_find_alternate_net(stcb, net, 2);
6905 	} else {
6906 		a_net = sctp_find_alternate_net(stcb, net, 0);
6907 	}
6908 	if ((a_net != net) &&
6909 	    ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
6910 		/*
6911 		 * We only proceed if a valid alternate is found that is not
6912 		 * this one and is reachable. Here we must move all chunks
6913 		 * queued in the send queue off of the destination address
6914 		 * to our alternate.
6915 		 */
6916 		TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
6917 			if (chk->whoTo == net) {
6918 				/* Move the chunk to our alternate */
6919 				sctp_free_remote_addr(chk->whoTo);
6920 				chk->whoTo = a_net;
6921 				atomic_add_int(&a_net->ref_count, 1);
6922 			}
6923 		}
6924 	}
6925 }
6926 
6927 int
6928 sctp_med_chunk_output(struct sctp_inpcb *inp,
6929     struct sctp_tcb *stcb,
6930     struct sctp_association *asoc,
6931     int *num_out,
6932     int *reason_code,
6933     int control_only, int *cwnd_full, int from_where,
6934     struct timeval *now, int *now_filled, int frag_point, int so_locked
6935 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
6936     SCTP_UNUSED
6937 #endif
6938 )
6939 {
6940 	/*
6941 	 * Ok this is the generic chunk service queue. we must do the
6942 	 * following: - Service the stream queue that is next, moving any
6943 	 * message (note I must get a complete message i.e. FIRST/MIDDLE and
6944 	 * LAST to the out queue in one pass) and assigning TSN's - Check to
6945 	 * see if the cwnd/rwnd allows any output, if so we go ahead and
6946 	 * fomulate and send the low level chunks. Making sure to combine
6947 	 * any control in the control chunk queue also.
6948 	 */
6949 	struct sctp_nets *net;
6950 	struct mbuf *outchain, *endoutchain;
6951 	struct sctp_tmit_chunk *chk, *nchk;
6952 	struct sctphdr *shdr;
6953 
6954 	/* temp arrays for unlinking */
6955 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
6956 	int no_fragmentflg, error;
6957 	int one_chunk, hbflag, skip_data_for_this_net;
6958 	int asconf, cookie, no_out_cnt;
6959 	int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind, eeor_mode;
6960 	unsigned int mtu, r_mtu, omtu, mx_mtu, to_out;
6961 	struct sctp_nets *start_at, *old_startat = NULL, *send_start_at;
6962 	int tsns_sent = 0;
6963 	uint32_t auth_offset = 0;
6964 	struct sctp_auth_chunk *auth = NULL;
6965 
6966 	/*
6967 	 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the
6968 	 * destination.
6969 	 */
6970 	int pf_hbflag = 0;
6971 	int quit_now = 0;
6972 
6973 	*num_out = 0;
6974 	cwnd_full_ind = 0;
6975 
6976 	if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
6977 	    (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED) ||
6978 	    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {
6979 		eeor_mode = 1;
6980 	} else {
6981 		eeor_mode = 0;
6982 	}
6983 	ctl_cnt = no_out_cnt = asconf = cookie = 0;
6984 	/*
6985 	 * First lets prime the pump. For each destination, if there is room
6986 	 * in the flight size, attempt to pull an MTU's worth out of the
6987 	 * stream queues into the general send_queue
6988 	 */
6989 #ifdef SCTP_AUDITING_ENABLED
6990 	sctp_audit_log(0xC2, 2);
6991 #endif
6992 	SCTP_TCB_LOCK_ASSERT(stcb);
6993 	hbflag = 0;
6994 	if ((control_only) || (asoc->stream_reset_outstanding))
6995 		no_data_chunks = 1;
6996 	else
6997 		no_data_chunks = 0;
6998 
6999 	/* Nothing to possible to send? */
7000 	if (TAILQ_EMPTY(&asoc->control_send_queue) &&
7001 	    TAILQ_EMPTY(&asoc->send_queue) &&
7002 	    TAILQ_EMPTY(&asoc->out_wheel)) {
7003 		*reason_code = 9;
7004 		return (0);
7005 	}
7006 	if (asoc->peers_rwnd == 0) {
7007 		/* No room in peers rwnd */
7008 		*cwnd_full = 1;
7009 		*reason_code = 1;
7010 		if (asoc->total_flight > 0) {
7011 			/* we are allowed one chunk in flight */
7012 			no_data_chunks = 1;
7013 		}
7014 	}
7015 	if ((no_data_chunks == 0) && (!TAILQ_EMPTY(&asoc->out_wheel))) {
7016 		if (sctp_cmt_on_off) {
7017 			/*
7018 			 * for CMT we start at the next one past the one we
7019 			 * last added data to.
7020 			 */
7021 			if (TAILQ_FIRST(&asoc->send_queue) != NULL) {
7022 				goto skip_the_fill_from_streams;
7023 			}
7024 			if (asoc->last_net_data_came_from) {
7025 				net = TAILQ_NEXT(asoc->last_net_data_came_from, sctp_next);
7026 				if (net == NULL) {
7027 					net = TAILQ_FIRST(&asoc->nets);
7028 				}
7029 			} else {
7030 				/* back to start */
7031 				net = TAILQ_FIRST(&asoc->nets);
7032 			}
7033 
7034 			/*
7035 			 * JRI-TODO: CMT-MPI. Simply set the first
7036 			 * destination (net) to be optimized for the next
7037 			 * message to be pulled out of the outwheel. 1. peek
7038 			 * at outwheel 2. If large message, set net =
7039 			 * highest_cwnd 3. If small message, set net =
7040 			 * lowest rtt
7041 			 */
7042 		} else {
7043 			net = asoc->primary_destination;
7044 			if (net == NULL) {
7045 				/* TSNH */
7046 				net = TAILQ_FIRST(&asoc->nets);
7047 			}
7048 		}
7049 		start_at = net;
7050 
7051 one_more_time:
7052 		for (; net != NULL; net = TAILQ_NEXT(net, sctp_next)) {
7053 			net->window_probe = 0;
7054 			if (old_startat && (old_startat == net)) {
7055 				break;
7056 			}
7057 			/*
7058 			 * JRI: if dest is unreachable or unconfirmed, do
7059 			 * not send data to it
7060 			 */
7061 			if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) || (net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
7062 				continue;
7063 			}
7064 			/*
7065 			 * JRI: if dest is in PF state, do not send data to
7066 			 * it
7067 			 */
7068 			if (sctp_cmt_on_off && sctp_cmt_pf && (net->dest_state & SCTP_ADDR_PF)) {
7069 				continue;
7070 			}
7071 			if ((sctp_cmt_on_off == 0) && (net->ref_count < 2)) {
7072 				/* nothing can be in queue for this guy */
7073 				continue;
7074 			}
7075 			if (net->flight_size >= net->cwnd) {
7076 				/* skip this network, no room */
7077 				cwnd_full_ind++;
7078 				continue;
7079 			}
7080 			/*
7081 			 * JRI : this for loop we are in takes in each net,
7082 			 * if its's got space in cwnd and has data sent to
7083 			 * it (when CMT is off) then it calls
7084 			 * sctp_fill_outqueue for the net. This gets data on
7085 			 * the send queue for that network.
7086 			 *
7087 			 * In sctp_fill_outqueue TSN's are assigned and data is
7088 			 * copied out of the stream buffers. Note mostly
7089 			 * copy by reference (we hope).
7090 			 */
7091 			if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
7092 				sctp_log_cwnd(stcb, net, 0, SCTP_CWND_LOG_FILL_OUTQ_CALLED);
7093 			}
7094 			sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now);
7095 			if (quit_now) {
7096 				/* memory alloc failure */
7097 				no_data_chunks = 1;
7098 				goto skip_the_fill_from_streams;
7099 			}
7100 		}
7101 		if (start_at != TAILQ_FIRST(&asoc->nets)) {
7102 			/* got to pick up the beginning stuff. */
7103 			old_startat = start_at;
7104 			start_at = net = TAILQ_FIRST(&asoc->nets);
7105 			if (old_startat)
7106 				goto one_more_time;
7107 		}
7108 	}
7109 skip_the_fill_from_streams:
7110 	*cwnd_full = cwnd_full_ind;
7111 
7112 	/* now service each destination and send out what we can for it */
7113 	/* Nothing to send? */
7114 	if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
7115 	    (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
7116 		*reason_code = 8;
7117 		return (0);
7118 	}
7119 	if (no_data_chunks) {
7120 		chk = TAILQ_FIRST(&asoc->control_send_queue);
7121 	} else {
7122 		chk = TAILQ_FIRST(&asoc->send_queue);
7123 	}
7124 	if (chk) {
7125 		send_start_at = chk->whoTo;
7126 	} else {
7127 		send_start_at = TAILQ_FIRST(&asoc->nets);
7128 	}
7129 	old_startat = NULL;
7130 again_one_more_time:
7131 	for (net = send_start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) {
7132 		/* how much can we send? */
7133 		/* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */
7134 		if (old_startat && (old_startat == net)) {
7135 			/* through list ocmpletely. */
7136 			break;
7137 		}
7138 		tsns_sent = 0;
7139 		if (net->ref_count < 2) {
7140 			/*
7141 			 * Ref-count of 1 so we cannot have data or control
7142 			 * queued to this address. Skip it.
7143 			 */
7144 			continue;
7145 		}
7146 		ctl_cnt = bundle_at = 0;
7147 		endoutchain = outchain = NULL;
7148 		no_fragmentflg = 1;
7149 		one_chunk = 0;
7150 		if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
7151 			skip_data_for_this_net = 1;
7152 		} else {
7153 			skip_data_for_this_net = 0;
7154 		}
7155 		if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) {
7156 			/*
7157 			 * if we have a route and an ifp check to see if we
7158 			 * have room to send to this guy
7159 			 */
7160 			struct ifnet *ifp;
7161 
7162 			ifp = net->ro.ro_rt->rt_ifp;
7163 			if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
7164 				SCTP_STAT_INCR(sctps_ifnomemqueued);
7165 				if (sctp_logging_level & SCTP_LOG_MAXBURST_ENABLE) {
7166 					sctp_log_maxburst(stcb, net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
7167 				}
7168 				continue;
7169 			}
7170 		}
7171 		if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
7172 			mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
7173 		} else {
7174 			mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
7175 		}
7176 		mx_mtu = mtu;
7177 		to_out = 0;
7178 		if (mtu > asoc->peers_rwnd) {
7179 			if (asoc->total_flight > 0) {
7180 				/* We have a packet in flight somewhere */
7181 				r_mtu = asoc->peers_rwnd;
7182 			} else {
7183 				/* We are always allowed to send one MTU out */
7184 				one_chunk = 1;
7185 				r_mtu = mtu;
7186 			}
7187 		} else {
7188 			r_mtu = mtu;
7189 		}
7190 		/************************/
7191 		/* Control transmission */
7192 		/************************/
7193 		/* Now first lets go through the control queue */
7194 		for (chk = TAILQ_FIRST(&asoc->control_send_queue);
7195 		    chk; chk = nchk) {
7196 			nchk = TAILQ_NEXT(chk, sctp_next);
7197 			if (chk->whoTo != net) {
7198 				/*
7199 				 * No, not sent to the network we are
7200 				 * looking at
7201 				 */
7202 				continue;
7203 			}
7204 			if (chk->data == NULL) {
7205 				continue;
7206 			}
7207 			if (chk->sent != SCTP_DATAGRAM_UNSENT) {
7208 				/*
7209 				 * It must be unsent. Cookies and ASCONF's
7210 				 * hang around but there timers will force
7211 				 * when marked for resend.
7212 				 */
7213 				continue;
7214 			}
7215 			/*
7216 			 * if no AUTH is yet included and this chunk
7217 			 * requires it, make sure to account for it.  We
7218 			 * don't apply the size until the AUTH chunk is
7219 			 * actually added below in case there is no room for
7220 			 * this chunk. NOTE: we overload the use of "omtu"
7221 			 * here
7222 			 */
7223 			if ((auth == NULL) &&
7224 			    sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
7225 			    stcb->asoc.peer_auth_chunks)) {
7226 				omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
7227 			} else
7228 				omtu = 0;
7229 			/* Here we do NOT factor the r_mtu */
7230 			if ((chk->send_size < (int)(mtu - omtu)) ||
7231 			    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
7232 				/*
7233 				 * We probably should glom the mbuf chain
7234 				 * from the chk->data for control but the
7235 				 * problem is it becomes yet one more level
7236 				 * of tracking to do if for some reason
7237 				 * output fails. Then I have got to
7238 				 * reconstruct the merged control chain.. el
7239 				 * yucko.. for now we take the easy way and
7240 				 * do the copy
7241 				 */
7242 				/*
7243 				 * Add an AUTH chunk, if chunk requires it
7244 				 * save the offset into the chain for AUTH
7245 				 */
7246 				if ((auth == NULL) &&
7247 				    (sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
7248 				    stcb->asoc.peer_auth_chunks))) {
7249 					outchain = sctp_add_auth_chunk(outchain,
7250 					    &endoutchain,
7251 					    &auth,
7252 					    &auth_offset,
7253 					    stcb,
7254 					    chk->rec.chunk_id.id);
7255 					SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
7256 				}
7257 				outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain,
7258 				    (int)chk->rec.chunk_id.can_take_data,
7259 				    chk->send_size, chk->copy_by_ref);
7260 				if (outchain == NULL) {
7261 					*reason_code = 8;
7262 					SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
7263 					return (ENOMEM);
7264 				}
7265 				SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
7266 				/* update our MTU size */
7267 				if (mtu > (chk->send_size + omtu))
7268 					mtu -= (chk->send_size + omtu);
7269 				else
7270 					mtu = 0;
7271 				to_out += (chk->send_size + omtu);
7272 				/* Do clear IP_DF ? */
7273 				if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
7274 					no_fragmentflg = 0;
7275 				}
7276 				if (chk->rec.chunk_id.can_take_data)
7277 					chk->data = NULL;
7278 				/* Mark things to be removed, if needed */
7279 				if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) ||
7280 				    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) ||
7281 				    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) ||
7282 				    (chk->rec.chunk_id.id == SCTP_SHUTDOWN) ||
7283 				    (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) ||
7284 				    (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) ||
7285 				    (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) ||
7286 				    (chk->rec.chunk_id.id == SCTP_ECN_CWR) ||
7287 				    (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) ||
7288 				    (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) {
7289 
7290 					if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) {
7291 						hbflag = 1;
7292 						/*
7293 						 * JRS 5/14/07 - Set the
7294 						 * flag to say a heartbeat
7295 						 * is being sent.
7296 						 */
7297 						pf_hbflag = 1;
7298 					}
7299 					/* remove these chunks at the end */
7300 					if (chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) {
7301 						/* turn off the timer */
7302 						if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
7303 							sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
7304 							    inp, stcb, net, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1);
7305 						}
7306 					}
7307 					ctl_cnt++;
7308 				} else {
7309 					/*
7310 					 * Other chunks, since they have
7311 					 * timers running (i.e. COOKIE or
7312 					 * ASCONF) we just "trust" that it
7313 					 * gets sent or retransmitted.
7314 					 */
7315 					ctl_cnt++;
7316 					if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
7317 						cookie = 1;
7318 						no_out_cnt = 1;
7319 					} else if (chk->rec.chunk_id.id == SCTP_ASCONF) {
7320 						/*
7321 						 * set hb flag since we can
7322 						 * use these for RTO
7323 						 */
7324 						hbflag = 1;
7325 						asconf = 1;
7326 						/*
7327 						 * should sysctl this: don't
7328 						 * bundle data with ASCONF
7329 						 * since it requires AUTH
7330 						 */
7331 						no_data_chunks = 1;
7332 					}
7333 					chk->sent = SCTP_DATAGRAM_SENT;
7334 					chk->snd_count++;
7335 				}
7336 				if (mtu == 0) {
7337 					/*
7338 					 * Ok we are out of room but we can
7339 					 * output without effecting the
7340 					 * flight size since this little guy
7341 					 * is a control only packet.
7342 					 */
7343 					if (asconf) {
7344 						sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
7345 						/*
7346 						 * do NOT clear the asconf
7347 						 * flag as it is used to do
7348 						 * appropriate source
7349 						 * address selection.
7350 						 */
7351 					}
7352 					if (cookie) {
7353 						sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
7354 						cookie = 0;
7355 					}
7356 					SCTP_BUF_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
7357 					if (outchain == NULL) {
7358 						/* no memory */
7359 						SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOBUFS);
7360 						error = ENOBUFS;
7361 						goto error_out_again;
7362 					}
7363 					shdr = mtod(outchain, struct sctphdr *);
7364 					shdr->src_port = inp->sctp_lport;
7365 					shdr->dest_port = stcb->rport;
7366 					shdr->v_tag = htonl(stcb->asoc.peer_vtag);
7367 					shdr->checksum = 0;
7368 					auth_offset += sizeof(struct sctphdr);
7369 					if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
7370 					    (struct sockaddr *)&net->ro._l_addr,
7371 					    outchain, auth_offset, auth,
7372 					    no_fragmentflg, 0, NULL, asconf, so_locked))) {
7373 						if (error == ENOBUFS) {
7374 							asoc->ifp_had_enobuf = 1;
7375 							SCTP_STAT_INCR(sctps_lowlevelerr);
7376 						}
7377 						if (from_where == 0) {
7378 							SCTP_STAT_INCR(sctps_lowlevelerrusr);
7379 						}
7380 				error_out_again:
7381 						/* error, could not output */
7382 						if (hbflag) {
7383 							if (*now_filled == 0) {
7384 								(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
7385 								*now_filled = 1;
7386 								*now = net->last_sent_time;
7387 							} else {
7388 								net->last_sent_time = *now;
7389 							}
7390 							hbflag = 0;
7391 						}
7392 						if (error == EHOSTUNREACH) {
7393 							/*
7394 							 * Destination went
7395 							 * unreachable
7396 							 * during this send
7397 							 */
7398 							sctp_move_to_an_alt(stcb, asoc, net);
7399 						}
7400 						*reason_code = 7;
7401 						continue;
7402 					} else
7403 						asoc->ifp_had_enobuf = 0;
7404 					/* Only HB or ASCONF advances time */
7405 					if (hbflag) {
7406 						if (*now_filled == 0) {
7407 							(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
7408 							*now_filled = 1;
7409 							*now = net->last_sent_time;
7410 						} else {
7411 							net->last_sent_time = *now;
7412 						}
7413 						hbflag = 0;
7414 					}
7415 					/*
7416 					 * increase the number we sent, if a
7417 					 * cookie is sent we don't tell them
7418 					 * any was sent out.
7419 					 */
7420 					outchain = endoutchain = NULL;
7421 					auth = NULL;
7422 					auth_offset = 0;
7423 					if (!no_out_cnt)
7424 						*num_out += ctl_cnt;
7425 					/* recalc a clean slate and setup */
7426 					if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7427 						mtu = (net->mtu - SCTP_MIN_OVERHEAD);
7428 					} else {
7429 						mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
7430 					}
7431 					to_out = 0;
7432 					no_fragmentflg = 1;
7433 				}
7434 			}
7435 		}
7436 		/*********************/
7437 		/* Data transmission */
7438 		/*********************/
7439 		/*
7440 		 * if AUTH for DATA is required and no AUTH has been added
7441 		 * yet, account for this in the mtu now... if no data can be
7442 		 * bundled, this adjustment won't matter anyways since the
7443 		 * packet will be going out...
7444 		 */
7445 		if ((auth == NULL) &&
7446 		    sctp_auth_is_required_chunk(SCTP_DATA,
7447 		    stcb->asoc.peer_auth_chunks)) {
7448 			mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
7449 		}
7450 		/* now lets add any data within the MTU constraints */
7451 		if (((struct sockaddr *)&net->ro._l_addr)->sa_family == AF_INET) {
7452 			if (net->mtu > (sizeof(struct ip) + sizeof(struct sctphdr)))
7453 				omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
7454 			else
7455 				omtu = 0;
7456 		} else {
7457 			if (net->mtu > (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)))
7458 				omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
7459 			else
7460 				omtu = 0;
7461 		}
7462 		if ((((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) && (skip_data_for_this_net == 0)) ||
7463 		    (cookie)) {
7464 			for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
7465 				if (no_data_chunks) {
7466 					/* let only control go out */
7467 					*reason_code = 1;
7468 					break;
7469 				}
7470 				if (net->flight_size >= net->cwnd) {
7471 					/* skip this net, no room for data */
7472 					*reason_code = 2;
7473 					break;
7474 				}
7475 				nchk = TAILQ_NEXT(chk, sctp_next);
7476 				if (chk->whoTo != net) {
7477 					/* No, not sent to this net */
7478 					continue;
7479 				}
7480 				if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
7481 					/*-
7482 					 * strange, we have a chunk that is
7483 					 * to big for its destination and
7484 					 * yet no fragment ok flag.
7485 					 * Something went wrong when the
7486 					 * PMTU changed...we did not mark
7487 					 * this chunk for some reason?? I
7488 					 * will fix it here by letting IP
7489 					 * fragment it for now and printing
7490 					 * a warning. This really should not
7491 					 * happen ...
7492 					 */
7493 					SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
7494 					    chk->send_size, mtu);
7495 					chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
7496 				}
7497 				if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
7498 				    ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
7499 					/* ok we will add this one */
7500 
7501 					/*
7502 					 * Add an AUTH chunk, if chunk
7503 					 * requires it, save the offset into
7504 					 * the chain for AUTH
7505 					 */
7506 					if ((auth == NULL) &&
7507 					    (sctp_auth_is_required_chunk(SCTP_DATA,
7508 					    stcb->asoc.peer_auth_chunks))) {
7509 
7510 						outchain = sctp_add_auth_chunk(outchain,
7511 						    &endoutchain,
7512 						    &auth,
7513 						    &auth_offset,
7514 						    stcb,
7515 						    SCTP_DATA);
7516 						SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
7517 					}
7518 					outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0,
7519 					    chk->send_size, chk->copy_by_ref);
7520 					if (outchain == NULL) {
7521 						SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n");
7522 						if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
7523 							sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
7524 						}
7525 						*reason_code = 3;
7526 						SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
7527 						return (ENOMEM);
7528 					}
7529 					/* upate our MTU size */
7530 					/* Do clear IP_DF ? */
7531 					if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
7532 						no_fragmentflg = 0;
7533 					}
7534 					/* unsigned subtraction of mtu */
7535 					if (mtu > chk->send_size)
7536 						mtu -= chk->send_size;
7537 					else
7538 						mtu = 0;
7539 					/* unsigned subtraction of r_mtu */
7540 					if (r_mtu > chk->send_size)
7541 						r_mtu -= chk->send_size;
7542 					else
7543 						r_mtu = 0;
7544 
7545 					to_out += chk->send_size;
7546 					if ((to_out > mx_mtu) && no_fragmentflg) {
7547 #ifdef INVARIANTS
7548 						panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out);
7549 #else
7550 						SCTP_PRINTF("Exceeding mtu of %d out size is %d\n",
7551 						    mx_mtu, to_out);
7552 #endif
7553 					}
7554 					chk->window_probe = 0;
7555 					data_list[bundle_at++] = chk;
7556 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
7557 						mtu = 0;
7558 						break;
7559 					}
7560 					if (chk->sent == SCTP_DATAGRAM_UNSENT) {
7561 						if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
7562 							SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks);
7563 						} else {
7564 							SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks);
7565 						}
7566 						if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) &&
7567 						    ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0))
7568 							/*
7569 							 * Count number of
7570 							 * user msg's that
7571 							 * were fragmented
7572 							 * we do this by
7573 							 * counting when we
7574 							 * see a LAST
7575 							 * fragment only.
7576 							 */
7577 							SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs);
7578 					}
7579 					if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) {
7580 						if (one_chunk) {
7581 							data_list[0]->window_probe = 1;
7582 							net->window_probe = 1;
7583 						}
7584 						break;
7585 					}
7586 				} else {
7587 					/*
7588 					 * Must be sent in order of the
7589 					 * TSN's (on a network)
7590 					 */
7591 					break;
7592 				}
7593 			}	/* for (chunk gather loop for this net) */
7594 		}		/* if asoc.state OPEN */
7595 		/* Is there something to send for this destination? */
7596 		if (outchain) {
7597 			/* We may need to start a control timer or two */
7598 			if (asconf) {
7599 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
7600 				    stcb, net);
7601 				/*
7602 				 * do NOT clear the asconf flag as it is
7603 				 * used to do appropriate source address
7604 				 * selection.
7605 				 */
7606 			}
7607 			if (cookie) {
7608 				sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
7609 				cookie = 0;
7610 			}
7611 			/* must start a send timer if data is being sent */
7612 			if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) {
7613 				/*
7614 				 * no timer running on this destination
7615 				 * restart it.
7616 				 */
7617 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
7618 			} else if (sctp_cmt_on_off && sctp_cmt_pf && pf_hbflag && ((net->dest_state & SCTP_ADDR_PF) == SCTP_ADDR_PF)
7619 			    && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) {
7620 				/*
7621 				 * JRS 5/14/07 - If a HB has been sent to a
7622 				 * PF destination and no T3 timer is
7623 				 * currently running, start the T3 timer to
7624 				 * track the HBs that were sent.
