xref: /freebsd/sys/netinet/sctp_output.c (revision 26ea346865df84a5f36598066028a4d9d392467f)
1 /*-
2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  * a) Redistributions of source code must retain the above copyright notice,
8  *   this list of conditions and the following disclaimer.
9  *
10  * b) Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *   the documentation and/or other materials provided with the distribution.
13  *
14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15  *    contributors may be used to endorse or promote products derived
16  *    from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28  * THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 /* $KAME: sctp_output.c,v 1.46 2005/03/06 16:04:17 itojun Exp $	 */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <netinet/sctp_os.h>
37 #include <sys/proc.h>
38 #include <netinet/sctp_var.h>
39 #include <netinet/sctp_sysctl.h>
40 #include <netinet/sctp_header.h>
41 #include <netinet/sctp_pcb.h>
42 #include <netinet/sctputil.h>
43 #include <netinet/sctp_output.h>
44 #include <netinet/sctp_uio.h>
45 #include <netinet/sctputil.h>
46 #include <netinet/sctp_auth.h>
47 #include <netinet/sctp_timer.h>
48 #include <netinet/sctp_asconf.h>
49 #include <netinet/sctp_indata.h>
50 #include <netinet/sctp_bsd_addr.h>
51 #include <netinet/sctp_input.h>
52 #include <netinet/sctp_crc32.h>
53 #include <netinet/udp.h>
54 #include <machine/in_cksum.h>
55 
56 
57 
58 #define SCTP_MAX_GAPS_INARRAY 4
59 struct sack_track {
60 	uint8_t right_edge;	/* mergable on the right edge */
61 	uint8_t left_edge;	/* mergable on the left edge */
62 	uint8_t num_entries;
63 	uint8_t spare;
64 	struct sctp_gap_ack_block gaps[SCTP_MAX_GAPS_INARRAY];
65 };
66 
67 struct sack_track sack_array[256] = {
68 	{0, 0, 0, 0,		/* 0x00 */
69 		{{0, 0},
70 		{0, 0},
71 		{0, 0},
72 		{0, 0}
73 		}
74 	},
75 	{1, 0, 1, 0,		/* 0x01 */
76 		{{0, 0},
77 		{0, 0},
78 		{0, 0},
79 		{0, 0}
80 		}
81 	},
82 	{0, 0, 1, 0,		/* 0x02 */
83 		{{1, 1},
84 		{0, 0},
85 		{0, 0},
86 		{0, 0}
87 		}
88 	},
89 	{1, 0, 1, 0,		/* 0x03 */
90 		{{0, 1},
91 		{0, 0},
92 		{0, 0},
93 		{0, 0}
94 		}
95 	},
96 	{0, 0, 1, 0,		/* 0x04 */
97 		{{2, 2},
98 		{0, 0},
99 		{0, 0},
100 		{0, 0}
101 		}
102 	},
103 	{1, 0, 2, 0,		/* 0x05 */
104 		{{0, 0},
105 		{2, 2},
106 		{0, 0},
107 		{0, 0}
108 		}
109 	},
110 	{0, 0, 1, 0,		/* 0x06 */
111 		{{1, 2},
112 		{0, 0},
113 		{0, 0},
114 		{0, 0}
115 		}
116 	},
117 	{1, 0, 1, 0,		/* 0x07 */
118 		{{0, 2},
119 		{0, 0},
120 		{0, 0},
121 		{0, 0}
122 		}
123 	},
124 	{0, 0, 1, 0,		/* 0x08 */
125 		{{3, 3},
126 		{0, 0},
127 		{0, 0},
128 		{0, 0}
129 		}
130 	},
131 	{1, 0, 2, 0,		/* 0x09 */
132 		{{0, 0},
133 		{3, 3},
134 		{0, 0},
135 		{0, 0}
136 		}
137 	},
138 	{0, 0, 2, 0,		/* 0x0a */
139 		{{1, 1},
140 		{3, 3},
141 		{0, 0},
142 		{0, 0}
143 		}
144 	},
145 	{1, 0, 2, 0,		/* 0x0b */
146 		{{0, 1},
147 		{3, 3},
148 		{0, 0},
149 		{0, 0}
150 		}
151 	},
152 	{0, 0, 1, 0,		/* 0x0c */
153 		{{2, 3},
154 		{0, 0},
155 		{0, 0},
156 		{0, 0}
157 		}
158 	},
159 	{1, 0, 2, 0,		/* 0x0d */
160 		{{0, 0},
161 		{2, 3},
162 		{0, 0},
163 		{0, 0}
164 		}
165 	},
166 	{0, 0, 1, 0,		/* 0x0e */
167 		{{1, 3},
168 		{0, 0},
169 		{0, 0},
170 		{0, 0}
171 		}
172 	},
173 	{1, 0, 1, 0,		/* 0x0f */
174 		{{0, 3},
175 		{0, 0},
176 		{0, 0},
177 		{0, 0}
178 		}
179 	},
180 	{0, 0, 1, 0,		/* 0x10 */
181 		{{4, 4},
182 		{0, 0},
183 		{0, 0},
184 		{0, 0}
185 		}
186 	},
187 	{1, 0, 2, 0,		/* 0x11 */
188 		{{0, 0},
189 		{4, 4},
190 		{0, 0},
191 		{0, 0}
192 		}
193 	},
194 	{0, 0, 2, 0,		/* 0x12 */
195 		{{1, 1},
196 		{4, 4},
197 		{0, 0},
198 		{0, 0}
199 		}
200 	},
201 	{1, 0, 2, 0,		/* 0x13 */
202 		{{0, 1},
203 		{4, 4},
204 		{0, 0},
205 		{0, 0}
206 		}
207 	},
208 	{0, 0, 2, 0,		/* 0x14 */
209 		{{2, 2},
210 		{4, 4},
211 		{0, 0},
212 		{0, 0}
213 		}
214 	},
215 	{1, 0, 3, 0,		/* 0x15 */
216 		{{0, 0},
217 		{2, 2},
218 		{4, 4},
219 		{0, 0}
220 		}
221 	},
222 	{0, 0, 2, 0,		/* 0x16 */
223 		{{1, 2},
224 		{4, 4},
225 		{0, 0},
226 		{0, 0}
227 		}
228 	},
229 	{1, 0, 2, 0,		/* 0x17 */
230 		{{0, 2},
231 		{4, 4},
232 		{0, 0},
233 		{0, 0}
234 		}
235 	},
236 	{0, 0, 1, 0,		/* 0x18 */
237 		{{3, 4},
238 		{0, 0},
239 		{0, 0},
240 		{0, 0}
241 		}
242 	},
243 	{1, 0, 2, 0,		/* 0x19 */
244 		{{0, 0},
245 		{3, 4},
246 		{0, 0},
247 		{0, 0}
248 		}
249 	},
250 	{0, 0, 2, 0,		/* 0x1a */
251 		{{1, 1},
252 		{3, 4},
253 		{0, 0},
254 		{0, 0}
255 		}
256 	},
257 	{1, 0, 2, 0,		/* 0x1b */
258 		{{0, 1},
259 		{3, 4},
260 		{0, 0},
261 		{0, 0}
262 		}
263 	},
264 	{0, 0, 1, 0,		/* 0x1c */
265 		{{2, 4},
266 		{0, 0},
267 		{0, 0},
268 		{0, 0}
269 		}
270 	},
271 	{1, 0, 2, 0,		/* 0x1d */
272 		{{0, 0},
273 		{2, 4},
274 		{0, 0},
275 		{0, 0}
276 		}
277 	},
278 	{0, 0, 1, 0,		/* 0x1e */
279 		{{1, 4},
280 		{0, 0},
281 		{0, 0},
282 		{0, 0}
283 		}
284 	},
285 	{1, 0, 1, 0,		/* 0x1f */
286 		{{0, 4},
287 		{0, 0},
288 		{0, 0},
289 		{0, 0}
290 		}
291 	},
292 	{0, 0, 1, 0,		/* 0x20 */
293 		{{5, 5},
294 		{0, 0},
295 		{0, 0},
296 		{0, 0}
297 		}
298 	},
299 	{1, 0, 2, 0,		/* 0x21 */
300 		{{0, 0},
301 		{5, 5},
302 		{0, 0},
303 		{0, 0}
304 		}
305 	},
306 	{0, 0, 2, 0,		/* 0x22 */
307 		{{1, 1},
308 		{5, 5},
309 		{0, 0},
310 		{0, 0}
311 		}
312 	},
313 	{1, 0, 2, 0,		/* 0x23 */
314 		{{0, 1},
315 		{5, 5},
316 		{0, 0},
317 		{0, 0}
318 		}
319 	},
320 	{0, 0, 2, 0,		/* 0x24 */
321 		{{2, 2},
322 		{5, 5},
323 		{0, 0},
324 		{0, 0}
325 		}
326 	},
327 	{1, 0, 3, 0,		/* 0x25 */
328 		{{0, 0},
329 		{2, 2},
330 		{5, 5},
331 		{0, 0}
332 		}
333 	},
334 	{0, 0, 2, 0,		/* 0x26 */
335 		{{1, 2},
336 		{5, 5},
337 		{0, 0},
338 		{0, 0}
339 		}
340 	},
341 	{1, 0, 2, 0,		/* 0x27 */
342 		{{0, 2},
343 		{5, 5},
344 		{0, 0},
345 		{0, 0}
346 		}
347 	},
348 	{0, 0, 2, 0,		/* 0x28 */
349 		{{3, 3},
350 		{5, 5},
351 		{0, 0},
352 		{0, 0}
353 		}
354 	},
355 	{1, 0, 3, 0,		/* 0x29 */
356 		{{0, 0},
357 		{3, 3},
358 		{5, 5},
359 		{0, 0}
360 		}
361 	},
362 	{0, 0, 3, 0,		/* 0x2a */
363 		{{1, 1},
364 		{3, 3},
365 		{5, 5},
366 		{0, 0}
367 		}
368 	},
369 	{1, 0, 3, 0,		/* 0x2b */
370 		{{0, 1},
371 		{3, 3},
372 		{5, 5},
373 		{0, 0}
374 		}
375 	},
376 	{0, 0, 2, 0,		/* 0x2c */
377 		{{2, 3},
378 		{5, 5},
379 		{0, 0},
380 		{0, 0}
381 		}
382 	},
383 	{1, 0, 3, 0,		/* 0x2d */
384 		{{0, 0},
385 		{2, 3},
386 		{5, 5},
387 		{0, 0}
388 		}
389 	},
390 	{0, 0, 2, 0,		/* 0x2e */
391 		{{1, 3},
392 		{5, 5},
393 		{0, 0},
394 		{0, 0}
395 		}
396 	},
397 	{1, 0, 2, 0,		/* 0x2f */
398 		{{0, 3},
399 		{5, 5},
400 		{0, 0},
401 		{0, 0}
402 		}
403 	},
404 	{0, 0, 1, 0,		/* 0x30 */
405 		{{4, 5},
406 		{0, 0},
407 		{0, 0},
408 		{0, 0}
409 		}
410 	},
411 	{1, 0, 2, 0,		/* 0x31 */
412 		{{0, 0},
413 		{4, 5},
414 		{0, 0},
415 		{0, 0}
416 		}
417 	},
418 	{0, 0, 2, 0,		/* 0x32 */
419 		{{1, 1},
420 		{4, 5},
421 		{0, 0},
422 		{0, 0}
423 		}
424 	},
425 	{1, 0, 2, 0,		/* 0x33 */
426 		{{0, 1},
427 		{4, 5},
428 		{0, 0},
429 		{0, 0}
430 		}
431 	},
432 	{0, 0, 2, 0,		/* 0x34 */
433 		{{2, 2},
434 		{4, 5},
435 		{0, 0},
436 		{0, 0}
437 		}
438 	},
439 	{1, 0, 3, 0,		/* 0x35 */
440 		{{0, 0},
441 		{2, 2},
442 		{4, 5},
443 		{0, 0}
444 		}
445 	},
446 	{0, 0, 2, 0,		/* 0x36 */
447 		{{1, 2},
448 		{4, 5},
449 		{0, 0},
450 		{0, 0}
451 		}
452 	},
453 	{1, 0, 2, 0,		/* 0x37 */
454 		{{0, 2},
455 		{4, 5},
456 		{0, 0},
457 		{0, 0}
458 		}
459 	},
460 	{0, 0, 1, 0,		/* 0x38 */
461 		{{3, 5},
462 		{0, 0},
463 		{0, 0},
464 		{0, 0}
465 		}
466 	},
467 	{1, 0, 2, 0,		/* 0x39 */
468 		{{0, 0},
469 		{3, 5},
470 		{0, 0},
471 		{0, 0}
472 		}
473 	},
474 	{0, 0, 2, 0,		/* 0x3a */
475 		{{1, 1},
476 		{3, 5},
477 		{0, 0},
478 		{0, 0}
479 		}
480 	},
481 	{1, 0, 2, 0,		/* 0x3b */
482 		{{0, 1},
483 		{3, 5},
484 		{0, 0},
485 		{0, 0}
486 		}
487 	},
488 	{0, 0, 1, 0,		/* 0x3c */
489 		{{2, 5},
490 		{0, 0},
491 		{0, 0},
492 		{0, 0}
493 		}
494 	},
495 	{1, 0, 2, 0,		/* 0x3d */
496 		{{0, 0},
497 		{2, 5},
498 		{0, 0},
499 		{0, 0}
500 		}
501 	},
502 	{0, 0, 1, 0,		/* 0x3e */
503 		{{1, 5},
504 		{0, 0},
505 		{0, 0},
506 		{0, 0}
507 		}
508 	},
509 	{1, 0, 1, 0,		/* 0x3f */
510 		{{0, 5},
511 		{0, 0},
512 		{0, 0},
513 		{0, 0}
514 		}
515 	},
516 	{0, 0, 1, 0,		/* 0x40 */
517 		{{6, 6},
518 		{0, 0},
519 		{0, 0},
520 		{0, 0}
521 		}
522 	},
523 	{1, 0, 2, 0,		/* 0x41 */
524 		{{0, 0},
525 		{6, 6},
526 		{0, 0},
527 		{0, 0}
528 		}
529 	},
530 	{0, 0, 2, 0,		/* 0x42 */
531 		{{1, 1},
532 		{6, 6},
533 		{0, 0},
534 		{0, 0}
535 		}
536 	},
537 	{1, 0, 2, 0,		/* 0x43 */
538 		{{0, 1},
539 		{6, 6},
540 		{0, 0},
541 		{0, 0}
542 		}
543 	},
544 	{0, 0, 2, 0,		/* 0x44 */
545 		{{2, 2},
546 		{6, 6},
547 		{0, 0},
548 		{0, 0}
549 		}
550 	},
551 	{1, 0, 3, 0,		/* 0x45 */
552 		{{0, 0},
553 		{2, 2},
554 		{6, 6},
555 		{0, 0}
556 		}
557 	},
558 	{0, 0, 2, 0,		/* 0x46 */
559 		{{1, 2},
560 		{6, 6},
561 		{0, 0},
562 		{0, 0}
563 		}
564 	},
565 	{1, 0, 2, 0,		/* 0x47 */
566 		{{0, 2},
567 		{6, 6},
568 		{0, 0},
569 		{0, 0}
570 		}
571 	},
572 	{0, 0, 2, 0,		/* 0x48 */
573 		{{3, 3},
574 		{6, 6},
575 		{0, 0},
576 		{0, 0}
577 		}
578 	},
579 	{1, 0, 3, 0,		/* 0x49 */
580 		{{0, 0},
581 		{3, 3},
582 		{6, 6},
583 		{0, 0}
584 		}
585 	},
586 	{0, 0, 3, 0,		/* 0x4a */
587 		{{1, 1},
588 		{3, 3},
589 		{6, 6},
590 		{0, 0}
591 		}
592 	},
593 	{1, 0, 3, 0,		/* 0x4b */
594 		{{0, 1},
595 		{3, 3},
596 		{6, 6},
597 		{0, 0}
598 		}
599 	},
600 	{0, 0, 2, 0,		/* 0x4c */
601 		{{2, 3},
602 		{6, 6},
603 		{0, 0},
604 		{0, 0}
605 		}
606 	},
607 	{1, 0, 3, 0,		/* 0x4d */
608 		{{0, 0},
609 		{2, 3},
610 		{6, 6},
611 		{0, 0}
612 		}
613 	},
614 	{0, 0, 2, 0,		/* 0x4e */
615 		{{1, 3},
616 		{6, 6},
617 		{0, 0},
618 		{0, 0}
619 		}
620 	},
621 	{1, 0, 2, 0,		/* 0x4f */
622 		{{0, 3},
623 		{6, 6},
624 		{0, 0},
625 		{0, 0}
626 		}
627 	},
628 	{0, 0, 2, 0,		/* 0x50 */
629 		{{4, 4},
630 		{6, 6},
631 		{0, 0},
632 		{0, 0}
633 		}
634 	},
635 	{1, 0, 3, 0,		/* 0x51 */
636 		{{0, 0},
637 		{4, 4},
638 		{6, 6},
639 		{0, 0}
640 		}
641 	},
642 	{0, 0, 3, 0,		/* 0x52 */
643 		{{1, 1},
644 		{4, 4},
645 		{6, 6},
646 		{0, 0}
647 		}
648 	},
649 	{1, 0, 3, 0,		/* 0x53 */
650 		{{0, 1},
651 		{4, 4},
652 		{6, 6},
653 		{0, 0}
654 		}
655 	},
656 	{0, 0, 3, 0,		/* 0x54 */
657 		{{2, 2},
658 		{4, 4},
659 		{6, 6},
660 		{0, 0}
661 		}
662 	},
663 	{1, 0, 4, 0,		/* 0x55 */
664 		{{0, 0},
665 		{2, 2},
666 		{4, 4},
667 		{6, 6}
668 		}
669 	},
670 	{0, 0, 3, 0,		/* 0x56 */
671 		{{1, 2},
672 		{4, 4},
673 		{6, 6},
674 		{0, 0}
675 		}
676 	},
677 	{1, 0, 3, 0,		/* 0x57 */
678 		{{0, 2},
679 		{4, 4},
680 		{6, 6},
681 		{0, 0}
682 		}
683 	},
684 	{0, 0, 2, 0,		/* 0x58 */
685 		{{3, 4},
686 		{6, 6},
687 		{0, 0},
688 		{0, 0}
689 		}
690 	},
691 	{1, 0, 3, 0,		/* 0x59 */
692 		{{0, 0},
693 		{3, 4},
694 		{6, 6},
695 		{0, 0}
696 		}
697 	},
698 	{0, 0, 3, 0,		/* 0x5a */
699 		{{1, 1},
700 		{3, 4},
701 		{6, 6},
702 		{0, 0}
703 		}
704 	},
705 	{1, 0, 3, 0,		/* 0x5b */
706 		{{0, 1},
707 		{3, 4},
708 		{6, 6},
709 		{0, 0}
710 		}
711 	},
712 	{0, 0, 2, 0,		/* 0x5c */
713 		{{2, 4},
714 		{6, 6},
715 		{0, 0},
716 		{0, 0}
717 		}
718 	},
719 	{1, 0, 3, 0,		/* 0x5d */
720 		{{0, 0},
721 		{2, 4},
722 		{6, 6},
723 		{0, 0}
724 		}
725 	},
726 	{0, 0, 2, 0,		/* 0x5e */
727 		{{1, 4},
728 		{6, 6},
729 		{0, 0},
730 		{0, 0}
731 		}
732 	},
733 	{1, 0, 2, 0,		/* 0x5f */
734 		{{0, 4},
735 		{6, 6},
736 		{0, 0},
737 		{0, 0}
738 		}
739 	},
740 	{0, 0, 1, 0,		/* 0x60 */
741 		{{5, 6},
742 		{0, 0},
743 		{0, 0},
744 		{0, 0}
745 		}
746 	},
747 	{1, 0, 2, 0,		/* 0x61 */
748 		{{0, 0},
749 		{5, 6},
750 		{0, 0},
751 		{0, 0}
752 		}
753 	},
754 	{0, 0, 2, 0,		/* 0x62 */
755 		{{1, 1},
756 		{5, 6},
757 		{0, 0},
758 		{0, 0}
759 		}
760 	},
761 	{1, 0, 2, 0,		/* 0x63 */
762 		{{0, 1},
763 		{5, 6},
764 		{0, 0},
765 		{0, 0}
766 		}
767 	},
768 	{0, 0, 2, 0,		/* 0x64 */
769 		{{2, 2},
770 		{5, 6},
771 		{0, 0},
772 		{0, 0}
773 		}
774 	},
775 	{1, 0, 3, 0,		/* 0x65 */
776 		{{0, 0},
777 		{2, 2},
778 		{5, 6},
779 		{0, 0}
780 		}
781 	},
782 	{0, 0, 2, 0,		/* 0x66 */
783 		{{1, 2},
784 		{5, 6},
785 		{0, 0},
786 		{0, 0}
787 		}
788 	},
789 	{1, 0, 2, 0,		/* 0x67 */
790 		{{0, 2},
791 		{5, 6},
792 		{0, 0},
793 		{0, 0}
794 		}
795 	},
796 	{0, 0, 2, 0,		/* 0x68 */
797 		{{3, 3},
798 		{5, 6},
799 		{0, 0},
800 		{0, 0}
801 		}
802 	},
803 	{1, 0, 3, 0,		/* 0x69 */
804 		{{0, 0},
805 		{3, 3},
806 		{5, 6},
807 		{0, 0}
808 		}
809 	},
810 	{0, 0, 3, 0,		/* 0x6a */
811 		{{1, 1},
812 		{3, 3},
813 		{5, 6},
814 		{0, 0}
815 		}
816 	},
817 	{1, 0, 3, 0,		/* 0x6b */
818 		{{0, 1},
819 		{3, 3},
820 		{5, 6},
821 		{0, 0}
822 		}
823 	},
824 	{0, 0, 2, 0,		/* 0x6c */
825 		{{2, 3},
826 		{5, 6},
827 		{0, 0},
828 		{0, 0}
829 		}
830 	},
831 	{1, 0, 3, 0,		/* 0x6d */
832 		{{0, 0},
833 		{2, 3},