7625 				 */
7626 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
7627 			}
7628 			/* Now send it, if there is anything to send :> */
7629 			SCTP_BUF_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
7630 			if (outchain == NULL) {
7631 				/* out of mbufs */
7632 				SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOBUFS);
7633 				error = ENOBUFS;
7634 				goto errored_send;
7635 			}
7636 			shdr = mtod(outchain, struct sctphdr *);
7637 			shdr->src_port = inp->sctp_lport;
7638 			shdr->dest_port = stcb->rport;
7639 			shdr->v_tag = htonl(stcb->asoc.peer_vtag);
7640 			shdr->checksum = 0;
7641 			auth_offset += sizeof(struct sctphdr);
7642 			if ((error = sctp_lowlevel_chunk_output(inp,
7643 			    stcb,
7644 			    net,
7645 			    (struct sockaddr *)&net->ro._l_addr,
7646 			    outchain,
7647 			    auth_offset,
7648 			    auth,
7649 			    no_fragmentflg,
7650 			    bundle_at,
7651 			    data_list[0],
7652 			    asconf, so_locked))) {
7653 				/* error, we could not output */
7654 				if (error == ENOBUFS) {
7655 					SCTP_STAT_INCR(sctps_lowlevelerr);
7656 					asoc->ifp_had_enobuf = 1;
7657 				}
7658 				if (from_where == 0) {
7659 					SCTP_STAT_INCR(sctps_lowlevelerrusr);
7660 				}
7661 		errored_send:
7662 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error);
7663 				if (hbflag) {
7664 					if (*now_filled == 0) {
7665 						(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
7666 						*now_filled = 1;
7667 						*now = net->last_sent_time;
7668 					} else {
7669 						net->last_sent_time = *now;
7670 					}
7671 					hbflag = 0;
7672 				}
7673 				if (error == EHOSTUNREACH) {
7674 					/*
7675 					 * Destination went unreachable
7676 					 * during this send
7677 					 */
7678 					sctp_move_to_an_alt(stcb, asoc, net);
7679 				}
7680 				*reason_code = 6;
7681 				/*-
7682 				 * I add this line to be paranoid. As far as
7683 				 * I can tell the continue, takes us back to
7684 				 * the top of the for, but just to make sure
7685 				 * I will reset these again here.
7686 				 */
7687 				ctl_cnt = bundle_at = 0;
7688 				continue;	/* This takes us back to the
7689 						 * for() for the nets. */
7690 			} else {
7691 				asoc->ifp_had_enobuf = 0;
7692 			}
7693 			outchain = endoutchain = NULL;
7694 			auth = NULL;
7695 			auth_offset = 0;
7696 			if (bundle_at || hbflag) {
7697 				/* For data/asconf and hb set time */
7698 				if (*now_filled == 0) {
7699 					(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
7700 					*now_filled = 1;
7701 					*now = net->last_sent_time;
7702 				} else {
7703 					net->last_sent_time = *now;
7704 				}
7705 			}
7706 			if (!no_out_cnt) {
7707 				*num_out += (ctl_cnt + bundle_at);
7708 			}
7709 			if (bundle_at) {
7710 				/* setup for a RTO measurement */
7711 				tsns_sent = data_list[0]->rec.data.TSN_seq;
7712 				/* fill time if not already filled */
7713 				if (*now_filled == 0) {
7714 					(void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
7715 					*now_filled = 1;
7716 					*now = asoc->time_last_sent;
7717 				} else {
7718 					asoc->time_last_sent = *now;
7719 				}
7720 				data_list[0]->do_rtt = 1;
7721 				SCTP_STAT_INCR_BY(sctps_senddata, bundle_at);
7722 				sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
7723 				if (sctp_early_fr) {
7724 					if (net->flight_size < net->cwnd) {
7725 						/* start or restart it */
7726 						if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
7727 							sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net,
7728 							    SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2);
7729 						}
7730 						SCTP_STAT_INCR(sctps_earlyfrstrout);
7731 						sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net);
7732 					} else {
7733 						/* stop it if its running */
7734 						if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
7735 							SCTP_STAT_INCR(sctps_earlyfrstpout);
7736 							sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net,
7737 							    SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3);
7738 						}
7739 					}
7740 				}
7741 			}
7742 			if (one_chunk) {
7743 				break;
7744 			}
7745 		}
7746 		if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
7747 			sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND);
7748 		}
7749 	}
7750 	if (old_startat == NULL) {
7751 		old_startat = send_start_at;
7752 		send_start_at = TAILQ_FIRST(&asoc->nets);
7753 		if (old_startat)
7754 			goto again_one_more_time;
7755 	}
7756 	/*
7757 	 * At the end there should be no NON timed chunks hanging on this
7758 	 * queue.
7759 	 */
7760 	if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
7761 		sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND);
7762 	}
7763 	if ((*num_out == 0) && (*reason_code == 0)) {
7764 		*reason_code = 4;
7765 	} else {
7766 		*reason_code = 5;
7767 	}
7768 	sctp_clean_up_ctl(stcb, asoc);
7769 	return (0);
7770 }
7771 
7772 void
7773 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
7774 {
7775 	/*-
7776 	 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of
7777 	 * the control chunk queue.
7778 	 */
7779 	struct sctp_chunkhdr *hdr;
7780 	struct sctp_tmit_chunk *chk;
7781 	struct mbuf *mat;
7782 
7783 	SCTP_TCB_LOCK_ASSERT(stcb);
7784 	sctp_alloc_a_chunk(stcb, chk);
7785 	if (chk == NULL) {
7786 		/* no memory */
7787 		sctp_m_freem(op_err);
7788 		return;
7789 	}
7790 	chk->copy_by_ref = 0;
7791 	SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT);
7792 	if (op_err == NULL) {
7793 		sctp_free_a_chunk(stcb, chk);
7794 		return;
7795 	}
7796 	chk->send_size = 0;
7797 	mat = op_err;
7798 	while (mat != NULL) {
7799 		chk->send_size += SCTP_BUF_LEN(mat);
7800 		mat = SCTP_BUF_NEXT(mat);
7801 	}
7802 	chk->rec.chunk_id.id = SCTP_OPERATION_ERROR;
7803 	chk->rec.chunk_id.can_take_data = 1;
7804 	chk->sent = SCTP_DATAGRAM_UNSENT;
7805 	chk->snd_count = 0;
7806 	chk->flags = 0;
7807 	chk->asoc = &stcb->asoc;
7808 	chk->data = op_err;
7809 	chk->whoTo = chk->asoc->primary_destination;
7810 	atomic_add_int(&chk->whoTo->ref_count, 1);
7811 	hdr = mtod(op_err, struct sctp_chunkhdr *);
7812 	hdr->chunk_type = SCTP_OPERATION_ERROR;
7813 	hdr->chunk_flags = 0;
7814 	hdr->chunk_length = htons(chk->send_size);
7815 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
7816 	    chk,
7817 	    sctp_next);
7818 	chk->asoc->ctrl_queue_cnt++;
7819 }
7820 
7821 int
7822 sctp_send_cookie_echo(struct mbuf *m,
7823     int offset,
7824     struct sctp_tcb *stcb,
7825     struct sctp_nets *net)
7826 {
7827 	/*-
7828 	 * pull out the cookie and put it at the front of the control chunk
7829 	 * queue.
7830 	 */
7831 	int at;
7832 	struct mbuf *cookie;
7833 	struct sctp_paramhdr parm, *phdr;
7834 	struct sctp_chunkhdr *hdr;
7835 	struct sctp_tmit_chunk *chk;
7836 	uint16_t ptype, plen;
7837 
7838 	/* First find the cookie in the param area */
7839 	cookie = NULL;
7840 	at = offset + sizeof(struct sctp_init_chunk);
7841 
7842 	SCTP_TCB_LOCK_ASSERT(stcb);
7843 	do {
7844 		phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
7845 		if (phdr == NULL) {
7846 			return (-3);
7847 		}
7848 		ptype = ntohs(phdr->param_type);
7849 		plen = ntohs(phdr->param_length);
7850 		if (ptype == SCTP_STATE_COOKIE) {
7851 			int pad;
7852 
7853 			/* found the cookie */
7854 			if ((pad = (plen % 4))) {
7855 				plen += 4 - pad;
7856 			}
7857 			cookie = SCTP_M_COPYM(m, at, plen, M_DONTWAIT);
7858 			if (cookie == NULL) {
7859 				/* No memory */
7860 				return (-2);
7861 			}
7862 			break;
7863 		}
7864 		at += SCTP_SIZE32(plen);
7865 	} while (phdr);
7866 	if (cookie == NULL) {
7867 		/* Did not find the cookie */
7868 		return (-3);
7869 	}
7870 	/* ok, we got the cookie lets change it into a cookie echo chunk */
7871 
7872 	/* first the change from param to cookie */
7873 	hdr = mtod(cookie, struct sctp_chunkhdr *);
7874 	hdr->chunk_type = SCTP_COOKIE_ECHO;
7875 	hdr->chunk_flags = 0;
7876 	/* get the chunk stuff now and place it in the FRONT of the queue */
7877 	sctp_alloc_a_chunk(stcb, chk);
7878 	if (chk == NULL) {
7879 		/* no memory */
7880 		sctp_m_freem(cookie);
7881 		return (-5);
7882 	}
7883 	chk->copy_by_ref = 0;
7884 	chk->send_size = plen;
7885 	chk->rec.chunk_id.id = SCTP_COOKIE_ECHO;
7886 	chk->rec.chunk_id.can_take_data = 0;
7887 	chk->sent = SCTP_DATAGRAM_UNSENT;
7888 	chk->snd_count = 0;
7889 	chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
7890 	chk->asoc = &stcb->asoc;
7891 	chk->data = cookie;
7892 	chk->whoTo = chk->asoc->primary_destination;
7893 	atomic_add_int(&chk->whoTo->ref_count, 1);
7894 	TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
7895 	chk->asoc->ctrl_queue_cnt++;
7896 	return (0);
7897 }
7898 
7899 void
7900 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
7901     struct mbuf *m,
7902     int offset,
7903     int chk_length,
7904     struct sctp_nets *net)
7905 {
7906 	/*
7907 	 * take a HB request and make it into a HB ack and send it.
7908 	 */
7909 	struct mbuf *outchain;
7910 	struct sctp_chunkhdr *chdr;
7911 	struct sctp_tmit_chunk *chk;
7912 
7913 
7914 	if (net == NULL)
7915 		/* must have a net pointer */
7916 		return;
7917 
7918 	outchain = SCTP_M_COPYM(m, offset, chk_length, M_DONTWAIT);
7919 	if (outchain == NULL) {
7920 		/* gak out of memory */
7921 		return;
7922 	}
7923 	chdr = mtod(outchain, struct sctp_chunkhdr *);
7924 	chdr->chunk_type = SCTP_HEARTBEAT_ACK;
7925 	chdr->chunk_flags = 0;
7926 	if (chk_length % 4) {
7927 		/* need pad */
7928 		uint32_t cpthis = 0;
7929 		int padlen;
7930 
7931 		padlen = 4 - (chk_length % 4);
7932 		m_copyback(outchain, chk_length, padlen, (caddr_t)&cpthis);
7933 	}
7934 	sctp_alloc_a_chunk(stcb, chk);
7935 	if (chk == NULL) {
7936 		/* no memory */
7937 		sctp_m_freem(outchain);
7938 		return;
7939 	}
7940 	chk->copy_by_ref = 0;
7941 	chk->send_size = chk_length;
7942 	chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK;
7943 	chk->rec.chunk_id.can_take_data = 1;
7944 	chk->sent = SCTP_DATAGRAM_UNSENT;
7945 	chk->snd_count = 0;
7946 	chk->flags = 0;
7947 	chk->asoc = &stcb->asoc;
7948 	chk->data = outchain;
7949 	chk->whoTo = net;
7950 	atomic_add_int(&chk->whoTo->ref_count, 1);
7951 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
7952 	chk->asoc->ctrl_queue_cnt++;
7953 }
7954 
7955 void
7956 sctp_send_cookie_ack(struct sctp_tcb *stcb)
7957 {
7958 	/* formulate and queue a cookie-ack back to sender */
7959 	struct mbuf *cookie_ack;
7960 	struct sctp_chunkhdr *hdr;
7961 	struct sctp_tmit_chunk *chk;
7962 
7963 	cookie_ack = NULL;
7964 	SCTP_TCB_LOCK_ASSERT(stcb);
7965 
7966 	cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_DONTWAIT, 1, MT_HEADER);
7967 	if (cookie_ack == NULL) {
7968 		/* no mbuf's */
7969 		return;
7970 	}
7971 	SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD);
7972 	sctp_alloc_a_chunk(stcb, chk);
7973 	if (chk == NULL) {
7974 		/* no memory */
7975 		sctp_m_freem(cookie_ack);
7976 		return;
7977 	}
7978 	chk->copy_by_ref = 0;
7979 	chk->send_size = sizeof(struct sctp_chunkhdr);
7980 	chk->rec.chunk_id.id = SCTP_COOKIE_ACK;
7981 	chk->rec.chunk_id.can_take_data = 1;
7982 	chk->sent = SCTP_DATAGRAM_UNSENT;
7983 	chk->snd_count = 0;
7984 	chk->flags = 0;
7985 	chk->asoc = &stcb->asoc;
7986 	chk->data = cookie_ack;
7987 	if (chk->asoc->last_control_chunk_from != NULL) {
7988 		chk->whoTo = chk->asoc->last_control_chunk_from;
7989 	} else {
7990 		chk->whoTo = chk->asoc->primary_destination;
7991 	}
7992 	atomic_add_int(&chk->whoTo->ref_count, 1);
7993 	hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
7994 	hdr->chunk_type = SCTP_COOKIE_ACK;
7995 	hdr->chunk_flags = 0;
7996 	hdr->chunk_length = htons(chk->send_size);
7997 	SCTP_BUF_LEN(cookie_ack) = chk->send_size;
7998 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
7999 	chk->asoc->ctrl_queue_cnt++;
8000 	return;
8001 }
8002 
8003 
8004 void
8005 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
8006 {
8007 	/* formulate and queue a SHUTDOWN-ACK back to the sender */
8008 	struct mbuf *m_shutdown_ack;
8009 	struct sctp_shutdown_ack_chunk *ack_cp;
8010 	struct sctp_tmit_chunk *chk;
8011 
8012 	m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_DONTWAIT, 1, MT_HEADER);
8013 	if (m_shutdown_ack == NULL) {
8014 		/* no mbuf's */
8015 		return;
8016 	}
8017 	SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD);
8018 	sctp_alloc_a_chunk(stcb, chk);
8019 	if (chk == NULL) {
8020 		/* no memory */
8021 		sctp_m_freem(m_shutdown_ack);
8022 		return;
8023 	}
8024 	chk->copy_by_ref = 0;
8025 	chk->send_size = sizeof(struct sctp_chunkhdr);
8026 	chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK;
8027 	chk->rec.chunk_id.can_take_data = 1;
8028 	chk->sent = SCTP_DATAGRAM_UNSENT;
8029 	chk->snd_count = 0;
8030 	chk->flags = 0;
8031 	chk->asoc = &stcb->asoc;
8032 	chk->data = m_shutdown_ack;
8033 	chk->whoTo = net;
8034 	atomic_add_int(&net->ref_count, 1);
8035 
8036 	ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
8037 	ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
8038 	ack_cp->ch.chunk_flags = 0;
8039 	ack_cp->ch.chunk_length = htons(chk->send_size);
8040 	SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size;
8041 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
8042 	chk->asoc->ctrl_queue_cnt++;
8043 	return;
8044 }
8045 
8046 void
8047 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
8048 {
8049 	/* formulate and queue a SHUTDOWN to the sender */
8050 	struct mbuf *m_shutdown;
8051 	struct sctp_shutdown_chunk *shutdown_cp;
8052 	struct sctp_tmit_chunk *chk;
8053 
8054 	m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_DONTWAIT, 1, MT_HEADER);
8055 	if (m_shutdown == NULL) {
8056 		/* no mbuf's */
8057 		return;
8058 	}
8059 	SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD);
8060 	sctp_alloc_a_chunk(stcb, chk);
8061 	if (chk == NULL) {
8062 		/* no memory */
8063 		sctp_m_freem(m_shutdown);
8064 		return;
8065 	}
8066 	chk->copy_by_ref = 0;
8067 	chk->send_size = sizeof(struct sctp_shutdown_chunk);
8068 	chk->rec.chunk_id.id = SCTP_SHUTDOWN;
8069 	chk->rec.chunk_id.can_take_data = 1;
8070 	chk->sent = SCTP_DATAGRAM_UNSENT;
8071 	chk->snd_count = 0;
8072 	chk->flags = 0;
8073 	chk->asoc = &stcb->asoc;
8074 	chk->data = m_shutdown;
8075 	chk->whoTo = net;
8076 	atomic_add_int(&net->ref_count, 1);
8077 
8078 	shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
8079 	shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
8080 	shutdown_cp->ch.chunk_flags = 0;
8081 	shutdown_cp->ch.chunk_length = htons(chk->send_size);
8082 	shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
8083 	SCTP_BUF_LEN(m_shutdown) = chk->send_size;
8084 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
8085 	chk->asoc->ctrl_queue_cnt++;
8086 	return;
8087 }
8088 
8089 void
8090 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked)
8091 {
8092 	/*
8093 	 * formulate and queue an ASCONF to the peer. ASCONF parameters
8094 	 * should be queued on the assoc queue.
8095 	 */
8096 	struct sctp_tmit_chunk *chk;
8097 	struct mbuf *m_asconf;
8098 	struct sctp_asconf_chunk *acp;
8099 	int len;
8100 
8101 	SCTP_TCB_LOCK_ASSERT(stcb);
8102 	/* compose an ASCONF chunk, maximum length is PMTU */
8103 	m_asconf = sctp_compose_asconf(stcb, &len, addr_locked);
8104 	if (m_asconf == NULL) {
8105 		return;
8106 	}
8107 	acp = mtod(m_asconf, struct sctp_asconf_chunk *);
8108 	sctp_alloc_a_chunk(stcb, chk);
8109 	if (chk == NULL) {
8110 		/* no memory */
8111 		sctp_m_freem(m_asconf);
8112 		return;
8113 	}
8114 	chk->copy_by_ref = 0;
8115 	chk->data = m_asconf;
8116 	chk->send_size = len;
8117 	chk->rec.chunk_id.id = SCTP_ASCONF;
8118 	chk->rec.chunk_id.can_take_data = 0;
8119 	chk->sent = SCTP_DATAGRAM_UNSENT;
8120 	chk->snd_count = 0;
8121 	chk->flags = 0;
8122 	chk->asoc = &stcb->asoc;
8123 	chk->whoTo = chk->asoc->primary_destination;
8124 	atomic_add_int(&chk->whoTo->ref_count, 1);
8125 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
8126 	chk->asoc->ctrl_queue_cnt++;
8127 	return;
8128 }
8129 
8130 void
8131 sctp_send_asconf_ack(struct sctp_tcb *stcb)
8132 {
8133 	/*
8134 	 * formulate and queue a asconf-ack back to sender. the asconf-ack
8135 	 * must be stored in the tcb.
8136 	 */
8137 	struct sctp_tmit_chunk *chk;
8138 	struct sctp_asconf_ack *ack, *latest_ack;
8139 	struct mbuf *m_ack, *m;
8140 	struct sctp_nets *net = NULL;
8141 
8142 	SCTP_TCB_LOCK_ASSERT(stcb);
8143 	/* Get the latest ASCONF-ACK */
8144 	latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead);
8145 	if (latest_ack == NULL) {
8146 		return;
8147 	}
8148 	if (latest_ack->last_sent_to != NULL &&
8149 	    latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) {
8150 		/* we're doing a retransmission */
8151 		net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0);
8152 		if (net == NULL) {
8153 			/* no alternate */
8154 			if (stcb->asoc.last_control_chunk_from == NULL)
8155 				net = stcb->asoc.primary_destination;
8156 			else
8157 				net = stcb->asoc.last_control_chunk_from;
8158 		}
8159 	} else {
8160 		/* normal case */
8161 		if (stcb->asoc.last_control_chunk_from == NULL)
8162 			net = stcb->asoc.primary_destination;
8163 		else
8164 			net = stcb->asoc.last_control_chunk_from;
8165 	}
8166 	latest_ack->last_sent_to = net;
8167 
8168 	TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) {
8169 		if (ack->data == NULL) {
8170 			continue;
8171 		}
8172 		/* copy the asconf_ack */
8173 		m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_DONTWAIT);
8174 		if (m_ack == NULL) {
8175 			/* couldn't copy it */
8176 			return;
8177 		}
8178 		sctp_alloc_a_chunk(stcb, chk);
8179 		if (chk == NULL) {
8180 			/* no memory */
8181 			if (m_ack)
8182 				sctp_m_freem(m_ack);
8183 			return;
8184 		}
8185 		chk->copy_by_ref = 0;
8186 
8187 		chk->whoTo = net;
8188 		chk->data = m_ack;
8189 		chk->send_size = 0;
8190 		/* Get size */
8191 		m = m_ack;
8192 		chk->send_size = ack->len;
8193 		chk->rec.chunk_id.id = SCTP_ASCONF_ACK;
8194 		chk->rec.chunk_id.can_take_data = 1;
8195 		chk->sent = SCTP_DATAGRAM_UNSENT;
8196 		chk->snd_count = 0;
8197 		chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;	/* XXX */
8198 		chk->asoc = &stcb->asoc;
8199 		atomic_add_int(&chk->whoTo->ref_count, 1);
8200 
8201 		TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
8202 		chk->asoc->ctrl_queue_cnt++;
8203 	}
8204 	return;
8205 }
8206 
8207 
8208 static int
8209 sctp_chunk_retransmission(struct sctp_inpcb *inp,
8210     struct sctp_tcb *stcb,
8211     struct sctp_association *asoc,
8212     int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked
8213 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
8214     SCTP_UNUSED
8215 #endif
8216 )
8217 {
8218 	/*-
8219 	 * send out one MTU of retransmission. If fast_retransmit is
8220 	 * happening we ignore the cwnd. Otherwise we obey the cwnd and
8221 	 * rwnd. For a Cookie or Asconf in the control chunk queue we
8222 	 * retransmit them by themselves.
8223 	 *
8224 	 * For data chunks we will pick out the lowest TSN's in the sent_queue
8225 	 * marked for resend and bundle them all together (up to a MTU of
8226 	 * destination). The address to send to should have been
8227 	 * selected/changed where the retransmission was marked (i.e. in FR
8228 	 * or t3-timeout routines).
8229 	 */
8230 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
8231 	struct sctp_tmit_chunk *chk, *fwd;
8232 	struct mbuf *m, *endofchain;
8233 	struct sctphdr *shdr;
8234 	int asconf;
8235 	struct sctp_nets *net = NULL;
8236 	uint32_t tsns_sent = 0;
8237 	int no_fragmentflg, bundle_at, cnt_thru;
8238 	unsigned int mtu;
8239 	int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
8240 	struct sctp_auth_chunk *auth = NULL;
8241 	uint32_t auth_offset = 0;
8242 	uint32_t dmtu = 0;
8243 
8244 	SCTP_TCB_LOCK_ASSERT(stcb);
8245 	tmr_started = ctl_cnt = bundle_at = error = 0;
8246 	no_fragmentflg = 1;
8247 	asconf = 0;
8248 	fwd_tsn = 0;
8249 	*cnt_out = 0;
8250 	fwd = NULL;
8251 	endofchain = m = NULL;
8252 #ifdef SCTP_AUDITING_ENABLED
8253 	sctp_audit_log(0xC3, 1);
8254 #endif
8255 	if ((TAILQ_EMPTY(&asoc->sent_queue)) &&
8256 	    (TAILQ_EMPTY(&asoc->control_send_queue))) {
8257 		SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n",
8258 		    asoc->sent_queue_retran_cnt);
8259 		asoc->sent_queue_cnt = 0;
8260 		asoc->sent_queue_cnt_removeable = 0;
8261 		/* send back 0/0 so we enter normal transmission */
8262 		*cnt_out = 0;
8263 		return (0);
8264 	}
8265 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
8266 		if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) ||
8267 		    (chk->rec.chunk_id.id == SCTP_ASCONF) ||
8268 		    (chk->rec.chunk_id.id == SCTP_STREAM_RESET) ||
8269 		    (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) {
8270 			if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) {
8271 				if (chk != asoc->str_reset) {
8272 					/*
8273 					 * not eligible for retran if its
8274 					 * not ours
8275 					 */
8276 					continue;
8277 				}
8278 			}
8279 			ctl_cnt++;
8280 			if (chk->rec.chunk_id.id == SCTP_ASCONF) {
8281 				no_fragmentflg = 1;
8282 				asconf = 1;
8283 			}
8284 			if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) {
8285 				fwd_tsn = 1;
8286 				fwd = chk;
8287 			}
8288 			/*
8289 			 * Add an AUTH chunk, if chunk requires it save the
8290 			 * offset into the chain for AUTH
8291 			 */
8292 			if ((auth == NULL) &&
8293 			    (sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
8294 			    stcb->asoc.peer_auth_chunks))) {
8295 				m = sctp_add_auth_chunk(m, &endofchain,
8296 				    &auth, &auth_offset,
8297 				    stcb,
8298 				    chk->rec.chunk_id.id);
8299 			}
8300 			m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref);
8301 			break;
8302 		}
8303 	}
8304 	one_chunk = 0;
8305 	cnt_thru = 0;
8306 	/* do we have control chunks to retransmit? */
8307 	if (m != NULL) {
8308 		/* Start a timer no matter if we suceed or fail */
8309 		if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
8310 			sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
8311 		} else if (chk->rec.chunk_id.id == SCTP_ASCONF)
8312 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
8313 
8314 		SCTP_BUF_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
8315 		if (m == NULL) {
8316 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOBUFS);
8317 			return (ENOBUFS);
8318 		}
8319 		shdr = mtod(m, struct sctphdr *);
8320 		shdr->src_port = inp->sctp_lport;
8321 		shdr->dest_port = stcb->rport;
8322 		shdr->v_tag = htonl(stcb->asoc.peer_vtag);
8323 		shdr->checksum = 0;
8324 		auth_offset += sizeof(struct sctphdr);
8325 		chk->snd_count++;	/* update our count */
8326 
8327 		if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
8328 		    (struct sockaddr *)&chk->whoTo->ro._l_addr, m, auth_offset,
8329 		    auth, no_fragmentflg, 0, NULL, asconf, so_locked))) {
8330 			SCTP_STAT_INCR(sctps_lowlevelerr);
8331 			return (error);
8332 		}
8333 		m = endofchain = NULL;
8334 		auth = NULL;
8335 		auth_offset = 0;
8336 		/*
8337 		 * We don't want to mark the net->sent time here since this
8338 		 * we use this for HB and retrans cannot measure RTT
8339 		 */
8340 		/* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */
8341 		*cnt_out += 1;
8342 		chk->sent = SCTP_DATAGRAM_SENT;
8343 		sctp_ucount_decr(asoc->sent_queue_retran_cnt);
8344 		if (fwd_tsn == 0) {
8345 			return (0);
8346 		} else {
8347 			/* Clean up the fwd-tsn list */
8348 			sctp_clean_up_ctl(stcb, asoc);
8349 			return (0);
8350 		}
8351 	}
8352 	/*
8353 	 * Ok, it is just data retransmission we need to do or that and a
8354 	 * fwd-tsn with it all.
8355 	 */
8356 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
8357 		return (SCTP_RETRAN_DONE);
8358 	}
8359 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
8360 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
8361 		/* not yet open, resend the cookie and that is it */
8362 		return (1);
8363 	}
8364 #ifdef SCTP_AUDITING_ENABLED
8365 	sctp_auditing(20, inp, stcb, NULL);
8366 #endif
8367 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
8368 		if (chk->sent != SCTP_DATAGRAM_RESEND) {
8369 			/* No, not sent to this net or not ready for rtx */
8370 			continue;
8371 		}
8372 		if ((sctp_max_retran_chunk) && (chk->snd_count >= sctp_max_retran_chunk)) {
8373 			/* Gak, we have exceeded max unlucky retran, abort! */
8374 			SCTP_PRINTF("Gak, chk->snd_count:%d >= max:%d - send abort\n",
8375 			    chk->snd_count,
8376 			    sctp_max_retran_chunk);
8377 			atomic_add_int(&stcb->asoc.refcnt, 1);
8378 			sctp_abort_an_association(stcb->sctp_ep, stcb, 0, NULL, so_locked);
8379 			SCTP_TCB_LOCK(stcb);
8380 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
8381 			return (SCTP_RETRAN_EXIT);
8382 		}
8383 		/* pick up the net */
8384 		net = chk->whoTo;
8385 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
8386 			mtu = (net->mtu - SCTP_MIN_OVERHEAD);
8387 		} else {
8388 			mtu = net->mtu - SCTP_MIN_V4_OVERHEAD;
8389 		}
8390 
8391 		if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
8392 			/* No room in peers rwnd */
8393 			uint32_t tsn;
8394 
8395 			tsn = asoc->last_acked_seq + 1;
8396 			if (tsn == chk->rec.data.TSN_seq) {
8397 				/*
8398 				 * we make a special exception for this
8399 				 * case. The peer has no rwnd but is missing
8400 				 * the lowest chunk.. which is probably what
8401 				 * is holding up the rwnd.
8402 				 */
8403 				goto one_chunk_around;
8404 			}
8405 			return (1);
8406 		}
8407 one_chunk_around:
8408 		if (asoc->peers_rwnd < mtu) {
8409 			one_chunk = 1;
8410 			if ((asoc->peers_rwnd == 0) &&
8411 			    (asoc->total_flight == 0)) {
8412 				chk->window_probe = 1;
8413 				chk->whoTo->window_probe = 1;
8414 			}
8415 		}
8416 #ifdef SCTP_AUDITING_ENABLED
8417 		sctp_audit_log(0xC3, 2);
8418 #endif
8419 		bundle_at = 0;
8420 		m = NULL;
8421 		net->fast_retran_ip = 0;
8422 		if (chk->rec.data.doing_fast_retransmit == 0) {
8423 			/*
8424 			 * if no FR in progress skip destination that have
8425 			 * flight_size > cwnd.
8426 			 */
8427 			if (net->flight_size >= net->cwnd) {
8428 				continue;
8429 			}
8430 		} else {
8431 			/*
8432 			 * Mark the destination net to have FR recovery
8433 			 * limits put on it.
8434 			 */
8435 			*fr_done = 1;
8436 			net->fast_retran_ip = 1;
8437 		}
8438 
8439 		/*
8440 		 * if no AUTH is yet included and this chunk requires it,
8441 		 * make sure to account for it.  We don't apply the size
8442 		 * until the AUTH chunk is actually added below in case
8443 		 * there is no room for this chunk.
8444 		 */
8445 		if ((auth == NULL) &&
8446 		    sctp_auth_is_required_chunk(SCTP_DATA,
8447 		    stcb->asoc.peer_auth_chunks)) {
8448 			dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
8449 		} else
8450 			dmtu = 0;
8451 
8452 		if ((chk->send_size <= (mtu - dmtu)) ||
8453 		    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
8454 			/* ok we will add this one */
8455 			if ((auth == NULL) &&
8456 			    (sctp_auth_is_required_chunk(SCTP_DATA,
8457 			    stcb->asoc.peer_auth_chunks))) {
8458 				m = sctp_add_auth_chunk(m, &endofchain,
8459 				    &auth, &auth_offset,
8460 				    stcb, SCTP_DATA);
8461 			}
8462 			m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref);
8463 			if (m == NULL) {
8464 				SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
8465 				return (ENOMEM);
8466 			}
8467 			/* Do clear IP_DF ? */
8468 			if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
8469 				no_fragmentflg = 0;
8470 			}
8471 			/* upate our MTU size */
8472 			if (mtu > (chk->send_size + dmtu))
8473 				mtu -= (chk->send_size + dmtu);
8474 			else
8475 				mtu = 0;
8476 			data_list[bundle_at++] = chk;
8477 			if (one_chunk && (asoc->total_flight <= 0)) {
8478 				SCTP_STAT_INCR(sctps_windowprobed);
8479 			}
8480 		}
8481 		if (one_chunk == 0) {
8482 			/*
8483 			 * now are there anymore forward from chk to pick
8484 			 * up?
8485 			 */
8486 			fwd = TAILQ_NEXT(chk, sctp_next);
8487 			while (fwd) {
8488 				if (fwd->sent != SCTP_DATAGRAM_RESEND) {
8489 					/* Nope, not for retran */
8490 					fwd = TAILQ_NEXT(fwd, sctp_next);
8491 					continue;
8492 				}
8493 				if (fwd->whoTo != net) {
8494 					/* Nope, not the net in question */
8495 					fwd = TAILQ_NEXT(fwd, sctp_next);
8496 					continue;
8497 				}
8498 				if ((auth == NULL) &&
8499 				    sctp_auth_is_required_chunk(SCTP_DATA,
8500 				    stcb->asoc.peer_auth_chunks)) {
8501 					dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
8502 				} else
8503 					dmtu = 0;
8504 				if (fwd->send_size <= (mtu - dmtu)) {
8505 					if ((auth == NULL) &&
8506 					    (sctp_auth_is_required_chunk(SCTP_DATA,
8507 					    stcb->asoc.peer_auth_chunks))) {
8508 						m = sctp_add_auth_chunk(m,
8509 						    &endofchain,
8510 						    &auth, &auth_offset,
8511 						    stcb,
8512 						    SCTP_DATA);
8513 					}
8514 					m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref);
8515 					if (m == NULL) {
8516 						SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
8517 						return (ENOMEM);
8518 					}
8519 					/* Do clear IP_DF ? */
8520 					if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
8521 						no_fragmentflg = 0;
8522 					}
8523 					/* upate our MTU size */
8524 					if (mtu > (fwd->send_size + dmtu))
8525 						mtu -= (fwd->send_size + dmtu);
8526 					else
8527 						mtu = 0;
8528 					data_list[bundle_at++] = fwd;
8529 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
8530 						break;
8531 					}
8532 					fwd = TAILQ_NEXT(fwd, sctp_next);
8533 				} else {
8534 					/* can't fit so we are done */
8535 					break;
8536 				}
8537 			}
8538 		}
8539 		/* Is there something to send for this destination? */
8540 		if (m) {
8541 			/*
8542 			 * No matter if we fail/or suceed we should start a
8543 			 * timer. A failure is like a lost IP packet :-)
8544 			 */
8545 			if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
8546 				/*
8547 				 * no timer running on this destination
8548 				 * restart it.
8549 				 */
8550 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
8551 				tmr_started = 1;
8552 			}
8553 			SCTP_BUF_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
8554 			if (m == NULL) {
8555 				SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOBUFS);
8556 				return (ENOBUFS);
8557 			}
8558 			shdr = mtod(m, struct sctphdr *);
8559 			shdr->src_port = inp->sctp_lport;
8560 			shdr->dest_port = stcb->rport;
8561 			shdr->v_tag = htonl(stcb->asoc.peer_vtag);
8562 			shdr->checksum = 0;
8563 			auth_offset += sizeof(struct sctphdr);
8564 			/* Now lets send it, if there is anything to send :> */
8565 			if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
8566 			    (struct sockaddr *)&net->ro._l_addr, m, auth_offset,
8567 			    auth, no_fragmentflg, 0, NULL, asconf, so_locked))) {
8568 				/* error, we could not output */
8569 				SCTP_STAT_INCR(sctps_lowlevelerr);
8570 				return (error);
8571 			}
8572 			m = endofchain = NULL;
8573 			auth = NULL;
8574 			auth_offset = 0;
8575 			/* For HB's */
8576 			/*
8577 			 * We don't want to mark the net->sent time here
8578 			 * since this we use this for HB and retrans cannot
8579 			 * measure RTT
8580 			 */
8581 			/* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */
8582 
8583 			/* For auto-close */
8584 			cnt_thru++;
8585 			if (*now_filled == 0) {
8586 				(void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
8587 				*now = asoc->time_last_sent;
8588 				*now_filled = 1;
8589 			} else {
8590 				asoc->time_last_sent = *now;
8591 			}
8592 			*cnt_out += bundle_at;
8593 #ifdef SCTP_AUDITING_ENABLED
8594 			sctp_audit_log(0xC4, bundle_at);
8595 #endif
8596 			if (bundle_at) {
8597 				tsns_sent = data_list[0]->rec.data.TSN_seq;
8598 			}
8599 			for (i = 0; i < bundle_at; i++) {
8600 				SCTP_STAT_INCR(sctps_sendretransdata);
8601 				data_list[i]->sent = SCTP_DATAGRAM_SENT;
8602 				/*
8603 				 * When we have a revoked data, and we
8604 				 * retransmit it, then we clear the revoked
8605 				 * flag since this flag dictates if we
8606 				 * subtracted from the fs
8607 				 */
8608 				if (data_list[i]->rec.data.chunk_was_revoked) {
8609 					/* Deflate the cwnd */
8610 					data_list[i]->whoTo->cwnd -= data_list[i]->book_size;
8611 					data_list[i]->rec.data.chunk_was_revoked = 0;
8612 				}
8613 				data_list[i]->snd_count++;
8614 				sctp_ucount_decr(asoc->sent_queue_retran_cnt);
8615 				/* record the time */
8616 				data_list[i]->sent_rcv_time = asoc->time_last_sent;
8617 				if (data_list[i]->book_size_scale) {
8618 					/*
8619 					 * need to double the book size on
8620 					 * this one
8621 					 */
8622 					data_list[i]->book_size_scale = 0;
8623 					/*
8624 					 * Since we double the booksize, we
8625 					 * must also double the output queue
8626 					 * size, since this get shrunk when
8627 					 * we free by this amount.
8628 					 */
8629 					atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size);
8630 					data_list[i]->book_size *= 2;
8631 
8632 
8633 				} else {
8634 					if (sctp_logging_level & SCTP_LOG_RWND_ENABLE) {
8635 						sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
8636 						    asoc->peers_rwnd, data_list[i]->send_size, sctp_peer_chunk_oh);
8637 					}
8638 					asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
8639 					    (uint32_t) (data_list[i]->send_size +
8640 					    sctp_peer_chunk_oh));
8641 				}
8642 				if (sctp_logging_level & SCTP_FLIGHT_LOGGING_ENABLE) {
8643 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND,
8644 					    data_list[i]->whoTo->flight_size,
8645 					    data_list[i]->book_size,
8646 					    (uintptr_t) data_list[i]->whoTo,
8647 					    data_list[i]->rec.data.TSN_seq);
8648 				}
8649 				sctp_flight_size_increase(data_list[i]);
8650 				sctp_total_flight_increase(stcb, data_list[i]);
8651 				if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
8652 					/* SWS sender side engages */
8653 					asoc->peers_rwnd = 0;
8654 				}
8655 				if ((i == 0) &&
8656 				    (data_list[i]->rec.data.doing_fast_retransmit)) {
8657 					SCTP_STAT_INCR(sctps_sendfastretrans);
8658 					if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
8659 					    (tmr_started == 0)) {
8660 						/*-
8661 						 * ok we just fast-retrans'd
8662 						 * the lowest TSN, i.e the
8663 						 * first on the list. In
8664 						 * this case we want to give
8665 						 * some more time to get a
8666 						 * SACK back without a
8667 						 * t3-expiring.
8668 						 */
8669 						sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net,
8670 						    SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4);
8671 						sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
8672 					}
8673 				}
8674 			}
8675 			if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
8676 				sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND);
8677 			}
8678 #ifdef SCTP_AUDITING_ENABLED
8679 			sctp_auditing(21, inp, stcb, NULL);
8680 #endif
8681 		} else {
8682 			/* None will fit */
8683 			return (1);
8684 		}
8685 		if (asoc->sent_queue_retran_cnt <= 0) {
8686 			/* all done we have no more to retran */
8687 			asoc->sent_queue_retran_cnt = 0;
8688 			break;
8689 		}
8690 		if (one_chunk) {
8691 			/* No more room in rwnd */
8692 			return (1);
8693 		}
8694 		/* stop the for loop here. we sent out a packet */
8695 		break;
8696 	}
8697 	return (0);
8698 }
8699 
8700 
8701 static int
8702 sctp_timer_validation(struct sctp_inpcb *inp,
8703     struct sctp_tcb *stcb,
8704     struct sctp_association *asoc,
8705     int ret)
8706 {
8707 	struct sctp_nets *net;
8708 
8709 	/* Validate that a timer is running somewhere */
8710 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
8711 		if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
8712 			/* Here is a timer */
8713 			return (ret);
8714 		}
8715 	}
8716 	SCTP_TCB_LOCK_ASSERT(stcb);
8717 	/* Gak, we did not have a timer somewhere */
8718 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n");
8719 	sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
8720 	return (ret);
8721 }
8722 
8723 void
8724 sctp_chunk_output(struct sctp_inpcb *inp,
8725     struct sctp_tcb *stcb,
8726     int from_where,
8727     int so_locked
8728 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
8729     SCTP_UNUSED
8730 #endif
8731 )
8732 {
8733 	/*-
8734 	 * Ok this is the generic chunk service queue. we must do the
8735 	 * following:
8736 	 * - See if there are retransmits pending, if so we must
8737 	 *   do these first.
8738 	 * - Service the stream queue that is next, moving any
8739 	 *   message (note I must get a complete message i.e.
8740 	 *   FIRST/MIDDLE and LAST to the out queue in one pass) and assigning
8741 	 *   TSN's
8742 	 * - Check to see if the cwnd/rwnd allows any output, if so we
8743 	 *   go ahead and fomulate and send the low level chunks. Making sure
8744 	 *   to combine any control in the control chunk queue also.
8745 	 */
8746 	struct sctp_association *asoc;
8747 	struct sctp_nets *net;
8748 	int error = 0, num_out = 0, tot_out = 0, ret = 0, reason_code = 0,
8749 	    burst_cnt = 0, burst_limit = 0;
8750 	struct timeval now;
8751 	int now_filled = 0;
8752 	int cwnd_full = 0;
8753 	int nagle_on = 0;
8754 	int frag_point = sctp_get_frag_point(stcb, &stcb->asoc);
8755 	int un_sent = 0;
8756 	int fr_done, tot_frs = 0;
8757 
8758 	asoc = &stcb->asoc;
8759 	if (from_where == SCTP_OUTPUT_FROM_USR_SEND) {
8760 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) {
8761 			nagle_on = 0;
8762 		} else {
8763 			nagle_on = 1;
8764 		}
8765 	}
8766 	SCTP_TCB_LOCK_ASSERT(stcb);
8767 
8768 	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
8769 
8770 	if ((un_sent <= 0) &&
8771 	    (TAILQ_EMPTY(&asoc->control_send_queue)) &&
8772 	    (asoc->sent_queue_retran_cnt == 0)) {
8773 		/* Nothing to do unless there is something to be sent left */
8774 		return;
8775 	}
8776 	/*
8777 	 * Do we have something to send, data or control AND a sack timer
8778 	 * running, if so piggy-back the sack.
8779 	 */
8780 	if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
8781 		sctp_send_sack(stcb);
8782 		(void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
8783 	}
8784 	while (asoc->sent_queue_retran_cnt) {
8785 		/*-
8786 		 * Ok, it is retransmission time only, we send out only ONE
8787 		 * packet with a single call off to the retran code.
8788 		 */
8789 		if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) {
8790 			/*-
8791 			 * Special hook for handling cookiess discarded
8792 			 * by peer that carried data. Send cookie-ack only
8793 			 * and then the next call with get the retran's.
8794 			 */
8795 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
8796 			    &cwnd_full, from_where,
8797 			    &now, &now_filled, frag_point, so_locked);
8798 			return;
8799 		} else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) {
8800 			/* if its not from a HB then do it */
8801 			fr_done = 0;
8802 			ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked);
8803 			if (fr_done) {
8804 				tot_frs++;
8805 			}
8806 		} else {
8807 			/*
8808 			 * its from any other place, we don't allow retran
8809 			 * output (only control)
8810 			 */
8811 			ret = 1;
8812 		}
8813 		if (ret > 0) {
8814 			/* Can't send anymore */
8815 			/*-
8816 			 * now lets push out control by calling med-level
8817 			 * output once. this assures that we WILL send HB's
8818 			 * if queued too.
8819 			 */
8820 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
8821 			    &cwnd_full, from_where,
8822 			    &now, &now_filled, frag_point, so_locked);
8823 #ifdef SCTP_AUDITING_ENABLED
8824 			sctp_auditing(8, inp, stcb, NULL);
8825 #endif
8826 			(void)sctp_timer_validation(inp, stcb, asoc, ret);
8827 			return;
8828 		}
8829 		if (ret < 0) {
8830 			/*-
8831 			 * The count was off.. retran is not happening so do
8832 			 * the normal retransmission.
8833 			 */
8834 #ifdef SCTP_AUDITING_ENABLED
8835 			sctp_auditing(9, inp, stcb, NULL);
8836 #endif
8837 			if (ret == SCTP_RETRAN_EXIT) {
8838 				return;
8839 			}
8840 			break;
8841 		}
8842 		if (from_where == SCTP_OUTPUT_FROM_T3) {
8843 			/* Only one transmission allowed out of a timeout */
8844 #ifdef SCTP_AUDITING_ENABLED
8845 			sctp_auditing(10, inp, stcb, NULL);
8846 #endif
8847 			/* Push out any control */
8848 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
8849 			    &now, &now_filled, frag_point, so_locked);
8850 			return;
8851 		}
8852 		if (tot_frs > asoc->max_burst) {
8853 			/* Hit FR burst limit */
8854 			return;
8855 		}
8856 		if ((num_out == 0) && (ret == 0)) {
8857 
8858 			/* No more retrans to send */
8859 			break;
8860 		}
8861 	}
8862 #ifdef SCTP_AUDITING_ENABLED
8863 	sctp_auditing(12, inp, stcb, NULL);
8864 #endif
8865 	/* Check for bad destinations, if they exist move chunks around. */
8866 	burst_limit = asoc->max_burst;
8867 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
8868 		if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
8869 		    SCTP_ADDR_NOT_REACHABLE) {
8870 			/*-
8871 			 * if possible move things off of this address we
8872 			 * still may send below due to the dormant state but
8873 			 * we try to find an alternate address to send to
8874 			 * and if we have one we move all queued data on the
8875 			 * out wheel to this alternate address.
8876 			 */
8877 			if (net->ref_count > 1)
8878 				sctp_move_to_an_alt(stcb, asoc, net);
8879 		} else if (sctp_cmt_on_off && sctp_cmt_pf && ((net->dest_state & SCTP_ADDR_PF) ==
8880 		    SCTP_ADDR_PF)) {
8881 			/*
8882 			 * JRS 5/14/07 - If CMT PF is on and the current
8883 			 * destination is in PF state, move all queued data
8884 			 * to an alternate desination.
8885 			 */
8886 			if (net->ref_count > 1)
8887 				sctp_move_to_an_alt(stcb, asoc, net);
8888 		} else {
8889 			/*-
8890 			 * if ((asoc->sat_network) || (net->addr_is_local))
8891 			 * { burst_limit = asoc->max_burst *
8892 			 * SCTP_SAT_NETWORK_BURST_INCR; }
8893 			 */
8894 			if (sctp_use_cwnd_based_maxburst) {
8895 				if ((net->flight_size + (burst_limit * net->mtu)) < net->cwnd) {
8896 					/*
8897 					 * JRS - Use the congestion control
8898 					 * given in the congestion control
8899 					 * module
8900 					 */
8901 					asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, burst_limit);
8902 					if (sctp_logging_level & SCTP_LOG_MAXBURST_ENABLE) {
8903 						sctp_log_maxburst(stcb, net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
8904 					}
8905 					SCTP_STAT_INCR(sctps_maxburstqueued);
8906 				}
8907 				net->fast_retran_ip = 0;
8908 			} else {
8909 				if (net->flight_size == 0) {
8910 					/* Should be decaying the cwnd here */
8911 					;
8912 				}
8913 			}
8914 		}
8915 
8916 	}
8917 	burst_cnt = 0;
8918 	cwnd_full = 0;
8919 	do {
8920 		error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
8921 		    &reason_code, 0, &cwnd_full, from_where,
8922 		    &now, &now_filled, frag_point, so_locked);
8923 		if (error) {
8924 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error);
8925 			if (sctp_logging_level & SCTP_LOG_MAXBURST_ENABLE) {
8926 				sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
8927 			}
8928 			if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
8929 				sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES);
8930 				sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES);
8931 			}
8932 			break;
8933 		}
8934 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out);
8935 
8936 		tot_out += num_out;
8937 		burst_cnt++;
8938 		if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
8939 			sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES);
8940 			if (num_out == 0) {
8941 				sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES);
8942 			}
8943 		}
8944 		if (nagle_on) {
8945 			/*-
8946 			 * When nagle is on, we look at how much is un_sent, then
8947 			 * if its smaller than an MTU and we have data in
8948 			 * flight we stop.
8949 			 */
8950 			un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
8951 			    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count)
8952 			    * sizeof(struct sctp_data_chunk)));
8953 			if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) &&
8954 			    (stcb->asoc.total_flight > 0)) {
8955 				break;
8956 			}
8957 		}
8958 		if (TAILQ_EMPTY(&asoc->control_send_queue) &&
8959 		    TAILQ_EMPTY(&asoc->send_queue) &&
8960 		    TAILQ_EMPTY(&asoc->out_wheel)) {
8961 			/* Nothing left to send */
8962 			break;
8963 		}
8964 		if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) {
8965 			/* Nothing left to send */
8966 			break;
8967 		}
8968 	} while (num_out && (sctp_use_cwnd_based_maxburst ||
8969 	    (burst_cnt < burst_limit)));
8970 
8971 	if (sctp_use_cwnd_based_maxburst == 0) {
8972 		if (burst_cnt >= burst_limit) {
8973 			SCTP_STAT_INCR(sctps_maxburstqueued);
8974 			asoc->burst_limit_applied = 1;
8975 			if (sctp_logging_level & SCTP_LOG_MAXBURST_ENABLE) {
8976 				sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED);
8977 			}
8978 		} else {
8979 			asoc->burst_limit_applied = 0;
8980 		}
8981 	}
8982 	if (sctp_logging_level & SCTP_CWND_LOGGING_ENABLE) {
8983 		sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES);
8984 	}
8985 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n",
8986 	    tot_out);
8987 
8988 	/*-
8989 	 * Now we need to clean up the control chunk chain if a ECNE is on
8990 	 * it. It must be marked as UNSENT again so next call will continue
8991 	 * to send it until such time that we get a CWR, to remove it.