834 		{5, 6},
835 		{0, 0}
836 		}
837 	},
838 	{0, 0, 2, 0,		/* 0x6e */
839 		{{1, 3},
840 		{5, 6},
841 		{0, 0},
842 		{0, 0}
843 		}
844 	},
845 	{1, 0, 2, 0,		/* 0x6f */
846 		{{0, 3},
847 		{5, 6},
848 		{0, 0},
849 		{0, 0}
850 		}
851 	},
852 	{0, 0, 1, 0,		/* 0x70 */
853 		{{4, 6},
854 		{0, 0},
855 		{0, 0},
856 		{0, 0}
857 		}
858 	},
859 	{1, 0, 2, 0,		/* 0x71 */
860 		{{0, 0},
861 		{4, 6},
862 		{0, 0},
863 		{0, 0}
864 		}
865 	},
866 	{0, 0, 2, 0,		/* 0x72 */
867 		{{1, 1},
868 		{4, 6},
869 		{0, 0},
870 		{0, 0}
871 		}
872 	},
873 	{1, 0, 2, 0,		/* 0x73 */
874 		{{0, 1},
875 		{4, 6},
876 		{0, 0},
877 		{0, 0}
878 		}
879 	},
880 	{0, 0, 2, 0,		/* 0x74 */
881 		{{2, 2},
882 		{4, 6},
883 		{0, 0},
884 		{0, 0}
885 		}
886 	},
887 	{1, 0, 3, 0,		/* 0x75 */
888 		{{0, 0},
889 		{2, 2},
890 		{4, 6},
891 		{0, 0}
892 		}
893 	},
894 	{0, 0, 2, 0,		/* 0x76 */
895 		{{1, 2},
896 		{4, 6},
897 		{0, 0},
898 		{0, 0}
899 		}
900 	},
901 	{1, 0, 2, 0,		/* 0x77 */
902 		{{0, 2},
903 		{4, 6},
904 		{0, 0},
905 		{0, 0}
906 		}
907 	},
908 	{0, 0, 1, 0,		/* 0x78 */
909 		{{3, 6},
910 		{0, 0},
911 		{0, 0},
912 		{0, 0}
913 		}
914 	},
915 	{1, 0, 2, 0,		/* 0x79 */
916 		{{0, 0},
917 		{3, 6},
918 		{0, 0},
919 		{0, 0}
920 		}
921 	},
922 	{0, 0, 2, 0,		/* 0x7a */
923 		{{1, 1},
924 		{3, 6},
925 		{0, 0},
926 		{0, 0}
927 		}
928 	},
929 	{1, 0, 2, 0,		/* 0x7b */
930 		{{0, 1},
931 		{3, 6},
932 		{0, 0},
933 		{0, 0}
934 		}
935 	},
936 	{0, 0, 1, 0,		/* 0x7c */
937 		{{2, 6},
938 		{0, 0},
939 		{0, 0},
940 		{0, 0}
941 		}
942 	},
943 	{1, 0, 2, 0,		/* 0x7d */
944 		{{0, 0},
945 		{2, 6},
946 		{0, 0},
947 		{0, 0}
948 		}
949 	},
950 	{0, 0, 1, 0,		/* 0x7e */
951 		{{1, 6},
952 		{0, 0},
953 		{0, 0},
954 		{0, 0}
955 		}
956 	},
957 	{1, 0, 1, 0,		/* 0x7f */
958 		{{0, 6},
959 		{0, 0},
960 		{0, 0},
961 		{0, 0}
962 		}
963 	},
964 	{0, 1, 1, 0,		/* 0x80 */
965 		{{7, 7},
966 		{0, 0},
967 		{0, 0},
968 		{0, 0}
969 		}
970 	},
971 	{1, 1, 2, 0,		/* 0x81 */
972 		{{0, 0},
973 		{7, 7},
974 		{0, 0},
975 		{0, 0}
976 		}
977 	},
978 	{0, 1, 2, 0,		/* 0x82 */
979 		{{1, 1},
980 		{7, 7},
981 		{0, 0},
982 		{0, 0}
983 		}
984 	},
985 	{1, 1, 2, 0,		/* 0x83 */
986 		{{0, 1},
987 		{7, 7},
988 		{0, 0},
989 		{0, 0}
990 		}
991 	},
992 	{0, 1, 2, 0,		/* 0x84 */
993 		{{2, 2},
994 		{7, 7},
995 		{0, 0},
996 		{0, 0}
997 		}
998 	},
999 	{1, 1, 3, 0,		/* 0x85 */
1000 		{{0, 0},
1001 		{2, 2},
1002 		{7, 7},
1003 		{0, 0}
1004 		}
1005 	},
1006 	{0, 1, 2, 0,		/* 0x86 */
1007 		{{1, 2},
1008 		{7, 7},
1009 		{0, 0},
1010 		{0, 0}
1011 		}
1012 	},
1013 	{1, 1, 2, 0,		/* 0x87 */
1014 		{{0, 2},
1015 		{7, 7},
1016 		{0, 0},
1017 		{0, 0}
1018 		}
1019 	},
1020 	{0, 1, 2, 0,		/* 0x88 */
1021 		{{3, 3},
1022 		{7, 7},
1023 		{0, 0},
1024 		{0, 0}
1025 		}
1026 	},
1027 	{1, 1, 3, 0,		/* 0x89 */
1028 		{{0, 0},
1029 		{3, 3},
1030 		{7, 7},
1031 		{0, 0}
1032 		}
1033 	},
1034 	{0, 1, 3, 0,		/* 0x8a */
1035 		{{1, 1},
1036 		{3, 3},
1037 		{7, 7},
1038 		{0, 0}
1039 		}
1040 	},
1041 	{1, 1, 3, 0,		/* 0x8b */
1042 		{{0, 1},
1043 		{3, 3},
1044 		{7, 7},
1045 		{0, 0}
1046 		}
1047 	},
1048 	{0, 1, 2, 0,		/* 0x8c */
1049 		{{2, 3},
1050 		{7, 7},
1051 		{0, 0},
1052 		{0, 0}
1053 		}
1054 	},
1055 	{1, 1, 3, 0,		/* 0x8d */
1056 		{{0, 0},
1057 		{2, 3},
1058 		{7, 7},
1059 		{0, 0}
1060 		}
1061 	},
1062 	{0, 1, 2, 0,		/* 0x8e */
1063 		{{1, 3},
1064 		{7, 7},
1065 		{0, 0},
1066 		{0, 0}
1067 		}
1068 	},
1069 	{1, 1, 2, 0,		/* 0x8f */
1070 		{{0, 3},
1071 		{7, 7},
1072 		{0, 0},
1073 		{0, 0}
1074 		}
1075 	},
1076 	{0, 1, 2, 0,		/* 0x90 */
1077 		{{4, 4},
1078 		{7, 7},
1079 		{0, 0},
1080 		{0, 0}
1081 		}
1082 	},
1083 	{1, 1, 3, 0,		/* 0x91 */
1084 		{{0, 0},
1085 		{4, 4},
1086 		{7, 7},
1087 		{0, 0}
1088 		}
1089 	},
1090 	{0, 1, 3, 0,		/* 0x92 */
1091 		{{1, 1},
1092 		{4, 4},
1093 		{7, 7},
1094 		{0, 0}
1095 		}
1096 	},
1097 	{1, 1, 3, 0,		/* 0x93 */
1098 		{{0, 1},
1099 		{4, 4},
1100 		{7, 7},
1101 		{0, 0}
1102 		}
1103 	},
1104 	{0, 1, 3, 0,		/* 0x94 */
1105 		{{2, 2},
1106 		{4, 4},
1107 		{7, 7},
1108 		{0, 0}
1109 		}
1110 	},
1111 	{1, 1, 4, 0,		/* 0x95 */
1112 		{{0, 0},
1113 		{2, 2},
1114 		{4, 4},
1115 		{7, 7}
1116 		}
1117 	},
1118 	{0, 1, 3, 0,		/* 0x96 */
1119 		{{1, 2},
1120 		{4, 4},
1121 		{7, 7},
1122 		{0, 0}
1123 		}
1124 	},
1125 	{1, 1, 3, 0,		/* 0x97 */
1126 		{{0, 2},
1127 		{4, 4},
1128 		{7, 7},
1129 		{0, 0}
1130 		}
1131 	},
1132 	{0, 1, 2, 0,		/* 0x98 */
1133 		{{3, 4},
1134 		{7, 7},
1135 		{0, 0},
1136 		{0, 0}
1137 		}
1138 	},
1139 	{1, 1, 3, 0,		/* 0x99 */
1140 		{{0, 0},
1141 		{3, 4},
1142 		{7, 7},
1143 		{0, 0}
1144 		}
1145 	},
1146 	{0, 1, 3, 0,		/* 0x9a */
1147 		{{1, 1},
1148 		{3, 4},
1149 		{7, 7},
1150 		{0, 0}
1151 		}
1152 	},
1153 	{1, 1, 3, 0,		/* 0x9b */
1154 		{{0, 1},
1155 		{3, 4},
1156 		{7, 7},
1157 		{0, 0}
1158 		}
1159 	},
1160 	{0, 1, 2, 0,		/* 0x9c */
1161 		{{2, 4},
1162 		{7, 7},
1163 		{0, 0},
1164 		{0, 0}
1165 		}
1166 	},
1167 	{1, 1, 3, 0,		/* 0x9d */
1168 		{{0, 0},
1169 		{2, 4},
1170 		{7, 7},
1171 		{0, 0}
1172 		}
1173 	},
1174 	{0, 1, 2, 0,		/* 0x9e */
1175 		{{1, 4},
1176 		{7, 7},
1177 		{0, 0},
1178 		{0, 0}
1179 		}
1180 	},
1181 	{1, 1, 2, 0,		/* 0x9f */
1182 		{{0, 4},
1183 		{7, 7},
1184 		{0, 0},
1185 		{0, 0}
1186 		}
1187 	},
1188 	{0, 1, 2, 0,		/* 0xa0 */
1189 		{{5, 5},
1190 		{7, 7},
1191 		{0, 0},
1192 		{0, 0}
1193 		}
1194 	},
1195 	{1, 1, 3, 0,		/* 0xa1 */
1196 		{{0, 0},
1197 		{5, 5},
1198 		{7, 7},
1199 		{0, 0}
1200 		}
1201 	},
1202 	{0, 1, 3, 0,		/* 0xa2 */
1203 		{{1, 1},
1204 		{5, 5},
1205 		{7, 7},
1206 		{0, 0}
1207 		}
1208 	},
1209 	{1, 1, 3, 0,		/* 0xa3 */
1210 		{{0, 1},
1211 		{5, 5},
1212 		{7, 7},
1213 		{0, 0}
1214 		}
1215 	},
1216 	{0, 1, 3, 0,		/* 0xa4 */
1217 		{{2, 2},
1218 		{5, 5},
1219 		{7, 7},
1220 		{0, 0}
1221 		}
1222 	},
1223 	{1, 1, 4, 0,		/* 0xa5 */
1224 		{{0, 0},
1225 		{2, 2},
1226 		{5, 5},
1227 		{7, 7}
1228 		}
1229 	},
1230 	{0, 1, 3, 0,		/* 0xa6 */
1231 		{{1, 2},
1232 		{5, 5},
1233 		{7, 7},
1234 		{0, 0}
1235 		}
1236 	},
1237 	{1, 1, 3, 0,		/* 0xa7 */
1238 		{{0, 2},
1239 		{5, 5},
1240 		{7, 7},
1241 		{0, 0}
1242 		}
1243 	},
1244 	{0, 1, 3, 0,		/* 0xa8 */
1245 		{{3, 3},
1246 		{5, 5},
1247 		{7, 7},
1248 		{0, 0}
1249 		}
1250 	},
1251 	{1, 1, 4, 0,		/* 0xa9 */
1252 		{{0, 0},
1253 		{3, 3},
1254 		{5, 5},
1255 		{7, 7}
1256 		}
1257 	},
1258 	{0, 1, 4, 0,		/* 0xaa */
1259 		{{1, 1},
1260 		{3, 3},
1261 		{5, 5},
1262 		{7, 7}
1263 		}
1264 	},
1265 	{1, 1, 4, 0,		/* 0xab */
1266 		{{0, 1},
1267 		{3, 3},
1268 		{5, 5},
1269 		{7, 7}
1270 		}
1271 	},
1272 	{0, 1, 3, 0,		/* 0xac */
1273 		{{2, 3},
1274 		{5, 5},
1275 		{7, 7},
1276 		{0, 0}
1277 		}
1278 	},
1279 	{1, 1, 4, 0,		/* 0xad */
1280 		{{0, 0},
1281 		{2, 3},
1282 		{5, 5},
1283 		{7, 7}
1284 		}
1285 	},
1286 	{0, 1, 3, 0,		/* 0xae */
1287 		{{1, 3},
1288 		{5, 5},
1289 		{7, 7},
1290 		{0, 0}
1291 		}
1292 	},
1293 	{1, 1, 3, 0,		/* 0xaf */
1294 		{{0, 3},
1295 		{5, 5},
1296 		{7, 7},
1297 		{0, 0}
1298 		}
1299 	},
1300 	{0, 1, 2, 0,		/* 0xb0 */
1301 		{{4, 5},
1302 		{7, 7},
1303 		{0, 0},
1304 		{0, 0}
1305 		}
1306 	},
1307 	{1, 1, 3, 0,		/* 0xb1 */
1308 		{{0, 0},
1309 		{4, 5},
1310 		{7, 7},
1311 		{0, 0}
1312 		}
1313 	},
1314 	{0, 1, 3, 0,		/* 0xb2 */
1315 		{{1, 1},
1316 		{4, 5},
1317 		{7, 7},
1318 		{0, 0}
1319 		}
1320 	},
1321 	{1, 1, 3, 0,		/* 0xb3 */
1322 		{{0, 1},
1323 		{4, 5},
1324 		{7, 7},
1325 		{0, 0}
1326 		}
1327 	},
1328 	{0, 1, 3, 0,		/* 0xb4 */
1329 		{{2, 2},
1330 		{4, 5},
1331 		{7, 7},
1332 		{0, 0}
1333 		}
1334 	},
1335 	{1, 1, 4, 0,		/* 0xb5 */
1336 		{{0, 0},
1337 		{2, 2},
1338 		{4, 5},
1339 		{7, 7}
1340 		}
1341 	},
1342 	{0, 1, 3, 0,		/* 0xb6 */
1343 		{{1, 2},
1344 		{4, 5},
1345 		{7, 7},
1346 		{0, 0}
1347 		}
1348 	},
1349 	{1, 1, 3, 0,		/* 0xb7 */
1350 		{{0, 2},
1351 		{4, 5},
1352 		{7, 7},
1353 		{0, 0}
1354 		}
1355 	},
1356 	{0, 1, 2, 0,		/* 0xb8 */
1357 		{{3, 5},
1358 		{7, 7},
1359 		{0, 0},
1360 		{0, 0}
1361 		}
1362 	},
1363 	{1, 1, 3, 0,		/* 0xb9 */
1364 		{{0, 0},
1365 		{3, 5},
1366 		{7, 7},
1367 		{0, 0}
1368 		}
1369 	},
1370 	{0, 1, 3, 0,		/* 0xba */
1371 		{{1, 1},
1372 		{3, 5},
1373 		{7, 7},
1374 		{0, 0}
1375 		}
1376 	},
1377 	{1, 1, 3, 0,		/* 0xbb */
1378 		{{0, 1},
1379 		{3, 5},
1380 		{7, 7},
1381 		{0, 0}
1382 		}
1383 	},
1384 	{0, 1, 2, 0,		/* 0xbc */
1385 		{{2, 5},
1386 		{7, 7},
1387 		{0, 0},
1388 		{0, 0}
1389 		}
1390 	},
1391 	{1, 1, 3, 0,		/* 0xbd */
1392 		{{0, 0},
1393 		{2, 5},
1394 		{7, 7},
1395 		{0, 0}
1396 		}
1397 	},
1398 	{0, 1, 2, 0,		/* 0xbe */
1399 		{{1, 5},
1400 		{7, 7},
1401 		{0, 0},
1402 		{0, 0}
1403 		}
1404 	},
1405 	{1, 1, 2, 0,		/* 0xbf */
1406 		{{0, 5},
1407 		{7, 7},
1408 		{0, 0},
1409 		{0, 0}
1410 		}
1411 	},
1412 	{0, 1, 1, 0,		/* 0xc0 */
1413 		{{6, 7},
1414 		{0, 0},
1415 		{0, 0},
1416 		{0, 0}
1417 		}
1418 	},
1419 	{1, 1, 2, 0,		/* 0xc1 */
1420 		{{0, 0},
1421 		{6, 7},
1422 		{0, 0},
1423 		{0, 0}
1424 		}
1425 	},
1426 	{0, 1, 2, 0,		/* 0xc2 */
1427 		{{1, 1},
1428 		{6, 7},
1429 		{0, 0},
1430 		{0, 0}
1431 		}
1432 	},
1433 	{1, 1, 2, 0,		/* 0xc3 */
1434 		{{0, 1},
1435 		{6, 7},
1436 		{0, 0},
1437 		{0, 0}
1438 		}
1439 	},
1440 	{0, 1, 2, 0,		/* 0xc4 */
1441 		{{2, 2},
1442 		{6, 7},
1443 		{0, 0},
1444 		{0, 0}
1445 		}
1446 	},
1447 	{1, 1, 3, 0,		/* 0xc5 */
1448 		{{0, 0},
1449 		{2, 2},
1450 		{6, 7},
1451 		{0, 0}
1452 		}
1453 	},
1454 	{0, 1, 2, 0,		/* 0xc6 */
1455 		{{1, 2},
1456 		{6, 7},
1457 		{0, 0},
1458 		{0, 0}
1459 		}
1460 	},
1461 	{1, 1, 2, 0,		/* 0xc7 */
1462 		{{0, 2},
1463 		{6, 7},
1464 		{0, 0},
1465 		{0, 0}
1466 		}
1467 	},
1468 	{0, 1, 2, 0,		/* 0xc8 */
1469 		{{3, 3},
1470 		{6, 7},
1471 		{0, 0},
1472 		{0, 0}
1473 		}
1474 	},
1475 	{1, 1, 3, 0,		/* 0xc9 */
1476 		{{0, 0},
1477 		{3, 3},
1478 		{6, 7},
1479 		{0, 0}
1480 		}
1481 	},
1482 	{0, 1, 3, 0,		/* 0xca */
1483 		{{1, 1},
1484 		{3, 3},
1485 		{6, 7},
1486 		{0, 0}
1487 		}
1488 	},
1489 	{1, 1, 3, 0,		/* 0xcb */
1490 		{{0, 1},
1491 		{3, 3},
1492 		{6, 7},
1493 		{0, 0}
1494 		}
1495 	},
1496 	{0, 1, 2, 0,		/* 0xcc */
1497 		{{2, 3},
1498 		{6, 7},
1499 		{0, 0},
1500 		{0, 0}
1501 		}
1502 	},
1503 	{1, 1, 3, 0,		/* 0xcd */
1504 		{{0, 0},
1505 		{2, 3},
1506 		{6, 7},
1507 		{0, 0}
1508 		}
1509 	},
1510 	{0, 1, 2, 0,		/* 0xce */
1511 		{{1, 3},
1512 		{6, 7},
1513 		{0, 0},
1514 		{0, 0}
1515 		}
1516 	},
1517 	{1, 1, 2, 0,		/* 0xcf */
1518 		{{0, 3},
1519 		{6, 7},
1520 		{0, 0},
1521 		{0, 0}
1522 		}
1523 	},
1524 	{0, 1, 2, 0,		/* 0xd0 */
1525 		{{4, 4},
1526 		{6, 7},
1527 		{0, 0},
1528 		{0, 0}
1529 		}
1530 	},
1531 	{1, 1, 3, 0,		/* 0xd1 */
1532 		{{0, 0},
1533 		{4, 4},
1534 		{6, 7},
1535 		{0, 0}
1536 		}
1537 	},
1538 	{0, 1, 3, 0,		/* 0xd2 */
1539 		{{1, 1},
1540 		{4, 4},
1541 		{6, 7},
1542 		{0, 0}
1543 		}
1544 	},
1545 	{1, 1, 3, 0,		/* 0xd3 */
1546 		{{0, 1},
1547 		{4, 4},
1548 		{6, 7},
1549 		{0, 0}
1550 		}
1551 	},
1552 	{0, 1, 3, 0,		/* 0xd4 */
1553 		{{2, 2},
1554 		{4, 4},
1555 		{6, 7},
1556 		{0, 0}
1557 		}
1558 	},
1559 	{1, 1, 4, 0,		/* 0xd5 */
1560 		{{0, 0},
1561 		{2, 2},
1562 		{4, 4},
1563 		{6, 7}
1564 		}
1565 	},
1566 	{0, 1, 3, 0,		/* 0xd6 */
1567 		{{1, 2},
1568 		{4, 4},
1569 		{6, 7},
1570 		{0, 0}
1571 		}
1572 	},
1573 	{1, 1, 3, 0,		/* 0xd7 */
1574 		{{0, 2},
1575 		{4, 4},
1576 		{6, 7},
1577 		{0, 0}
1578 		}
1579 	},
1580 	{0, 1, 2, 0,		/* 0xd8 */
1581 		{{3, 4},
1582 		{6, 7},
1583 		{0, 0},
1584 		{0, 0}
1585 		}
1586 	},
1587 	{1, 1, 3, 0,		/* 0xd9 */
1588 		{{0, 0},
1589 		{3, 4},
1590 		{6, 7},
1591 		{0, 0}
1592 		}
1593 	},
1594 	{0, 1, 3, 0,		/* 0xda */
1595 		{{1, 1},
1596 		{3, 4},
1597 		{6, 7},
1598 		{0, 0}
1599 		}
1600 	},
1601 	{1, 1, 3, 0,		/* 0xdb */
1602 		{{0, 1},
1603 		{3, 4},
1604 		{6, 7},
1605 		{0, 0}
1606 		}
1607 	},
1608 	{0, 1, 2, 0,		/* 0xdc */
1609 		{{2, 4},
1610 		{6, 7},
1611 		{0, 0},
1612 		{0, 0}
1613 		}
1614 	},
1615 	{1, 1, 3, 0,		/* 0xdd */
1616 		{{0, 0},
1617 		{2, 4},
1618 		{6, 7},
1619 		{0, 0}
1620 		}
1621 	},
1622 	{0, 1, 2, 0,		/* 0xde */
1623 		{{1, 4},
1624 		{6, 7},
1625 		{0, 0},
1626 		{0, 0}
1627 		}
1628 	},
1629 	{1, 1, 2, 0,		/* 0xdf */
1630 		{{0, 4},
1631 		{6, 7},
1632 		{0, 0},
1633 		{0, 0}
1634 		}
1635 	},
1636 	{0, 1, 1, 0,		/* 0xe0 */
1637 		{{5, 7},
1638 		{0, 0},
1639 		{0, 0},
1640 		{0, 0}
1641 		}
1642 	},
1643 	{1, 1, 2, 0,		/* 0xe1 */
1644 		{{0, 0},
1645 		{5, 7},
1646 		{0, 0},
1647 		{0, 0}
1648 		}
1649 	},
1650 	{0, 1, 2, 0,		/* 0xe2 */
1651 		{{1, 1},
1652 		{5, 7},
1653 		{0, 0},
1654 		{0, 0}
1655 		}
1656 	},
1657 	{1, 1, 2, 0,		/* 0xe3 */
1658 		{{0, 1},
1659 		{5, 7},
1660 		{0, 0},
1661 		{0, 0}
1662 		}
1663 	},
1664 	{0, 1, 2, 0,		/* 0xe4 */
1665 		{{2, 2},
1666 		{5, 7},
1667 		{0, 0},
1668 		{0, 0}
1669 		}
1670 	},
1671 	{1, 1, 3, 0,		/* 0xe5 */
1672 		{{0, 0},
1673 		{2, 2},