8992 	 */
8993 	if (stcb->asoc.ecn_echo_cnt_onq)
8994 		sctp_fix_ecn_echo(asoc);
8995 	return;
8996 }
8997 
8998 
8999 int
9000 sctp_output(inp, m, addr, control, p, flags)
9001 	struct sctp_inpcb *inp;
9002 	struct mbuf *m;
9003 	struct sockaddr *addr;
9004 	struct mbuf *control;
9005 	struct thread *p;
9006 	int flags;
9007 {
9008 	if (inp == NULL) {
9009 		SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
9010 		return (EINVAL);
9011 	}
9012 	if (inp->sctp_socket == NULL) {
9013 		SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
9014 		return (EINVAL);
9015 	}
9016 	return (sctp_sosend(inp->sctp_socket,
9017 	    addr,
9018 	    (struct uio *)NULL,
9019 	    m,
9020 	    control,
9021 	    flags, p
9022 	    ));
9023 }
9024 
9025 void
9026 send_forward_tsn(struct sctp_tcb *stcb,
9027     struct sctp_association *asoc)
9028 {
9029 	struct sctp_tmit_chunk *chk;
9030 	struct sctp_forward_tsn_chunk *fwdtsn;
9031 
9032 	SCTP_TCB_LOCK_ASSERT(stcb);
9033 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
9034 		if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) {
9035 			/* mark it to unsent */
9036 			chk->sent = SCTP_DATAGRAM_UNSENT;
9037 			chk->snd_count = 0;
9038 			/* Do we correct its output location? */
9039 			if (chk->whoTo != asoc->primary_destination) {
9040 				sctp_free_remote_addr(chk->whoTo);
9041 				chk->whoTo = asoc->primary_destination;
9042 				atomic_add_int(&chk->whoTo->ref_count, 1);
9043 			}
9044 			goto sctp_fill_in_rest;
9045 		}
9046 	}
9047 	/* Ok if we reach here we must build one */
9048 	sctp_alloc_a_chunk(stcb, chk);
9049 	if (chk == NULL) {
9050 		return;
9051 	}
9052 	chk->copy_by_ref = 0;
9053 	chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN;
9054 	chk->rec.chunk_id.can_take_data = 0;
9055 	chk->asoc = asoc;
9056 	chk->whoTo = NULL;
9057 
9058 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
9059 	if (chk->data == NULL) {
9060 		sctp_free_a_chunk(stcb, chk);
9061 		return;
9062 	}
9063 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
9064 	chk->sent = SCTP_DATAGRAM_UNSENT;
9065 	chk->snd_count = 0;
9066 	chk->whoTo = asoc->primary_destination;
9067 	atomic_add_int(&chk->whoTo->ref_count, 1);
9068 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
9069 	asoc->ctrl_queue_cnt++;
9070 sctp_fill_in_rest:
9071 	/*-
9072 	 * Here we go through and fill out the part that deals with
9073 	 * stream/seq of the ones we skip.
9074 	 */
9075 	SCTP_BUF_LEN(chk->data) = 0;
9076 	{
9077 		struct sctp_tmit_chunk *at, *tp1, *last;
9078 		struct sctp_strseq *strseq;
9079 		unsigned int cnt_of_space, i, ovh;
9080 		unsigned int space_needed;
9081 		unsigned int cnt_of_skipped = 0;
9082 
9083 		TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
9084 			if (at->sent != SCTP_FORWARD_TSN_SKIP) {
9085 				/* no more to look at */
9086 				break;
9087 			}
9088 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
9089 				/* We don't report these */
9090 				continue;
9091 			}
9092 			cnt_of_skipped++;
9093 		}
9094 		space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
9095 		    (cnt_of_skipped * sizeof(struct sctp_strseq)));
9096 
9097 		cnt_of_space = M_TRAILINGSPACE(chk->data);
9098 
9099 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9100 			ovh = SCTP_MIN_OVERHEAD;
9101 		} else {
9102 			ovh = SCTP_MIN_V4_OVERHEAD;
9103 		}
9104 		if (cnt_of_space > (asoc->smallest_mtu - ovh)) {
9105 			/* trim to a mtu size */
9106 			cnt_of_space = asoc->smallest_mtu - ovh;
9107 		}
9108 		if (cnt_of_space < space_needed) {
9109 			/*-
9110 			 * ok we must trim down the chunk by lowering the
9111 			 * advance peer ack point.
9112 			 */
9113 			cnt_of_skipped = (cnt_of_space -
9114 			    ((sizeof(struct sctp_forward_tsn_chunk)) /
9115 			    sizeof(struct sctp_strseq)));
9116 			/*-
9117 			 * Go through and find the TSN that will be the one
9118 			 * we report.
9119 			 */
9120 			at = TAILQ_FIRST(&asoc->sent_queue);
9121 			for (i = 0; i < cnt_of_skipped; i++) {
9122 				tp1 = TAILQ_NEXT(at, sctp_next);
9123 				at = tp1;
9124 			}
9125 			last = at;
9126 			/*-
9127 			 * last now points to last one I can report, update
9128 			 * peer ack point
9129 			 */
9130 			asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
9131 			space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
9132 		}
9133 		chk->send_size = space_needed;
9134 		/* Setup the chunk */
9135 		fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
9136 		fwdtsn->ch.chunk_length = htons(chk->send_size);
9137 		fwdtsn->ch.chunk_flags = 0;
9138 		fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
9139 		fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
9140 		chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
9141 		    (cnt_of_skipped * sizeof(struct sctp_strseq)));
9142 		SCTP_BUF_LEN(chk->data) = chk->send_size;
9143 		fwdtsn++;
9144 		/*-
9145 		 * Move pointer to after the fwdtsn and transfer to the
9146 		 * strseq pointer.
9147 		 */
9148 		strseq = (struct sctp_strseq *)fwdtsn;
9149 		/*-
9150 		 * Now populate the strseq list. This is done blindly
9151 		 * without pulling out duplicate stream info. This is
9152 		 * inefficent but won't harm the process since the peer will
9153 		 * look at these in sequence and will thus release anything.
9154 		 * It could mean we exceed the PMTU and chop off some that
9155 		 * we could have included.. but this is unlikely (aka 1432/4
9156 		 * would mean 300+ stream seq's would have to be reported in
9157 		 * one FWD-TSN. With a bit of work we can later FIX this to
9158 		 * optimize and pull out duplcates.. but it does add more
9159 		 * overhead. So for now... not!
9160 		 */
9161 		at = TAILQ_FIRST(&asoc->sent_queue);
9162 		for (i = 0; i < cnt_of_skipped; i++) {
9163 			tp1 = TAILQ_NEXT(at, sctp_next);
9164 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
9165 				/* We don't report these */
9166 				i--;
9167 				at = tp1;
9168 				continue;
9169 			}
9170 			strseq->stream = ntohs(at->rec.data.stream_number);
9171 			strseq->sequence = ntohs(at->rec.data.stream_seq);
9172 			strseq++;
9173 			at = tp1;
9174 		}
9175 	}
9176 	return;
9177 
9178 }
9179 
9180 void
9181 sctp_send_sack(struct sctp_tcb *stcb)
9182 {
9183 	/*-
9184 	 * Queue up a SACK in the control queue. We must first check to see
9185 	 * if a SACK is somehow on the control queue. If so, we will take
9186 	 * and and remove the old one.
9187 	 */
9188 	struct sctp_association *asoc;
9189 	struct sctp_tmit_chunk *chk, *a_chk;
9190 	struct sctp_sack_chunk *sack;
9191 	struct sctp_gap_ack_block *gap_descriptor;
9192 	struct sack_track *selector;
9193 	int mergeable = 0;
9194 	int offset;
9195 	caddr_t limit;
9196 	uint32_t *dup;
9197 	int limit_reached = 0;
9198 	unsigned int i, jstart, siz, j;
9199 	unsigned int num_gap_blocks = 0, space;
9200 	int num_dups = 0;
9201 	int space_req;
9202 
9203 	a_chk = NULL;
9204 	asoc = &stcb->asoc;
9205 	SCTP_TCB_LOCK_ASSERT(stcb);
9206 	if (asoc->last_data_chunk_from == NULL) {
9207 		/* Hmm we never received anything */
9208 		return;
9209 	}
9210 	sctp_set_rwnd(stcb, asoc);
9211 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
9212 		if (chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) {
9213 			/* Hmm, found a sack already on queue, remove it */
9214 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
9215 			asoc->ctrl_queue_cnt++;
9216 			a_chk = chk;
9217 			if (a_chk->data) {
9218 				sctp_m_freem(a_chk->data);
9219 				a_chk->data = NULL;
9220 			}
9221 			sctp_free_remote_addr(a_chk->whoTo);
9222 			a_chk->whoTo = NULL;
9223 			break;
9224 		}
9225 	}
9226 	if (a_chk == NULL) {
9227 		sctp_alloc_a_chunk(stcb, a_chk);
9228 		if (a_chk == NULL) {
9229 			/* No memory so we drop the idea, and set a timer */
9230 			if (stcb->asoc.delayed_ack) {
9231 				sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
9232 				    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5);
9233 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
9234 				    stcb->sctp_ep, stcb, NULL);
9235 			} else {
9236 				stcb->asoc.send_sack = 1;
9237 			}
9238 			return;
9239 		}
9240 		a_chk->copy_by_ref = 0;
9241 		/* a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK; */
9242 		a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK;
9243 		a_chk->rec.chunk_id.can_take_data = 1;
9244 	}
9245 	/* Clear our pkt counts */
9246 	asoc->data_pkts_seen = 0;
9247 
9248 	a_chk->asoc = asoc;
9249 	a_chk->snd_count = 0;
9250 	a_chk->send_size = 0;	/* fill in later */
9251 	a_chk->sent = SCTP_DATAGRAM_UNSENT;
9252 	a_chk->whoTo = NULL;
9253 
9254 	if ((asoc->numduptsns) ||
9255 	    (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
9256 	    ) {
9257 		/*-
9258 		 * Ok, we have some duplicates or the destination for the
9259 		 * sack is unreachable, lets see if we can select an
9260 		 * alternate than asoc->last_data_chunk_from
9261 		 */
9262 		if ((!(asoc->last_data_chunk_from->dest_state &
9263 		    SCTP_ADDR_NOT_REACHABLE)) &&
9264 		    (asoc->used_alt_onsack > asoc->numnets)) {
9265 			/* We used an alt last time, don't this time */
9266 			a_chk->whoTo = NULL;
9267 		} else {
9268 			asoc->used_alt_onsack++;
9269 			a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0);
9270 		}
9271 		if (a_chk->whoTo == NULL) {
9272 			/* Nope, no alternate */
9273 			a_chk->whoTo = asoc->last_data_chunk_from;
9274 			asoc->used_alt_onsack = 0;
9275 		}
9276 	} else {
9277 		/*
9278 		 * No duplicates so we use the last place we received data
9279 		 * from.
9280 		 */
9281 		asoc->used_alt_onsack = 0;
9282 		a_chk->whoTo = asoc->last_data_chunk_from;
9283 	}
9284 	if (a_chk->whoTo) {
9285 		atomic_add_int(&a_chk->whoTo->ref_count, 1);
9286 	}
9287 	if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
9288 		/* no gaps */
9289 		space_req = sizeof(struct sctp_sack_chunk);
9290 	} else {
9291 		/* gaps get a cluster */
9292 		space_req = MCLBYTES;
9293 	}
9294 	/* Ok now lets formulate a MBUF with our sack */
9295 	a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_DONTWAIT, 1, MT_DATA);
9296 	if ((a_chk->data == NULL) ||
9297 	    (a_chk->whoTo == NULL)) {
9298 		/* rats, no mbuf memory */
9299 		if (a_chk->data) {
9300 			/* was a problem with the destination */
9301 			sctp_m_freem(a_chk->data);
9302 			a_chk->data = NULL;
9303 		}
9304 		sctp_free_a_chunk(stcb, a_chk);
9305 		/* sa_ignore NO_NULL_CHK */
9306 		if (stcb->asoc.delayed_ack) {
9307 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
9308 			    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6);
9309 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
9310 			    stcb->sctp_ep, stcb, NULL);
9311 		} else {
9312 			stcb->asoc.send_sack = 1;
9313 		}
9314 		return;
9315 	}
9316 	/* ok, lets go through and fill it in */
9317 	SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD);
9318 	space = M_TRAILINGSPACE(a_chk->data);
9319 	if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) {
9320 		space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD);
9321 	}
9322 	limit = mtod(a_chk->data, caddr_t);
9323 	limit += space;
9324 
9325 	sack = mtod(a_chk->data, struct sctp_sack_chunk *);
9326 	sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
9327 	/* 0x01 is used by nonce for ecn */
9328 	if ((sctp_ecn_enable) &&
9329 	    (sctp_ecn_nonce) &&
9330 	    (asoc->peer_supports_ecn_nonce))
9331 		sack->ch.chunk_flags = (asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM);
9332 	else
9333 		sack->ch.chunk_flags = 0;
9334 
9335 	if (sctp_cmt_on_off && sctp_cmt_use_dac) {
9336 		/*-
9337 		 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been
9338 		 * received, then set high bit to 1, else 0. Reset
9339 		 * pkts_rcvd.
9340 		 */
9341 		sack->ch.chunk_flags |= (asoc->cmt_dac_pkts_rcvd << 6);
9342 		asoc->cmt_dac_pkts_rcvd = 0;
9343 	}
9344 #ifdef SCTP_ASOCLOG_OF_TSNS
9345 	stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn;
9346 	stcb->asoc.cumack_log_atsnt++;
9347 	if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) {
9348 		stcb->asoc.cumack_log_atsnt = 0;
9349 	}
9350 #endif
9351 	sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
9352 	sack->sack.a_rwnd = htonl(asoc->my_rwnd);
9353 	asoc->my_last_reported_rwnd = asoc->my_rwnd;
9354 
9355 	/* reset the readers interpretation */
9356 	stcb->freed_by_sorcv_sincelast = 0;
9357 
9358 	gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
9359 
9360 	siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8;
9361 	if (compare_with_wrap(asoc->mapping_array_base_tsn, asoc->cumulative_tsn, MAX_TSN)) {
9362 		offset = 1;
9363 		/*-
9364 		 * cum-ack behind the mapping array, so we start and use all
9365 		 * entries.
9366 		 */
9367 		jstart = 0;
9368 	} else {
9369 		offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn;
9370 		/*-
9371 		 * we skip the first one when the cum-ack is at or above the
9372 		 * mapping array base. Note this only works if
9373 		 */
9374 		jstart = 1;
9375 	}
9376 	if (compare_with_wrap(asoc->highest_tsn_inside_map, asoc->cumulative_tsn, MAX_TSN)) {
9377 		/* we have a gap .. maybe */
9378 		for (i = 0; i < siz; i++) {
9379 			selector = &sack_array[asoc->mapping_array[i]];
9380 			if (mergeable && selector->right_edge) {
9381 				/*
9382 				 * Backup, left and right edges were ok to
9383 				 * merge.
9384 				 */
9385 				num_gap_blocks--;
9386 				gap_descriptor--;
9387 			}
9388 			if (selector->num_entries == 0)
9389 				mergeable = 0;
9390 			else {
9391 				for (j = jstart; j < selector->num_entries; j++) {
9392 					if (mergeable && selector->right_edge) {
9393 						/*
9394 						 * do a merge by NOT setting
9395 						 * the left side
9396 						 */
9397 						mergeable = 0;
9398 					} else {
9399 						/*
9400 						 * no merge, set the left
9401 						 * side
9402 						 */
9403 						mergeable = 0;
9404 						gap_descriptor->start = htons((selector->gaps[j].start + offset));
9405 					}
9406 					gap_descriptor->end = htons((selector->gaps[j].end + offset));
9407 					num_gap_blocks++;
9408 					gap_descriptor++;
9409 					if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) {
9410 						/* no more room */
9411 						limit_reached = 1;
9412 						break;
9413 					}
9414 				}
9415 				if (selector->left_edge) {
9416 					mergeable = 1;
9417 				}
9418 			}
9419 			if (limit_reached) {
9420 				/* Reached the limit stop */
9421 				break;
9422 			}
9423 			jstart = 0;
9424 			offset += 8;
9425 		}
9426 		if (num_gap_blocks == 0) {
9427 			/*
9428 			 * slide not yet happened, and somehow we got called
9429 			 * to send a sack. Cumack needs to move up.
9430 			 */
9431 			int abort_flag = 0;
9432 
9433 			asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
9434 			sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
9435 			sctp_sack_check(stcb, 0, 0, &abort_flag);
9436 		}
9437 	}
9438 	/* now we must add any dups we are going to report. */
9439 	if ((limit_reached == 0) && (asoc->numduptsns)) {
9440 		dup = (uint32_t *) gap_descriptor;
9441 		for (i = 0; i < asoc->numduptsns; i++) {
9442 			*dup = htonl(asoc->dup_tsns[i]);
9443 			dup++;
9444 			num_dups++;
9445 			if (((caddr_t)dup + sizeof(uint32_t)) > limit) {
9446 				/* no more room */
9447 				break;
9448 			}
9449 		}
9450 		asoc->numduptsns = 0;
9451 	}
9452 	/*
9453 	 * now that the chunk is prepared queue it to the control chunk
9454 	 * queue.
9455 	 */
9456 	a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
9457 	    (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
9458 	    (num_dups * sizeof(int32_t)));
9459 	SCTP_BUF_LEN(a_chk->data) = a_chk->send_size;
9460 	sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
9461 	sack->sack.num_dup_tsns = htons(num_dups);
9462 	sack->ch.chunk_length = htons(a_chk->send_size);
9463 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
9464 	asoc->ctrl_queue_cnt++;
9465 	asoc->send_sack = 0;
9466 	SCTP_STAT_INCR(sctps_sendsacks);
9467 	return;
9468 }
9469 
9470 
9471 void
9472 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked
9473 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
9474     SCTP_UNUSED
9475 #endif
9476 )
9477 {
9478 	struct mbuf *m_abort;
9479 	struct mbuf *m_out = NULL, *m_end = NULL;
9480 	struct sctp_abort_chunk *abort = NULL;
9481 	int sz;
9482 	uint32_t auth_offset = 0;
9483 	struct sctp_auth_chunk *auth = NULL;
9484 	struct sctphdr *shdr;
9485 
9486 	/*-
9487 	 * Add an AUTH chunk, if chunk requires it and save the offset into
9488 	 * the chain for AUTH
9489 	 */
9490 	if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION,
9491 	    stcb->asoc.peer_auth_chunks)) {
9492 		m_out = sctp_add_auth_chunk(m_out, &m_end, &auth, &auth_offset,
9493 		    stcb, SCTP_ABORT_ASSOCIATION);
9494 	}
9495 	SCTP_TCB_LOCK_ASSERT(stcb);
9496 	m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_DONTWAIT, 1, MT_HEADER);
9497 	if (m_abort == NULL) {
9498 		/* no mbuf's */
9499 		if (m_out)
9500 			sctp_m_freem(m_out);
9501 		return;
9502 	}
9503 	/* link in any error */
9504 	SCTP_BUF_NEXT(m_abort) = operr;
9505 	sz = 0;
9506 	if (operr) {
9507 		struct mbuf *n;
9508 
9509 		n = operr;
9510 		while (n) {
9511 			sz += SCTP_BUF_LEN(n);
9512 			n = SCTP_BUF_NEXT(n);
9513 		}
9514 	}
9515 	SCTP_BUF_LEN(m_abort) = sizeof(*abort);
9516 	if (m_out == NULL) {
9517 		/* NO Auth chunk prepended, so reserve space in front */
9518 		SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD);
9519 		m_out = m_abort;
9520 	} else {
9521 		/* Put AUTH chunk at the front of the chain */
9522 		SCTP_BUF_NEXT(m_end) = m_abort;
9523 	}
9524 
9525 	/* fill in the ABORT chunk */
9526 	abort = mtod(m_abort, struct sctp_abort_chunk *);
9527 	abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION;
9528 	abort->ch.chunk_flags = 0;
9529 	abort->ch.chunk_length = htons(sizeof(*abort) + sz);
9530 
9531 	/* prepend and fill in the SCTP header */
9532 	SCTP_BUF_PREPEND(m_out, sizeof(struct sctphdr), M_DONTWAIT);
9533 	if (m_out == NULL) {
9534 		/* TSNH: no memory */
9535 		return;
9536 	}
9537 	shdr = mtod(m_out, struct sctphdr *);
9538 	shdr->src_port = stcb->sctp_ep->sctp_lport;
9539 	shdr->dest_port = stcb->rport;
9540 	shdr->v_tag = htonl(stcb->asoc.peer_vtag);
9541 	shdr->checksum = 0;
9542 	auth_offset += sizeof(struct sctphdr);
9543 
9544 	(void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
9545 	    stcb->asoc.primary_destination,
9546 	    (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
9547 	    m_out, auth_offset, auth, 1, 0, NULL, 0, so_locked);
9548 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9549 }
9550 
9551 void
9552 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
9553     struct sctp_nets *net)
9554 {
9555 	/* formulate and SEND a SHUTDOWN-COMPLETE */
9556 	struct mbuf *m_shutdown_comp;
9557 	struct sctp_shutdown_complete_msg *comp_cp;
9558 
9559 	m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_complete_msg), 0, M_DONTWAIT, 1, MT_HEADER);
9560 	if (m_shutdown_comp == NULL) {
9561 		/* no mbuf's */
9562 		return;
9563 	}
9564 	comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
9565 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
9566 	comp_cp->shut_cmp.ch.chunk_flags = 0;
9567 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
9568 	comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
9569 	comp_cp->sh.dest_port = stcb->rport;
9570 	comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
9571 	comp_cp->sh.checksum = 0;
9572 
9573 	SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_msg);
9574 	(void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
9575 	    (struct sockaddr *)&net->ro._l_addr,
9576 	    m_shutdown_comp, 0, NULL, 1, 0, NULL, 0, SCTP_SO_NOT_LOCKED);
9577 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9578 	return;
9579 }
9580 
9581 void
9582 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh,
9583     uint32_t vrf_id)
9584 {
9585 	/* formulate and SEND a SHUTDOWN-COMPLETE */
9586 	struct mbuf *o_pak;
9587 	struct mbuf *mout;
9588 	struct ip *iph, *iph_out;
9589 	struct ip6_hdr *ip6, *ip6_out;
9590 	int offset_out, len, mlen;
9591 	struct sctp_shutdown_complete_msg *comp_cp;
9592 
9593 	/* Get room for the largest message */
9594 	len = (sizeof(struct ip6_hdr) + sizeof(struct sctp_shutdown_complete_msg));
9595 	mout = sctp_get_mbuf_for_msg(len, 1, M_DONTWAIT, 1, MT_DATA);
9596 	if (mout == NULL) {
9597 		return;
9598 	}
9599 	SCTP_BUF_LEN(mout) = len;
9600 	iph = mtod(m, struct ip *);
9601 	iph_out = NULL;
9602 	ip6_out = NULL;
9603 	offset_out = 0;
9604 	if (iph->ip_v == IPVERSION) {
9605 		SCTP_BUF_LEN(mout) = sizeof(struct ip) +
9606 		    sizeof(struct sctp_shutdown_complete_msg);
9607 		SCTP_BUF_NEXT(mout) = NULL;
9608 		iph_out = mtod(mout, struct ip *);
9609 
9610 		/* Fill in the IP header for the ABORT */
9611 		iph_out->ip_v = IPVERSION;
9612 		iph_out->ip_hl = (sizeof(struct ip) / 4);
9613 		iph_out->ip_tos = (u_char)0;
9614 		iph_out->ip_id = 0;
9615 		iph_out->ip_off = 0;
9616 		iph_out->ip_ttl = MAXTTL;
9617 		iph_out->ip_p = IPPROTO_SCTP;
9618 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
9619 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
9620 
9621 		/* let IP layer calculate this */
9622 		iph_out->ip_sum = 0;
9623 		offset_out += sizeof(*iph_out);
9624 		comp_cp = (struct sctp_shutdown_complete_msg *)(
9625 		    (caddr_t)iph_out + offset_out);
9626 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
9627 		ip6 = (struct ip6_hdr *)iph;
9628 		SCTP_BUF_LEN(mout) = sizeof(struct ip6_hdr) +
9629 		    sizeof(struct sctp_shutdown_complete_msg);
9630 		SCTP_BUF_NEXT(mout) = NULL;
9631 		ip6_out = mtod(mout, struct ip6_hdr *);
9632 
9633 		/* Fill in the IPv6 header for the ABORT */
9634 		ip6_out->ip6_flow = ip6->ip6_flow;
9635 		ip6_out->ip6_hlim = ip6_defhlim;
9636 		ip6_out->ip6_nxt = IPPROTO_SCTP;
9637 		ip6_out->ip6_src = ip6->ip6_dst;
9638 		ip6_out->ip6_dst = ip6->ip6_src;
9639 		/*
9640 		 * ?? The old code had both the iph len + payload, I think
9641 		 * this is wrong and would never have worked
9642 		 */
9643 		ip6_out->ip6_plen = sizeof(struct sctp_shutdown_complete_msg);
9644 		offset_out += sizeof(*ip6_out);
9645 		comp_cp = (struct sctp_shutdown_complete_msg *)(
9646 		    (caddr_t)ip6_out + offset_out);
9647 	} else {
9648 		/* Currently not supported. */
9649 		return;
9650 	}
9651 	if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
9652 		/* no mbuf's */
9653 		sctp_m_freem(mout);
9654 		return;
9655 	}
9656 	/* Now copy in and fill in the ABORT tags etc. */
9657 	comp_cp->sh.src_port = sh->dest_port;
9658 	comp_cp->sh.dest_port = sh->src_port;
9659 	comp_cp->sh.checksum = 0;
9660 	comp_cp->sh.v_tag = sh->v_tag;
9661 	comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
9662 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
9663 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
9664 
9665 	/* add checksum */
9666 	comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
9667 	if (iph_out != NULL) {
9668 		sctp_route_t ro;
9669 		int ret;
9670 		struct sctp_tcb *stcb = NULL;
9671 
9672 		mlen = SCTP_BUF_LEN(mout);
9673 		bzero(&ro, sizeof ro);
9674 		/* set IPv4 length */
9675 		iph_out->ip_len = mlen;
9676 #ifdef  SCTP_PACKET_LOGGING
9677 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
9678 			sctp_packet_log(mout, mlen);
9679 #endif
9680 		SCTP_ATTACH_CHAIN(o_pak, mout, mlen);
9681 
9682 		/* out it goes */
9683 		SCTP_IP_OUTPUT(ret, o_pak, &ro, stcb, vrf_id);
9684 
9685 		/* Free the route if we got one back */
9686 		if (ro.ro_rt)
9687 			RTFREE(ro.ro_rt);
9688 	} else if (ip6_out != NULL) {
9689 		struct route_in6 ro;
9690 		int ret;
9691 		struct sctp_tcb *stcb = NULL;
9692 		struct ifnet *ifp = NULL;
9693 
9694 		bzero(&ro, sizeof(ro));
9695 		mlen = SCTP_BUF_LEN(mout);
9696 #ifdef  SCTP_PACKET_LOGGING
9697 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
9698 			sctp_packet_log(mout, mlen);
9699 #endif
9700 		SCTP_ATTACH_CHAIN(o_pak, mout, mlen);
9701 		SCTP_IP6_OUTPUT(ret, o_pak, &ro, &ifp, stcb, vrf_id);
9702 
9703 		/* Free the route if we got one back */
9704 		if (ro.ro_rt)
9705 			RTFREE(ro.ro_rt);
9706 	}
9707 	SCTP_STAT_INCR(sctps_sendpackets);
9708 	SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
9709 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9710 	return;
9711 
9712 }
9713 
9714 static struct sctp_nets *
9715 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
9716 {
9717 	struct sctp_nets *net, *hnet;
9718 	int ms_goneby, highest_ms, state_overide = 0;
9719 
9720 	(void)SCTP_GETTIME_TIMEVAL(now);
9721 	highest_ms = 0;
9722 	hnet = NULL;
9723 	SCTP_TCB_LOCK_ASSERT(stcb);
9724 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
9725 		if (
9726 		    ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
9727 		    (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
9728 		    ) {
9729 			/*
9730 			 * Skip this guy from consideration if HB is off AND
9731 			 * its confirmed
9732 			 */
9733 			continue;
9734 		}
9735 		if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
9736 			/* skip this dest net from consideration */
9737 			continue;
9738 		}
9739 		if (net->last_sent_time.tv_sec) {
9740 			/* Sent to so we subtract */
9741 			ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
9742 		} else
9743 			/* Never been sent to */
9744 			ms_goneby = 0x7fffffff;
9745 		/*-
9746 		 * When the address state is unconfirmed but still
9747 		 * considered reachable, we HB at a higher rate. Once it
9748 		 * goes confirmed OR reaches the "unreachable" state, thenw
9749 		 * we cut it back to HB at a more normal pace.