1674 		{5, 7},
1675 		{0, 0}
1676 		}
1677 	},
1678 	{0, 1, 2, 0,		/* 0xe6 */
1679 		{{1, 2},
1680 		{5, 7},
1681 		{0, 0},
1682 		{0, 0}
1683 		}
1684 	},
1685 	{1, 1, 2, 0,		/* 0xe7 */
1686 		{{0, 2},
1687 		{5, 7},
1688 		{0, 0},
1689 		{0, 0}
1690 		}
1691 	},
1692 	{0, 1, 2, 0,		/* 0xe8 */
1693 		{{3, 3},
1694 		{5, 7},
1695 		{0, 0},
1696 		{0, 0}
1697 		}
1698 	},
1699 	{1, 1, 3, 0,		/* 0xe9 */
1700 		{{0, 0},
1701 		{3, 3},
1702 		{5, 7},
1703 		{0, 0}
1704 		}
1705 	},
1706 	{0, 1, 3, 0,		/* 0xea */
1707 		{{1, 1},
1708 		{3, 3},
1709 		{5, 7},
1710 		{0, 0}
1711 		}
1712 	},
1713 	{1, 1, 3, 0,		/* 0xeb */
1714 		{{0, 1},
1715 		{3, 3},
1716 		{5, 7},
1717 		{0, 0}
1718 		}
1719 	},
1720 	{0, 1, 2, 0,		/* 0xec */
1721 		{{2, 3},
1722 		{5, 7},
1723 		{0, 0},
1724 		{0, 0}
1725 		}
1726 	},
1727 	{1, 1, 3, 0,		/* 0xed */
1728 		{{0, 0},
1729 		{2, 3},
1730 		{5, 7},
1731 		{0, 0}
1732 		}
1733 	},
1734 	{0, 1, 2, 0,		/* 0xee */
1735 		{{1, 3},
1736 		{5, 7},
1737 		{0, 0},
1738 		{0, 0}
1739 		}
1740 	},
1741 	{1, 1, 2, 0,		/* 0xef */
1742 		{{0, 3},
1743 		{5, 7},
1744 		{0, 0},
1745 		{0, 0}
1746 		}
1747 	},
1748 	{0, 1, 1, 0,		/* 0xf0 */
1749 		{{4, 7},
1750 		{0, 0},
1751 		{0, 0},
1752 		{0, 0}
1753 		}
1754 	},
1755 	{1, 1, 2, 0,		/* 0xf1 */
1756 		{{0, 0},
1757 		{4, 7},
1758 		{0, 0},
1759 		{0, 0}
1760 		}
1761 	},
1762 	{0, 1, 2, 0,		/* 0xf2 */
1763 		{{1, 1},
1764 		{4, 7},
1765 		{0, 0},
1766 		{0, 0}
1767 		}
1768 	},
1769 	{1, 1, 2, 0,		/* 0xf3 */
1770 		{{0, 1},
1771 		{4, 7},
1772 		{0, 0},
1773 		{0, 0}
1774 		}
1775 	},
1776 	{0, 1, 2, 0,		/* 0xf4 */
1777 		{{2, 2},
1778 		{4, 7},
1779 		{0, 0},
1780 		{0, 0}
1781 		}
1782 	},
1783 	{1, 1, 3, 0,		/* 0xf5 */
1784 		{{0, 0},
1785 		{2, 2},
1786 		{4, 7},
1787 		{0, 0}
1788 		}
1789 	},
1790 	{0, 1, 2, 0,		/* 0xf6 */
1791 		{{1, 2},
1792 		{4, 7},
1793 		{0, 0},
1794 		{0, 0}
1795 		}
1796 	},
1797 	{1, 1, 2, 0,		/* 0xf7 */
1798 		{{0, 2},
1799 		{4, 7},
1800 		{0, 0},
1801 		{0, 0}
1802 		}
1803 	},
1804 	{0, 1, 1, 0,		/* 0xf8 */
1805 		{{3, 7},
1806 		{0, 0},
1807 		{0, 0},
1808 		{0, 0}
1809 		}
1810 	},
1811 	{1, 1, 2, 0,		/* 0xf9 */
1812 		{{0, 0},
1813 		{3, 7},
1814 		{0, 0},
1815 		{0, 0}
1816 		}
1817 	},
1818 	{0, 1, 2, 0,		/* 0xfa */
1819 		{{1, 1},
1820 		{3, 7},
1821 		{0, 0},
1822 		{0, 0}
1823 		}
1824 	},
1825 	{1, 1, 2, 0,		/* 0xfb */
1826 		{{0, 1},
1827 		{3, 7},
1828 		{0, 0},
1829 		{0, 0}
1830 		}
1831 	},
1832 	{0, 1, 1, 0,		/* 0xfc */
1833 		{{2, 7},
1834 		{0, 0},
1835 		{0, 0},
1836 		{0, 0}
1837 		}
1838 	},
1839 	{1, 1, 2, 0,		/* 0xfd */
1840 		{{0, 0},
1841 		{2, 7},
1842 		{0, 0},
1843 		{0, 0}
1844 		}
1845 	},
1846 	{0, 1, 1, 0,		/* 0xfe */
1847 		{{1, 7},
1848 		{0, 0},
1849 		{0, 0},
1850 		{0, 0}
1851 		}
1852 	},
1853 	{1, 1, 1, 0,		/* 0xff */
1854 		{{0, 7},
1855 		{0, 0},
1856 		{0, 0},
1857 		{0, 0}
1858 		}
1859 	}
1860 };
1861 
1862 /* EY  below are nr_sacks version of the preceeding two data structures, identical except their names */
1863 #define SCTP_MAX_NR_GAPS_INARRAY 4
1864 struct nr_sack_track {
1865 	uint8_t right_edge;	/* mergable on the right edge */
1866 	uint8_t left_edge;	/* mergable on the left edge */
1867 	uint8_t num_entries;
1868 	uint8_t spare;
1869 	struct sctp_nr_gap_ack_block nr_gaps[SCTP_MAX_NR_GAPS_INARRAY];
1870 };
1871 
1872 struct nr_sack_track nr_sack_array[256] = {
1873 	{0, 0, 0, 0,		/* 0x00 */
1874 		{{0, 0},
1875 		{0, 0},
1876 		{0, 0},
1877 		{0, 0}
1878 		}
1879 	},
1880 	{1, 0, 1, 0,		/* 0x01 */
1881 		{{0, 0},
1882 		{0, 0},
1883 		{0, 0},
1884 		{0, 0}
1885 		}
1886 	},
1887 	{0, 0, 1, 0,		/* 0x02 */
1888 		{{1, 1},
1889 		{0, 0},
1890 		{0, 0},
1891 		{0, 0}
1892 		}
1893 	},
1894 	{1, 0, 1, 0,		/* 0x03 */
1895 		{{0, 1},
1896 		{0, 0},
1897 		{0, 0},
1898 		{0, 0}
1899 		}
1900 	},
1901 	{0, 0, 1, 0,		/* 0x04 */
1902 		{{2, 2},
1903 		{0, 0},
1904 		{0, 0},
1905 		{0, 0}
1906 		}
1907 	},
1908 	{1, 0, 2, 0,		/* 0x05 */
1909 		{{0, 0},
1910 		{2, 2},
1911 		{0, 0},
1912 		{0, 0}
1913 		}
1914 	},
1915 	{0, 0, 1, 0,		/* 0x06 */
1916 		{{1, 2},
1917 		{0, 0},
1918 		{0, 0},
1919 		{0, 0}
1920 		}
1921 	},
1922 	{1, 0, 1, 0,		/* 0x07 */
1923 		{{0, 2},
1924 		{0, 0},
1925 		{0, 0},
1926 		{0, 0}
1927 		}
1928 	},
1929 	{0, 0, 1, 0,		/* 0x08 */
1930 		{{3, 3},
1931 		{0, 0},
1932 		{0, 0},
1933 		{0, 0}
1934 		}
1935 	},
1936 	{1, 0, 2, 0,		/* 0x09 */
1937 		{{0, 0},
1938 		{3, 3},
1939 		{0, 0},
1940 		{0, 0}
1941 		}
1942 	},
1943 	{0, 0, 2, 0,		/* 0x0a */
1944 		{{1, 1},
1945 		{3, 3},
1946 		{0, 0},
1947 		{0, 0}
1948 		}
1949 	},
1950 	{1, 0, 2, 0,		/* 0x0b */
1951 		{{0, 1},
1952 		{3, 3},
1953 		{0, 0},
1954 		{0, 0}
1955 		}
1956 	},
1957 	{0, 0, 1, 0,		/* 0x0c */
1958 		{{2, 3},
1959 		{0, 0},
1960 		{0, 0},
1961 		{0, 0}
1962 		}
1963 	},
1964 	{1, 0, 2, 0,		/* 0x0d */
1965 		{{0, 0},
1966 		{2, 3},
1967 		{0, 0},
1968 		{0, 0}
1969 		}
1970 	},
1971 	{0, 0, 1, 0,		/* 0x0e */
1972 		{{1, 3},
1973 		{0, 0},
1974 		{0, 0},
1975 		{0, 0}
1976 		}
1977 	},
1978 	{1, 0, 1, 0,		/* 0x0f */
1979 		{{0, 3},
1980 		{0, 0},
1981 		{0, 0},
1982 		{0, 0}
1983 		}
1984 	},
1985 	{0, 0, 1, 0,		/* 0x10 */
1986 		{{4, 4},
1987 		{0, 0},
1988 		{0, 0},
1989 		{0, 0}
1990 		}
1991 	},
1992 	{1, 0, 2, 0,		/* 0x11 */
1993 		{{0, 0},
1994 		{4, 4},
1995 		{0, 0},
1996 		{0, 0}
1997 		}
1998 	},
1999 	{0, 0, 2, 0,		/* 0x12 */
2000 		{{1, 1},
2001 		{4, 4},
2002 		{0, 0},
2003 		{0, 0}
2004 		}
2005 	},
2006 	{1, 0, 2, 0,		/* 0x13 */
2007 		{{0, 1},
2008 		{4, 4},
2009 		{0, 0},
2010 		{0, 0}
2011 		}
2012 	},
2013 	{0, 0, 2, 0,		/* 0x14 */
2014 		{{2, 2},
2015 		{4, 4},
2016 		{0, 0},
2017 		{0, 0}
2018 		}
2019 	},
2020 	{1, 0, 3, 0,		/* 0x15 */
2021 		{{0, 0},
2022 		{2, 2},
2023 		{4, 4},
2024 		{0, 0}
2025 		}
2026 	},
2027 	{0, 0, 2, 0,		/* 0x16 */
2028 		{{1, 2},
2029 		{4, 4},
2030 		{0, 0},
2031 		{0, 0}
2032 		}
2033 	},
2034 	{1, 0, 2, 0,		/* 0x17 */
2035 		{{0, 2},
2036 		{4, 4},
2037 		{0, 0},
2038 		{0, 0}
2039 		}
2040 	},
2041 	{0, 0, 1, 0,		/* 0x18 */
2042 		{{3, 4},
2043 		{0, 0},
2044 		{0, 0},
2045 		{0, 0}
2046 		}
2047 	},
2048 	{1, 0, 2, 0,		/* 0x19 */
2049 		{{0, 0},
2050 		{3, 4},
2051 		{0, 0},
2052 		{0, 0}
2053 		}
2054 	},
2055 	{0, 0, 2, 0,		/* 0x1a */
2056 		{{1, 1},
2057 		{3, 4},
2058 		{0, 0},
2059 		{0, 0}
2060 		}
2061 	},
2062 	{1, 0, 2, 0,		/* 0x1b */
2063 		{{0, 1},
2064 		{3, 4},
2065 		{0, 0},
2066 		{0, 0}
2067 		}
2068 	},
2069 	{0, 0, 1, 0,		/* 0x1c */
2070 		{{2, 4},
2071 		{0, 0},
2072 		{0, 0},
2073 		{0, 0}
2074 		}
2075 	},
2076 	{1, 0, 2, 0,		/* 0x1d */
2077 		{{0, 0},
2078 		{2, 4},
2079 		{0, 0},
2080 		{0, 0}
2081 		}
2082 	},
2083 	{0, 0, 1, 0,		/* 0x1e */
2084 		{{1, 4},
2085 		{0, 0},
2086 		{0, 0},
2087 		{0, 0}
2088 		}
2089 	},
2090 	{1, 0, 1, 0,		/* 0x1f */
2091 		{{0, 4},
2092 		{0, 0},
2093 		{0, 0},
2094 		{0, 0}
2095 		}
2096 	},
2097 	{0, 0, 1, 0,		/* 0x20 */
2098 		{{5, 5},
2099 		{0, 0},
2100 		{0, 0},
2101 		{0, 0}
2102 		}
2103 	},
2104 	{1, 0, 2, 0,		/* 0x21 */
2105 		{{0, 0},
2106 		{5, 5},
2107 		{0, 0},
2108 		{0, 0}
2109 		}
2110 	},
2111 	{0, 0, 2, 0,		/* 0x22 */
2112 		{{1, 1},
2113 		{5, 5},
2114 		{0, 0},
2115 		{0, 0}
2116 		}
2117 	},
2118 	{1, 0, 2, 0,		/* 0x23 */
2119 		{{0, 1},
2120 		{5, 5},
2121 		{0, 0},
2122 		{0, 0}
2123 		}
2124 	},
2125 	{0, 0, 2, 0,		/* 0x24 */
2126 		{{2, 2},
2127 		{5, 5},
2128 		{0, 0},
2129 		{0, 0}
2130 		}
2131 	},
2132 	{1, 0, 3, 0,		/* 0x25 */
2133 		{{0, 0},
2134 		{2, 2},
2135 		{5, 5},
2136 		{0, 0}
2137 		}
2138 	},
2139 	{0, 0, 2, 0,		/* 0x26 */
2140 		{{1, 2},
2141 		{5, 5},
2142 		{0, 0},
2143 		{0, 0}
2144 		}
2145 	},
2146 	{1, 0, 2, 0,		/* 0x27 */
2147 		{{0, 2},
2148 		{5, 5},
2149 		{0, 0},
2150 		{0, 0}
2151 		}
2152 	},
2153 	{0, 0, 2, 0,		/* 0x28 */
2154 		{{3, 3},
2155 		{5, 5},
2156 		{0, 0},
2157 		{0, 0}
2158 		}
2159 	},
2160 	{1, 0, 3, 0,		/* 0x29 */
2161 		{{0, 0},
2162 		{3, 3},
2163 		{5, 5},
2164 		{0, 0}
2165 		}
2166 	},
2167 	{0, 0, 3, 0,		/* 0x2a */
2168 		{{1, 1},
2169 		{3, 3},
2170 		{5, 5},
2171 		{0, 0}
2172 		}
2173 	},
2174 	{1, 0, 3, 0,		/* 0x2b */
2175 		{{0, 1},
2176 		{3, 3},
2177 		{5, 5},
2178 		{0, 0}
2179 		}
2180 	},
2181 	{0, 0, 2, 0,		/* 0x2c */
2182 		{{2, 3},
2183 		{5, 5},
2184 		{0, 0},
2185 		{0, 0}
2186 		}
2187 	},
2188 	{1, 0, 3, 0,		/* 0x2d */
2189 		{{0, 0},
2190 		{2, 3},
2191 		{5, 5},
2192 		{0, 0}
2193 		}
2194 	},
2195 	{0, 0, 2, 0,		/* 0x2e */
2196 		{{1, 3},
2197 		{5, 5},
2198 		{0, 0},
2199 		{0, 0}
2200 		}
2201 	},
2202 	{1, 0, 2, 0,		/* 0x2f */
2203 		{{0, 3},
2204 		{5, 5},
2205 		{0, 0},
2206 		{0, 0}
2207 		}
2208 	},
2209 	{0, 0, 1, 0,		/* 0x30 */
2210 		{{4, 5},
2211 		{0, 0},
2212 		{0, 0},
2213 		{0, 0}
2214 		}
2215 	},
2216 	{1, 0, 2, 0,		/* 0x31 */
2217 		{{0, 0},
2218 		{4, 5},
2219 		{0, 0},
2220 		{0, 0}
2221 		}
2222 	},
2223 	{0, 0, 2, 0,		/* 0x32 */
2224 		{{1, 1},
2225 		{4, 5},
2226 		{0, 0},
2227 		{0, 0}
2228 		}
2229 	},
2230 	{1, 0, 2, 0,		/* 0x33 */
2231 		{{0, 1},
2232 		{4, 5},
2233 		{0, 0},
2234 		{0, 0}
2235 		}
2236 	},
2237 	{0, 0, 2, 0,		/* 0x34 */
2238 		{{2, 2},
2239 		{4, 5},
2240 		{0, 0},
2241 		{0, 0}
2242 		}
2243 	},
2244 	{1, 0, 3, 0,		/* 0x35 */
2245 		{{0, 0},
2246 		{2, 2},
2247 		{4, 5},
2248 		{0, 0}
2249 		}
2250 	},
2251 	{0, 0, 2, 0,		/* 0x36 */
2252 		{{1, 2},
2253 		{4, 5},
2254 		{0, 0},
2255 		{0, 0}
2256 		}
2257 	},
2258 	{1, 0, 2, 0,		/* 0x37 */
2259 		{{0, 2},
2260 		{4, 5},
2261 		{0, 0},
2262 		{0, 0}
2263 		}
2264 	},
2265 	{0, 0, 1, 0,		/* 0x38 */
2266 		{{3, 5},
2267 		{0, 0},
2268 		{0, 0},
2269 		{0, 0}
2270 		}
2271 	},
2272 	{1, 0, 2, 0,		/* 0x39 */
2273 		{{0, 0},
2274 		{3, 5},
2275 		{0, 0},
2276 		{0, 0}
2277 		}
2278 	},
2279 	{0, 0, 2, 0,		/* 0x3a */
2280 		{{1, 1},
2281 		{3, 5},
2282 		{0, 0},
2283 		{0, 0}
2284 		}
2285 	},
2286 	{1, 0, 2, 0,		/* 0x3b */
2287 		{{0, 1},
2288 		{3, 5},
2289 		{0, 0},
2290 		{0, 0}
2291 		}
2292 	},
2293 	{0, 0, 1, 0,		/* 0x3c */
2294 		{{2, 5},
2295 		{0, 0},
2296 		{0, 0},
2297 		{0, 0}
2298 		}
2299 	},
2300 	{1, 0, 2, 0,		/* 0x3d */
2301 		{{0, 0},
2302 		{2, 5},
2303 		{0, 0},
2304 		{0, 0}
2305 		}
2306 	},
2307 	{0, 0, 1, 0,		/* 0x3e */
2308 		{{1, 5},
2309 		{0, 0},
2310 		{0, 0},
2311 		{0, 0}
2312 		}
2313 	},
2314 	{1, 0, 1, 0,		/* 0x3f */
2315 		{{0, 5},
2316 		{0, 0},
2317 		{0, 0},
2318 		{0, 0}
2319 		}
2320 	},
2321 	{0, 0, 1, 0,		/* 0x40 */
2322 		{{6, 6},
2323 		{0, 0},
2324 		{0, 0},
2325 		{0, 0}
2326 		}
2327 	},
2328 	{1, 0, 2, 0,		/* 0x41 */
2329 		{{0, 0},
2330 		{6, 6},
2331 		{0, 0},
2332 		{0, 0}
2333 		}
2334 	},
2335 	{0, 0, 2, 0,		/* 0x42 */
2336 		{{1, 1},
2337 		{6, 6},
2338 		{0, 0},
2339 		{0, 0}
2340 		}
2341 	},
2342 	{1, 0, 2, 0,		/* 0x43 */
2343 		{{0, 1},
2344 		{6, 6},
2345 		{0, 0},
2346 		{0, 0}
2347 		}
2348 	},
2349 	{0, 0, 2, 0,		/* 0x44 */
2350 		{{2, 2},
2351 		{6, 6},
2352 		{0, 0},
2353 		{0, 0}
2354 		}
2355 	},
2356 	{1, 0, 3, 0,		/* 0x45 */
2357 		{{0, 0},
2358 		{2, 2},
2359 		{6, 6},
2360 		{0, 0}
2361 		}
2362 	},
2363 	{0, 0, 2, 0,		/* 0x46 */
2364 		{{1, 2},
2365 		{6, 6},
2366 		{0, 0},
2367 		{0, 0}
2368 		}
2369 	},
2370 	{1, 0, 2, 0,		/* 0x47 */
2371 		{{0, 2},
2372 		{6, 6},
2373 		{0, 0},
2374 		{0, 0}
2375 		}
2376 	},
2377 	{0, 0, 2, 0,		/* 0x48 */
2378 		{{3, 3},
2379 		{6, 6},
2380 		{0, 0},
2381 		{0, 0}
2382 		}
2383 	},
2384 	{1, 0, 3, 0,		/* 0x49 */
2385 		{{0, 0},
2386 		{3, 3},
2387 		{6, 6},
2388 		{0, 0}
2389 		}
2390 	},
2391 	{0, 0, 3, 0,		/* 0x4a */
2392 		{{1, 1},
2393 		{3, 3},
2394 		{6, 6},
2395 		{0, 0}
2396 		}
2397 	},
2398 	{1, 0, 3, 0,		/* 0x4b */
2399 		{{0, 1},
2400 		{3, 3},
2401 		{6, 6},
2402 		{0, 0}
2403 		}
2404 	},
2405 	{0, 0, 2, 0,		/* 0x4c */
2406 		{{2, 3},
2407 		{6, 6},
2408 		{0, 0},
2409 		{0, 0}
2410 		}
2411 	},
2412 	{1, 0, 3, 0,		/* 0x4d */
2413 		{{0, 0},
2414 		{2, 3},
2415 		{6, 6},
2416 		{0, 0}
2417 		}
2418 	},
2419 	{0, 0, 2, 0,		/* 0x4e */
2420 		{{1, 3},
2421 		{6, 6},
2422 		{0, 0},
2423 		{0, 0}
2424 		}
2425 	},
2426 	{1, 0, 2, 0,		/* 0x4f */
2427 		{{0, 3},
2428 		{6, 6},
2429 		{0, 0},
2430 		{0, 0}
2431 		}
2432 	},
2433 	{0, 0, 2, 0,		/* 0x50 */
2434 		{{4, 4},
2435 		{6, 6},
2436 		{0, 0},
2437 		{0, 0}
2438 		}
2439 	},
2440 	{1, 0, 3, 0,		/* 0x51 */
2441 		{{0, 0},
2442 		{4, 4},
2443 		{6, 6},
2444 		{0, 0}
2445 		}
2446 	},
2447 	{0, 0, 3, 0,		/* 0x52 */
2448 		{{1, 1},
2449 		{4, 4},
2450 		{6, 6},
2451 		{0, 0}
2452 		}
2453 	},
2454 	{1, 0, 3, 0,		/* 0x53 */
2455 		{{0, 1},
2456 		{4, 4},
2457 		{6, 6},
2458 		{0, 0}
2459 		}
2460 	},
2461 	{0, 0, 3, 0,		/* 0x54 */
2462 		{{2, 2},
2463 		{4, 4},
2464 		{6, 6},
2465 		{0, 0}
2466 		}
2467 	},
2468 	{1, 0, 4, 0,		/* 0x55 */
2469 		{{0, 0},
2470 		{2, 2},
2471 		{4, 4},
2472 		{6, 6}
2473 		}
2474 	},
2475 	{0, 0, 3, 0,		/* 0x56 */
2476 		{{1, 2},
2477 		{4, 4},
2478 		{6, 6},
2479 		{0, 0}
2480 		}
2481 	},
2482 	{1, 0, 3, 0,		/* 0x57 */
2483 		{{0, 2},
2484 		{4, 4},
2485 		{6, 6},