9750 		 */
9751 		if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED | SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
9752 			state_overide = 1;
9753 		} else {
9754 			state_overide = 0;
9755 		}
9756 
9757 		if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
9758 		    (ms_goneby > highest_ms)) {
9759 			highest_ms = ms_goneby;
9760 			hnet = net;
9761 		}
9762 	}
9763 	if (hnet &&
9764 	    ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED | SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
9765 		state_overide = 1;
9766 	} else {
9767 		state_overide = 0;
9768 	}
9769 
9770 	if (hnet && highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
9771 		/*-
9772 		 * Found the one with longest delay bounds OR it is
9773 		 * unconfirmed and still not marked unreachable.
9774 		 */
9775 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "net:%p is the hb winner -", hnet);
9776 #ifdef SCTP_DEBUG
9777 		if (hnet) {
9778 			SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT4,
9779 			    (struct sockaddr *)&hnet->ro._l_addr);
9780 		} else {
9781 			SCTPDBG(SCTP_DEBUG_OUTPUT4, " none\n");
9782 		}
9783 #endif
9784 		/* update the timer now */
9785 		hnet->last_sent_time = *now;
9786 		return (hnet);
9787 	}
9788 	/* Nothing to HB */
9789 	return (NULL);
9790 }
9791 
9792 int
9793 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
9794 {
9795 	struct sctp_tmit_chunk *chk;
9796 	struct sctp_nets *net;
9797 	struct sctp_heartbeat_chunk *hb;
9798 	struct timeval now;
9799 	struct sockaddr_in *sin;
9800 	struct sockaddr_in6 *sin6;
9801 
9802 	SCTP_TCB_LOCK_ASSERT(stcb);
9803 	if (user_req == 0) {
9804 		net = sctp_select_hb_destination(stcb, &now);
9805 		if (net == NULL) {
9806 			/*-
9807 			 * All our busy none to send to, just start the
9808 			 * timer again.
9809 			 */
9810 			if (stcb->asoc.state == 0) {
9811 				return (0);
9812 			}
9813 			sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
9814 			    stcb->sctp_ep,
9815 			    stcb,
9816 			    net);
9817 			return (0);
9818 		}
9819 	} else {
9820 		net = u_net;
9821 		if (net == NULL) {
9822 			return (0);
9823 		}
9824 		(void)SCTP_GETTIME_TIMEVAL(&now);
9825 	}
9826 	sin = (struct sockaddr_in *)&net->ro._l_addr;
9827 	if (sin->sin_family != AF_INET) {
9828 		if (sin->sin_family != AF_INET6) {
9829 			/* huh */
9830 			return (0);
9831 		}
9832 	}
9833 	sctp_alloc_a_chunk(stcb, chk);
9834 	if (chk == NULL) {
9835 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n");
9836 		return (0);
9837 	}
9838 	chk->copy_by_ref = 0;
9839 	chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST;
9840 	chk->rec.chunk_id.can_take_data = 1;
9841 	chk->asoc = &stcb->asoc;
9842 	chk->send_size = sizeof(struct sctp_heartbeat_chunk);
9843 
9844 	chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER);
9845 	if (chk->data == NULL) {
9846 		sctp_free_a_chunk(stcb, chk);
9847 		return (0);
9848 	}
9849 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
9850 	SCTP_BUF_LEN(chk->data) = chk->send_size;
9851 	chk->sent = SCTP_DATAGRAM_UNSENT;
9852 	chk->snd_count = 0;
9853 	chk->whoTo = net;
9854 	atomic_add_int(&chk->whoTo->ref_count, 1);
9855 	/* Now we have a mbuf that we can fill in with the details */
9856 	hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
9857 	memset(hb, 0, sizeof(struct sctp_heartbeat_chunk));
9858 	/* fill out chunk header */
9859 	hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
9860 	hb->ch.chunk_flags = 0;
9861 	hb->ch.chunk_length = htons(chk->send_size);
9862 	/* Fill out hb parameter */
9863 	hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
9864 	hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
9865 	hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
9866 	hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
9867 	/* Did our user request this one, put it in */
9868 	hb->heartbeat.hb_info.user_req = user_req;
9869 	hb->heartbeat.hb_info.addr_family = sin->sin_family;
9870 	hb->heartbeat.hb_info.addr_len = sin->sin_len;
9871 	if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
9872 		/*
9873 		 * we only take from the entropy pool if the address is not
9874 		 * confirmed.
9875 		 */
9876 		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
9877 		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
9878 	} else {
9879 		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
9880 		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
9881 	}
9882 	if (sin->sin_family == AF_INET) {
9883 		memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
9884 	} else if (sin->sin_family == AF_INET6) {
9885 		/* We leave the scope the way it is in our lookup table. */
9886 		sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
9887 		memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
9888 	} else {
9889 		/* huh compiler bug */
9890 		return (0);
9891 	}
9892 
9893 	/*
9894 	 * JRS 5/14/07 - In CMT PF, the T3 timer is used to track
9895 	 * PF-heartbeats.  Because of this, threshold management is done by
9896 	 * the t3 timer handler, and does not need to be done upon the send
9897 	 * of a PF-heartbeat. If CMT PF is on and the destination to which a
9898 	 * heartbeat is being sent is in PF state, do NOT do threshold
9899 	 * management.
9900 	 */
9901 	if ((sctp_cmt_pf == 0) || ((net->dest_state & SCTP_ADDR_PF) != SCTP_ADDR_PF)) {
9902 		/* ok we have a destination that needs a beat */
9903 		/* lets do the theshold management Qiaobing style */
9904 		if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
9905 		    stcb->asoc.max_send_times)) {
9906 			/*-
9907 			 * we have lost the association, in a way this is
9908 			 * quite bad since we really are one less time since
9909 			 * we really did not send yet. This is the down side
9910 			 * to the Q's style as defined in the RFC and not my
9911 			 * alternate style defined in the RFC.
9912 			 */
9913 			if (chk->data != NULL) {
9914 				sctp_m_freem(chk->data);
9915 				chk->data = NULL;
9916 			}
9917 			/*
9918 			 * Here we do NOT use the macro since the
9919 			 * association is now gone.
9920 			 */
9921 			if (chk->whoTo) {
9922 				sctp_free_remote_addr(chk->whoTo);
9923 				chk->whoTo = NULL;
9924 			}
9925 			sctp_free_a_chunk((struct sctp_tcb *)NULL, chk);
9926 			return (-1);
9927 		}
9928 	}
9929 	net->hb_responded = 0;
9930 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
9931 	stcb->asoc.ctrl_queue_cnt++;
9932 	SCTP_STAT_INCR(sctps_sendheartbeat);
9933 	/*-
9934 	 * Call directly med level routine to put out the chunk. It will
9935 	 * always tumble out control chunks aka HB but it may even tumble
9936 	 * out data too.
9937 	 */
9938 	return (1);
9939 }
9940 
9941 void
9942 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
9943     uint32_t high_tsn)
9944 {
9945 	struct sctp_association *asoc;
9946 	struct sctp_ecne_chunk *ecne;
9947 	struct sctp_tmit_chunk *chk;
9948 
9949 	asoc = &stcb->asoc;
9950 	SCTP_TCB_LOCK_ASSERT(stcb);
9951 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
9952 		if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) {
9953 			/* found a previous ECN_ECHO update it if needed */
9954 			ecne = mtod(chk->data, struct sctp_ecne_chunk *);
9955 			ecne->tsn = htonl(high_tsn);
9956 			return;
9957 		}
9958 	}
9959 	/* nope could not find one to update so we must build one */
9960 	sctp_alloc_a_chunk(stcb, chk);
9961 	if (chk == NULL) {
9962 		return;
9963 	}
9964 	chk->copy_by_ref = 0;
9965 	SCTP_STAT_INCR(sctps_sendecne);
9966 	chk->rec.chunk_id.id = SCTP_ECN_ECHO;
9967 	chk->rec.chunk_id.can_take_data = 0;
9968 	chk->asoc = &stcb->asoc;
9969 	chk->send_size = sizeof(struct sctp_ecne_chunk);
9970 	chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER);
9971 	if (chk->data == NULL) {
9972 		sctp_free_a_chunk(stcb, chk);
9973 		return;
9974 	}
9975 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
9976 	SCTP_BUF_LEN(chk->data) = chk->send_size;
9977 	chk->sent = SCTP_DATAGRAM_UNSENT;
9978 	chk->snd_count = 0;
9979 	chk->whoTo = net;
9980 	atomic_add_int(&chk->whoTo->ref_count, 1);
9981 	stcb->asoc.ecn_echo_cnt_onq++;
9982 	ecne = mtod(chk->data, struct sctp_ecne_chunk *);
9983 	ecne->ch.chunk_type = SCTP_ECN_ECHO;
9984 	ecne->ch.chunk_flags = 0;
9985 	ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
9986 	ecne->tsn = htonl(high_tsn);
9987 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
9988 	asoc->ctrl_queue_cnt++;
9989 }
9990 
9991 void
9992 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
9993     struct mbuf *m, int iphlen, int bad_crc)
9994 {
9995 	struct sctp_association *asoc;
9996 	struct sctp_pktdrop_chunk *drp;
9997 	struct sctp_tmit_chunk *chk;
9998 	uint8_t *datap;
9999 	int len;
10000 	int was_trunc = 0;
10001 	struct ip *iph;
10002 	int fullsz = 0, extra = 0;
10003 	long spc;
10004 	int offset;
10005 	struct sctp_chunkhdr *ch, chunk_buf;
10006 	unsigned int chk_length;
10007 
10008 	if (!stcb) {
10009 		return;
10010 	}
10011 	asoc = &stcb->asoc;
10012 	SCTP_TCB_LOCK_ASSERT(stcb);
10013 	if (asoc->peer_supports_pktdrop == 0) {
10014 		/*-
10015 		 * peer must declare support before I send one.
10016 		 */
10017 		return;
10018 	}
10019 	if (stcb->sctp_socket == NULL) {
10020 		return;
10021 	}
10022 	sctp_alloc_a_chunk(stcb, chk);
10023 	if (chk == NULL) {
10024 		return;
10025 	}
10026 	chk->copy_by_ref = 0;
10027 	iph = mtod(m, struct ip *);
10028 	if (iph == NULL) {
10029 		sctp_free_a_chunk(stcb, chk);
10030 		return;
10031 	}
10032 	if (iph->ip_v == IPVERSION) {
10033 		/* IPv4 */
10034 		len = chk->send_size = iph->ip_len;
10035 	} else {
10036 		struct ip6_hdr *ip6h;
10037 
10038 		/* IPv6 */
10039 		ip6h = mtod(m, struct ip6_hdr *);
10040 		len = chk->send_size = htons(ip6h->ip6_plen);
10041 	}
10042 	/* Validate that we do not have an ABORT in here. */
10043 	offset = iphlen + sizeof(struct sctphdr);
10044 	ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
10045 	    sizeof(*ch), (uint8_t *) & chunk_buf);
10046 	while (ch != NULL) {
10047 		chk_length = ntohs(ch->chunk_length);
10048 		if (chk_length < sizeof(*ch)) {
10049 			/* break to abort land */
10050 			break;
10051 		}
10052 		switch (ch->chunk_type) {
10053 		case SCTP_PACKET_DROPPED:
10054 		case SCTP_ABORT_ASSOCIATION:
10055 			/*-
10056 			 * we don't respond with an PKT-DROP to an ABORT
10057 			 * or PKT-DROP
10058 			 */
10059 			sctp_free_a_chunk(stcb, chk);
10060 			return;
10061 		default:
10062 			break;
10063 		}
10064 		offset += SCTP_SIZE32(chk_length);
10065 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
10066 		    sizeof(*ch), (uint8_t *) & chunk_buf);
10067 	}
10068 
10069 	if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) >
10070 	    min(stcb->asoc.smallest_mtu, MCLBYTES)) {
10071 		/*
10072 		 * only send 1 mtu worth, trim off the excess on the end.
10073 		 */
10074 		fullsz = len - extra;
10075 		len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD;
10076 		was_trunc = 1;
10077 	}
10078 	chk->asoc = &stcb->asoc;
10079 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
10080 	if (chk->data == NULL) {
10081 jump_out:
10082 		sctp_free_a_chunk(stcb, chk);
10083 		return;
10084 	}
10085 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
10086 	drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
10087 	if (drp == NULL) {
10088 		sctp_m_freem(chk->data);
10089 		chk->data = NULL;
10090 		goto jump_out;
10091 	}
10092 	chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
10093 	    sizeof(struct sctphdr) + SCTP_MED_OVERHEAD));
10094 	chk->book_size_scale = 0;
10095 	if (was_trunc) {
10096 		drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
10097 		drp->trunc_len = htons(fullsz);
10098 		/*
10099 		 * Len is already adjusted to size minus overhead above take
10100 		 * out the pkt_drop chunk itself from it.
10101 		 */
10102 		chk->send_size = len - sizeof(struct sctp_pktdrop_chunk);
10103 		len = chk->send_size;
10104 	} else {
10105 		/* no truncation needed */
10106 		drp->ch.chunk_flags = 0;
10107 		drp->trunc_len = htons(0);
10108 	}
10109 	if (bad_crc) {
10110 		drp->ch.chunk_flags |= SCTP_BADCRC;
10111 	}
10112 	chk->send_size += sizeof(struct sctp_pktdrop_chunk);
10113 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10114 	chk->sent = SCTP_DATAGRAM_UNSENT;
10115 	chk->snd_count = 0;
10116 	if (net) {
10117 		/* we should hit here */
10118 		chk->whoTo = net;
10119 	} else {
10120 		chk->whoTo = asoc->primary_destination;
10121 	}
10122 	atomic_add_int(&chk->whoTo->ref_count, 1);
10123 	chk->rec.chunk_id.id = SCTP_PACKET_DROPPED;
10124 	chk->rec.chunk_id.can_take_data = 1;
10125 	drp->ch.chunk_type = SCTP_PACKET_DROPPED;
10126 	drp->ch.chunk_length = htons(chk->send_size);
10127 	spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket);
10128 	if (spc < 0) {
10129 		spc = 0;
10130 	}
10131 	drp->bottle_bw = htonl(spc);
10132 	if (asoc->my_rwnd) {
10133 		drp->current_onq = htonl(asoc->size_on_reasm_queue +
10134 		    asoc->size_on_all_streams +
10135 		    asoc->my_rwnd_control_len +
10136 		    stcb->sctp_socket->so_rcv.sb_cc);
10137 	} else {
10138 		/*-
10139 		 * If my rwnd is 0, possibly from mbuf depletion as well as
10140 		 * space used, tell the peer there is NO space aka onq == bw
10141 		 */
10142 		drp->current_onq = htonl(spc);
10143 	}
10144 	drp->reserved = 0;
10145 	datap = drp->data;
10146 	m_copydata(m, iphlen, len, (caddr_t)datap);
10147 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
10148 	asoc->ctrl_queue_cnt++;
10149 }
10150 
10151 void
10152 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
10153 {
10154 	struct sctp_association *asoc;
10155 	struct sctp_cwr_chunk *cwr;
10156 	struct sctp_tmit_chunk *chk;
10157 
10158 	asoc = &stcb->asoc;
10159 	SCTP_TCB_LOCK_ASSERT(stcb);
10160 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
10161 		if (chk->rec.chunk_id.id == SCTP_ECN_CWR) {
10162 			/* found a previous ECN_CWR update it if needed */
10163 			cwr = mtod(chk->data, struct sctp_cwr_chunk *);
10164 			if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
10165 			    MAX_TSN)) {
10166 				cwr->tsn = htonl(high_tsn);
10167 			}
10168 			return;
10169 		}
10170 	}
10171 	/* nope could not find one to update so we must build one */
10172 	sctp_alloc_a_chunk(stcb, chk);
10173 	if (chk == NULL) {
10174 		return;
10175 	}
10176 	chk->copy_by_ref = 0;
10177 	chk->rec.chunk_id.id = SCTP_ECN_CWR;
10178 	chk->rec.chunk_id.can_take_data = 1;
10179 	chk->asoc = &stcb->asoc;
10180 	chk->send_size = sizeof(struct sctp_cwr_chunk);
10181 	chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER);
10182 	if (chk->data == NULL) {
10183 		sctp_free_a_chunk(stcb, chk);
10184 		return;
10185 	}
10186 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
10187 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10188 	chk->sent = SCTP_DATAGRAM_UNSENT;
10189 	chk->snd_count = 0;
10190 	chk->whoTo = net;
10191 	atomic_add_int(&chk->whoTo->ref_count, 1);
10192 	cwr = mtod(chk->data, struct sctp_cwr_chunk *);
10193 	cwr->ch.chunk_type = SCTP_ECN_CWR;
10194 	cwr->ch.chunk_flags = 0;
10195 	cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
10196 	cwr->tsn = htonl(high_tsn);
10197 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
10198 	asoc->ctrl_queue_cnt++;
10199 }
10200 
10201 void
10202 sctp_add_stream_reset_out(struct sctp_tmit_chunk *chk,
10203     int number_entries, uint16_t * list,
10204     uint32_t seq, uint32_t resp_seq, uint32_t last_sent)
10205 {
10206 	int len, old_len, i;
10207 	struct sctp_stream_reset_out_request *req_out;
10208 	struct sctp_chunkhdr *ch;
10209 
10210 	ch = mtod(chk->data, struct sctp_chunkhdr *);
10211 
10212 
10213 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
10214 
10215 	/* get to new offset for the param. */
10216 	req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len);
10217 	/* now how long will this param be? */
10218 	len = (sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries));
10219 	req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST);
10220 	req_out->ph.param_length = htons(len);
10221 	req_out->request_seq = htonl(seq);
10222 	req_out->response_seq = htonl(resp_seq);
10223 	req_out->send_reset_at_tsn = htonl(last_sent);
10224 	if (number_entries) {
10225 		for (i = 0; i < number_entries; i++) {
10226 			req_out->list_of_streams[i] = htons(list[i]);
10227 		}
10228 	}
10229 	if (SCTP_SIZE32(len) > len) {
10230 		/*-
10231 		 * Need to worry about the pad we may end up adding to the
10232 		 * end. This is easy since the struct is either aligned to 4
10233 		 * bytes or 2 bytes off.
10234 		 */
10235 		req_out->list_of_streams[number_entries] = 0;
10236 	}
10237 	/* now fix the chunk length */
10238 	ch->chunk_length = htons(len + old_len);
10239 	chk->book_size = len + old_len;
10240 	chk->book_size_scale = 0;
10241 	chk->send_size = SCTP_SIZE32(chk->book_size);
10242 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10243 	return;
10244 }
10245 
10246 
10247 void
10248 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk,
10249     int number_entries, uint16_t * list,
10250     uint32_t seq)
10251 {
10252 	int len, old_len, i;
10253 	struct sctp_stream_reset_in_request *req_in;
10254 	struct sctp_chunkhdr *ch;
10255 
10256 	ch = mtod(chk->data, struct sctp_chunkhdr *);
10257 
10258 
10259 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
10260 
10261 	/* get to new offset for the param. */
10262 	req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len);
10263 	/* now how long will this param be? */
10264 	len = (sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries));
10265 	req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST);
10266 	req_in->ph.param_length = htons(len);
10267 	req_in->request_seq = htonl(seq);
10268 	if (number_entries) {
10269 		for (i = 0; i < number_entries; i++) {
10270 			req_in->list_of_streams[i] = htons(list[i]);
10271 		}
10272 	}
10273 	if (SCTP_SIZE32(len) > len) {
10274 		/*-
10275 		 * Need to worry about the pad we may end up adding to the
10276 		 * end. This is easy since the struct is either aligned to 4
10277 		 * bytes or 2 bytes off.
10278 		 */
10279 		req_in->list_of_streams[number_entries] = 0;
10280 	}
10281 	/* now fix the chunk length */
10282 	ch->chunk_length = htons(len + old_len);
10283 	chk->book_size = len + old_len;
10284 	chk->book_size_scale = 0;
10285 	chk->send_size = SCTP_SIZE32(chk->book_size);
10286 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10287 	return;
10288 }
10289 
10290 
10291 void
10292 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk,
10293     uint32_t seq)
10294 {
10295 	int len, old_len;
10296 	struct sctp_stream_reset_tsn_request *req_tsn;
10297 	struct sctp_chunkhdr *ch;
10298 
10299 	ch = mtod(chk->data, struct sctp_chunkhdr *);
10300 
10301 
10302 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
10303 
10304 	/* get to new offset for the param. */
10305 	req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len);
10306 	/* now how long will this param be? */
10307 	len = sizeof(struct sctp_stream_reset_tsn_request);
10308 	req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST);
10309 	req_tsn->ph.param_length = htons(len);
10310 	req_tsn->request_seq = htonl(seq);
10311 
10312 	/* now fix the chunk length */
10313 	ch->chunk_length = htons(len + old_len);
10314 	chk->send_size = len + old_len;
10315 	chk->book_size = SCTP_SIZE32(chk->send_size);
10316 	chk->book_size_scale = 0;
10317 	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
10318 	return;
10319 }
10320 
10321 void
10322 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk,
10323     uint32_t resp_seq, uint32_t result)
10324 {
10325 	int len, old_len;
10326 	struct sctp_stream_reset_response *resp;
10327 	struct sctp_chunkhdr *ch;
10328 
10329 	ch = mtod(chk->data, struct sctp_chunkhdr *);
10330 
10331 
10332 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
10333 
10334 	/* get to new offset for the param. */
10335 	resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len);
10336 	/* now how long will this param be? */
10337 	len = sizeof(struct sctp_stream_reset_response);
10338 	resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE);
10339 	resp->ph.param_length = htons(len);
10340 	resp->response_seq = htonl(resp_seq);
10341 	resp->result = ntohl(result);
10342 
10343 	/* now fix the chunk length */
10344 	ch->chunk_length = htons(len + old_len);
10345 	chk->book_size = len + old_len;
10346 	chk->book_size_scale = 0;
10347 	chk->send_size = SCTP_SIZE32(chk->book_size);
10348 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10349 	return;
10350 
10351 }
10352 
10353 
10354 void
10355 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk,
10356     uint32_t resp_seq, uint32_t result,
10357     uint32_t send_una, uint32_t recv_next)
10358 {
10359 	int len, old_len;
10360 	struct sctp_stream_reset_response_tsn *resp;
10361 	struct sctp_chunkhdr *ch;
10362 
10363 	ch = mtod(chk->data, struct sctp_chunkhdr *);
10364 
10365 
10366 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
10367 
10368 	/* get to new offset for the param. */
10369 	resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len);
10370 	/* now how long will this param be? */
10371 	len = sizeof(struct sctp_stream_reset_response_tsn);
10372 	resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE);
10373 	resp->ph.param_length = htons(len);
10374 	resp->response_seq = htonl(resp_seq);
10375 	resp->result = htonl(result);
10376 	resp->senders_next_tsn = htonl(send_una);
10377 	resp->receivers_next_tsn = htonl(recv_next);
10378 
10379 	/* now fix the chunk length */
10380 	ch->chunk_length = htons(len + old_len);
10381 	chk->book_size = len + old_len;
10382 	chk->send_size = SCTP_SIZE32(chk->book_size);
10383 	chk->book_size_scale = 0;
10384 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10385 	return;
10386 }
10387 
10388 
10389 int
10390 sctp_send_str_reset_req(struct sctp_tcb *stcb,
10391     int number_entries, uint16_t * list,
10392     uint8_t send_out_req, uint32_t resp_seq,
10393     uint8_t send_in_req,
10394     uint8_t send_tsn_req)
10395 {
10396 
10397 	struct sctp_association *asoc;
10398 	struct sctp_tmit_chunk *chk;
10399 	struct sctp_chunkhdr *ch;
10400 	uint32_t seq;
10401 
10402 	asoc = &stcb->asoc;
10403 	if (asoc->stream_reset_outstanding) {
10404 		/*-
10405 		 * Already one pending, must get ACK back to clear the flag.