2486 		{0, 0}
2487 		}
2488 	},
2489 	{0, 0, 2, 0,		/* 0x58 */
2490 		{{3, 4},
2491 		{6, 6},
2492 		{0, 0},
2493 		{0, 0}
2494 		}
2495 	},
2496 	{1, 0, 3, 0,		/* 0x59 */
2497 		{{0, 0},
2498 		{3, 4},
2499 		{6, 6},
2500 		{0, 0}
2501 		}
2502 	},
2503 	{0, 0, 3, 0,		/* 0x5a */
2504 		{{1, 1},
2505 		{3, 4},
2506 		{6, 6},
2507 		{0, 0}
2508 		}
2509 	},
2510 	{1, 0, 3, 0,		/* 0x5b */
2511 		{{0, 1},
2512 		{3, 4},
2513 		{6, 6},
2514 		{0, 0}
2515 		}
2516 	},
2517 	{0, 0, 2, 0,		/* 0x5c */
2518 		{{2, 4},
2519 		{6, 6},
2520 		{0, 0},
2521 		{0, 0}
2522 		}
2523 	},
2524 	{1, 0, 3, 0,		/* 0x5d */
2525 		{{0, 0},
2526 		{2, 4},
2527 		{6, 6},
2528 		{0, 0}
2529 		}
2530 	},
2531 	{0, 0, 2, 0,		/* 0x5e */
2532 		{{1, 4},
2533 		{6, 6},
2534 		{0, 0},
2535 		{0, 0}
2536 		}
2537 	},
2538 	{1, 0, 2, 0,		/* 0x5f */
2539 		{{0, 4},
2540 		{6, 6},
2541 		{0, 0},
2542 		{0, 0}
2543 		}
2544 	},
2545 	{0, 0, 1, 0,		/* 0x60 */
2546 		{{5, 6},
2547 		{0, 0},
2548 		{0, 0},
2549 		{0, 0}
2550 		}
2551 	},
2552 	{1, 0, 2, 0,		/* 0x61 */
2553 		{{0, 0},
2554 		{5, 6},
2555 		{0, 0},
2556 		{0, 0}
2557 		}
2558 	},
2559 	{0, 0, 2, 0,		/* 0x62 */
2560 		{{1, 1},
2561 		{5, 6},
2562 		{0, 0},
2563 		{0, 0}
2564 		}
2565 	},
2566 	{1, 0, 2, 0,		/* 0x63 */
2567 		{{0, 1},
2568 		{5, 6},
2569 		{0, 0},
2570 		{0, 0}
2571 		}
2572 	},
2573 	{0, 0, 2, 0,		/* 0x64 */
2574 		{{2, 2},
2575 		{5, 6},
2576 		{0, 0},
2577 		{0, 0}
2578 		}
2579 	},
2580 	{1, 0, 3, 0,		/* 0x65 */
2581 		{{0, 0},
2582 		{2, 2},
2583 		{5, 6},
2584 		{0, 0}
2585 		}
2586 	},
2587 	{0, 0, 2, 0,		/* 0x66 */
2588 		{{1, 2},
2589 		{5, 6},
2590 		{0, 0},
2591 		{0, 0}
2592 		}
2593 	},
2594 	{1, 0, 2, 0,		/* 0x67 */
2595 		{{0, 2},
2596 		{5, 6},
2597 		{0, 0},
2598 		{0, 0}
2599 		}
2600 	},
2601 	{0, 0, 2, 0,		/* 0x68 */
2602 		{{3, 3},
2603 		{5, 6},
2604 		{0, 0},
2605 		{0, 0}
2606 		}
2607 	},
2608 	{1, 0, 3, 0,		/* 0x69 */
2609 		{{0, 0},
2610 		{3, 3},
2611 		{5, 6},
2612 		{0, 0}
2613 		}
2614 	},
2615 	{0, 0, 3, 0,		/* 0x6a */
2616 		{{1, 1},
2617 		{3, 3},
2618 		{5, 6},
2619 		{0, 0}
2620 		}
2621 	},
2622 	{1, 0, 3, 0,		/* 0x6b */
2623 		{{0, 1},
2624 		{3, 3},
2625 		{5, 6},
2626 		{0, 0}
2627 		}
2628 	},
2629 	{0, 0, 2, 0,		/* 0x6c */
2630 		{{2, 3},
2631 		{5, 6},
2632 		{0, 0},
2633 		{0, 0}
2634 		}
2635 	},
2636 	{1, 0, 3, 0,		/* 0x6d */
2637 		{{0, 0},
2638 		{2, 3},
2639 		{5, 6},
2640 		{0, 0}
2641 		}
2642 	},
2643 	{0, 0, 2, 0,		/* 0x6e */
2644 		{{1, 3},
2645 		{5, 6},
2646 		{0, 0},
2647 		{0, 0}
2648 		}
2649 	},
2650 	{1, 0, 2, 0,		/* 0x6f */
2651 		{{0, 3},
2652 		{5, 6},
2653 		{0, 0},
2654 		{0, 0}
2655 		}
2656 	},
2657 	{0, 0, 1, 0,		/* 0x70 */
2658 		{{4, 6},
2659 		{0, 0},
2660 		{0, 0},
2661 		{0, 0}
2662 		}
2663 	},
2664 	{1, 0, 2, 0,		/* 0x71 */
2665 		{{0, 0},
2666 		{4, 6},
2667 		{0, 0},
2668 		{0, 0}
2669 		}
2670 	},
2671 	{0, 0, 2, 0,		/* 0x72 */
2672 		{{1, 1},
2673 		{4, 6},
2674 		{0, 0},
2675 		{0, 0}
2676 		}
2677 	},
2678 	{1, 0, 2, 0,		/* 0x73 */
2679 		{{0, 1},
2680 		{4, 6},
2681 		{0, 0},
2682 		{0, 0}
2683 		}
2684 	},
2685 	{0, 0, 2, 0,		/* 0x74 */
2686 		{{2, 2},
2687 		{4, 6},
2688 		{0, 0},
2689 		{0, 0}
2690 		}
2691 	},
2692 	{1, 0, 3, 0,		/* 0x75 */
2693 		{{0, 0},
2694 		{2, 2},
2695 		{4, 6},
2696 		{0, 0}
2697 		}
2698 	},
2699 	{0, 0, 2, 0,		/* 0x76 */
2700 		{{1, 2},
2701 		{4, 6},
2702 		{0, 0},
2703 		{0, 0}
2704 		}
2705 	},
2706 	{1, 0, 2, 0,		/* 0x77 */
2707 		{{0, 2},
2708 		{4, 6},
2709 		{0, 0},
2710 		{0, 0}
2711 		}
2712 	},
2713 	{0, 0, 1, 0,		/* 0x78 */
2714 		{{3, 6},
2715 		{0, 0},
2716 		{0, 0},
2717 		{0, 0}
2718 		}
2719 	},
2720 	{1, 0, 2, 0,		/* 0x79 */
2721 		{{0, 0},
2722 		{3, 6},
2723 		{0, 0},
2724 		{0, 0}
2725 		}
2726 	},
2727 	{0, 0, 2, 0,		/* 0x7a */
2728 		{{1, 1},
2729 		{3, 6},
2730 		{0, 0},
2731 		{0, 0}
2732 		}
2733 	},
2734 	{1, 0, 2, 0,		/* 0x7b */
2735 		{{0, 1},
2736 		{3, 6},
2737 		{0, 0},
2738 		{0, 0}
2739 		}
2740 	},
2741 	{0, 0, 1, 0,		/* 0x7c */
2742 		{{2, 6},
2743 		{0, 0},
2744 		{0, 0},
2745 		{0, 0}
2746 		}
2747 	},
2748 	{1, 0, 2, 0,		/* 0x7d */
2749 		{{0, 0},
2750 		{2, 6},
2751 		{0, 0},
2752 		{0, 0}
2753 		}
2754 	},
2755 	{0, 0, 1, 0,		/* 0x7e */
2756 		{{1, 6},
2757 		{0, 0},
2758 		{0, 0},
2759 		{0, 0}
2760 		}
2761 	},
2762 	{1, 0, 1, 0,		/* 0x7f */
2763 		{{0, 6},
2764 		{0, 0},
2765 		{0, 0},
2766 		{0, 0}
2767 		}
2768 	},
2769 	{0, 1, 1, 0,		/* 0x80 */
2770 		{{7, 7},
2771 		{0, 0},
2772 		{0, 0},
2773 		{0, 0}
2774 		}
2775 	},
2776 	{1, 1, 2, 0,		/* 0x81 */
2777 		{{0, 0},
2778 		{7, 7},
2779 		{0, 0},
2780 		{0, 0}
2781 		}
2782 	},
2783 	{0, 1, 2, 0,		/* 0x82 */
2784 		{{1, 1},
2785 		{7, 7},
2786 		{0, 0},
2787 		{0, 0}
2788 		}
2789 	},
2790 	{1, 1, 2, 0,		/* 0x83 */
2791 		{{0, 1},
2792 		{7, 7},
2793 		{0, 0},
2794 		{0, 0}
2795 		}
2796 	},
2797 	{0, 1, 2, 0,		/* 0x84 */
2798 		{{2, 2},
2799 		{7, 7},
2800 		{0, 0},
2801 		{0, 0}
2802 		}
2803 	},
2804 	{1, 1, 3, 0,		/* 0x85 */
2805 		{{0, 0},
2806 		{2, 2},
2807 		{7, 7},
2808 		{0, 0}
2809 		}
2810 	},
2811 	{0, 1, 2, 0,		/* 0x86 */
2812 		{{1, 2},
2813 		{7, 7},
2814 		{0, 0},
2815 		{0, 0}
2816 		}
2817 	},
2818 	{1, 1, 2, 0,		/* 0x87 */
2819 		{{0, 2},
2820 		{7, 7},
2821 		{0, 0},
2822 		{0, 0}
2823 		}
2824 	},
2825 	{0, 1, 2, 0,		/* 0x88 */
2826 		{{3, 3},
2827 		{7, 7},
2828 		{0, 0},
2829 		{0, 0}
2830 		}
2831 	},
2832 	{1, 1, 3, 0,		/* 0x89 */
2833 		{{0, 0},
2834 		{3, 3},
2835 		{7, 7},
2836 		{0, 0}
2837 		}
2838 	},
2839 	{0, 1, 3, 0,		/* 0x8a */
2840 		{{1, 1},
2841 		{3, 3},
2842 		{7, 7},
2843 		{0, 0}
2844 		}
2845 	},
2846 	{1, 1, 3, 0,		/* 0x8b */
2847 		{{0, 1},
2848 		{3, 3},
2849 		{7, 7},
2850 		{0, 0}
2851 		}
2852 	},
2853 	{0, 1, 2, 0,		/* 0x8c */
2854 		{{2, 3},
2855 		{7, 7},
2856 		{0, 0},
2857 		{0, 0}
2858 		}
2859 	},
2860 	{1, 1, 3, 0,		/* 0x8d */
2861 		{{0, 0},
2862 		{2, 3},
2863 		{7, 7},
2864 		{0, 0}
2865 		}
2866 	},
2867 	{0, 1, 2, 0,		/* 0x8e */
2868 		{{1, 3},
2869 		{7, 7},
2870 		{0, 0},
2871 		{0, 0}
2872 		}
2873 	},
2874 	{1, 1, 2, 0,		/* 0x8f */
2875 		{{0, 3},
2876 		{7, 7},
2877 		{0, 0},
2878 		{0, 0}
2879 		}
2880 	},
2881 	{0, 1, 2, 0,		/* 0x90 */
2882 		{{4, 4},
2883 		{7, 7},
2884 		{0, 0},
2885 		{0, 0}
2886 		}
2887 	},
2888 	{1, 1, 3, 0,		/* 0x91 */
2889 		{{0, 0},
2890 		{4, 4},
2891 		{7, 7},
2892 		{0, 0}
2893 		}
2894 	},
2895 	{0, 1, 3, 0,		/* 0x92 */
2896 		{{1, 1},
2897 		{4, 4},
2898 		{7, 7},
2899 		{0, 0}
2900 		}
2901 	},
2902 	{1, 1, 3, 0,		/* 0x93 */
2903 		{{0, 1},
2904 		{4, 4},
2905 		{7, 7},
2906 		{0, 0}
2907 		}
2908 	},
2909 	{0, 1, 3, 0,		/* 0x94 */
2910 		{{2, 2},
2911 		{4, 4},
2912 		{7, 7},
2913 		{0, 0}
2914 		}
2915 	},
2916 	{1, 1, 4, 0,		/* 0x95 */
2917 		{{0, 0},
2918 		{2, 2},
2919 		{4, 4},
2920 		{7, 7}
2921 		}
2922 	},
2923 	{0, 1, 3, 0,		/* 0x96 */
2924 		{{1, 2},
2925 		{4, 4},
2926 		{7, 7},
2927 		{0, 0}
2928 		}
2929 	},
2930 	{1, 1, 3, 0,		/* 0x97 */
2931 		{{0, 2},
2932 		{4, 4},
2933 		{7, 7},
2934 		{0, 0}
2935 		}
2936 	},
2937 	{0, 1, 2, 0,		/* 0x98 */
2938 		{{3, 4},
2939 		{7, 7},
2940 		{0, 0},
2941 		{0, 0}
2942 		}
2943 	},
2944 	{1, 1, 3, 0,		/* 0x99 */
2945 		{{0, 0},
2946 		{3, 4},
2947 		{7, 7},
2948 		{0, 0}
2949 		}
2950 	},
2951 	{0, 1, 3, 0,		/* 0x9a */
2952 		{{1, 1},
2953 		{3, 4},
2954 		{7, 7},
2955 		{0, 0}
2956 		}
2957 	},
2958 	{1, 1, 3, 0,		/* 0x9b */
2959 		{{0, 1},
2960 		{3, 4},
2961 		{7, 7},
2962 		{0, 0}
2963 		}
2964 	},
2965 	{0, 1, 2, 0,		/* 0x9c */
2966 		{{2, 4},
2967 		{7, 7},
2968 		{0, 0},
2969 		{0, 0}
2970 		}
2971 	},
2972 	{1, 1, 3, 0,		/* 0x9d */
2973 		{{0, 0},
2974 		{2, 4},
2975 		{7, 7},
2976 		{0, 0}
2977 		}
2978 	},
2979 	{0, 1, 2, 0,		/* 0x9e */
2980 		{{1, 4},
2981 		{7, 7},
2982 		{0, 0},
2983 		{0, 0}
2984 		}
2985 	},
2986 	{1, 1, 2, 0,		/* 0x9f */
2987 		{{0, 4},
2988 		{7, 7},
2989 		{0, 0},
2990 		{0, 0}
2991 		}
2992 	},
2993 	{0, 1, 2, 0,		/* 0xa0 */
2994 		{{5, 5},
2995 		{7, 7},
2996 		{0, 0},
2997 		{0, 0}
2998 		}
2999 	},
3000 	{1, 1, 3, 0,		/* 0xa1 */
3001 		{{0, 0},
3002 		{5, 5},
3003 		{7, 7},
3004 		{0, 0}
3005 		}
3006 	},
3007 	{0, 1, 3, 0,		/* 0xa2 */
3008 		{{1, 1},
3009 		{5, 5},
3010 		{7, 7},
3011 		{0, 0}
3012 		}
3013 	},
3014 	{1, 1, 3, 0,		/* 0xa3 */
3015 		{{0, 1},
3016 		{5, 5},
3017 		{7, 7},
3018 		{0, 0}
3019 		}
3020 	},
3021 	{0, 1, 3, 0,		/* 0xa4 */
3022 		{{2, 2},
3023 		{5, 5},
3024 		{7, 7},
3025 		{0, 0}
3026 		}
3027 	},
3028 	{1, 1, 4, 0,		/* 0xa5 */
3029 		{{0, 0},
3030 		{2, 2},
3031 		{5, 5},
3032 		{7, 7}
3033 		}
3034 	},
3035 	{0, 1, 3, 0,		/* 0xa6 */
3036 		{{1, 2},
3037 		{5, 5},
3038 		{7, 7},
3039 		{0, 0}
3040 		}
3041 	},
3042 	{1, 1, 3, 0,		/* 0xa7 */
3043 		{{0, 2},
3044 		{5, 5},
3045 		{7, 7},
3046 		{0, 0}
3047 		}
3048 	},
3049 	{0, 1, 3, 0,		/* 0xa8 */
3050 		{{3, 3},
3051 		{5, 5},
3052 		{7, 7},
3053 		{0, 0}
3054 		}
3055 	},
3056 	{1, 1, 4, 0,		/* 0xa9 */
3057 		{{0, 0},
3058 		{3, 3},
3059 		{5, 5},
3060 		{7, 7}
3061 		}
3062 	},
3063 	{0, 1, 4, 0,		/* 0xaa */
3064 		{{1, 1},
3065 		{3, 3},
3066 		{5, 5},
3067 		{7, 7}
3068 		}
3069 	},
3070 	{1, 1, 4, 0,		/* 0xab */
3071 		{{0, 1},
3072 		{3, 3},
3073 		{5, 5},
3074 		{7, 7}
3075 		}
3076 	},
3077 	{0, 1, 3, 0,		/* 0xac */
3078 		{{2, 3},
3079 		{5, 5},
3080 		{7, 7},
3081 		{0, 0}
3082 		}
3083 	},
3084 	{1, 1, 4, 0,		/* 0xad */
3085 		{{0, 0},
3086 		{2, 3},
3087 		{5, 5},
3088 		{7, 7}
3089 		}
3090 	},
3091 	{0, 1, 3, 0,		/* 0xae */
3092 		{{1, 3},
3093 		{5, 5},
3094 		{7, 7},
3095 		{0, 0}
3096 		}
3097 	},
3098 	{1, 1, 3, 0,		/* 0xaf */
3099 		{{0, 3},
3100 		{5, 5},
3101 		{7, 7},
3102 		{0, 0}
3103 		}
3104 	},
3105 	{0, 1, 2, 0,		/* 0xb0 */
3106 		{{4, 5},
3107 		{7, 7},
3108 		{0, 0},
3109 		{0, 0}
3110 		}
3111 	},
3112 	{1, 1, 3, 0,		/* 0xb1 */
3113 		{{0, 0},
3114 		{4, 5},
3115 		{7, 7},
3116 		{0, 0}
3117 		}
3118 	},
3119 	{0, 1, 3, 0,		/* 0xb2 */
3120 		{{1, 1},
3121 		{4, 5},
3122 		{7, 7},
3123 		{0, 0}
3124 		}
3125 	},
3126 	{1, 1, 3, 0,		/* 0xb3 */
3127 		{{0, 1},
3128 		{4, 5},
3129 		{7, 7},
3130 		{0, 0}
3131 		}
3132 	},
3133 	{0, 1, 3, 0,		/* 0xb4 */
3134 		{{2, 2},
3135 		{4, 5},
3136 		{7, 7},
3137 		{0, 0}
3138 		}
3139 	},
3140 	{1, 1, 4, 0,		/* 0xb5 */
3141 		{{0, 0},
3142 		{2, 2},
3143 		{4, 5},
3144 		{7, 7}
3145 		}
3146 	},
3147 	{0, 1, 3, 0,		/* 0xb6 */
3148 		{{1, 2},
3149 		{4, 5},
3150 		{7, 7},
3151 		{0, 0}
3152 		}
3153 	},
3154 	{1, 1, 3, 0,		/* 0xb7 */
3155 		{{0, 2},
3156 		{4, 5},
3157 		{7, 7},
3158 		{0, 0}
3159 		}
3160 	},
3161 	{0, 1, 2, 0,		/* 0xb8 */
3162 		{{3, 5},
3163 		{7, 7},
3164 		{0, 0},
3165 		{0, 0}
3166 		}
3167 	},
3168 	{1, 1, 3, 0,		/* 0xb9 */
3169 		{{0, 0},
3170 		{3, 5},
3171 		{7, 7},
3172 		{0, 0}
3173 		}
3174 	},
3175 	{0, 1, 3, 0,		/* 0xba */
3176 		{{1, 1},
3177 		{3, 5},
3178 		{7, 7},
3179 		{0, 0}
3180 		}
3181 	},
3182 	{1, 1, 3, 0,		/* 0xbb */
3183 		{{0, 1},
3184 		{3, 5},
3185 		{7, 7},
3186 		{0, 0}
3187 		}
3188 	},
3189 	{0, 1, 2, 0,		/* 0xbc */
3190 		{{2, 5},
3191 		{7, 7},
3192 		{0, 0},
3193 		{0, 0}
3194 		}
3195 	},
3196 	{1, 1, 3, 0,		/* 0xbd */
3197 		{{0, 0},
3198 		{2, 5},
3199 		{7, 7},
3200 		{0, 0}
3201 		}
3202 	},
3203 	{0, 1, 2, 0,		/* 0xbe */
3204 		{{1, 5},
3205 		{7, 7},
3206 		{0, 0},
3207 		{0, 0}
3208 		}
3209 	},
3210 	{1, 1, 2, 0,		/* 0xbf */
3211 		{{0, 5},
3212 		{7, 7},
3213 		{0, 0},
3214 		{0, 0}
3215 		}
3216 	},
3217 	{0, 1, 1, 0,		/* 0xc0 */
3218 		{{6, 7},
3219 		{0, 0},
3220 		{0, 0},
3221 		{0, 0}
3222 		}
3223 	},
3224 	{1, 1, 2, 0,		/* 0xc1 */
3225 		{{0, 0},
3226 		{6, 7},
3227 		{0, 0},
3228 		{0, 0}
3229 		}
3230 	},
3231 	{0, 1, 2, 0,		/* 0xc2 */
3232 		{{1, 1},
3233 		{6, 7},
3234 		{0, 0},
3235 		{0, 0}
3236 		}
3237 	},
3238 	{1, 1, 2, 0,		/* 0xc3 */
3239 		{{0, 1},
3240 		{6, 7},
3241 		{0, 0},
3242 		{0, 0}
3243 		}
3244 	},
3245 	{0, 1, 2, 0,		/* 0xc4 */
3246 		{{2, 2},
3247 		{6, 7},
3248 		{0, 0},
3249 		{0, 0}
3250 		}
3251 	},
3252 	{1, 1, 3, 0,		/* 0xc5 */
3253 		{{0, 0},
3254 		{2, 2},
3255 		{6, 7},
3256 		{0, 0}
3257 		}
3258 	},
3259 	{0, 1, 2, 0,		/* 0xc6 */
3260 		{{1, 2},
3261 		{6, 7},
3262 		{0, 0},
3263 		{0, 0}
3264 		}
3265 	},
3266 	{1, 1, 2, 0,		/* 0xc7 */
3267 		{{0, 2},
3268 		{6, 7},
3269 		{0, 0},
3270 		{0, 0}
3271 		}
3272 	},
3273 	{0, 1, 2, 0,		/* 0xc8 */
3274 		{{3, 3},
3275 		{6, 7},
3276 		{0, 0},
3277 		{0, 0}
3278 		}
3279 	},
3280 	{1, 1, 3, 0,		/* 0xc9 */
3281 		{{0, 0},
3282 		{3, 3},
3283 		{6, 7},
3284 		{0, 0}
3285 		}
3286 	},
3287 	{0, 1, 3, 0,		/* 0xca */
3288 		{{1, 1},
3289 		{3, 3},
3290 		{6, 7},
3291 		{0, 0}
3292 		}
3293 	},
3294 	{1, 1, 3, 0,		/* 0xcb */
3295 		{{0, 1},
3296 		{3, 3},
3297 		{6, 7},
3298 		{0, 0}
3299 		}
3300 	},
3301 	{0, 1, 2, 0,		/* 0xcc */
3302 		{{2, 3},
3303 		{6, 7},
3304 		{0, 0},
3305 		{0, 0}
3306 		}
3307 	},
3308 	{1, 1, 3, 0,		/* 0xcd */
3309 		{{0, 0},
3310 		{2, 3},
3311 		{6, 7},
3312 		{0, 0}
3313 		}
3314 	},
3315 	{0, 1, 2, 0,		/* 0xce */