10406 		 */
10407 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY);
10408 		return (EBUSY);
10409 	}
10410 	if ((send_out_req == 0) && (send_in_req == 0) && (send_tsn_req == 0)) {
10411 		/* nothing to do */
10412 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
10413 		return (EINVAL);
10414 	}
10415 	if (send_tsn_req && (send_out_req || send_in_req)) {
10416 		/* error, can't do that */
10417 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
10418 		return (EINVAL);
10419 	}
10420 	sctp_alloc_a_chunk(stcb, chk);
10421 	if (chk == NULL) {
10422 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
10423 		return (ENOMEM);
10424 	}
10425 	chk->copy_by_ref = 0;
10426 	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
10427 	chk->rec.chunk_id.can_take_data = 0;
10428 	chk->asoc = &stcb->asoc;
10429 	chk->book_size = sizeof(struct sctp_chunkhdr);
10430 	chk->send_size = SCTP_SIZE32(chk->book_size);
10431 	chk->book_size_scale = 0;
10432 
10433 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
10434 	if (chk->data == NULL) {
10435 		sctp_free_a_chunk(stcb, chk);
10436 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
10437 		return (ENOMEM);
10438 	}
10439 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
10440 
10441 	/* setup chunk parameters */
10442 	chk->sent = SCTP_DATAGRAM_UNSENT;
10443 	chk->snd_count = 0;
10444 	chk->whoTo = asoc->primary_destination;
10445 	atomic_add_int(&chk->whoTo->ref_count, 1);
10446 
10447 	ch = mtod(chk->data, struct sctp_chunkhdr *);
10448 	ch->chunk_type = SCTP_STREAM_RESET;
10449 	ch->chunk_flags = 0;
10450 	ch->chunk_length = htons(chk->book_size);
10451 	SCTP_BUF_LEN(chk->data) = chk->send_size;
10452 
10453 	seq = stcb->asoc.str_reset_seq_out;
10454 	if (send_out_req) {
10455 		sctp_add_stream_reset_out(chk, number_entries, list,
10456 		    seq, resp_seq, (stcb->asoc.sending_seq - 1));
10457 		asoc->stream_reset_out_is_outstanding = 1;
10458 		seq++;
10459 		asoc->stream_reset_outstanding++;
10460 	}
10461 	if (send_in_req) {
10462 		sctp_add_stream_reset_in(chk, number_entries, list, seq);
10463 		asoc->stream_reset_outstanding++;
10464 	}
10465 	if (send_tsn_req) {
10466 		sctp_add_stream_reset_tsn(chk, seq);
10467 		asoc->stream_reset_outstanding++;
10468 	}
10469 	asoc->str_reset = chk;
10470 
10471 	/* insert the chunk for sending */
10472 	TAILQ_INSERT_TAIL(&asoc->control_send_queue,
10473 	    chk,
10474 	    sctp_next);
10475 	asoc->ctrl_queue_cnt++;
10476 	sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
10477 	return (0);
10478 }
10479 
10480 void
10481 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
10482     struct mbuf *err_cause, uint32_t vrf_id)
10483 {
10484 	/*-
10485 	 * Formulate the abort message, and send it back down.
10486 	 */
10487 	struct mbuf *o_pak;
10488 	struct mbuf *mout;
10489 	struct sctp_abort_msg *abm;
10490 	struct ip *iph, *iph_out;
10491 	struct ip6_hdr *ip6, *ip6_out;
10492 	int iphlen_out, len;
10493 
10494 	/* don't respond to ABORT with ABORT */
10495 	if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
10496 		if (err_cause)
10497 			sctp_m_freem(err_cause);
10498 		return;
10499 	}
10500 	len = (sizeof(struct ip6_hdr) + sizeof(struct sctp_abort_msg));
10501 
10502 	mout = sctp_get_mbuf_for_msg(len, 1, M_DONTWAIT, 1, MT_DATA);
10503 	if (mout == NULL) {
10504 		if (err_cause)
10505 			sctp_m_freem(err_cause);
10506 		return;
10507 	}
10508 	iph = mtod(m, struct ip *);
10509 	iph_out = NULL;
10510 	ip6_out = NULL;
10511 	if (iph->ip_v == IPVERSION) {
10512 		iph_out = mtod(mout, struct ip *);
10513 		SCTP_BUF_LEN(mout) = sizeof(*iph_out) + sizeof(*abm);
10514 		SCTP_BUF_NEXT(mout) = err_cause;
10515 
10516 		/* Fill in the IP header for the ABORT */
10517 		iph_out->ip_v = IPVERSION;
10518 		iph_out->ip_hl = (sizeof(struct ip) / 4);
10519 		iph_out->ip_tos = (u_char)0;
10520 		iph_out->ip_id = 0;
10521 		iph_out->ip_off = 0;
10522 		iph_out->ip_ttl = MAXTTL;
10523 		iph_out->ip_p = IPPROTO_SCTP;
10524 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
10525 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
10526 		/* let IP layer calculate this */
10527 		iph_out->ip_sum = 0;
10528 
10529 		iphlen_out = sizeof(*iph_out);
10530 		abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
10531 	} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
10532 		ip6 = (struct ip6_hdr *)iph;
10533 		ip6_out = mtod(mout, struct ip6_hdr *);
10534 		SCTP_BUF_LEN(mout) = sizeof(*ip6_out) + sizeof(*abm);
10535 		SCTP_BUF_NEXT(mout) = err_cause;
10536 
10537 		/* Fill in the IP6 header for the ABORT */
10538 		ip6_out->ip6_flow = ip6->ip6_flow;
10539 		ip6_out->ip6_hlim = ip6_defhlim;
10540 		ip6_out->ip6_nxt = IPPROTO_SCTP;
10541 		ip6_out->ip6_src = ip6->ip6_dst;
10542 		ip6_out->ip6_dst = ip6->ip6_src;
10543 
10544 		iphlen_out = sizeof(*ip6_out);
10545 		abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
10546 	} else {
10547 		/* Currently not supported */
10548 		if (err_cause)
10549 			sctp_m_freem(err_cause);
10550 		sctp_m_freem(mout);
10551 		return;
10552 	}
10553 
10554 	abm->sh.src_port = sh->dest_port;
10555 	abm->sh.dest_port = sh->src_port;
10556 	abm->sh.checksum = 0;
10557 	if (vtag == 0) {
10558 		abm->sh.v_tag = sh->v_tag;
10559 		abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
10560 	} else {
10561 		abm->sh.v_tag = htonl(vtag);
10562 		abm->msg.ch.chunk_flags = 0;
10563 	}
10564 	abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
10565 
10566 	if (err_cause) {
10567 		struct mbuf *m_tmp = err_cause;
10568 		int err_len = 0;
10569 
10570 		/* get length of the err_cause chain */
10571 		while (m_tmp != NULL) {
10572 			err_len += SCTP_BUF_LEN(m_tmp);
10573 			m_tmp = SCTP_BUF_NEXT(m_tmp);
10574 		}
10575 		len = SCTP_BUF_LEN(mout) + err_len;
10576 		if (err_len % 4) {
10577 			/* need pad at end of chunk */
10578 			uint32_t cpthis = 0;
10579 			int padlen;
10580 
10581 			padlen = 4 - (len % 4);
10582 			m_copyback(mout, len, padlen, (caddr_t)&cpthis);
10583 			len += padlen;
10584 		}
10585 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
10586 	} else {
10587 		len = SCTP_BUF_LEN(mout);
10588 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
10589 	}
10590 
10591 	/* add checksum */
10592 	abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
10593 	if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
10594 		/* no mbuf's */
10595 		sctp_m_freem(mout);
10596 		return;
10597 	}
10598 	if (iph_out != NULL) {
10599 		sctp_route_t ro;
10600 		struct sctp_tcb *stcb = NULL;
10601 		int ret;
10602 
10603 		/* zap the stack pointer to the route */
10604 		bzero(&ro, sizeof ro);
10605 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "sctp_send_abort calling ip_output:\n");
10606 		SCTPDBG_PKT(SCTP_DEBUG_OUTPUT2, iph_out, &abm->sh);
10607 		/* set IPv4 length */
10608 		iph_out->ip_len = len;
10609 		/* out it goes */
10610 #ifdef  SCTP_PACKET_LOGGING
10611 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
10612 			sctp_packet_log(mout, len);
10613 #endif
10614 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
10615 		SCTP_IP_OUTPUT(ret, o_pak, &ro, stcb, vrf_id);
10616 
10617 		/* Free the route if we got one back */
10618 		if (ro.ro_rt)
10619 			RTFREE(ro.ro_rt);
10620 	} else if (ip6_out != NULL) {
10621 		struct route_in6 ro;
10622 		int ret;
10623 		struct sctp_tcb *stcb = NULL;
10624 		struct ifnet *ifp = NULL;
10625 
10626 		/* zap the stack pointer to the route */
10627 		bzero(&ro, sizeof(ro));
10628 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "sctp_send_abort calling ip6_output:\n");
10629 		SCTPDBG_PKT(SCTP_DEBUG_OUTPUT2, (struct ip *)ip6_out, &abm->sh);
10630 		ip6_out->ip6_plen = len - sizeof(*ip6_out);
10631 #ifdef  SCTP_PACKET_LOGGING
10632 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
10633 			sctp_packet_log(mout, len);
10634 #endif
10635 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
10636 		SCTP_IP6_OUTPUT(ret, o_pak, &ro, &ifp, stcb, vrf_id);
10637 
10638 		/* Free the route if we got one back */
10639 		if (ro.ro_rt)
10640 			RTFREE(ro.ro_rt);
10641 	}
10642 	SCTP_STAT_INCR(sctps_sendpackets);
10643 	SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
10644 }
10645 
10646 void
10647 sctp_send_operr_to(struct mbuf *m, int iphlen, struct mbuf *scm, uint32_t vtag,
10648     uint32_t vrf_id)
10649 {
10650 	struct mbuf *o_pak;
10651 	struct sctphdr *ihdr;
10652 	int retcode;
10653 	struct sctphdr *ohdr;
10654 	struct sctp_chunkhdr *ophdr;
10655 	struct ip *iph;
10656 	struct mbuf *mout;
10657 
10658 #ifdef SCTP_DEBUG
10659 	struct sockaddr_in6 lsa6, fsa6;
10660 
10661 #endif
10662 	uint32_t val;
10663 	struct mbuf *at;
10664 	int len;
10665 
10666 	iph = mtod(m, struct ip *);
10667 	ihdr = (struct sctphdr *)((caddr_t)iph + iphlen);
10668 
10669 	SCTP_BUF_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT);
10670 	if (scm == NULL) {
10671 		/* can't send because we can't add a mbuf */
10672 		return;
10673 	}
10674 	ohdr = mtod(scm, struct sctphdr *);
10675 	ohdr->src_port = ihdr->dest_port;
10676 	ohdr->dest_port = ihdr->src_port;
10677 	ohdr->v_tag = vtag;
10678 	ohdr->checksum = 0;
10679 	ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
10680 	ophdr->chunk_type = SCTP_OPERATION_ERROR;
10681 	ophdr->chunk_flags = 0;
10682 	len = 0;
10683 	at = scm;
10684 	while (at) {
10685 		len += SCTP_BUF_LEN(at);
10686 		at = SCTP_BUF_NEXT(at);
10687 	}
10688 	ophdr->chunk_length = htons(len - sizeof(struct sctphdr));
10689 	if (len % 4) {
10690 		/* need padding */
10691 		uint32_t cpthis = 0;
10692 		int padlen;
10693 
10694 		padlen = 4 - (len % 4);
10695 		m_copyback(scm, len, padlen, (caddr_t)&cpthis);
10696 		len += padlen;
10697 	}
10698 	val = sctp_calculate_sum(scm, NULL, 0);
10699 	mout = sctp_get_mbuf_for_msg(sizeof(struct ip6_hdr), 1, M_DONTWAIT, 1, MT_DATA);
10700 	if (mout == NULL) {
10701 		sctp_m_freem(scm);
10702 		return;
10703 	}
10704 	SCTP_BUF_NEXT(mout) = scm;
10705 	if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
10706 		sctp_m_freem(mout);
10707 		return;
10708 	}
10709 	ohdr->checksum = val;
10710 	if (iph->ip_v == IPVERSION) {
10711 		/* V4 */
10712 		struct ip *out;
10713 		sctp_route_t ro;
10714 		struct sctp_tcb *stcb = NULL;
10715 
10716 		SCTP_BUF_LEN(mout) = sizeof(struct ip);
10717 		len += sizeof(struct ip);
10718 
10719 		bzero(&ro, sizeof ro);
10720 		out = mtod(mout, struct ip *);
10721 		out->ip_v = iph->ip_v;
10722 		out->ip_hl = (sizeof(struct ip) / 4);
10723 		out->ip_tos = iph->ip_tos;
10724 		out->ip_id = iph->ip_id;
10725 		out->ip_off = 0;
10726 		out->ip_ttl = MAXTTL;
10727 		out->ip_p = IPPROTO_SCTP;
10728 		out->ip_sum = 0;
10729 		out->ip_src = iph->ip_dst;
10730 		out->ip_dst = iph->ip_src;
10731 		out->ip_len = len;
10732 #ifdef  SCTP_PACKET_LOGGING
10733 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
10734 			sctp_packet_log(mout, len);
10735 #endif
10736 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
10737 
10738 		SCTP_IP_OUTPUT(retcode, o_pak, &ro, stcb, vrf_id);
10739 
10740 		SCTP_STAT_INCR(sctps_sendpackets);
10741 		SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
10742 		/* Free the route if we got one back */
10743 		if (ro.ro_rt)
10744 			RTFREE(ro.ro_rt);
10745 	} else {
10746 		/* V6 */
10747 		struct route_in6 ro;
10748 		int ret;
10749 		struct sctp_tcb *stcb = NULL;
10750 		struct ifnet *ifp = NULL;
10751 		struct ip6_hdr *out6, *in6;
10752 
10753 		SCTP_BUF_LEN(mout) = sizeof(struct ip6_hdr);
10754 		len += sizeof(struct ip6_hdr);
10755 		bzero(&ro, sizeof ro);
10756 		in6 = mtod(m, struct ip6_hdr *);
10757 		out6 = mtod(mout, struct ip6_hdr *);
10758 		out6->ip6_flow = in6->ip6_flow;
10759 		out6->ip6_hlim = ip6_defhlim;
10760 		out6->ip6_nxt = IPPROTO_SCTP;
10761 		out6->ip6_src = in6->ip6_dst;
10762 		out6->ip6_dst = in6->ip6_src;
10763 		out6->ip6_plen = len - sizeof(struct ip6_hdr);
10764 
10765 #ifdef SCTP_DEBUG
10766 		bzero(&lsa6, sizeof(lsa6));
10767 		lsa6.sin6_len = sizeof(lsa6);
10768 		lsa6.sin6_family = AF_INET6;
10769 		lsa6.sin6_addr = out6->ip6_src;
10770 		bzero(&fsa6, sizeof(fsa6));
10771 		fsa6.sin6_len = sizeof(fsa6);
10772 		fsa6.sin6_family = AF_INET6;
10773 		fsa6.sin6_addr = out6->ip6_dst;
10774 #endif
10775 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "sctp_operr_to calling ipv6 output:\n");
10776 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "src: ");
10777 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&lsa6);
10778 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "dst ");
10779 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&fsa6);
10780 
10781 #ifdef  SCTP_PACKET_LOGGING
10782 		if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
10783 			sctp_packet_log(mout, len);
10784 #endif
10785 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
10786 		SCTP_IP6_OUTPUT(ret, o_pak, &ro, &ifp, stcb, vrf_id);
10787 
10788 		SCTP_STAT_INCR(sctps_sendpackets);
10789 		SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
10790 		/* Free the route if we got one back */
10791 		if (ro.ro_rt)
10792 			RTFREE(ro.ro_rt);
10793 	}
10794 }
10795 
10796 static struct mbuf *
10797 sctp_copy_resume(struct sctp_stream_queue_pending *sp,
10798     struct uio *uio,
10799     struct sctp_sndrcvinfo *srcv,
10800     int max_send_len,
10801     int user_marks_eor,
10802     int *error,
10803     uint32_t * sndout,
10804     struct mbuf **new_tail)
10805 {
10806 	struct mbuf *m;
10807 
10808 	m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0,
10809 	    (M_PKTHDR | (user_marks_eor ? M_EOR : 0)));
10810 	if (m == NULL) {
10811 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
10812 		*error = ENOMEM;
10813 	} else {
10814 		*sndout = m_length(m, NULL);
10815 		*new_tail = m_last(m);
10816 	}
10817 	return (m);
10818 }
10819 
10820 static int
10821 sctp_copy_one(struct sctp_stream_queue_pending *sp,
10822     struct uio *uio,
10823     int resv_upfront)
10824 {
10825 	int left;
10826 
10827 	left = sp->length;
10828 	sp->data = m_uiotombuf(uio, M_WAITOK, sp->length,
10829 	    resv_upfront, 0);
10830 	if (sp->data == NULL) {
10831 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
10832 		return (ENOMEM);
10833 	}
10834 	sp->tail_mbuf = m_last(sp->data);
10835 	return (0);
10836 }
10837 
10838 
10839 
10840 static struct sctp_stream_queue_pending *
10841 sctp_copy_it_in(struct sctp_tcb *stcb,
10842     struct sctp_association *asoc,
10843     struct sctp_sndrcvinfo *srcv,
10844     struct uio *uio,
10845     struct sctp_nets *net,
10846     int max_send_len,
10847     int user_marks_eor,
10848     int *error,
10849     int non_blocking)
10850 {
10851 	/*-
10852 	 * This routine must be very careful in its work. Protocol
10853 	 * processing is up and running so care must be taken to spl...()
10854 	 * when you need to do something that may effect the stcb/asoc. The
10855 	 * sb is locked however. When data is copied the protocol processing
10856 	 * should be enabled since this is a slower operation...
10857 	 */
10858 	struct sctp_stream_queue_pending *sp = NULL;
10859 	int resv_in_first;
10860 
10861 	*error = 0;
10862 	/* Now can we send this? */
10863 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
10864 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
10865 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
10866 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
10867 		/* got data while shutting down */
10868 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
10869 		*error = ECONNRESET;
10870 		goto out_now;
10871 	}
10872 	sctp_alloc_a_strmoq(stcb, sp);
10873 	if (sp == NULL) {
10874 		SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
10875 		*error = ENOMEM;
10876 		goto out_now;
10877 	}
10878 	sp->act_flags = 0;
10879 	sp->sender_all_done = 0;
10880 	sp->sinfo_flags = srcv->sinfo_flags;
10881 	sp->timetolive = srcv->sinfo_timetolive;
10882 	sp->ppid = srcv->sinfo_ppid;
10883 	sp->context = srcv->sinfo_context;
10884 	sp->strseq = 0;
10885 	(void)SCTP_GETTIME_TIMEVAL(&sp->ts);
10886 
10887 	sp->stream = srcv->sinfo_stream;
10888 	sp->length = min(uio->uio_resid, max_send_len);
10889 	if ((sp->length == (uint32_t) uio->uio_resid) &&
10890 	    ((user_marks_eor == 0) ||
10891 	    (srcv->sinfo_flags & SCTP_EOF) ||
10892 	    (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) {
10893 		sp->msg_is_complete = 1;
10894 	} else {
10895 		sp->msg_is_complete = 0;
10896 	}
10897 	sp->sender_all_done = 0;
10898 	sp->some_taken = 0;
10899 	sp->put_last_out = 0;
10900 	resv_in_first = sizeof(struct sctp_data_chunk);
10901 	sp->data = sp->tail_mbuf = NULL;
10902 	*error = sctp_copy_one(sp, uio, resv_in_first);
10903 	if (*error) {
10904 		sctp_free_a_strmoq(stcb, sp);
10905 		sp = NULL;
10906 	} else {
10907 		if (sp->sinfo_flags & SCTP_ADDR_OVER) {
10908 			sp->net = net;
10909 			sp->addr_over = 1;
10910 		} else {
10911 			sp->net = asoc->primary_destination;
10912 			sp->addr_over = 0;
10913 		}
10914 		atomic_add_int(&sp->net->ref_count, 1);
10915 		sctp_set_prsctp_policy(stcb, sp);
10916 	}
10917 out_now:
10918 	return (sp);
10919 }
10920 
10921 
10922 int
10923 sctp_sosend(struct socket *so,
10924     struct sockaddr *addr,
10925     struct uio *uio,
10926     struct mbuf *top,
10927     struct mbuf *control,
10928     int flags,
10929     struct thread *p
10930 )
10931 {
10932 	struct sctp_inpcb *inp;
10933 	int error, use_rcvinfo = 0;
10934 	struct sctp_sndrcvinfo srcv;
10935 
10936 	inp = (struct sctp_inpcb *)so->so_pcb;
10937 	if (control) {
10938 		/* process cmsg snd/rcv info (maybe a assoc-id) */
10939 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
10940 		    sizeof(srcv))) {
10941 			/* got one */
10942 			use_rcvinfo = 1;
10943 		}
10944 	}
10945 	error = sctp_lower_sosend(so, addr, uio, top,
10946 	    control,
10947 	    flags,
10948 	    use_rcvinfo, &srcv
10949 	    ,p
10950 	    );
10951 	return (error);
10952 }
10953 
10954 
10955 int
10956 sctp_lower_sosend(struct socket *so,
10957     struct sockaddr *addr,
10958     struct uio *uio,
10959     struct mbuf *i_pak,
10960     struct mbuf *control,
10961     int flags,
10962     int use_rcvinfo,
10963     struct sctp_sndrcvinfo *srcv
10964     ,
10965     struct thread *p
10966 )
10967 {
10968 	unsigned int sndlen = 0, max_len;
10969 	int error, len;
10970 	struct mbuf *top = NULL;
10971 
10972 #if defined(__NetBSD__) || defined(__OpenBSD_)
10973 	int s;
10974 
10975 #endif
10976 	int queue_only = 0, queue_only_for_init = 0;
10977 	int free_cnt_applied = 0;
10978 	int un_sent = 0;
10979 	int now_filled = 0;
10980 	unsigned int inqueue_bytes = 0;
10981 	struct sctp_block_entry be;
10982 	struct sctp_inpcb *inp;
10983 	struct sctp_tcb *stcb = NULL;
10984 	struct timeval now;
10985 	struct sctp_nets *net;
10986 	struct sctp_association *asoc;
10987 	struct sctp_inpcb *t_inp;
10988 	int user_marks_eor;
10989 	int create_lock_applied = 0;
10990 	int nagle_applies = 0;
10991 	int some_on_control = 0;
10992 	int got_all_of_the_send = 0;
10993 	int hold_tcblock = 0;
10994 	int non_blocking = 0;
10995 	int temp_flags = 0;
10996 	uint32_t local_add_more, local_soresv = 0;
10997 
10998 	error = 0;
10999 	net = NULL;
11000 	stcb = NULL;
11001 	asoc = NULL;
11002 
11003 	t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
11004 	if (inp == NULL) {
11005 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
11006 		error = EFAULT;
11007 		if (i_pak) {
11008 			SCTP_RELEASE_PKT(i_pak);
11009 		}
11010 		return (error);
11011 	}
11012 	if ((uio == NULL) && (i_pak == NULL)) {
11013 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11014 		return (EINVAL);
11015 	}
11016 	user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
11017 	atomic_add_int(&inp->total_sends, 1);
11018 	if (uio) {
11019 		if (uio->uio_resid < 0) {
11020 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11021 			return (EINVAL);
11022 		}
11023 		sndlen = uio->uio_resid;
11024 	} else {
11025 		top = SCTP_HEADER_TO_CHAIN(i_pak);
11026 		sndlen = SCTP_HEADER_LEN(i_pak);
11027 	}
11028 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n",
11029 	    addr,
11030 	    sndlen);
11031 	/*-
11032          * Pre-screen address, if one is given the sin-len
11033          * must be set correctly!
11034          */
11035 	if (addr) {
11036 		if ((addr->sa_family == AF_INET) &&
11037 		    (addr->sa_len != sizeof(struct sockaddr_in))) {
11038 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11039 			error = EINVAL;
11040 			goto out_unlocked;
11041 		} else if ((addr->sa_family == AF_INET6) &&
11042 		    (addr->sa_len != sizeof(struct sockaddr_in6))) {
11043 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11044 			error = EINVAL;
11045 			goto out_unlocked;
11046 		}
11047 	}
11048 	hold_tcblock = 0;
11049 
11050 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
11051 	    (inp->sctp_socket->so_qlimit)) {
11052 		/* The listener can NOT send */
11053 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
11054 		error = EFAULT;
11055 		goto out_unlocked;
11056 	}
11057 	if ((use_rcvinfo) && srcv) {
11058 		if (INVALID_SINFO_FLAG(srcv->sinfo_flags) ||
11059 		    PR_SCTP_INVALID_POLICY(srcv->sinfo_flags)) {
11060 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11061 			error = EINVAL;
11062 			goto out_unlocked;
11063 		}
11064 		if (srcv->sinfo_flags)
11065 			SCTP_STAT_INCR(sctps_sends_with_flags);
11066 
11067 		if (srcv->sinfo_flags & SCTP_SENDALL) {
11068 			/* its a sendall */
11069 			error = sctp_sendall(inp, uio, top, srcv);
11070 			top = NULL;
11071 			goto out_unlocked;
11072 		}
11073 	}
11074 	/* now we must find the assoc */
11075 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) ||
11076 	    (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
11077 		SCTP_INP_RLOCK(inp);
11078 		stcb = LIST_FIRST(&inp->sctp_asoc_list);
11079 		if (stcb == NULL) {
11080 			SCTP_INP_RUNLOCK(inp);
11081 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN);
11082 			error = ENOTCONN;
11083 			goto out_unlocked;
11084 		}
11085 		hold_tcblock = 0;
11086 		SCTP_INP_RUNLOCK(inp);
11087 		if (addr) {
11088 			/* Must locate the net structure if addr given */
11089 			net = sctp_findnet(stcb, addr);
11090 			if (net) {
11091 				/* validate port was 0 or correct */
11092 				struct sockaddr_in *sin;
11093 
11094 				sin = (struct sockaddr_in *)addr;
11095 				if ((sin->sin_port != 0) &&
11096 				    (sin->sin_port != stcb->rport)) {
11097 					net = NULL;
11098 				}
11099 			}
11100 			temp_flags |= SCTP_ADDR_OVER;
11101 		} else
11102 			net = stcb->asoc.primary_destination;
11103 		if (addr && (net == NULL)) {
11104 			/* Could not find address, was it legal */
11105 			if (addr->sa_family == AF_INET) {
11106 				struct sockaddr_in *sin;
11107 
11108 				sin = (struct sockaddr_in *)addr;
11109 				if (sin->sin_addr.s_addr == 0) {
11110 					if ((sin->sin_port == 0) ||
11111 					    (sin->sin_port == stcb->rport)) {
11112 						net = stcb->asoc.primary_destination;
11113 					}
11114 				}
11115 			} else {
11116 				struct sockaddr_in6 *sin6;
11117 
11118 				sin6 = (struct sockaddr_in6 *)addr;
11119 				if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
11120 					if ((sin6->sin6_port == 0) ||
11121 					    (sin6->sin6_port == stcb->rport)) {
11122 						net = stcb->asoc.primary_destination;
11123 					}
11124 				}
11125 			}
11126 		}
11127 		if (net == NULL) {
11128 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11129 			error = EINVAL;
11130 			goto out_unlocked;
11131 		}
11132 	} else if (use_rcvinfo && srcv && srcv->sinfo_assoc_id) {
11133 		stcb = sctp_findassociation_ep_asocid(inp, srcv->sinfo_assoc_id, 0);
11134 		if (stcb) {
11135 			if (addr)
11136 				/*
11137 				 * Must locate the net structure if addr
11138 				 * given
11139 				 */
11140 				net = sctp_findnet(stcb, addr);
11141 			else
11142 				net = stcb->asoc.primary_destination;
11143 			if ((srcv->sinfo_flags & SCTP_ADDR_OVER) &&
11144 			    ((net == NULL) || (addr == NULL))) {
11145 				struct sockaddr_in *sin;
11146 
11147 				if (addr == NULL) {
11148 					SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11149 					error = EINVAL;
11150 					goto out_unlocked;
11151 				}
11152 				sin = (struct sockaddr_in *)addr;
11153 				/* Validate port is 0 or correct */
11154 				if ((sin->sin_port != 0) &&
11155 				    (sin->sin_port != stcb->rport)) {
11156 					net = NULL;
11157 				}
11158 			}
11159 		}
11160 		hold_tcblock = 0;
11161 	} else if (addr) {
11162 		/*-
11163 		 * Since we did not use findep we must
11164 		 * increment it, and if we don't find a tcb
11165 		 * decrement it.
11166 		 */
11167 		SCTP_INP_WLOCK(inp);
11168 		SCTP_INP_INCR_REF(inp);
11169 		SCTP_INP_WUNLOCK(inp);
11170 		stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
11171 		if (stcb == NULL) {
11172 			SCTP_INP_WLOCK(inp);
11173 			SCTP_INP_DECR_REF(inp);
11174 			SCTP_INP_WUNLOCK(inp);
11175 		} else {
11176 			hold_tcblock = 1;
11177 		}
11178 	}
11179 	if ((stcb == NULL) && (addr)) {
11180 		/* Possible implicit send? */
11181 		SCTP_ASOC_CREATE_LOCK(inp);
11182 		create_lock_applied = 1;
11183 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
11184 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
11185 			/* Should I really unlock ? */
11186 			SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
11187 			error = EFAULT;
11188 			goto out_unlocked;
11189 
11190 		}
11191 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
11192 		    (addr->sa_family == AF_INET6)) {
11193 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11194 			error = EINVAL;
11195 			goto out_unlocked;
11196 		}
11197 		SCTP_INP_WLOCK(inp);
11198 		SCTP_INP_INCR_REF(inp);
11199 		SCTP_INP_WUNLOCK(inp);
11200 		/* With the lock applied look again */
11201 		stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
11202 		if (stcb == NULL) {
11203 			SCTP_INP_WLOCK(inp);
11204 			SCTP_INP_DECR_REF(inp);
11205 			SCTP_INP_WUNLOCK(inp);
11206 		} else {
11207 			hold_tcblock = 1;
11208 		}
11209 		if (t_inp != inp) {
11210 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN);
11211 			error = ENOTCONN;
11212 			goto out_unlocked;
11213 		}
11214 	}
11215 	if (stcb == NULL) {
11216 		if (addr == NULL) {
11217 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT);
11218 			error = ENOENT;
11219 			goto out_unlocked;
11220 		} else {
11221 			/*
11222 			 * UDP style, we must go ahead and start the INIT
11223 			 * process
11224 			 */
11225 			uint32_t vrf_id;
11226 
11227 			if ((use_rcvinfo) && (srcv) &&
11228 			    ((srcv->sinfo_flags & SCTP_ABORT) ||
11229 			    ((srcv->sinfo_flags & SCTP_EOF) &&
11230 			    (sndlen == 0)))) {
11231 				/*-
11232 				 * User asks to abort a non-existant assoc,
11233 				 * or EOF a non-existant assoc with no data
11234 				 */
11235 				SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT);
11236 				error = ENOENT;
11237 				goto out_unlocked;
11238 			}
11239 			/* get an asoc/stcb struct */
11240 			vrf_id = inp->def_vrf_id;
11241 #ifdef INVARIANTS
11242 			if (create_lock_applied == 0) {
11243 				panic("Error, should hold create lock and I don't?");
11244 			}
11245 #endif
11246 			stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0, vrf_id,
11247 			    p
11248 			    );
11249 			if (stcb == NULL) {
11250 				/* Error is setup for us in the call */
11251 				goto out_unlocked;
11252 			}
11253 			if (create_lock_applied) {
11254 				SCTP_ASOC_CREATE_UNLOCK(inp);
11255 				create_lock_applied = 0;
11256 			} else {
11257 				SCTP_PRINTF("Huh-3? create lock should have been on??\n");
11258 			}
11259 			/*
11260 			 * Turn on queue only flag to prevent data from
11261 			 * being sent
11262 			 */
11263 			queue_only = 1;
11264 			asoc = &stcb->asoc;
11265 			SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT);
11266 			(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
11267 
11268 			/* initialize authentication params for the assoc */
11269 			sctp_initialize_auth_params(inp, stcb);
11270 
11271 			if (control) {
11272 				/*
11273 				 * see if a init structure exists in cmsg
11274 				 * headers
11275 				 */
11276 				struct sctp_initmsg initm;
11277 				int i;
11278 
11279 				if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
11280 				    sizeof(initm))) {
11281 					/*
11282 					 * we have an INIT override of the
11283 					 * default
11284 					 */
11285 					if (initm.sinit_max_attempts)
11286 						asoc->max_init_times = initm.sinit_max_attempts;
11287 					if (initm.sinit_num_ostreams)
11288 						asoc->pre_open_streams = initm.sinit_num_ostreams;
11289 					if (initm.sinit_max_instreams)
11290 						asoc->max_inbound_streams = initm.sinit_max_instreams;
11291 					if (initm.sinit_max_init_timeo)
11292 						asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
11293 					if (asoc->streamoutcnt < asoc->pre_open_streams) {
11294 						/* Default is NOT correct */
11295 						SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, defout:%d pre_open:%d\n",
11296 						    asoc->streamoutcnt, asoc->pre_open_streams);
11297 						/*
11298 						 * What happens if this
11299 						 * fails? we panic ...
11300 						 */
11301 						{
11302 							struct sctp_stream_out *tmp_str;
11303 							int had_lock = 0;
11304 
11305 							if (hold_tcblock) {
11306 								had_lock = 1;
11307 								SCTP_TCB_UNLOCK(stcb);
11308 							}
11309 							SCTP_MALLOC(tmp_str,
11310 							    struct sctp_stream_out *,
11311 							    (asoc->pre_open_streams *
11312 							    sizeof(struct sctp_stream_out)),
11313 							    SCTP_M_STRMO);
11314 							if (had_lock) {
11315 								SCTP_TCB_LOCK(stcb);
11316 							}
11317 							if (tmp_str != NULL) {
11318 								SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
11319 								asoc->strmout = tmp_str;
11320 								asoc->streamoutcnt = asoc->pre_open_streams;
11321 							} else {
11322 								asoc->pre_open_streams = asoc->streamoutcnt;
11323 							}
11324 						}
11325 						for (i = 0; i < asoc->streamoutcnt; i++) {
11326 							/*-
11327 						         * inbound side must be set
11328 						         * to 0xffff, also NOTE when
11329 						         * we get the INIT-ACK back
11330 						         * (for INIT sender) we MUST
11331 						         * reduce the count
11332 						         * (streamoutcnt) but first
11333 						         * check if we sent to any
11334 						         * of the upper streams that
11335 						         * were dropped (if some
11336 						         * were). Those that were
11337 						         * dropped must be notified
11338 						         * to the upper layer as
11339 						         * failed to send.
11340 						         */
11341 							asoc->strmout[i].next_sequence_sent = 0x0;
11342 							TAILQ_INIT(&asoc->strmout[i].outqueue);
11343 							asoc->strmout[i].stream_no = i;
11344 							asoc->strmout[i].last_msg_incomplete = 0;
11345 							asoc->strmout[i].next_spoke.tqe_next = 0;
11346 							asoc->strmout[i].next_spoke.tqe_prev = 0;
11347 						}
11348 					}
11349 				}
11350 			}
11351 			hold_tcblock = 1;
11352 			/* out with the INIT */
11353 			queue_only_for_init = 1;
11354 			/*-
11355 		         * we may want to dig in after this call and adjust the MTU
11356 		         * value. It defaulted to 1500 (constant) but the ro
11357 		         * structure may now have an update and thus we may need to
11358 		         * change it BEFORE we append the message.
11359 		         */
11360 			net = stcb->asoc.primary_destination;
11361 			asoc = &stcb->asoc;
11362 		}
11363 	}
11364 	if ((SCTP_SO_IS_NBIO(so)
11365 	    || (flags & MSG_NBIO)
11366 	    )) {
11367 		non_blocking = 1;
11368 	}
11369 	asoc = &stcb->asoc;
11370 
11371 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) {
11372 		if (sndlen > asoc->smallest_mtu) {
11373 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE);
11374 			error = EMSGSIZE;
11375 			goto out_unlocked;
11376 		}
11377 	}
11378 	/* would we block? */
11379 	if (non_blocking) {
11380 		if (hold_tcblock == 0) {
11381 			SCTP_TCB_LOCK(stcb);
11382 			hold_tcblock = 1;
11383 		}
11384 		inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
11385 		if ((SCTP_SB_LIMIT_SND(so) <
11386 		    (sndlen + inqueue_bytes + stcb->asoc.sb_send_resv)) ||
11387 		    (stcb->asoc.chunks_on_out_queue >
11388 		    sctp_max_chunks_on_queue)) {
11389 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK);
11390 			if (sndlen > SCTP_SB_LIMIT_SND(so))
11391 				error = EMSGSIZE;
11392 			else
11393 				error = EWOULDBLOCK;
11394 			goto out_unlocked;
11395 		}
11396 		stcb->asoc.sb_send_resv += sndlen;
11397 		SCTP_TCB_UNLOCK(stcb);
11398 		hold_tcblock = 0;
11399 	} else {
11400 		atomic_add_int(&stcb->asoc.sb_send_resv, sndlen);
11401 	}
11402 	local_soresv = sndlen;
11403 	/* Keep the stcb from being freed under our feet */
11404 	if (free_cnt_applied) {
11405 #ifdef INVARIANTS
11406 		panic("refcnt already incremented");
11407 #else
11408 		printf("refcnt:1 already incremented?\n");
11409 #endif
11410 	} else {
11411 		atomic_add_int(&stcb->asoc.refcnt, 1);
11412 		free_cnt_applied = 1;
11413 	}
11414 	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
11415 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
11416 		error = ECONNRESET;
11417 		goto out_unlocked;
11418 	}
11419 	if (create_lock_applied) {
11420 		SCTP_ASOC_CREATE_UNLOCK(inp);
11421 		create_lock_applied = 0;
11422 	}
11423 	if (asoc->stream_reset_outstanding) {
11424 		/*
11425 		 * Can't queue any data while stream reset is underway.
11426 		 */
11427 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAGAIN);
11428 		error = EAGAIN;
11429 		goto out_unlocked;
11430 	}
11431 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
11432 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
11433 		queue_only = 1;
11434 	}
11435 	if ((use_rcvinfo == 0) || (srcv == NULL)) {
11436 		/* Grab the default stuff from the asoc */
11437 		srcv = (struct sctp_sndrcvinfo *)&stcb->asoc.def_send;
11438 	}
11439 	/* we are now done with all control */
11440 	if (control) {
11441 		sctp_m_freem(control);
11442 		control = NULL;
11443 	}
11444 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
11445 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
11446 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
11447 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
11448 		if ((use_rcvinfo) &&
11449 		    (srcv->sinfo_flags & SCTP_ABORT)) {
11450 			;
11451 		} else {
11452 			SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
11453 			error = ECONNRESET;
11454 			goto out_unlocked;
11455 		}
11456 	}
11457 	/* Ok, we will attempt a msgsnd :> */
11458 	if (p) {
11459 		p->td_ru.ru_msgsnd++;
11460 	}
11461 	if (stcb) {
11462 		if (((srcv->sinfo_flags | temp_flags) & SCTP_ADDR_OVER) == 0) {
11463 			net = stcb->asoc.primary_destination;
11464 		}
11465 	}
11466 	if (net == NULL) {
11467 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11468 		error = EINVAL;
11469 		goto out_unlocked;
11470 	}
11471 	if ((net->flight_size > net->cwnd) && (sctp_cmt_on_off == 0)) {
11472 		/*-
11473 		 * CMT: Added check for CMT above. net above is the primary
11474 		 * dest. If CMT is ON, sender should always attempt to send
11475 		 * with the output routine sctp_fill_outqueue() that loops
11476 		 * through all destination addresses. Therefore, if CMT is
11477 		 * ON, queue_only is NOT set to 1 here, so that
11478 		 * sctp_chunk_output() can be called below.
11479 		 */
11480 		queue_only = 1;
11481 
11482 	} else if (asoc->ifp_had_enobuf) {
11483 		SCTP_STAT_INCR(sctps_ifnomemqueued);
11484 		if (net->flight_size > (net->mtu * 2))
11485 			queue_only = 1;
11486 		asoc->ifp_had_enobuf = 0;
11487 	} else {
11488 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
11489 		    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)));
11490 	}
11491 	/* Are we aborting? */
11492 	if (srcv->sinfo_flags & SCTP_ABORT) {
11493 		struct mbuf *mm;
11494 		int tot_demand, tot_out = 0, max_out;
11495 
11496 		SCTP_STAT_INCR(sctps_sends_with_abort);
11497 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
11498 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
11499 			/* It has to be up before we abort */
11500 			/* how big is the user initiated abort? */
11501 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11502 			error = EINVAL;
11503 			goto out;
11504 		}
11505 		if (hold_tcblock) {
11506 			SCTP_TCB_UNLOCK(stcb);
11507 			hold_tcblock = 0;
11508 		}
11509 		if (top) {
11510 			struct mbuf *cntm = NULL;
11511 
11512 			mm = sctp_get_mbuf_for_msg(1, 0, M_WAIT, 1, MT_DATA);
11513 			if (sndlen != 0) {
11514 				cntm = top;
11515 				while (cntm) {
11516 					tot_out += SCTP_BUF_LEN(cntm);
11517 					cntm = SCTP_BUF_NEXT(cntm);
11518 				}
11519 			}
11520 			tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
11521 		} else {
11522 			/* Must fit in a MTU */
11523 			tot_out = sndlen;
11524 			tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
11525 			if (tot_demand > SCTP_DEFAULT_ADD_MORE) {
11526 				/* To big */
11527 				SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE);
11528 				error = EMSGSIZE;
11529 				goto out;
11530 			}
11531 			mm = sctp_get_mbuf_for_msg(tot_demand, 0, M_WAIT, 1, MT_DATA);
11532 		}
11533 		if (mm == NULL) {
11534 			SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
11535 			error = ENOMEM;
11536 			goto out;
11537 		}
11538 		max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr);
11539 		max_out -= sizeof(struct sctp_abort_msg);
11540 		if (tot_out > max_out) {
11541 			tot_out = max_out;
11542 		}
11543 		if (mm) {
11544 			struct sctp_paramhdr *ph;
11545 
11546 			/* now move forward the data pointer */
11547 			ph = mtod(mm, struct sctp_paramhdr *);
11548 			ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
11549 			ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
11550 			ph++;
11551 			SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr);
11552 			if (top == NULL) {
11553 				error = uiomove((caddr_t)ph, (int)tot_out, uio);
11554 				if (error) {
11555 					/*-
11556 				         * Here if we can't get his data we
11557 				         * still abort we just don't get to
11558 				         * send the users note :-0
11559 				         */
11560 					sctp_m_freem(mm);
11561 					mm = NULL;
11562 				}
11563 			} else {
11564 				if (sndlen != 0) {
11565 					SCTP_BUF_NEXT(mm) = top;
11566 				}
11567 			}
11568 		}
11569 		if (hold_tcblock == 0) {
11570 			SCTP_TCB_LOCK(stcb);
11571 			hold_tcblock = 1;
11572 		}
11573 		atomic_add_int(&stcb->asoc.refcnt, -1);
11574 		free_cnt_applied = 0;
11575 		/* release this lock, otherwise we hang on ourselves */
11576 		sctp_abort_an_association(stcb->sctp_ep, stcb,
11577 		    SCTP_RESPONSE_TO_USER_REQ,
11578 		    mm, SCTP_SO_LOCKED);
11579 		/* now relock the stcb so everything is sane */
11580 		hold_tcblock = 0;
11581 		stcb = NULL;
11582 		/*
11583 		 * In this case top is already chained to mm avoid double
11584 		 * free, since we free it below if top != NULL and driver
11585 		 * would free it after sending the packet out
11586 		 */
11587 		if (sndlen != 0) {
11588 			top = NULL;
11589 		}
11590 		goto out_unlocked;
11591 	}
11592 	/* Calculate the maximum we can send */
11593 	inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
11594 	if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) {
11595 		if (non_blocking) {
11596 			/* we already checked for non-blocking above. */
11597 			max_len = sndlen;
11598 		} else {
11599 			max_len = SCTP_SB_LIMIT_SND(so) - stcb->asoc.total_output_queue_size;
11600 		}
11601 	} else {
11602 		max_len = 0;
11603 	}
11604 	if (hold_tcblock) {
11605 		SCTP_TCB_UNLOCK(stcb);
11606 		hold_tcblock = 0;
11607 	}
11608 	/* Is the stream no. valid? */
11609 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
11610 		/* Invalid stream number */
11611 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11612 		error = EINVAL;
11613 		goto out_unlocked;
11614 	}
11615 	if (asoc->strmout == NULL) {
11616 		/* huh? software error */
11617 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT);
11618 		error = EFAULT;
11619 		goto out_unlocked;
11620 	}
11621 	/* Unless E_EOR mode is on, we must make a send FIT in one call. */
11622 	if ((user_marks_eor == 0) &&
11623 	    (sndlen > SCTP_SB_LIMIT_SND(stcb->sctp_socket))) {
11624 		/* It will NEVER fit */
11625 		SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE);
11626 		error = EMSGSIZE;
11627 		goto out_unlocked;
11628 	}
11629 	if ((uio == NULL) && user_marks_eor) {
11630 		/*-
11631 		 * We do not support eeor mode for
11632 		 * sending with mbuf chains (like sendfile).
11633 		 */
11634 		SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11635 		error = EINVAL;
11636 		goto out_unlocked;
11637 	}
11638 	if (user_marks_eor) {
11639 		local_add_more = sctp_add_more_threshold;
11640 	} else {
11641 		/*-
11642 		 * For non-eeor the whole message must fit in
11643 		 * the socket send buffer.
11644 		 */
11645 		local_add_more = sndlen;
11646 	}
11647 	len = 0;
11648 	if (non_blocking) {
11649 		goto skip_preblock;
11650 	}
11651 	if (((max_len <= local_add_more) &&
11652 	    (SCTP_SB_LIMIT_SND(so) > local_add_more)) ||
11653 	    ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) > sctp_max_chunks_on_queue)) {	/* if */
11654 		/* No room right no ! */
11655 		SOCKBUF_LOCK(&so->so_snd);
11656 		inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
11657 		while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + sctp_add_more_threshold)) ||
11658 		    ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) > sctp_max_chunks_on_queue /* while */ )) {
11659 
11660 			if (sctp_logging_level & SCTP_BLK_LOGGING_ENABLE) {
11661 				sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA,
11662 				    so, asoc, sndlen);
11663 			}
11664 			be.error = 0;
11665 			stcb->block_entry = &be;
11666 			error = sbwait(&so->so_snd);
11667 			stcb->block_entry = NULL;
11668 			if (error || so->so_error || be.error) {
11669 				if (error == 0) {
11670 					if (so->so_error)
11671 						error = so->so_error;
11672 					if (be.error) {
11673 						error = be.error;
11674 					}
11675 				}
11676 				SOCKBUF_UNLOCK(&so->so_snd);
11677 				goto out_unlocked;
11678 			}
11679 			if (sctp_logging_level & SCTP_BLK_LOGGING_ENABLE) {
11680 				sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
11681 				    so, asoc, stcb->asoc.total_output_queue_size);
11682 			}
11683 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
11684 				goto out_unlocked;
11685 			}
11686 			inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
11687 		}
11688 		inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
11689 		if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) {
11690 			max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes;
11691 		} else {
11692 			max_len = 0;
11693 		}
11694 		SOCKBUF_UNLOCK(&so->so_snd);
11695 	}
11696 skip_preblock:
11697 	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
11698 		goto out_unlocked;
11699 	}
11700 	atomic_add_int(&stcb->total_sends, 1);
11701 	/*
11702 	 * sndlen covers for mbuf case uio_resid covers for the non-mbuf
11703 	 * case NOTE: uio will be null when top/mbuf is passed
11704 	 */
11705 	if (sndlen == 0) {
11706 		if (srcv->sinfo_flags & SCTP_EOF) {
11707 			got_all_of_the_send = 1;
11708 			goto dataless_eof;
11709 		} else {
11710 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11711 			error = EINVAL;
11712 			goto out;
11713 		}
11714 	}
11715 	if (top == NULL) {
11716 		struct sctp_stream_queue_pending *sp;
11717 		struct sctp_stream_out *strm;
11718 		uint32_t sndout, initial_out;
11719 
11720 		initial_out = uio->uio_resid;
11721 
11722 		SCTP_TCB_SEND_LOCK(stcb);
11723 		if ((asoc->stream_locked) &&
11724 		    (asoc->stream_locked_on != srcv->sinfo_stream)) {
11725 			SCTP_TCB_SEND_UNLOCK(stcb);
11726 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11727 			error = EINVAL;
11728 			goto out;
11729 		}
11730 		SCTP_TCB_SEND_UNLOCK(stcb);
11731 
11732 		strm = &stcb->asoc.strmout[srcv->sinfo_stream];
11733 		if (strm->last_msg_incomplete == 0) {
11734 	do_a_copy_in:
11735 			sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error, non_blocking);
11736 			if ((sp == NULL) || (error)) {
11737 				goto out;
11738 			}
11739 			SCTP_TCB_SEND_LOCK(stcb);
11740 			if (sp->msg_is_complete) {
11741 				strm->last_msg_incomplete = 0;
11742 				asoc->stream_locked = 0;
11743 			} else {
11744 				/*
11745 				 * Just got locked to this guy in case of an
11746 				 * interrupt.