3316 		{{1, 3},
3317 		{6, 7},
3318 		{0, 0},
3319 		{0, 0}
3320 		}
3321 	},
3322 	{1, 1, 2, 0,		/* 0xcf */
3323 		{{0, 3},
3324 		{6, 7},
3325 		{0, 0},
3326 		{0, 0}
3327 		}
3328 	},
3329 	{0, 1, 2, 0,		/* 0xd0 */
3330 		{{4, 4},
3331 		{6, 7},
3332 		{0, 0},
3333 		{0, 0}
3334 		}
3335 	},
3336 	{1, 1, 3, 0,		/* 0xd1 */
3337 		{{0, 0},
3338 		{4, 4},
3339 		{6, 7},
3340 		{0, 0}
3341 		}
3342 	},
3343 	{0, 1, 3, 0,		/* 0xd2 */
3344 		{{1, 1},
3345 		{4, 4},
3346 		{6, 7},
3347 		{0, 0}
3348 		}
3349 	},
3350 	{1, 1, 3, 0,		/* 0xd3 */
3351 		{{0, 1},
3352 		{4, 4},
3353 		{6, 7},
3354 		{0, 0}
3355 		}
3356 	},
3357 	{0, 1, 3, 0,		/* 0xd4 */
3358 		{{2, 2},
3359 		{4, 4},
3360 		{6, 7},
3361 		{0, 0}
3362 		}
3363 	},
3364 	{1, 1, 4, 0,		/* 0xd5 */
3365 		{{0, 0},
3366 		{2, 2},
3367 		{4, 4},
3368 		{6, 7}
3369 		}
3370 	},
3371 	{0, 1, 3, 0,		/* 0xd6 */
3372 		{{1, 2},
3373 		{4, 4},
3374 		{6, 7},
3375 		{0, 0}
3376 		}
3377 	},
3378 	{1, 1, 3, 0,		/* 0xd7 */
3379 		{{0, 2},
3380 		{4, 4},
3381 		{6, 7},
3382 		{0, 0}
3383 		}
3384 	},
3385 	{0, 1, 2, 0,		/* 0xd8 */
3386 		{{3, 4},
3387 		{6, 7},
3388 		{0, 0},
3389 		{0, 0}
3390 		}
3391 	},
3392 	{1, 1, 3, 0,		/* 0xd9 */
3393 		{{0, 0},
3394 		{3, 4},
3395 		{6, 7},
3396 		{0, 0}
3397 		}
3398 	},
3399 	{0, 1, 3, 0,		/* 0xda */
3400 		{{1, 1},
3401 		{3, 4},
3402 		{6, 7},
3403 		{0, 0}
3404 		}
3405 	},
3406 	{1, 1, 3, 0,		/* 0xdb */
3407 		{{0, 1},
3408 		{3, 4},
3409 		{6, 7},
3410 		{0, 0}
3411 		}
3412 	},
3413 	{0, 1, 2, 0,		/* 0xdc */
3414 		{{2, 4},
3415 		{6, 7},
3416 		{0, 0},
3417 		{0, 0}
3418 		}
3419 	},
3420 	{1, 1, 3, 0,		/* 0xdd */
3421 		{{0, 0},
3422 		{2, 4},
3423 		{6, 7},
3424 		{0, 0}
3425 		}
3426 	},
3427 	{0, 1, 2, 0,		/* 0xde */
3428 		{{1, 4},
3429 		{6, 7},
3430 		{0, 0},
3431 		{0, 0}
3432 		}
3433 	},
3434 	{1, 1, 2, 0,		/* 0xdf */
3435 		{{0, 4},
3436 		{6, 7},
3437 		{0, 0},
3438 		{0, 0}
3439 		}
3440 	},
3441 	{0, 1, 1, 0,		/* 0xe0 */
3442 		{{5, 7},
3443 		{0, 0},
3444 		{0, 0},
3445 		{0, 0}
3446 		}
3447 	},
3448 	{1, 1, 2, 0,		/* 0xe1 */
3449 		{{0, 0},
3450 		{5, 7},
3451 		{0, 0},
3452 		{0, 0}
3453 		}
3454 	},
3455 	{0, 1, 2, 0,		/* 0xe2 */
3456 		{{1, 1},
3457 		{5, 7},
3458 		{0, 0},
3459 		{0, 0}
3460 		}
3461 	},
3462 	{1, 1, 2, 0,		/* 0xe3 */
3463 		{{0, 1},
3464 		{5, 7},
3465 		{0, 0},
3466 		{0, 0}
3467 		}
3468 	},
3469 	{0, 1, 2, 0,		/* 0xe4 */
3470 		{{2, 2},
3471 		{5, 7},
3472 		{0, 0},
3473 		{0, 0}
3474 		}
3475 	},
3476 	{1, 1, 3, 0,		/* 0xe5 */
3477 		{{0, 0},
3478 		{2, 2},
3479 		{5, 7},
3480 		{0, 0}
3481 		}
3482 	},
3483 	{0, 1, 2, 0,		/* 0xe6 */
3484 		{{1, 2},
3485 		{5, 7},
3486 		{0, 0},
3487 		{0, 0}
3488 		}
3489 	},
3490 	{1, 1, 2, 0,		/* 0xe7 */
3491 		{{0, 2},
3492 		{5, 7},
3493 		{0, 0},
3494 		{0, 0}
3495 		}
3496 	},
3497 	{0, 1, 2, 0,		/* 0xe8 */
3498 		{{3, 3},
3499 		{5, 7},
3500 		{0, 0},
3501 		{0, 0}
3502 		}
3503 	},
3504 	{1, 1, 3, 0,		/* 0xe9 */
3505 		{{0, 0},
3506 		{3, 3},
3507 		{5, 7},
3508 		{0, 0}
3509 		}
3510 	},
3511 	{0, 1, 3, 0,		/* 0xea */
3512 		{{1, 1},
3513 		{3, 3},
3514 		{5, 7},
3515 		{0, 0}
3516 		}
3517 	},
3518 	{1, 1, 3, 0,		/* 0xeb */
3519 		{{0, 1},
3520 		{3, 3},
3521 		{5, 7},
3522 		{0, 0}
3523 		}
3524 	},
3525 	{0, 1, 2, 0,		/* 0xec */
3526 		{{2, 3},
3527 		{5, 7},
3528 		{0, 0},
3529 		{0, 0}
3530 		}
3531 	},
3532 	{1, 1, 3, 0,		/* 0xed */
3533 		{{0, 0},
3534 		{2, 3},
3535 		{5, 7},
3536 		{0, 0}
3537 		}
3538 	},
3539 	{0, 1, 2, 0,		/* 0xee */
3540 		{{1, 3},
3541 		{5, 7},
3542 		{0, 0},
3543 		{0, 0}
3544 		}
3545 	},
3546 	{1, 1, 2, 0,		/* 0xef */
3547 		{{0, 3},
3548 		{5, 7},
3549 		{0, 0},
3550 		{0, 0}
3551 		}
3552 	},
3553 	{0, 1, 1, 0,		/* 0xf0 */
3554 		{{4, 7},
3555 		{0, 0},
3556 		{0, 0},
3557 		{0, 0}
3558 		}
3559 	},
3560 	{1, 1, 2, 0,		/* 0xf1 */
3561 		{{0, 0},
3562 		{4, 7},
3563 		{0, 0},
3564 		{0, 0}
3565 		}
3566 	},
3567 	{0, 1, 2, 0,		/* 0xf2 */
3568 		{{1, 1},
3569 		{4, 7},
3570 		{0, 0},
3571 		{0, 0}
3572 		}
3573 	},
3574 	{1, 1, 2, 0,		/* 0xf3 */
3575 		{{0, 1},
3576 		{4, 7},
3577 		{0, 0},
3578 		{0, 0}
3579 		}
3580 	},
3581 	{0, 1, 2, 0,		/* 0xf4 */
3582 		{{2, 2},
3583 		{4, 7},
3584 		{0, 0},
3585 		{0, 0}
3586 		}
3587 	},
3588 	{1, 1, 3, 0,		/* 0xf5 */
3589 		{{0, 0},
3590 		{2, 2},
3591 		{4, 7},
3592 		{0, 0}
3593 		}
3594 	},
3595 	{0, 1, 2, 0,		/* 0xf6 */
3596 		{{1, 2},
3597 		{4, 7},
3598 		{0, 0},
3599 		{0, 0}
3600 		}
3601 	},
3602 	{1, 1, 2, 0,		/* 0xf7 */
3603 		{{0, 2},
3604 		{4, 7},
3605 		{0, 0},
3606 		{0, 0}
3607 		}
3608 	},
3609 	{0, 1, 1, 0,		/* 0xf8 */
3610 		{{3, 7},
3611 		{0, 0},
3612 		{0, 0},
3613 		{0, 0}
3614 		}
3615 	},
3616 	{1, 1, 2, 0,		/* 0xf9 */
3617 		{{0, 0},
3618 		{3, 7},
3619 		{0, 0},
3620 		{0, 0}
3621 		}
3622 	},
3623 	{0, 1, 2, 0,		/* 0xfa */
3624 		{{1, 1},
3625 		{3, 7},
3626 		{0, 0},
3627 		{0, 0}
3628 		}
3629 	},
3630 	{1, 1, 2, 0,		/* 0xfb */
3631 		{{0, 1},
3632 		{3, 7},
3633 		{0, 0},
3634 		{0, 0}
3635 		}
3636 	},
3637 	{0, 1, 1, 0,		/* 0xfc */
3638 		{{2, 7},
3639 		{0, 0},
3640 		{0, 0},
3641 		{0, 0}
3642 		}
3643 	},
3644 	{1, 1, 2, 0,		/* 0xfd */
3645 		{{0, 0},
3646 		{2, 7},
3647 		{0, 0},
3648 		{0, 0}
3649 		}
3650 	},
3651 	{0, 1, 1, 0,		/* 0xfe */
3652 		{{1, 7},
3653 		{0, 0},
3654 		{0, 0},
3655 		{0, 0}
3656 		}
3657 	},
3658 	{1, 1, 1, 0,		/* 0xff */
3659 		{{0, 7},
3660 		{0, 0},
3661 		{0, 0},
3662 		{0, 0}
3663 		}
3664 	}
3665 };
3666 
3667 
3668 
3669 int
3670 sctp_is_address_in_scope(struct sctp_ifa *ifa,
3671     int ipv4_addr_legal,
3672     int ipv6_addr_legal,
3673     int loopback_scope,
3674     int ipv4_local_scope,
3675     int local_scope,
3676     int site_scope,
3677     int do_update)
3678 {
3679 	if ((loopback_scope == 0) &&
3680 	    (ifa->ifn_p) && SCTP_IFN_IS_IFT_LOOP(ifa->ifn_p)) {
3681 		/*
3682 		 * skip loopback if not in scope *
3683 		 */
3684 		return (0);
3685 	}
3686 	switch (ifa->address.sa.sa_family) {
3687 	case AF_INET:
3688 		if (ipv4_addr_legal) {
3689 			struct sockaddr_in *sin;
3690 
3691 			sin = (struct sockaddr_in *)&ifa->address.sin;
3692 			if (sin->sin_addr.s_addr == 0) {
3693 				/* not in scope , unspecified */
3694 				return (0);
3695 			}
3696 			if ((ipv4_local_scope == 0) &&
3697 			    (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3698 				/* private address not in scope */
3699 				return (0);
3700 			}
3701 		} else {
3702 			return (0);
3703 		}
3704 		break;
3705 #ifdef INET6
3706 	case AF_INET6:
3707 		if (ipv6_addr_legal) {
3708 			struct sockaddr_in6 *sin6;
3709 
3710 			/*
3711 			 * Must update the flags,  bummer, which means any
3712 			 * IFA locks must now be applied HERE <->
3713 			 */
3714 			if (do_update) {
3715 				sctp_gather_internal_ifa_flags(ifa);
3716 			}
3717 			if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
3718 				return (0);
3719 			}
3720 			/* ok to use deprecated addresses? */
3721 			sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
3722 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
3723 				/* skip unspecifed addresses */
3724 				return (0);
3725 			}
3726 			if (	/* (local_scope == 0) && */
3727 			    (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3728 				return (0);
3729 			}
3730 			if ((site_scope == 0) &&
3731 			    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3732 				return (0);
3733 			}
3734 		} else {
3735 			return (0);
3736 		}
3737 		break;
3738 #endif
3739 	default:
3740 		return (0);
3741 	}
3742 	return (1);
3743 }
3744 
3745 static struct mbuf *
3746 sctp_add_addr_to_mbuf(struct mbuf *m, struct sctp_ifa *ifa)
3747 {
3748 	struct sctp_paramhdr *parmh;
3749 	struct mbuf *mret;
3750 	int len;
3751 
3752 	if (ifa->address.sa.sa_family == AF_INET) {
3753 		len = sizeof(struct sctp_ipv4addr_param);
3754 	} else if (ifa->address.sa.sa_family == AF_INET6) {
3755 		len = sizeof(struct sctp_ipv6addr_param);
3756 	} else {
3757 		/* unknown type */
3758 		return (m);
3759 	}
3760 	if (M_TRAILINGSPACE(m) >= len) {
3761 		/* easy side we just drop it on the end */
3762 		parmh = (struct sctp_paramhdr *)(SCTP_BUF_AT(m, SCTP_BUF_LEN(m)));
3763 		mret = m;
3764 	} else {
3765 		/* Need more space */
3766 		mret = m;
3767 		while (SCTP_BUF_NEXT(mret) != NULL) {
3768 			mret = SCTP_BUF_NEXT(mret);
3769 		}
3770 		SCTP_BUF_NEXT(mret) = sctp_get_mbuf_for_msg(len, 0, M_DONTWAIT, 1, MT_DATA);
3771 		if (SCTP_BUF_NEXT(mret) == NULL) {
3772 			/* We are hosed, can't add more addresses */
3773 			return (m);
3774 		}
3775 		mret = SCTP_BUF_NEXT(mret);
3776 		parmh = mtod(mret, struct sctp_paramhdr *);
3777 	}
3778 	/* now add the parameter */
3779 	switch (ifa->address.sa.sa_family) {
3780 	case AF_INET:
3781 		{
3782 			struct sctp_ipv4addr_param *ipv4p;
3783 			struct sockaddr_in *sin;
3784 
3785 			sin = (struct sockaddr_in *)&ifa->address.sin;
3786 			ipv4p = (struct sctp_ipv4addr_param *)parmh;
3787 			parmh->param_type = htons(SCTP_IPV4_ADDRESS);
3788 			parmh->param_length = htons(len);
3789 			ipv4p->addr = sin->sin_addr.s_addr;
3790 			SCTP_BUF_LEN(mret) += len;
3791 			break;
3792 		}
3793 #ifdef INET6
3794 	case AF_INET6:
3795 		{
3796 			struct sctp_ipv6addr_param *ipv6p;
3797 			struct sockaddr_in6 *sin6;
3798 
3799 			sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
3800 			ipv6p = (struct sctp_ipv6addr_param *)parmh;
3801 			parmh->param_type = htons(SCTP_IPV6_ADDRESS);
3802 			parmh->param_length = htons(len);
3803 			memcpy(ipv6p->addr, &sin6->sin6_addr,
3804 			    sizeof(ipv6p->addr));
3805 			/* clear embedded scope in the address */
3806 			in6_clearscope((struct in6_addr *)ipv6p->addr);
3807 			SCTP_BUF_LEN(mret) += len;
3808 			break;
3809 		}
3810 #endif
3811 	default:
3812 		return (m);
3813 	}
3814 	return (mret);
3815 }
3816 
3817 
3818 struct mbuf *
3819 sctp_add_addresses_to_i_ia(struct sctp_inpcb *inp, struct sctp_scoping *scope,
3820     struct mbuf *m_at, int cnt_inits_to)
3821 {
3822 	struct sctp_vrf *vrf = NULL;
3823 	int cnt, limit_out = 0, total_count;
3824 	uint32_t vrf_id;
3825 
3826 	vrf_id = inp->def_vrf_id;
3827 	SCTP_IPI_ADDR_RLOCK();
3828 	vrf = sctp_find_vrf(vrf_id);
3829 	if (vrf == NULL) {
3830 		SCTP_IPI_ADDR_RUNLOCK();
3831 		return (m_at);
3832 	}
3833 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3834 		struct sctp_ifa *sctp_ifap;
3835 		struct sctp_ifn *sctp_ifnp;
3836 
3837 		cnt = cnt_inits_to;
3838 		if (vrf->total_ifa_count > SCTP_COUNT_LIMIT) {
3839 			limit_out = 1;
3840 			cnt = SCTP_ADDRESS_LIMIT;
3841 			goto skip_count;
3842 		}
3843 		LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3844 			if ((scope->loopback_scope == 0) &&
3845 			    SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) {
3846 				/*
3847 				 * Skip loopback devices if loopback_scope
3848 				 * not set
3849 				 */
3850 				continue;
3851 			}
3852 			LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3853 				if (sctp_is_address_in_scope(sctp_ifap,
3854 				    scope->ipv4_addr_legal,
3855 				    scope->ipv6_addr_legal,
3856 				    scope->loopback_scope,
3857 				    scope->ipv4_local_scope,
3858 				    scope->local_scope,
3859 				    scope->site_scope, 1) == 0) {
3860 					continue;
3861 				}
3862 				cnt++;
3863 				if (cnt > SCTP_ADDRESS_LIMIT) {
3864 					break;
3865 				}
3866 			}
3867 			if (cnt > SCTP_ADDRESS_LIMIT) {
3868 				break;
3869 			}
3870 		}
3871 skip_count:
3872 		if (cnt > 1) {
3873 			total_count = 0;
3874 			LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3875 				cnt = 0;
3876 				if ((scope->loopback_scope == 0) &&
3877 				    SCTP_IFN_IS_IFT_LOOP(sctp_ifnp)) {
3878 					/*
3879 					 * Skip loopback devices if
3880 					 * loopback_scope not set
3881 					 */
3882 					continue;
3883 				}
3884 				LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3885 					if (sctp_is_address_in_scope(sctp_ifap,
3886 					    scope->ipv4_addr_legal,
3887 					    scope->ipv6_addr_legal,
3888 					    scope->loopback_scope,
3889 					    scope->ipv4_local_scope,
3890 					    scope->local_scope,
3891 					    scope->site_scope, 0) == 0) {
3892 						continue;
3893 					}
3894 					m_at = sctp_add_addr_to_mbuf(m_at, sctp_ifap);
3895 					if (limit_out) {
3896 						cnt++;
3897 						total_count++;
3898 						if (cnt >= 2) {
3899 							/*
3900 							 * two from each
3901 							 * address
3902 							 */
3903 							break;
3904 						}
3905 						if (total_count > SCTP_ADDRESS_LIMIT) {
3906 							/* No more addresses */
3907 							break;
3908 						}
3909 					}
3910 				}
3911 			}
3912 		}
3913 	} else {
3914 		struct sctp_laddr *laddr;
3915 
3916 		cnt = cnt_inits_to;
3917 		/* First, how many ? */
3918 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3919 			if (laddr->ifa == NULL) {
3920 				continue;
3921 			}
3922 			if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3923 				/*
3924 				 * Address being deleted by the system, dont
3925 				 * list.