11747 				 */
11748 				strm->last_msg_incomplete = 1;
11749 				asoc->stream_locked = 1;
11750 				asoc->stream_locked_on = srcv->sinfo_stream;
11751 				sp->sender_all_done = 0;
11752 			}
11753 			sctp_snd_sb_alloc(stcb, sp->length);
11754 			atomic_add_int(&asoc->stream_queue_cnt, 1);
11755 			if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
11756 				sp->strseq = strm->next_sequence_sent;
11757 				if (sctp_logging_level & SCTP_LOG_AT_SEND_2_SCTP) {
11758 					sctp_misc_ints(SCTP_STRMOUT_LOG_ASSIGN,
11759 					    (uintptr_t) stcb, sp->length,
11760 					    (uint32_t) ((srcv->sinfo_stream << 16) | sp->strseq), 0);
11761 				}
11762 				strm->next_sequence_sent++;
11763 			} else {
11764 				SCTP_STAT_INCR(sctps_sends_with_unord);
11765 			}
11766 			TAILQ_INSERT_TAIL(&strm->outqueue, sp, next);
11767 			if ((strm->next_spoke.tqe_next == NULL) &&
11768 			    (strm->next_spoke.tqe_prev == NULL)) {
11769 				/* Not on wheel, insert */
11770 				sctp_insert_on_wheel(stcb, asoc, strm, 1);
11771 			}
11772 			SCTP_TCB_SEND_UNLOCK(stcb);
11773 		} else {
11774 			SCTP_TCB_SEND_LOCK(stcb);
11775 			sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead);
11776 			SCTP_TCB_SEND_UNLOCK(stcb);
11777 			if (sp == NULL) {
11778 				/* ???? Huh ??? last msg is gone */
11779 #ifdef INVARIANTS
11780 				panic("Warning: Last msg marked incomplete, yet nothing left?");
11781 #else
11782 				SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n");
11783 				strm->last_msg_incomplete = 0;
11784 #endif
11785 				goto do_a_copy_in;
11786 
11787 			}
11788 		}
11789 		while (uio->uio_resid > 0) {
11790 			/* How much room do we have? */
11791 			struct mbuf *new_tail, *mm;
11792 
11793 			if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size)
11794 				max_len = SCTP_SB_LIMIT_SND(so) - stcb->asoc.total_output_queue_size;
11795 			else
11796 				max_len = 0;
11797 
11798 			if ((max_len > sctp_add_more_threshold) ||
11799 			    (max_len && (SCTP_SB_LIMIT_SND(so) < sctp_add_more_threshold)) ||
11800 			    (uio->uio_resid &&
11801 			    (uio->uio_resid <= (int)max_len))) {
11802 				sndout = 0;
11803 				new_tail = NULL;
11804 				if (hold_tcblock) {
11805 					SCTP_TCB_UNLOCK(stcb);
11806 					hold_tcblock = 0;
11807 				}
11808 				mm = sctp_copy_resume(sp, uio, srcv, max_len, user_marks_eor, &error, &sndout, &new_tail);
11809 				if ((mm == NULL) || error) {
11810 					if (mm) {
11811 						sctp_m_freem(mm);
11812 					}
11813 					goto out;
11814 				}
11815 				/* Update the mbuf and count */
11816 				SCTP_TCB_SEND_LOCK(stcb);
11817 				if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
11818 					/*
11819 					 * we need to get out. Peer probably
11820 					 * aborted.
11821 					 */
11822 					sctp_m_freem(mm);
11823 					if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) {
11824 						SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
11825 						error = ECONNRESET;
11826 					}
11827 					SCTP_TCB_SEND_UNLOCK(stcb);
11828 					goto out;
11829 				}
11830 				if (sp->tail_mbuf) {
11831 					/* tack it to the end */
11832 					SCTP_BUF_NEXT(sp->tail_mbuf) = mm;
11833 					sp->tail_mbuf = new_tail;
11834 				} else {
11835 					/* A stolen mbuf */
11836 					sp->data = mm;
11837 					sp->tail_mbuf = new_tail;
11838 				}
11839 				sctp_snd_sb_alloc(stcb, sndout);
11840 				atomic_add_int(&sp->length, sndout);
11841 				len += sndout;
11842 
11843 				/* Did we reach EOR? */
11844 				if ((uio->uio_resid == 0) &&
11845 				    ((user_marks_eor == 0) ||
11846 				    (srcv->sinfo_flags & SCTP_EOF) ||
11847 				    (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))
11848 				    ) {
11849 					sp->msg_is_complete = 1;
11850 				} else {
11851 					sp->msg_is_complete = 0;
11852 				}
11853 				SCTP_TCB_SEND_UNLOCK(stcb);
11854 			}
11855 			if (uio->uio_resid == 0) {
11856 				/* got it all? */
11857 				continue;
11858 			}
11859 			/* PR-SCTP? */
11860 			if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
11861 				/*
11862 				 * This is ugly but we must assure locking
11863 				 * order
11864 				 */
11865 				if (hold_tcblock == 0) {
11866 					SCTP_TCB_LOCK(stcb);
11867 					hold_tcblock = 1;
11868 				}
11869 				sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
11870 				inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
11871 				if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size)
11872 					max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes;
11873 				else
11874 					max_len = 0;
11875 				if (max_len > 0) {
11876 					continue;
11877 				}
11878 				SCTP_TCB_UNLOCK(stcb);
11879 				hold_tcblock = 0;
11880 			}
11881 			/* wait for space now */
11882 			if (non_blocking) {
11883 				/* Non-blocking io in place out */
11884 				goto skip_out_eof;
11885 			}
11886 			if ((net->flight_size > net->cwnd) &&
11887 			    (sctp_cmt_on_off == 0)) {
11888 				queue_only = 1;
11889 			} else if (asoc->ifp_had_enobuf) {
11890 				SCTP_STAT_INCR(sctps_ifnomemqueued);
11891 				if (net->flight_size > (net->mtu * 2)) {
11892 					queue_only = 1;
11893 				} else {
11894 					queue_only = 0;
11895 				}
11896 				asoc->ifp_had_enobuf = 0;
11897 				un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
11898 				    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) *
11899 				    sizeof(struct sctp_data_chunk)));
11900 			} else {
11901 				un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
11902 				    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) *
11903 				    sizeof(struct sctp_data_chunk)));
11904 				if (net->flight_size > (net->mtu * stcb->asoc.max_burst)) {
11905 					queue_only = 1;
11906 					SCTP_STAT_INCR(sctps_send_burst_avoid);
11907 				} else if (net->flight_size > net->cwnd) {
11908 					queue_only = 1;
11909 					SCTP_STAT_INCR(sctps_send_cwnd_avoid);
11910 				} else {
11911 					queue_only = 0;
11912 				}
11913 			}
11914 			if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) &&
11915 			    (stcb->asoc.total_flight > 0) &&
11916 			    (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) &&
11917 			    (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))
11918 			    ) {
11919 
11920 				/*-
11921 				 * Ok, Nagle is set on and we have data outstanding.
11922 				 * Don't send anything and let SACKs drive out the
11923 				 * data unless wen have a "full" segment to send.
11924 				 */
11925 				if (sctp_logging_level & SCTP_NAGLE_LOGGING_ENABLE) {
11926 					sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED);
11927 				}
11928 				SCTP_STAT_INCR(sctps_naglequeued);
11929 				nagle_applies = 1;
11930 			} else {
11931 				if (sctp_logging_level & SCTP_NAGLE_LOGGING_ENABLE) {
11932 					if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY))
11933 						sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED);
11934 				}
11935 				SCTP_STAT_INCR(sctps_naglesent);
11936 				nagle_applies = 0;
11937 			}
11938 			/* What about the INIT, send it maybe */
11939 			if (sctp_logging_level & SCTP_BLK_LOGGING_ENABLE) {
11940 
11941 				sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only,
11942 				    nagle_applies, un_sent);
11943 				sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size,
11944 				    stcb->asoc.total_flight,
11945 				    stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count);
11946 			}
11947 			if (queue_only_for_init) {
11948 				if (hold_tcblock == 0) {
11949 					SCTP_TCB_LOCK(stcb);
11950 					hold_tcblock = 1;
11951 				}
11952 				if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
11953 					/* a collision took us forward? */
11954 					queue_only_for_init = 0;
11955 					queue_only = 0;
11956 				} else {
11957 					sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED);
11958 					SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT);
11959 					queue_only_for_init = 0;
11960 					queue_only = 1;
11961 				}
11962 			}
11963 			if ((queue_only == 0) && (nagle_applies == 0)
11964 			    ) {
11965 				/*-
11966 				 * need to start chunk output
11967 				 * before blocking.. note that if
11968 				 * a lock is already applied, then
11969 				 * the input via the net is happening
11970 				 * and I don't need to start output :-D
11971 				 */
11972 				if (hold_tcblock == 0) {
11973 					if (SCTP_TCB_TRYLOCK(stcb)) {
11974 						hold_tcblock = 1;
11975 						sctp_chunk_output(inp,
11976 						    stcb,
11977 						    SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
11978 					}
11979 				} else {
11980 					sctp_chunk_output(inp,
11981 					    stcb,
11982 					    SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
11983 				}
11984 				if (hold_tcblock == 1) {
11985 					SCTP_TCB_UNLOCK(stcb);
11986 					hold_tcblock = 0;
11987 				}
11988 			}
11989 			SOCKBUF_LOCK(&so->so_snd);
11990 			/*-
11991 		         * This is a bit strange, but I think it will
11992 		         * work. The total_output_queue_size is locked and
11993 		         * protected by the TCB_LOCK, which we just released.
11994 		         * There is a race that can occur between releasing it
11995 		         * above, and me getting the socket lock, where sacks
11996 		         * come in but we have not put the SB_WAIT on the
11997 		         * so_snd buffer to get the wakeup. After the LOCK
11998 		         * is applied the sack_processing will also need to
11999 		         * LOCK the so->so_snd to do the actual sowwakeup(). So
12000 		         * once we have the socket buffer lock if we recheck the
12001 		         * size we KNOW we will get to sleep safely with the
12002 		         * wakeup flag in place.
12003 		         */
12004 			if (SCTP_SB_LIMIT_SND(so) <= (stcb->asoc.total_output_queue_size +
12005 			    min(sctp_add_more_threshold, SCTP_SB_LIMIT_SND(so)))
12006 			    ) {
12007 				if (sctp_logging_level & SCTP_BLK_LOGGING_ENABLE) {
12008 					sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
12009 					    so, asoc, uio->uio_resid);
12010 				}
12011 				be.error = 0;
12012 				stcb->block_entry = &be;
12013 				error = sbwait(&so->so_snd);
12014 				stcb->block_entry = NULL;
12015 
12016 				if (error || so->so_error || be.error) {
12017 					if (error == 0) {
12018 						if (so->so_error)
12019 							error = so->so_error;
12020 						if (be.error) {
12021 							error = be.error;
12022 						}
12023 					}
12024 					SOCKBUF_UNLOCK(&so->so_snd);
12025 					goto out_unlocked;
12026 				}
12027 				if (sctp_logging_level & SCTP_BLK_LOGGING_ENABLE) {
12028 					sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
12029 					    so, asoc, stcb->asoc.total_output_queue_size);
12030 				}
12031 			}
12032 			SOCKBUF_UNLOCK(&so->so_snd);
12033 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
12034 				goto out_unlocked;
12035 			}
12036 		}
12037 		SCTP_TCB_SEND_LOCK(stcb);
12038 		if (sp) {
12039 			if (sp->msg_is_complete == 0) {
12040 				strm->last_msg_incomplete = 1;
12041 				asoc->stream_locked = 1;
12042 				asoc->stream_locked_on = srcv->sinfo_stream;
12043 			} else {
12044 				sp->sender_all_done = 1;
12045 				strm->last_msg_incomplete = 0;
12046 				asoc->stream_locked = 0;
12047 			}
12048 		} else {
12049 			SCTP_PRINTF("Huh no sp TSNH?\n");
12050 			strm->last_msg_incomplete = 0;
12051 			asoc->stream_locked = 0;
12052 		}
12053 		SCTP_TCB_SEND_UNLOCK(stcb);
12054 		if (uio->uio_resid == 0) {
12055 			got_all_of_the_send = 1;
12056 		}
12057 	} else if (top) {
12058 		/* We send in a 0, since we do NOT have any locks */
12059 		error = sctp_msg_append(stcb, net, top, srcv, 0);
12060 		top = NULL;
12061 		if (srcv->sinfo_flags & SCTP_EOF) {
12062 			/*
12063 			 * This should only happen for Panda for the mbuf
12064 			 * send case, which does NOT yet support EEOR mode.
12065 			 * Thus, we can just set this flag to do the proper
12066 			 * EOF handling.
12067 			 */
12068 			got_all_of_the_send = 1;
12069 		}
12070 	}
12071 	if (error) {
12072 		goto out;
12073 	}
12074 dataless_eof:
12075 	/* EOF thing ? */
12076 	if ((srcv->sinfo_flags & SCTP_EOF) &&
12077 	    (got_all_of_the_send == 1) &&
12078 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
12079 	    ) {
12080 		int cnt;
12081 
12082 		SCTP_STAT_INCR(sctps_sends_with_eof);
12083 		error = 0;
12084 		if (hold_tcblock == 0) {
12085 			SCTP_TCB_LOCK(stcb);
12086 			hold_tcblock = 1;
12087 		}
12088 		cnt = sctp_is_there_unsent_data(stcb);
12089 		if (TAILQ_EMPTY(&asoc->send_queue) &&
12090 		    TAILQ_EMPTY(&asoc->sent_queue) &&
12091 		    (cnt == 0)) {
12092 			if (asoc->locked_on_sending) {
12093 				goto abort_anyway;
12094 			}
12095 			/* there is nothing queued to send, so I'm done... */
12096 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
12097 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
12098 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
12099 				/* only send SHUTDOWN the first time through */
12100 				sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
12101 				if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
12102 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
12103 				}
12104 				SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
12105 				SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
12106 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
12107 				    asoc->primary_destination);
12108 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
12109 				    asoc->primary_destination);
12110 			}
12111 		} else {
12112 			/*-
12113 		         * we still got (or just got) data to send, so set
12114 		         * SHUTDOWN_PENDING
12115 		         */
12116 			/*-
12117 		         * XXX sockets draft says that SCTP_EOF should be
12118 		         * sent with no data.  currently, we will allow user
12119 		         * data to be sent first and move to
12120 		         * SHUTDOWN-PENDING
12121 		         */
12122 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
12123 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
12124 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
12125 				if (hold_tcblock == 0) {
12126 					SCTP_TCB_LOCK(stcb);
12127 					hold_tcblock = 1;
12128 				}
12129 				if (asoc->locked_on_sending) {
12130 					/* Locked to send out the data */
12131 					struct sctp_stream_queue_pending *sp;
12132 
12133 					sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead);
12134 					if (sp) {
12135 						if ((sp->length == 0) && (sp->msg_is_complete == 0))
12136 							asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
12137 					}
12138 				}
12139 				asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
12140 				if (TAILQ_EMPTY(&asoc->send_queue) &&
12141 				    TAILQ_EMPTY(&asoc->sent_queue) &&
12142 				    (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
12143 			abort_anyway:
12144 					if (free_cnt_applied) {
12145 						atomic_add_int(&stcb->asoc.refcnt, -1);
12146 						free_cnt_applied = 0;
12147 					}
12148 					sctp_abort_an_association(stcb->sctp_ep, stcb,
12149 					    SCTP_RESPONSE_TO_USER_REQ,
12150 					    NULL, SCTP_SO_LOCKED);
12151 					/*
12152 					 * now relock the stcb so everything
12153 					 * is sane
12154 					 */
12155 					hold_tcblock = 0;
12156 					stcb = NULL;
12157 					goto out;
12158 				}
12159 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
12160 				    asoc->primary_destination);
12161 				sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY);
12162 			}
12163 		}
12164 	}
12165 skip_out_eof:
12166 	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
12167 		some_on_control = 1;
12168 	}
12169 	if ((net->flight_size > net->cwnd) &&
12170 	    (sctp_cmt_on_off == 0)) {
12171 		queue_only = 1;
12172 	} else if (asoc->ifp_had_enobuf) {
12173 		SCTP_STAT_INCR(sctps_ifnomemqueued);
12174 		if (net->flight_size > (net->mtu * 2)) {
12175 			queue_only = 1;
12176 		} else {
12177 			queue_only = 0;
12178 		}
12179 		asoc->ifp_had_enobuf = 0;
12180 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
12181 		    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) *
12182 		    sizeof(struct sctp_data_chunk)));
12183 	} else {
12184 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
12185 		    ((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) *
12186 		    sizeof(struct sctp_data_chunk)));
12187 		if (net->flight_size > (net->mtu * stcb->asoc.max_burst)) {
12188 			queue_only = 1;
12189 			SCTP_STAT_INCR(sctps_send_burst_avoid);
12190 		} else if (net->flight_size > net->cwnd) {
12191 			queue_only = 1;
12192 			SCTP_STAT_INCR(sctps_send_cwnd_avoid);
12193 		} else {
12194 			queue_only = 0;
12195 		}
12196 	}
12197 	if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) &&
12198 	    (stcb->asoc.total_flight > 0) &&
12199 	    (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) &&
12200 	    (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))
12201 	    ) {
12202 		/*-
12203 		 * Ok, Nagle is set on and we have data outstanding.
12204 		 * Don't send anything and let SACKs drive out the
12205 		 * data unless wen have a "full" segment to send.
12206 		 */
12207 		if (sctp_logging_level & SCTP_NAGLE_LOGGING_ENABLE) {
12208 			sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED);
12209 		}
12210 		SCTP_STAT_INCR(sctps_naglequeued);
12211 		nagle_applies = 1;
12212 	} else {
12213 		if (sctp_logging_level & SCTP_NAGLE_LOGGING_ENABLE) {
12214 			if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY))
12215 				sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED);
12216 		}
12217 		SCTP_STAT_INCR(sctps_naglesent);
12218 		nagle_applies = 0;
12219 	}
12220 	if (queue_only_for_init) {
12221 		if (hold_tcblock == 0) {
12222 			SCTP_TCB_LOCK(stcb);
12223 			hold_tcblock = 1;
12224 		}
12225 		if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
12226 			/* a collision took us forward? */
12227 			queue_only_for_init = 0;
12228 			queue_only = 0;
12229 		} else {
12230 			sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED);
12231 			SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_WAIT);
12232 			queue_only_for_init = 0;
12233 			queue_only = 1;
12234 		}
12235 	}
12236 	if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) {
12237 		/* we can attempt to send too. */
12238 		if (hold_tcblock == 0) {
12239 			/*
12240 			 * If there is activity recv'ing sacks no need to
12241 			 * send
12242 			 */
12243 			if (SCTP_TCB_TRYLOCK(stcb)) {
12244 				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
12245 				hold_tcblock = 1;
12246 			}
12247 		} else {
12248 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
12249 		}
12250 	} else if ((queue_only == 0) &&
12251 		    (stcb->asoc.peers_rwnd == 0) &&
12252 	    (stcb->asoc.total_flight == 0)) {
12253 		/* We get to have a probe outstanding */
12254 		if (hold_tcblock == 0) {
12255 			hold_tcblock = 1;
12256 			SCTP_TCB_LOCK(stcb);
12257 		}
12258 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
12259 	} else if (some_on_control) {
12260 		int num_out, reason, cwnd_full, frag_point;
12261 
12262 		/* Here we do control only */
12263 		if (hold_tcblock == 0) {
12264 			hold_tcblock = 1;
12265 			SCTP_TCB_LOCK(stcb);
12266 		}
12267 		frag_point = sctp_get_frag_point(stcb, &stcb->asoc);
12268 		(void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
12269 		    &reason, 1, &cwnd_full, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED);
12270 	}
12271 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d",
12272 	    queue_only, stcb->asoc.peers_rwnd, un_sent,
12273 	    stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
12274 	    stcb->asoc.total_output_queue_size, error);
12275 
12276 out:
12277 out_unlocked:
12278 
12279 	if (local_soresv && stcb) {
12280 		atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen);
12281 		local_soresv = 0;
12282 	}
12283 	if (create_lock_applied) {
12284 		SCTP_ASOC_CREATE_UNLOCK(inp);
12285 		create_lock_applied = 0;
12286 	}
12287 	if ((stcb) && hold_tcblock) {
12288 		SCTP_TCB_UNLOCK(stcb);
12289 	}
12290 	if (stcb && free_cnt_applied) {
12291 		atomic_add_int(&stcb->asoc.refcnt, -1);
12292 	}
12293 #ifdef INVARIANTS
12294 	if (stcb) {
12295 		if (mtx_owned(&stcb->tcb_mtx)) {
12296 			panic("Leaving with tcb mtx owned?");
12297 		}
12298 		if (mtx_owned(&stcb->tcb_send_mtx)) {
12299 			panic("Leaving with tcb send mtx owned?");
12300 		}
12301 	}
12302 #endif
12303 	if (top) {
12304 		sctp_m_freem(top);
12305 	}
12306 	if (control) {
12307 		sctp_m_freem(control);
12308 	}
12309 	return (error);
12310 }
12311 
12312 
12313 /*
12314  * generate an AUTHentication chunk, if required
12315  */
12316 struct mbuf *
12317 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end,
12318     struct sctp_auth_chunk **auth_ret, uint32_t * offset,
12319     struct sctp_tcb *stcb, uint8_t chunk)
12320 {
12321 	struct mbuf *m_auth;
12322 	struct sctp_auth_chunk *auth;
12323 	int chunk_len;
12324 
12325 	if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) ||
12326 	    (stcb == NULL))
12327 		return (m);
12328 
12329 	/* sysctl disabled auth? */
12330 	if (sctp_auth_disable)
12331 		return (m);
12332 
12333 	/* peer doesn't do auth... */
12334 	if (!stcb->asoc.peer_supports_auth) {
12335 		return (m);
12336 	}
12337 	/* does the requested chunk require auth? */
12338 	if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) {
12339 		return (m);
12340 	}
12341 	m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_DONTWAIT, 1, MT_HEADER);
12342 	if (m_auth == NULL) {
12343 		/* no mbuf's */
12344 		return (m);
12345 	}
12346 	/* reserve some space if this will be the first mbuf */
12347 	if (m == NULL)
12348 		SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD);
12349 	/* fill in the AUTH chunk details */
12350 	auth = mtod(m_auth, struct sctp_auth_chunk *);
12351 	bzero(auth, sizeof(*auth));
12352 	auth->ch.chunk_type = SCTP_AUTHENTICATION;
12353 	auth->ch.chunk_flags = 0;
12354 	chunk_len = sizeof(*auth) +
12355 	    sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id);
12356 	auth->ch.chunk_length = htons(chunk_len);
12357 	auth->hmac_id = htons(stcb->asoc.peer_hmac_id);
12358 	/* key id and hmac digest will be computed and filled in upon send */
12359 
12360 	/* save the offset where the auth was inserted into the chain */
12361 	if (m != NULL) {
12362 		struct mbuf *cn;
12363 
12364 		*offset = 0;
12365 		cn = m;
12366 		while (cn) {
12367 			*offset += SCTP_BUF_LEN(cn);
12368 			cn = SCTP_BUF_NEXT(cn);
12369 		}
12370 	} else
12371 		*offset = 0;
12372 
12373 	/* update length and return pointer to the auth chunk */
12374 	SCTP_BUF_LEN(m_auth) = chunk_len;
12375 	m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0);
12376 	if (auth_ret != NULL)
12377 		*auth_ret = auth;
12378 
12379 	return (m);
12380 }
12381 
12382 int
12383 sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t * ro)
12384 {
12385 	struct nd_prefix *pfx = NULL;
12386 	struct nd_pfxrouter *pfxrtr = NULL;
12387 	struct sockaddr_in6 gw6;
12388 
12389 	if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6)
12390 		return (0);
12391 
12392 	/* get prefix entry of address */
12393 	LIST_FOREACH(pfx, &nd_prefix, ndpr_entry) {
12394 		if (pfx->ndpr_stateflags & NDPRF_DETACHED)
12395 			continue;
12396 		if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr,
12397 		    &src6->sin6_addr, &pfx->ndpr_mask))
12398 			break;
12399 	}
12400 	/* no prefix entry in the prefix list */
12401 	if (pfx == NULL) {
12402 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for ");
12403 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6);
12404 		return (0);
12405 	}
12406 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is ");
12407 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6);
12408 
12409 	/* search installed gateway from prefix entry */
12410 	for (pfxrtr = pfx->ndpr_advrtrs.lh_first; pfxrtr; pfxrtr =
12411 	    pfxrtr->pfr_next) {
12412 		memset(&gw6, 0, sizeof(struct sockaddr_in6));
12413 		gw6.sin6_family = AF_INET6;
12414 		gw6.sin6_len = sizeof(struct sockaddr_in6);
12415 		memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr,
12416 		    sizeof(struct in6_addr));
12417 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is ");
12418 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6);
12419 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is ");
12420 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway);
12421 		if (sctp_cmpaddr((struct sockaddr *)&gw6,
12422 		    ro->ro_rt->rt_gateway)) {
12423 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n");
12424 			return (1);
12425 		}
12426 	}
12427 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n");
12428 	return (0);
12429 }
12430 int
12431 sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t * ro)
12432 {
12433 	struct sockaddr_in *sin, *mask;
12434 	struct ifaddr *ifa;
12435 	struct in_addr srcnetaddr, gwnetaddr;
12436 
12437 	if (ro == NULL || ro->ro_rt == NULL ||
12438 	    sifa->address.sa.sa_family != AF_INET) {
12439 		return (0);
12440 	}
12441 	ifa = (struct ifaddr *)sifa->ifa;
12442 	mask = (struct sockaddr_in *)(ifa->ifa_netmask);
12443 	sin = (struct sockaddr_in *)&sifa->address.sin;
12444 	srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr);
12445 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is ");
12446 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa);
12447 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr);
12448 
12449 	sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
12450 	gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr);
12451 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is ");
12452 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway);
12453 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr);
12454 	if (srcnetaddr.s_addr == gwnetaddr.s_addr) {
12455 		return (1);
12456 	}
12457 	return (0);
12458 }
12459