3926 				 */
3927 				continue;
3928 			if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3929 				/*
3930 				 * Address being deleted on this ep don't
3931 				 * list.
3932 				 */
3933 				continue;
3934 			}
3935 			if (sctp_is_address_in_scope(laddr->ifa,
3936 			    scope->ipv4_addr_legal,
3937 			    scope->ipv6_addr_legal,
3938 			    scope->loopback_scope,
3939 			    scope->ipv4_local_scope,
3940 			    scope->local_scope,
3941 			    scope->site_scope, 1) == 0) {
3942 				continue;
3943 			}
3944 			cnt++;
3945 		}
3946 		if (cnt > SCTP_ADDRESS_LIMIT) {
3947 			limit_out = 1;
3948 		}
3949 		/*
3950 		 * To get through a NAT we only list addresses if we have
3951 		 * more than one. That way if you just bind a single address
3952 		 * we let the source of the init dictate our address.
3953 		 */
3954 		if (cnt > 1) {
3955 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3956 				cnt = 0;
3957 				if (laddr->ifa == NULL) {
3958 					continue;
3959 				}
3960 				if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3961 					continue;
3962 
3963 				if (sctp_is_address_in_scope(laddr->ifa,
3964 				    scope->ipv4_addr_legal,
3965 				    scope->ipv6_addr_legal,
3966 				    scope->loopback_scope,
3967 				    scope->ipv4_local_scope,
3968 				    scope->local_scope,
3969 				    scope->site_scope, 0) == 0) {
3970 					continue;
3971 				}
3972 				m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
3973 				cnt++;
3974 				if (cnt >= SCTP_ADDRESS_LIMIT) {
3975 					break;
3976 				}
3977 			}
3978 		}
3979 	}
3980 	SCTP_IPI_ADDR_RUNLOCK();
3981 	return (m_at);
3982 }
3983 
3984 static struct sctp_ifa *
3985 sctp_is_ifa_addr_preferred(struct sctp_ifa *ifa,
3986     uint8_t dest_is_loop,
3987     uint8_t dest_is_priv,
3988     sa_family_t fam)
3989 {
3990 	uint8_t dest_is_global = 0;
3991 
3992 	/* dest_is_priv is true if destination is a private address */
3993 	/* dest_is_loop is true if destination is a loopback addresses */
3994 
3995 	/*
3996 	 * Here we determine if its a preferred address. A preferred address
3997 	 * means it is the same scope or higher scope then the destination.
3998 	 * L = loopback, P = private, G = global
3999 	 * ----------------------------------------- src    |  dest | result
4000 	 * ---------------------------------------- L     |    L  |    yes
4001 	 * ----------------------------------------- P     |    L  |
4002 	 * yes-v4 no-v6 ----------------------------------------- G     |
4003 	 * L  |    yes-v4 no-v6 ----------------------------------------- L
4004 	 * |    P  |    no ----------------------------------------- P     |
4005 	 * P  |    yes ----------------------------------------- G     |
4006 	 * P  |    no ----------------------------------------- L     |    G
4007 	 * |    no ----------------------------------------- P     |    G  |
4008 	 * no ----------------------------------------- G     |    G  |
4009 	 * yes -----------------------------------------
4010 	 */
4011 
4012 	if (ifa->address.sa.sa_family != fam) {
4013 		/* forget mis-matched family */
4014 		return (NULL);
4015 	}
4016 	if ((dest_is_priv == 0) && (dest_is_loop == 0)) {
4017 		dest_is_global = 1;
4018 	}
4019 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Is destination preferred:");
4020 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &ifa->address.sa);
4021 	/* Ok the address may be ok */
4022 	if (fam == AF_INET6) {
4023 		/* ok to use deprecated addresses? no lets not! */
4024 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
4025 			SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:1\n");
4026 			return (NULL);
4027 		}
4028 		if (ifa->src_is_priv && !ifa->src_is_loop) {
4029 			if (dest_is_loop) {
4030 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:2\n");
4031 				return (NULL);
4032 			}
4033 		}
4034 		if (ifa->src_is_glob) {
4035 			if (dest_is_loop) {
4036 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:3\n");
4037 				return (NULL);
4038 			}
4039 		}
4040 	}
4041 	/*
4042 	 * Now that we know what is what, implement or table this could in
4043 	 * theory be done slicker (it used to be), but this is
4044 	 * straightforward and easier to validate :-)
4045 	 */
4046 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "src_loop:%d src_priv:%d src_glob:%d\n",
4047 	    ifa->src_is_loop, ifa->src_is_priv, ifa->src_is_glob);
4048 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "dest_loop:%d dest_priv:%d dest_glob:%d\n",
4049 	    dest_is_loop, dest_is_priv, dest_is_global);
4050 
4051 	if ((ifa->src_is_loop) && (dest_is_priv)) {
4052 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:4\n");
4053 		return (NULL);
4054 	}
4055 	if ((ifa->src_is_glob) && (dest_is_priv)) {
4056 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:5\n");
4057 		return (NULL);
4058 	}
4059 	if ((ifa->src_is_loop) && (dest_is_global)) {
4060 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:6\n");
4061 		return (NULL);
4062 	}
4063 	if ((ifa->src_is_priv) && (dest_is_global)) {
4064 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "NO:7\n");
4065 		return (NULL);
4066 	}
4067 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "YES\n");
4068 	/* its a preferred address */
4069 	return (ifa);
4070 }
4071 
4072 static struct sctp_ifa *
4073 sctp_is_ifa_addr_acceptable(struct sctp_ifa *ifa,
4074     uint8_t dest_is_loop,
4075     uint8_t dest_is_priv,
4076     sa_family_t fam)
4077 {
4078 	uint8_t dest_is_global = 0;
4079 
4080 
4081 	/*
4082 	 * Here we determine if its a acceptable address. A acceptable
4083 	 * address means it is the same scope or higher scope but we can
4084 	 * allow for NAT which means its ok to have a global dest and a
4085 	 * private src.
4086 	 *
4087 	 * L = loopback, P = private, G = global
4088 	 * ----------------------------------------- src    |  dest | result
4089 	 * ----------------------------------------- L     |   L   |    yes
4090 	 * ----------------------------------------- P     |   L   |
4091 	 * yes-v4 no-v6 ----------------------------------------- G     |
4092 	 * L   |    yes ----------------------------------------- L     |
4093 	 * P   |    no ----------------------------------------- P     |   P
4094 	 * |    yes ----------------------------------------- G     |   P
4095 	 * |    yes - May not work -----------------------------------------
4096 	 * L     |   G   |    no ----------------------------------------- P
4097 	 * |   G   |    yes - May not work
4098 	 * ----------------------------------------- G     |   G   |    yes
4099 	 * -----------------------------------------
4100 	 */
4101 
4102 	if (ifa->address.sa.sa_family != fam) {
4103 		/* forget non matching family */
4104 		return (NULL);
4105 	}
4106 	/* Ok the address may be ok */
4107 	if ((dest_is_loop == 0) && (dest_is_priv == 0)) {
4108 		dest_is_global = 1;
4109 	}
4110 	if (fam == AF_INET6) {
4111 		/* ok to use deprecated addresses? */
4112 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
4113 			return (NULL);
4114 		}
4115 		if (ifa->src_is_priv) {
4116 			/* Special case, linklocal to loop */
4117 			if (dest_is_loop)
4118 				return (NULL);
4119 		}
4120 	}
4121 	/*
4122 	 * Now that we know what is what, implement our table. This could in
4123 	 * theory be done slicker (it used to be), but this is
4124 	 * straightforward and easier to validate :-)
4125 	 */
4126 	if ((ifa->src_is_loop == 1) && (dest_is_priv)) {
4127 		return (NULL);
4128 	}
4129 	if ((ifa->src_is_loop == 1) && (dest_is_global)) {
4130 		return (NULL);
4131 	}
4132 	/* its an acceptable address */
4133 	return (ifa);
4134 }
4135 
4136 int
4137 sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
4138 {
4139 	struct sctp_laddr *laddr;
4140 
4141 	if (stcb == NULL) {
4142 		/* There are no restrictions, no TCB :-) */
4143 		return (0);
4144 	}
4145 	LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) {
4146 		if (laddr->ifa == NULL) {
4147 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n",
4148 			    __FUNCTION__);
4149 			continue;
4150 		}
4151 		if (laddr->ifa == ifa) {
4152 			/* Yes it is on the list */
4153 			return (1);
4154 		}
4155 	}
4156 	return (0);
4157 }
4158 
4159 
4160 int
4161 sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa)
4162 {
4163 	struct sctp_laddr *laddr;
4164 
4165 	if (ifa == NULL)
4166 		return (0);
4167 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4168 		if (laddr->ifa == NULL) {
4169 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "%s: NULL ifa\n",
4170 			    __FUNCTION__);
4171 			continue;
4172 		}
4173 		if ((laddr->ifa == ifa) && laddr->action == 0)
4174 			/* same pointer */
4175 			return (1);
4176 	}
4177 	return (0);
4178 }
4179 
4180 
4181 
4182 static struct sctp_ifa *
4183 sctp_choose_boundspecific_inp(struct sctp_inpcb *inp,
4184     sctp_route_t * ro,
4185     uint32_t vrf_id,
4186     int non_asoc_addr_ok,
4187     uint8_t dest_is_priv,
4188     uint8_t dest_is_loop,
4189     sa_family_t fam)
4190 {
4191 	struct sctp_laddr *laddr, *starting_point;
4192 	void *ifn;
4193 	int resettotop = 0;
4194 	struct sctp_ifn *sctp_ifn;
4195 	struct sctp_ifa *sctp_ifa, *sifa;
4196 	struct sctp_vrf *vrf;
4197 	uint32_t ifn_index;
4198 
4199 	vrf = sctp_find_vrf(vrf_id);
4200 	if (vrf == NULL)
4201 		return (NULL);
4202 
4203 	ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
4204 	ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro);
4205 	sctp_ifn = sctp_find_ifn(ifn, ifn_index);
4206 	/*
4207 	 * first question, is the ifn we will emit on in our list, if so, we
4208 	 * want such an address. Note that we first looked for a preferred
4209 	 * address.
4210 	 */
4211 	if (sctp_ifn) {
4212 		/* is a preferred one on the interface we route out? */
4213 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
4214 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
4215 			    (non_asoc_addr_ok == 0))
4216 				continue;
4217 			sifa = sctp_is_ifa_addr_preferred(sctp_ifa,
4218 			    dest_is_loop,
4219 			    dest_is_priv, fam);
4220 			if (sifa == NULL)
4221 				continue;
4222 			if (sctp_is_addr_in_ep(inp, sifa)) {
4223 				atomic_add_int(&sifa->refcount, 1);
4224 				return (sifa);
4225 			}
4226 		}
4227 	}
4228 	/*
4229 	 * ok, now we now need to find one on the list of the addresses. We
4230 	 * can't get one on the emitting interface so let's find first a
4231 	 * preferred one. If not that an acceptable one otherwise... we
4232 	 * return NULL.
4233 	 */
4234 	starting_point = inp->next_addr_touse;
4235 once_again:
4236 	if (inp->next_addr_touse == NULL) {
4237 		inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list);
4238 		resettotop = 1;
4239 	}
4240 	for (laddr = inp->next_addr_touse; laddr;
4241 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
4242 		if (laddr->ifa == NULL) {
4243 			/* address has been removed */
4244 			continue;
4245 		}
4246 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
4247 			/* address is being deleted */
4248 			continue;
4249 		}
4250 		sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop,
4251 		    dest_is_priv, fam);
4252 		if (sifa == NULL)
4253 			continue;
4254 		atomic_add_int(&sifa->refcount, 1);
4255 		return (sifa);
4256 	}
4257 	if (resettotop == 0) {
4258 		inp->next_addr_touse = NULL;
4259 		goto once_again;
4260 	}
4261 	inp->next_addr_touse = starting_point;
4262 	resettotop = 0;
4263 once_again_too:
4264 	if (inp->next_addr_touse == NULL) {
4265 		inp->next_addr_touse = LIST_FIRST(&inp->sctp_addr_list);
4266 		resettotop = 1;
4267 	}
4268 	/* ok, what about an acceptable address in the inp */
4269 	for (laddr = inp->next_addr_touse; laddr;
4270 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
4271 		if (laddr->ifa == NULL) {
4272 			/* address has been removed */
4273 			continue;
4274 		}
4275 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
4276 			/* address is being deleted */
4277 			continue;
4278 		}
4279 		sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop,
4280 		    dest_is_priv, fam);
4281 		if (sifa == NULL)
4282 			continue;
4283 		atomic_add_int(&sifa->refcount, 1);
4284 		return (sifa);
4285 	}
4286 	if (resettotop == 0) {
4287 		inp->next_addr_touse = NULL;
4288 		goto once_again_too;
4289 	}
4290 	/*
4291 	 * no address bound can be a source for the destination we are in
4292 	 * trouble
4293 	 */
4294 	return (NULL);
4295 }
4296 
4297 
4298 
4299 static struct sctp_ifa *
4300 sctp_choose_boundspecific_stcb(struct sctp_inpcb *inp,
4301     struct sctp_tcb *stcb,
4302     struct sctp_nets *net,
4303     sctp_route_t * ro,
4304     uint32_t vrf_id,
4305     uint8_t dest_is_priv,
4306     uint8_t dest_is_loop,
4307     int non_asoc_addr_ok,
4308     sa_family_t fam)
4309 {
4310 	struct sctp_laddr *laddr, *starting_point;
4311 	void *ifn;
4312 	struct sctp_ifn *sctp_ifn;
4313 	struct sctp_ifa *sctp_ifa, *sifa;
4314 	uint8_t start_at_beginning = 0;
4315 	struct sctp_vrf *vrf;
4316 	uint32_t ifn_index;
4317 
4318 	/*
4319 	 * first question, is the ifn we will emit on in our list, if so, we
4320 	 * want that one.
4321 	 */
4322 	vrf = sctp_find_vrf(vrf_id);
4323 	if (vrf == NULL)
4324 		return (NULL);
4325 
4326 	ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
4327 	ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro);
4328 	sctp_ifn = sctp_find_ifn(ifn, ifn_index);
4329 
4330 	/*
4331 	 * first question, is the ifn we will emit on in our list?  If so,
4332 	 * we want that one. First we look for a preferred. Second, we go
4333 	 * for an acceptable.
4334 	 */
4335 	if (sctp_ifn) {
4336 		/* first try for a preferred address on the ep */
4337 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
4338 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0))
4339 				continue;
4340 			if (sctp_is_addr_in_ep(inp, sctp_ifa)) {
4341 				sifa = sctp_is_ifa_addr_preferred(sctp_ifa, dest_is_loop, dest_is_priv, fam);
4342 				if (sifa == NULL)
4343 					continue;
4344 				if (((non_asoc_addr_ok == 0) &&
4345 				    (sctp_is_addr_restricted(stcb, sifa))) ||
4346 				    (non_asoc_addr_ok &&
4347 				    (sctp_is_addr_restricted(stcb, sifa)) &&
4348 				    (!sctp_is_addr_pending(stcb, sifa)))) {
4349 					/* on the no-no list */
4350 					continue;
4351 				}
4352 				atomic_add_int(&sifa->refcount, 1);
4353 				return (sifa);
4354 			}
4355 		}
4356 		/* next try for an acceptable address on the ep */
4357 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
4358 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) && (non_asoc_addr_ok == 0))
4359 				continue;
4360 			if (sctp_is_addr_in_ep(inp, sctp_ifa)) {
4361 				sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop, dest_is_priv, fam);
4362 				if (sifa == NULL)
4363 					continue;
4364 				if (((non_asoc_addr_ok == 0) &&
4365 				    (sctp_is_addr_restricted(stcb, sifa))) ||
4366 				    (non_asoc_addr_ok &&
4367 				    (sctp_is_addr_restricted(stcb, sifa)) &&
4368 				    (!sctp_is_addr_pending(stcb, sifa)))) {
4369 					/* on the no-no list */
4370 					continue;
4371 				}
4372 				atomic_add_int(&sifa->refcount, 1);
4373 				return (sifa);
4374 			}
4375 		}
4376 
4377 	}
4378 	/*
4379 	 * if we can't find one like that then we must look at all addresses
4380 	 * bound to pick one at first preferable then secondly acceptable.
4381 	 */
4382 	starting_point = stcb->asoc.last_used_address;
4383 sctp_from_the_top:
4384 	if (stcb->asoc.last_used_address == NULL) {
4385 		start_at_beginning = 1;
4386 		stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
4387 	}
4388 	/* search beginning with the last used address */
4389 	for (laddr = stcb->asoc.last_used_address; laddr;
4390 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
4391 		if (laddr->ifa == NULL) {
4392 			/* address has been removed */
4393 			continue;
4394 		}
4395 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
4396 			/* address is being deleted */
4397 			continue;
4398 		}
4399 		sifa = sctp_is_ifa_addr_preferred(laddr->ifa, dest_is_loop, dest_is_priv, fam);
4400 		if (sifa == NULL)
4401 			continue;
4402 		if (((non_asoc_addr_ok == 0) &&
4403 		    (sctp_is_addr_restricted(stcb, sifa))) ||
4404 		    (non_asoc_addr_ok &&
4405 		    (sctp_is_addr_restricted(stcb, sifa)) &&
4406 		    (!sctp_is_addr_pending(stcb, sifa)))) {
4407 			/* on the no-no list */
4408 			continue;
4409 		}
4410 		stcb->asoc.last_used_address = laddr;
4411 		atomic_add_int(&sifa->refcount, 1);
4412 		return (sifa);
4413 	}
4414 	if (start_at_beginning == 0) {
4415 		stcb->asoc.last_used_address = NULL;
4416 		goto sctp_from_the_top;
4417 	}
4418 	/* now try for any higher scope than the destination */
4419 	stcb->asoc.last_used_address = starting_point;
4420 	start_at_beginning = 0;
4421 sctp_from_the_top2:
4422 	if (stcb->asoc.last_used_address == NULL) {
4423 		start_at_beginning = 1;
4424 		stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
4425 	}
4426 	/* search beginning with the last used address */
4427 	for (laddr = stcb->asoc.last_used_address; laddr;
4428 	    laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
4429 		if (laddr->ifa == NULL) {
4430 			/* address has been removed */
4431 			continue;
4432 		}
4433 		if (laddr->action == SCTP_DEL_IP_ADDRESS) {
4434 			/* address is being deleted */
4435 			continue;
4436 		}
4437 		sifa = sctp_is_ifa_addr_acceptable(laddr->ifa, dest_is_loop,
4438 		    dest_is_priv, fam);
4439 		if (sifa == NULL)
4440 			continue;
4441 		if (((non_asoc_addr_ok == 0) &&
4442 		    (sctp_is_addr_restricted(stcb, sifa))) ||
4443 		    (non_asoc_addr_ok &&
4444 		    (sctp_is_addr_restricted(stcb, sifa)) &&
4445 		    (!sctp_is_addr_pending(stcb, sifa)))) {
4446 			/* on the no-no list */
4447 			continue;
4448 		}
4449 		stcb->asoc.last_used_address = laddr;
4450 		atomic_add_int(&sifa->refcount, 1);
4451 		return (sifa);
4452 	}
4453 	if (start_at_beginning == 0) {
4454 		stcb->asoc.last_used_address = NULL;
4455 		goto sctp_from_the_top2;
4456 	}
4457 	return (NULL);
4458 }
4459 
4460 static struct sctp_ifa *
4461 sctp_select_nth_preferred_addr_from_ifn_boundall(struct sctp_ifn *ifn,
4462     struct sctp_tcb *stcb,
4463     int non_asoc_addr_ok,
4464     uint8_t dest_is_loop,
4465     uint8_t dest_is_priv,
4466     int addr_wanted,
4467     sa_family_t fam,
4468     sctp_route_t * ro
4469 )
4470 {
4471 	struct sctp_ifa *ifa, *sifa;
4472 	int num_eligible_addr = 0;
4473 
4474 #ifdef INET6
4475 	struct sockaddr_in6 sin6, lsa6;
4476 
4477 	if (fam == AF_INET6) {
4478 		memcpy(&sin6, &ro->ro_dst, sizeof(struct sockaddr_in6));
4479 		(void)sa6_recoverscope(&sin6);
4480 	}
4481 #endif				/* INET6 */
4482 	LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) {
4483 		if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
4484 		    (non_asoc_addr_ok == 0))
4485 			continue;
4486 		sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop,
4487 		    dest_is_priv, fam);
4488 		if (sifa == NULL)
4489 			continue;
4490 #ifdef INET6
4491 		if (fam == AF_INET6 &&
4492 		    dest_is_loop &&
4493 		    sifa->src_is_loop && sifa->src_is_priv) {
4494 			/*
4495 			 * don't allow fe80::1 to be a src on loop ::1, we
4496 			 * don't list it to the peer so we will get an
4497 			 * abort.
4498 			 */
4499 			continue;
4500 		}
4501 		if (fam == AF_INET6 &&
4502 		    IN6_IS_ADDR_LINKLOCAL(&sifa->address.sin6.sin6_addr) &&
4503 		    IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) {
4504 			/*
4505 			 * link-local <-> link-local must belong to the same
4506 			 * scope.
4507 			 */
4508 			memcpy(&lsa6, &sifa->address.sin6, sizeof(struct sockaddr_in6));
4509 			(void)sa6_recoverscope(&lsa6);
4510 			if (sin6.sin6_scope_id != lsa6.sin6_scope_id) {
4511 				continue;
4512 			}
4513 		}
4514 #endif				/* INET6 */
4515 
4516 		/*
4517 		 * Check if the IPv6 address matches to next-hop. In the
4518 		 * mobile case, old IPv6 address may be not deleted from the
4519 		 * interface. Then, the interface has previous and new
4520 		 * addresses.  We should use one corresponding to the
4521 		 * next-hop.  (by micchie)
4522 		 */
4523 #ifdef INET6
4524 		if (stcb && fam == AF_INET6 &&
4525 		    sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) {
4526 			if (sctp_v6src_match_nexthop(&sifa->address.sin6, ro)
4527 			    == 0) {
4528 				continue;
4529 			}
4530 		}
4531 #endif
4532 		/* Avoid topologically incorrect IPv4 address */
4533 		if (stcb && fam == AF_INET &&
4534 		    sctp_is_mobility_feature_on(stcb->sctp_ep, SCTP_MOBILITY_BASE)) {
4535 			if (sctp_v4src_match_nexthop(sifa, ro) == 0) {
4536 				continue;
4537 			}
4538 		}
4539 		if (stcb) {
4540 			if (((non_asoc_addr_ok == 0) &&
4541 			    (sctp_is_addr_restricted(stcb, sifa))) ||
4542 			    (non_asoc_addr_ok &&
4543 			    (sctp_is_addr_restricted(stcb, sifa)) &&
4544 			    (!sctp_is_addr_pending(stcb, sifa)))) {
4545 				/*
4546 				 * It is restricted for some reason..
4547 				 * probably not yet added.
4548 				 */
4549 				continue;
4550 			}
4551 		}
4552 		if (num_eligible_addr >= addr_wanted) {
4553 			return (sifa);
4554 		}
4555 		num_eligible_addr++;
4556 	}
4557 	return (NULL);
4558 }
4559 
4560 
4561 static int
4562 sctp_count_num_preferred_boundall(struct sctp_ifn *ifn,
4563     struct sctp_tcb *stcb,
4564     int non_asoc_addr_ok,
4565     uint8_t dest_is_loop,
4566     uint8_t dest_is_priv,
4567     sa_family_t fam)
4568 {
4569 	struct sctp_ifa *ifa, *sifa;
4570 	int num_eligible_addr = 0;
4571 
4572 	LIST_FOREACH(ifa, &ifn->ifalist, next_ifa) {
4573 		if ((ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
4574 		    (non_asoc_addr_ok == 0)) {
4575 			continue;
4576 		}
4577 		sifa = sctp_is_ifa_addr_preferred(ifa, dest_is_loop,
4578 		    dest_is_priv, fam);
4579 		if (sifa == NULL) {
4580 			continue;
4581 		}
4582 		if (stcb) {
4583 			if (((non_asoc_addr_ok == 0) &&
4584 			    (sctp_is_addr_restricted(stcb, sifa))) ||
4585 			    (non_asoc_addr_ok &&
4586 			    (sctp_is_addr_restricted(stcb, sifa)) &&
4587 			    (!sctp_is_addr_pending(stcb, sifa)))) {
4588 				/*
4589 				 * It is restricted for some reason..
4590 				 * probably not yet added.
4591 				 */
4592 				continue;
4593 			}
4594 		}
4595 		num_eligible_addr++;
4596 	}
4597 	return (num_eligible_addr);
4598 }
4599 
4600 static struct sctp_ifa *
4601 sctp_choose_boundall(struct sctp_inpcb *inp,
4602     struct sctp_tcb *stcb,
4603     struct sctp_nets *net,
4604     sctp_route_t * ro,
4605     uint32_t vrf_id,
4606     uint8_t dest_is_priv,
4607     uint8_t dest_is_loop,
4608     int non_asoc_addr_ok,
4609     sa_family_t fam)
4610 {
4611 	int cur_addr_num = 0, num_preferred = 0;
4612 	void *ifn;
4613 	struct sctp_ifn *sctp_ifn, *looked_at = NULL, *emit_ifn;
4614 	struct sctp_ifa *sctp_ifa, *sifa;
4615 	uint32_t ifn_index;
4616 	struct sctp_vrf *vrf;
4617 
4618 	/*-
4619 	 * For boundall we can use any address in the association.
4620 	 * If non_asoc_addr_ok is set we can use any address (at least in
4621 	 * theory). So we look for preferred addresses first. If we find one,
4622 	 * we use it. Otherwise we next try to get an address on the
4623 	 * interface, which we should be able to do (unless non_asoc_addr_ok
4624 	 * is false and we are routed out that way). In these cases where we
4625 	 * can't use the address of the interface we go through all the
4626 	 * ifn's looking for an address we can use and fill that in. Punting
4627 	 * means we send back address 0, which will probably cause problems
4628 	 * actually since then IP will fill in the address of the route ifn,
4629 	 * which means we probably already rejected it.. i.e. here comes an
4630 	 * abort :-<.
4631 	 */
4632 	vrf = sctp_find_vrf(vrf_id);
4633 	if (vrf == NULL)
4634 		return (NULL);
4635 
4636 	ifn = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
4637 	ifn_index = SCTP_GET_IF_INDEX_FROM_ROUTE(ro);
4638 	emit_ifn = looked_at = sctp_ifn = sctp_find_ifn(ifn, ifn_index);
4639 	if (sctp_ifn == NULL) {
4640 		/* ?? We don't have this guy ?? */
4641 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "No ifn emit interface?\n");
4642 		goto bound_all_plan_b;
4643 	}
4644 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "ifn_index:%d name:%s is emit interface\n",
4645 	    ifn_index, sctp_ifn->ifn_name);
4646 
4647 	if (net) {
4648 		cur_addr_num = net->indx_of_eligible_next_to_use;
4649 	}
4650 	num_preferred = sctp_count_num_preferred_boundall(sctp_ifn,
4651 	    stcb,
4652 	    non_asoc_addr_ok,
4653 	    dest_is_loop,
4654 	    dest_is_priv, fam);
4655 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Found %d preferred source addresses for intf:%s\n",
4656 	    num_preferred, sctp_ifn->ifn_name);
4657 	if (num_preferred == 0) {
4658 		/*
4659 		 * no eligible addresses, we must use some other interface
4660 		 * address if we can find one.
4661 		 */
4662 		goto bound_all_plan_b;
4663 	}
4664 	/*
4665 	 * Ok we have num_eligible_addr set with how many we can use, this
4666 	 * may vary from call to call due to addresses being deprecated
4667 	 * etc..
4668 	 */
4669 	if (cur_addr_num >= num_preferred) {
4670 		cur_addr_num = 0;
4671 	}
4672 	/*
4673 	 * select the nth address from the list (where cur_addr_num is the
4674 	 * nth) and 0 is the first one, 1 is the second one etc...
4675 	 */
4676 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "cur_addr_num:%d\n", cur_addr_num);
4677 
4678 	sctp_ifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, stcb, non_asoc_addr_ok, dest_is_loop,
4679 	    dest_is_priv, cur_addr_num, fam, ro);
4680 
4681 	/* if sctp_ifa is NULL something changed??, fall to plan b. */
4682 	if (sctp_ifa) {
4683 		atomic_add_int(&sctp_ifa->refcount, 1);
4684 		if (net) {
4685 			/* save off where the next one we will want */
4686 			net->indx_of_eligible_next_to_use = cur_addr_num + 1;
4687 		}
4688 		return (sctp_ifa);
4689 	}
4690 	/*
4691 	 * plan_b: Look at all interfaces and find a preferred address. If
4692 	 * no preferred fall through to plan_c.
4693 	 */
4694 bound_all_plan_b:
4695 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan B\n");
4696 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
4697 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "Examine interface %s\n",
4698 		    sctp_ifn->ifn_name);
4699 		if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
4700 			/* wrong base scope */
4701 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "skip\n");
4702 			continue;
4703 		}
4704 		if ((sctp_ifn == looked_at) && looked_at) {
4705 			/* already looked at this guy */
4706 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "already seen\n");
4707 			continue;
4708 		}
4709 		num_preferred = sctp_count_num_preferred_boundall(sctp_ifn, stcb, non_asoc_addr_ok,
4710 		    dest_is_loop, dest_is_priv, fam);
4711 		SCTPDBG(SCTP_DEBUG_OUTPUT2,
4712 		    "Found ifn:%p %d preferred source addresses\n",
4713 		    ifn, num_preferred);
4714 		if (num_preferred == 0) {
4715 			/* None on this interface. */
4716 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefered -- skipping to next\n");
4717 			continue;
4718 		}
4719 		SCTPDBG(SCTP_DEBUG_OUTPUT2,
4720 		    "num preferred:%d on interface:%p cur_addr_num:%d\n",
4721 		    num_preferred, sctp_ifn, cur_addr_num);
4722 
4723 		/*
4724 		 * Ok we have num_eligible_addr set with how many we can
4725 		 * use, this may vary from call to call due to addresses
4726 		 * being deprecated etc..
4727 		 */
4728 		if (cur_addr_num >= num_preferred) {
4729 			cur_addr_num = 0;
4730 		}
4731 		sifa = sctp_select_nth_preferred_addr_from_ifn_boundall(sctp_ifn, stcb, non_asoc_addr_ok, dest_is_loop,
4732 		    dest_is_priv, cur_addr_num, fam, ro);
4733 		if (sifa == NULL)
4734 			continue;
4735 		if (net) {
4736 			net->indx_of_eligible_next_to_use = cur_addr_num + 1;
4737 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "we selected %d\n",
4738 			    cur_addr_num);
4739 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "Source:");
4740 			SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa);
4741 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "Dest:");
4742 			SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &net->ro._l_addr.sa);
4743 		}
4744 		atomic_add_int(&sifa->refcount, 1);
4745 		return (sifa);
4746 
4747 	}
4748 
4749 	/* plan_c: do we have an acceptable address on the emit interface */
4750 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan C: find acceptable on interface\n");
4751 	if (emit_ifn == NULL) {
4752 		goto plan_d;
4753 	}
4754 	LIST_FOREACH(sctp_ifa, &emit_ifn->ifalist, next_ifa) {
4755 		if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
4756 		    (non_asoc_addr_ok == 0))
4757 			continue;
4758 		sifa = sctp_is_ifa_addr_acceptable(sctp_ifa, dest_is_loop,
4759 		    dest_is_priv, fam);
4760 		if (sifa == NULL)
4761 			continue;
4762 		if (stcb) {
4763 			if (((non_asoc_addr_ok == 0) &&
4764 			    (sctp_is_addr_restricted(stcb, sifa))) ||
4765 			    (non_asoc_addr_ok &&
4766 			    (sctp_is_addr_restricted(stcb, sifa)) &&
4767 			    (!sctp_is_addr_pending(stcb, sifa)))) {
4768 				/*
4769 				 * It is restricted for some reason..
4770 				 * probably not yet added.
4771 				 */
4772 				continue;
4773 			}
4774 		}
4775 		atomic_add_int(&sifa->refcount, 1);
4776 		return (sifa);
4777 	}
4778 plan_d:
4779 	/*
4780 	 * plan_d: We are in trouble. No preferred address on the emit
4781 	 * interface. And not even a preferred address on all interfaces. Go
4782 	 * out and see if we can find an acceptable address somewhere
4783 	 * amongst all interfaces.
4784 	 */
4785 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Trying Plan D\n");
4786 	LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
4787 		if (dest_is_loop == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
4788 			/* wrong base scope */
4789 			continue;
4790 		}
4791 		if ((sctp_ifn == looked_at) && looked_at)
4792 			/* already looked at this guy */
4793 			continue;
4794 
4795 		LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
4796 			if ((sctp_ifa->localifa_flags & SCTP_ADDR_DEFER_USE) &&
4797 			    (non_asoc_addr_ok == 0))
4798 				continue;
4799 			sifa = sctp_is_ifa_addr_acceptable(sctp_ifa,
4800 			    dest_is_loop,
4801 			    dest_is_priv, fam);
4802 			if (sifa == NULL)
4803 				continue;
4804 			if (stcb) {
4805 				if (((non_asoc_addr_ok == 0) &&
4806 				    (sctp_is_addr_restricted(stcb, sifa))) ||
4807 				    (non_asoc_addr_ok &&
4808 				    (sctp_is_addr_restricted(stcb, sifa)) &&
4809 				    (!sctp_is_addr_pending(stcb, sifa)))) {
4810 					/*
4811 					 * It is restricted for some
4812 					 * reason.. probably not yet added.
4813 					 */
4814 					continue;
4815 				}
4816 			}
4817 			atomic_add_int(&sifa->refcount, 1);
4818 			return (sifa);
4819 		}
4820 	}
4821 	/*
4822 	 * Ok we can find NO address to source from that is not on our
4823 	 * restricted list and non_asoc_address is NOT ok, or it is on our
4824 	 * restricted list. We can't source to it :-(
4825 	 */
4826 	return (NULL);
4827 }
4828 
4829 
4830 
4831 /* tcb may be NULL */
4832 struct sctp_ifa *
4833 sctp_source_address_selection(struct sctp_inpcb *inp,
4834     struct sctp_tcb *stcb,
4835     sctp_route_t * ro,
4836     struct sctp_nets *net,
4837     int non_asoc_addr_ok, uint32_t vrf_id)
4838 {
4839 	struct sockaddr_in *to = (struct sockaddr_in *)&ro->ro_dst;
4840 
4841 #ifdef INET6
4842 	struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&ro->ro_dst;
4843 
4844 #endif
4845 	struct sctp_ifa *answer;
4846 	uint8_t dest_is_priv, dest_is_loop;
4847 	sa_family_t fam;
4848 
4849 	/*-
4850 	 * Rules: - Find the route if needed, cache if I can. - Look at
4851 	 * interface address in route, Is it in the bound list. If so we
4852 	 * have the best source. - If not we must rotate amongst the
4853 	 * addresses.
4854 	 *
4855 	 * Cavets and issues
4856 	 *
4857 	 * Do we need to pay attention to scope. We can have a private address
4858 	 * or a global address we are sourcing or sending to. So if we draw
4859 	 * it out
4860 	 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
4861 	 * For V4
4862          *------------------------------------------
4863 	 *      source     *      dest  *  result
4864 	 * -----------------------------------------
4865 	 * <a>  Private    *    Global  *  NAT
4866 	 * -----------------------------------------
4867 	 * <b>  Private    *    Private *  No problem
4868 	 * -----------------------------------------
4869          * <c>  Global     *    Private *  Huh, How will this work?
4870 	 * -----------------------------------------
4871          * <d>  Global     *    Global  *  No Problem
4872          *------------------------------------------
4873 	 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
4874 	 * For V6
4875          *------------------------------------------
4876 	 *      source     *      dest  *  result
4877 	 * -----------------------------------------
4878 	 * <a>  Linklocal  *    Global  *
4879 	 * -----------------------------------------
4880 	 * <b>  Linklocal  * Linklocal  *  No problem
4881 	 * -----------------------------------------
4882          * <c>  Global     * Linklocal  *  Huh, How will this work?
4883 	 * -----------------------------------------
4884          * <d>  Global     *    Global  *  No Problem
4885          *------------------------------------------
4886 	 * zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
4887          *
4888 	 * And then we add to that what happens if there are multiple addresses
4889 	 * assigned to an interface. Remember the ifa on a ifn is a linked
4890 	 * list of addresses. So one interface can have more than one IP
4891 	 * address. What happens if we have both a private and a global
4892 	 * address? Do we then use context of destination to sort out which
4893 	 * one is best? And what about NAT's sending P->G may get you a NAT
4894 	 * translation, or should you select the G thats on the interface in
4895 	 * preference.
4896 	 *
4897 	 * Decisions:
4898 	 *
4899 	 * - count the number of addresses on the interface.
4900          * - if it is one, no problem except case <c>.
4901          *   For <a> we will assume a NAT out there.
4902 	 * - if there are more than one, then we need to worry about scope P
4903 	 *   or G. We should prefer G -> G and P -> P if possible.
4904 	 *   Then as a secondary fall back to mixed types G->P being a last
4905 	 *   ditch one.
4906          * - The above all works for bound all, but bound specific we need to
4907 	 *   use the same concept but instead only consider the bound
4908 	 *   addresses. If the bound set is NOT assigned to the interface then
4909 	 *   we must use rotation amongst the bound addresses..
4910 	 */
4911 	if (ro->ro_rt == NULL) {
4912 		/*
4913 		 * Need a route to cache.
4914 		 */
4915 		SCTP_RTALLOC(ro, vrf_id);
4916 	}
4917 	if (ro->ro_rt == NULL) {
4918 		return (NULL);
4919 	}
4920 	fam = to->sin_family;
4921 	dest_is_priv = dest_is_loop = 0;
4922 	/* Setup our scopes for the destination */
4923 	switch (fam) {
4924 	case AF_INET:
4925 		/* Scope based on outbound address */
4926 		if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
4927 			dest_is_loop = 1;
4928 			if (net != NULL) {
4929 				/* mark it as local */
4930 				net->addr_is_local = 1;
4931 			}
4932 		} else if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
4933 			dest_is_priv = 1;
4934 		}
4935 		break;
4936 #ifdef INET6
4937 	case AF_INET6:
4938 		/* Scope based on outbound address */
4939 		if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr) ||
4940 		    SCTP_ROUTE_IS_REAL_LOOP(ro)) {
4941 			/*
4942 			 * If the address is a loopback address, which
4943 			 * consists of "::1" OR "fe80::1%lo0", we are
4944 			 * loopback scope. But we don't use dest_is_priv
4945 			 * (link local addresses).
4946 			 */
4947 			dest_is_loop = 1;
4948 			if (net != NULL) {
4949 				/* mark it as local */
4950 				net->addr_is_local = 1;
4951 			}
4952 		} else if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
4953 			dest_is_priv = 1;
4954 		}
4955 		break;
4956 #endif
4957 	}
4958 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "Select source addr for:");
4959 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)to);
4960 	SCTP_IPI_ADDR_RLOCK();
4961 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
4962 		/*
4963 		 * Bound all case
4964 		 */
4965 		answer = sctp_choose_boundall(inp, stcb, net, ro, vrf_id,
4966 		    dest_is_priv, dest_is_loop,
4967 		    non_asoc_addr_ok, fam);
4968 		SCTP_IPI_ADDR_RUNLOCK();
4969 		return (answer);
4970 	}
4971 	/*
4972 	 * Subset bound case
4973 	 */
4974 	if (stcb) {
4975 		answer = sctp_choose_boundspecific_stcb(inp, stcb, net, ro,
4976 		    vrf_id, dest_is_priv,
4977 		    dest_is_loop,
4978 		    non_asoc_addr_ok, fam);
4979 	} else {
4980 		answer = sctp_choose_boundspecific_inp(inp, ro, vrf_id,
4981 		    non_asoc_addr_ok,
4982 		    dest_is_priv,
4983 		    dest_is_loop, fam);
4984 	}
4985 	SCTP_IPI_ADDR_RUNLOCK();
4986 	return (answer);
4987 }
4988 
4989 static int
4990 sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
4991 {
4992 	struct cmsghdr cmh;
4993 	int tlen, at;
4994 
4995 	tlen = SCTP_BUF_LEN(control);
4996 	at = 0;
4997 	/*
4998 	 * Independent of how many mbufs, find the c_type inside the control
4999 	 * structure and copy out the data.
5000 	 */
5001 	while (at < tlen) {
5002 		if ((tlen - at) < (int)CMSG_ALIGN(sizeof(cmh))) {
5003 			/* not enough room for one more we are done. */
5004 			return (0);
5005 		}
5006 		m_copydata(control, at, sizeof(cmh), (caddr_t)&cmh);
5007 		if (((int)cmh.cmsg_len + at) > tlen) {
5008 			/*
5009 			 * this is real messed up since there is not enough
5010 			 * data here to cover the cmsg header. We are done.
5011 			 */
5012 			return (0);
5013 		}
5014 		if ((cmh.cmsg_level == IPPROTO_SCTP) &&
5015 		    (c_type == cmh.cmsg_type)) {
5016 			/* found the one we want, copy it out */
5017 			at += CMSG_ALIGN(sizeof(struct cmsghdr));
5018 			if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
5019 				/*
5020 				 * space of cmsg_len after header not big
5021 				 * enough
5022 				 */
5023 				return (0);
5024 			}
5025 			m_copydata(control, at, cpsize, data);
5026 			return (1);
5027 		} else {
5028 			at += CMSG_ALIGN(cmh.cmsg_len);
5029 			if (cmh.cmsg_len == 0) {
5030 				break;
5031 			}
5032 		}
5033 	}
5034 	/* not found */
5035 	return (0);
5036 }
5037 
5038 static struct mbuf *
5039 sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
5040     struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in, uint8_t ** signature)
5041 {
5042 	struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
5043 	struct sctp_state_cookie *stc;
5044 	struct sctp_paramhdr *ph;
5045 	uint8_t *foo;
5046 	int sig_offset;
5047 	uint16_t cookie_sz;
5048 
5049 	mret = NULL;
5050 	mret = sctp_get_mbuf_for_msg((sizeof(struct sctp_state_cookie) +
5051 	    sizeof(struct sctp_paramhdr)), 0,
5052 	    M_DONTWAIT, 1, MT_DATA);
5053 	if (mret == NULL) {
5054 		return (NULL);
5055 	}
5056 	copy_init = SCTP_M_COPYM(init, init_offset, M_COPYALL, M_DONTWAIT);
5057 	if (copy_init == NULL) {
5058 		sctp_m_freem(mret);
5059 		return (NULL);
5060 	}
5061 #ifdef SCTP_MBUF_LOGGING
5062 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5063 		struct mbuf *mat;
5064 
5065 		mat = copy_init;
5066 		while (mat) {
5067 			if (SCTP_BUF_IS_EXTENDED(mat)) {
5068 				sctp_log_mb(mat, SCTP_MBUF_ICOPY);
5069 			}
5070 			mat = SCTP_BUF_NEXT(mat);
5071 		}
5072 	}
5073 #endif
5074 	copy_initack = SCTP_M_COPYM(initack, initack_offset, M_COPYALL,
5075 	    M_DONTWAIT);
5076 	if (copy_initack == NULL) {
5077 		sctp_m_freem(mret);
5078 		sctp_m_freem(copy_init);
5079 		return (NULL);
5080 	}
5081 #ifdef SCTP_MBUF_LOGGING
5082 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5083 		struct mbuf *mat;
5084 
5085 		mat = copy_initack;
5086 		while (mat) {
5087 			if (SCTP_BUF_IS_EXTENDED(mat)) {
5088 				sctp_log_mb(mat, SCTP_MBUF_ICOPY);
5089 			}
5090 			mat = SCTP_BUF_NEXT(mat);
5091 		}
5092 	}
5093 #endif
5094 	/* easy side we just drop it on the end */
5095 	ph = mtod(mret, struct sctp_paramhdr *);
5096 	SCTP_BUF_LEN(mret) = sizeof(struct sctp_state_cookie) +
5097 	    sizeof(struct sctp_paramhdr);
5098 	stc = (struct sctp_state_cookie *)((caddr_t)ph +
5099 	    sizeof(struct sctp_paramhdr));
5100 	ph->param_type = htons(SCTP_STATE_COOKIE);
5101 	ph->param_length = 0;	/* fill in at the end */
5102 	/* Fill in the stc cookie data */
5103 	memcpy(stc, stc_in, sizeof(struct sctp_state_cookie));
5104 
5105 	/* tack the INIT and then the INIT-ACK onto the chain */
5106 	cookie_sz = 0;
5107 	m_at = mret;
5108 	for (m_at = mret; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
5109 		cookie_sz += SCTP_BUF_LEN(m_at);
5110 		if (SCTP_BUF_NEXT(m_at) == NULL) {
5111 			SCTP_BUF_NEXT(m_at) = copy_init;
5112 			break;
5113 		}
5114 	}
5115 
5116 	for (m_at = copy_init; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
5117 		cookie_sz += SCTP_BUF_LEN(m_at);
5118 		if (SCTP_BUF_NEXT(m_at) == NULL) {
5119 			SCTP_BUF_NEXT(m_at) = copy_initack;
5120 			break;
5121 		}
5122 	}
5123 
5124 	for (m_at = copy_initack; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
5125 		cookie_sz += SCTP_BUF_LEN(m_at);
5126 		if (SCTP_BUF_NEXT(m_at) == NULL) {
5127 			break;
5128 		}
5129 	}
5130 	sig = sctp_get_mbuf_for_msg(SCTP_SECRET_SIZE, 0, M_DONTWAIT, 1, MT_DATA);
5131 	if (sig == NULL) {
5132 		/* no space, so free the entire chain */
5133 		sctp_m_freem(mret);
5134 		return (NULL);
5135 	}
5136 	SCTP_BUF_LEN(sig) = 0;
5137 	SCTP_BUF_NEXT(m_at) = sig;
5138 	sig_offset = 0;
5139 	foo = (uint8_t *) (mtod(sig, caddr_t)+sig_offset);
5140 	memset(foo, 0, SCTP_SIGNATURE_SIZE);
5141 	*signature = foo;
5142 	SCTP_BUF_LEN(sig) += SCTP_SIGNATURE_SIZE;
5143 	cookie_sz += SCTP_SIGNATURE_SIZE;
5144 	ph->param_length = htons(cookie_sz);
5145 	return (mret);
5146 }
5147 
5148 
5149 static uint8_t
5150 sctp_get_ect(struct sctp_tcb *stcb,
5151     struct sctp_tmit_chunk *chk)
5152 {
5153 	uint8_t this_random;
5154 
5155 	/* Huh? */
5156 	if (SCTP_BASE_SYSCTL(sctp_ecn_enable) == 0)
5157 		return (0);
5158 
5159 	if (SCTP_BASE_SYSCTL(sctp_ecn_nonce) == 0)
5160 		/* no nonce, always return ECT0 */
5161 		return (SCTP_ECT0_BIT);
5162 
5163 	if (stcb->asoc.peer_supports_ecn_nonce == 0) {
5164 		/* Peer does NOT support it, so we send a ECT0 only */
5165 		return (SCTP_ECT0_BIT);
5166 	}
5167 	if (chk == NULL)
5168 		return (SCTP_ECT0_BIT);
5169 
5170 	if ((stcb->asoc.hb_random_idx > 3) ||
5171 	    ((stcb->asoc.hb_random_idx == 3) &&
5172 	    (stcb->asoc.hb_ect_randombit > 7))) {
5173 		uint32_t rndval;
5174 
5175 warp_drive_sa:
5176 		rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
5177 		memcpy(stcb->asoc.hb_random_values, &rndval,
5178 		    sizeof(stcb->asoc.hb_random_values));
5179 		this_random = stcb->asoc.hb_random_values[0];
5180 		stcb->asoc.hb_random_idx = 0;
5181 		stcb->asoc.hb_ect_randombit = 0;
5182 	} else {
5183 		if (stcb->asoc.hb_ect_randombit > 7) {
5184 			stcb->asoc.hb_ect_randombit = 0;
5185 			stcb->asoc.hb_random_idx++;
5186 			if (stcb->asoc.hb_random_idx > 3) {
5187 				goto warp_drive_sa;
5188 			}
5189 		}
5190 		this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
5191 	}
5192 	if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
5193 		if (chk != NULL)
5194 			/* ECN Nonce stuff */
5195 			chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
5196 		stcb->asoc.hb_ect_randombit++;
5197 		return (SCTP_ECT1_BIT);
5198 	} else {
5199 		stcb->asoc.hb_ect_randombit++;
5200 		return (SCTP_ECT0_BIT);
5201 	}
5202 }
5203 
5204 static int
5205 sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
5206     struct sctp_tcb *stcb,	/* may be NULL */
5207     struct sctp_nets *net,
5208     struct sockaddr *to,
5209     struct mbuf *m,
5210     uint32_t auth_offset,
5211     struct sctp_auth_chunk *auth,
5212     uint16_t auth_keyid,
5213     int nofragment_flag,
5214     int ecn_ok,
5215     struct sctp_tmit_chunk *chk,
5216     int out_of_asoc_ok,
5217     uint16_t src_port,
5218     uint16_t dest_port,
5219     uint32_t v_tag,
5220     uint16_t port,
5221     int so_locked,
5222 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
5223     SCTP_UNUSED
5224 #endif
5225     union sctp_sockstore *over_addr
5226 )
5227 /* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
5228 {
5229 	/*
5230 	 * Given a mbuf chain (via SCTP_BUF_NEXT()) that holds a packet
5231 	 * header WITH an SCTPHDR but no IP header, endpoint inp and sa
5232 	 * structure: - fill in the HMAC digest of any AUTH chunk in the
5233 	 * packet. - calculate and fill in the SCTP checksum. - prepend an
5234 	 * IP address header. - if boundall use INADDR_ANY. - if
5235 	 * boundspecific do source address selection. - set fragmentation
5236 	 * option for ipV4. - On return from IP output, check/adjust mtu
5237 	 * size of output interface and smallest_mtu size as well.
5238 	 */
5239 	/* Will need ifdefs around this */
5240 	struct mbuf *o_pak;
5241 	struct mbuf *newm;
5242 	struct sctphdr *sctphdr;
5243 	int packet_length;
5244 	int ret;
5245 	uint32_t vrf_id;
5246 	sctp_route_t *ro = NULL;
5247 	struct udphdr *udp = NULL;
5248 
5249 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5250 	struct socket *so = NULL;
5251 
5252 #endif
5253 
5254 	if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
5255 		SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT);
5256 		sctp_m_freem(m);
5257 		return (EFAULT);
5258 	}
5259 	if (stcb) {
5260 		vrf_id = stcb->asoc.vrf_id;
5261 	} else {
5262 		vrf_id = inp->def_vrf_id;
5263 	}
5264 
5265 	/* fill in the HMAC digest for any AUTH chunk in the packet */
5266 	if ((auth != NULL) && (stcb != NULL)) {
5267 		sctp_fill_hmac_digest_m(m, auth_offset, auth, stcb, auth_keyid);
5268 	}
5269 	if (to->sa_family == AF_INET) {
5270 		struct ip *ip = NULL;
5271 		sctp_route_t iproute;
5272 		uint8_t tos_value;
5273 		int len;
5274 
5275 		len = sizeof(struct ip) + sizeof(struct sctphdr);
5276 		if (port) {
5277 			len += sizeof(struct udphdr);
5278 		}
5279 		newm = sctp_get_mbuf_for_msg(len, 1, M_DONTWAIT, 1, MT_DATA);
5280 		if (newm == NULL) {
5281 			sctp_m_freem(m);
5282 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
5283 			return (ENOMEM);
5284 		}
5285 		SCTP_ALIGN_TO_END(newm, len);
5286 		SCTP_BUF_LEN(newm) = len;
5287 		SCTP_BUF_NEXT(newm) = m;
5288 		m = newm;
5289 		packet_length = sctp_calculate_len(m);
5290 		ip = mtod(m, struct ip *);
5291 		ip->ip_v = IPVERSION;
5292 		ip->ip_hl = (sizeof(struct ip) >> 2);
5293 		if (net) {
5294 			tos_value = net->tos_flowlabel & 0x000000ff;
5295 		} else {
5296 			tos_value = inp->ip_inp.inp.inp_ip_tos;
5297 		}
5298 		if ((nofragment_flag) && (port == 0)) {
5299 #if defined(WITH_CONVERT_IP_OFF) || defined(__FreeBSD__) || defined(__APPLE__) || defined(__Userspace__)
5300 			ip->ip_off = IP_DF;
5301 #else
5302 			ip->ip_off = htons(IP_DF);
5303 #endif
5304 		} else
5305 			ip->ip_off = 0;
5306 
5307 		/* FreeBSD has a function for ip_id's */
5308 		ip->ip_id = ip_newid();
5309 
5310 		ip->ip_ttl = inp->ip_inp.inp.inp_ip_ttl;
5311 		ip->ip_len = packet_length;
5312 		if (stcb) {
5313 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
5314 				/* Enable ECN */
5315 				ip->ip_tos = ((u_char)(tos_value & 0xfc) | sctp_get_ect(stcb, chk));
5316 			} else {
5317 				/* No ECN */
5318 				ip->ip_tos = (u_char)(tos_value & 0xfc);
5319 			}
5320 		} else {
5321 			/* no association at all */
5322 			ip->ip_tos = (tos_value & 0xfc);
5323 		}
5324 		if (port) {
5325 			ip->ip_p = IPPROTO_UDP;
5326 		} else {
5327 			ip->ip_p = IPPROTO_SCTP;
5328 		}
5329 		ip->ip_sum = 0;
5330 		if (net == NULL) {
5331 			ro = &iproute;
5332 			memset(&iproute, 0, sizeof(iproute));
5333 			memcpy(&ro->ro_dst, to, to->sa_len);
5334 		} else {
5335 			ro = (sctp_route_t *) & net->ro;
5336 		}
5337 		/* Now the address selection part */
5338 		ip->ip_dst.s_addr = ((struct sockaddr_in *)to)->sin_addr.s_addr;
5339 
5340 		/* call the routine to select the src address */
5341 		if (net && out_of_asoc_ok == 0) {
5342 			if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) {
5343 				sctp_free_ifa(net->ro._s_addr);
5344 				net->ro._s_addr = NULL;
5345 				net->src_addr_selected = 0;
5346 				if (ro->ro_rt) {
5347 					RTFREE(ro->ro_rt);
5348 					ro->ro_rt = NULL;
5349 				}
5350 			}
5351 			if (net->src_addr_selected == 0) {
5352 				/* Cache the source address */
5353 				net->ro._s_addr = sctp_source_address_selection(inp, stcb,
5354 				    ro, net, 0,
5355 				    vrf_id);
5356 				net->src_addr_selected = 1;
5357 			}
5358 			if (net->ro._s_addr == NULL) {
5359 				/* No route to host */
5360 				net->src_addr_selected = 0;
5361 				goto no_route;
5362 			}
5363 			ip->ip_src = net->ro._s_addr->address.sin.sin_addr;
5364 		} else {
5365 			if (over_addr == NULL) {
5366 				struct sctp_ifa *_lsrc;
5367 
5368 				_lsrc = sctp_source_address_selection(inp, stcb, ro,
5369 				    net,
5370 				    out_of_asoc_ok,
5371 				    vrf_id);
5372 				if (_lsrc == NULL) {
5373 					goto no_route;
5374 				}
5375 				ip->ip_src = _lsrc->address.sin.sin_addr;
5376 				sctp_free_ifa(_lsrc);
5377 			} else {
5378 				ip->ip_src = over_addr->sin.sin_addr;
5379 				SCTP_RTALLOC((&ro->ro_rt), vrf_id);
5380 			}
5381 		}
5382 		if (port) {
5383 			udp = (struct udphdr *)((caddr_t)ip + sizeof(struct ip));
5384 			udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port));
5385 			udp->uh_dport = port;
5386 			udp->uh_ulen = htons(packet_length - sizeof(struct ip));
5387 			udp->uh_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP));
5388 			sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr));
5389 		} else {
5390 			sctphdr = (struct sctphdr *)((caddr_t)ip + sizeof(struct ip));
5391 		}
5392 
5393 		sctphdr->src_port = src_port;
5394 		sctphdr->dest_port = dest_port;
5395 		sctphdr->v_tag = v_tag;
5396 		sctphdr->checksum = 0;
5397 
5398 		/*
5399 		 * If source address selection fails and we find no route
5400 		 * then the ip_output should fail as well with a
5401 		 * NO_ROUTE_TO_HOST type error. We probably should catch
5402 		 * that somewhere and abort the association right away
5403 		 * (assuming this is an INIT being sent).
5404 		 */
5405 		if ((ro->ro_rt == NULL)) {
5406 			/*
5407 			 * src addr selection failed to find a route (or
5408 			 * valid source addr), so we can't get there from
5409 			 * here (yet)!
5410 			 */
5411 	no_route:
5412 			SCTPDBG(SCTP_DEBUG_OUTPUT1,
5413 			    "%s: dropped packet - no valid source addr\n",
5414 			    __FUNCTION__);
5415 			if (net) {
5416 				SCTPDBG(SCTP_DEBUG_OUTPUT1,
5417 				    "Destination was ");
5418 				SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT1,
5419 				    &net->ro._l_addr.sa);
5420 				if (net->dest_state & SCTP_ADDR_CONFIRMED) {
5421 					if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb) {
5422 						SCTPDBG(SCTP_DEBUG_OUTPUT1, "no route takes interface %p down\n", net);
5423 						sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
5424 						    stcb,
5425 						    SCTP_FAILED_THRESHOLD,
5426 						    (void *)net,
5427 						    so_locked);
5428 						net->dest_state &= ~SCTP_ADDR_REACHABLE;
5429 						net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
5430 						/*
5431 						 * JRS 5/14/07 - If a
5432 						 * destination is
5433 						 * unreachable, the PF bit
5434 						 * is turned off.  This
5435 						 * allows an unambiguous use
5436 						 * of the PF bit for
5437 						 * destinations that are
5438 						 * reachable but potentially
5439 						 * failed. If the
5440 						 * destination is set to the
5441 						 * unreachable state, also
5442 						 * set the destination to
5443 						 * the PF state.
5444 						 */
5445 						/*
5446 						 * Add debug message here if
5447 						 * destination is not in PF
5448 						 * state.
5449 						 */
5450 						/*
5451 						 * Stop any running T3
5452 						 * timers here?
5453 						 */
5454 						if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) && SCTP_BASE_SYSCTL(sctp_cmt_pf)) {
5455 							net->dest_state &= ~SCTP_ADDR_PF;
5456 							SCTPDBG(SCTP_DEBUG_OUTPUT1, "Destination %p moved from PF to unreachable.\n",
5457 							    net);
5458 						}
5459 					}
5460 				}
5461 				if (stcb) {
5462 					if (net == stcb->asoc.primary_destination) {
5463 						/* need a new primary */
5464 						struct sctp_nets *alt;
5465 
5466 						alt = sctp_find_alternate_net(stcb, net, 0);
5467 						if (alt != net) {
5468 							if (sctp_set_primary_addr(stcb,
5469 							    (struct sockaddr *)NULL,
5470 							    alt) == 0) {
5471 								net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
5472 								if (net->ro._s_addr) {
5473 									sctp_free_ifa(net->ro._s_addr);
5474 									net->ro._s_addr = NULL;
5475 								}
5476 								net->src_addr_selected = 0;
5477 							}
5478 						}
5479 					}
5480 				}
5481 			}
5482 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EHOSTUNREACH);
5483 			sctp_m_freem(m);
5484 			return (EHOSTUNREACH);
5485 		}
5486 		if (ro != &iproute) {
5487 			memcpy(&iproute, ro, sizeof(*ro));
5488 		}
5489 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv4 output routine from low level src addr:%x\n",
5490 		    (uint32_t) (ntohl(ip->ip_src.s_addr)));
5491 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "Destination is %x\n",
5492 		    (uint32_t) (ntohl(ip->ip_dst.s_addr)));
5493 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "RTP route is %p through\n",
5494 		    ro->ro_rt);
5495 
5496 		if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
5497 			/* failed to prepend data, give up */
5498 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
5499 			sctp_m_freem(m);
5500 			return (ENOMEM);
5501 		}
5502 #ifdef  SCTP_PACKET_LOGGING
5503 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
5504 			sctp_packet_log(m, packet_length);
5505 #endif
5506 		SCTP_ATTACH_CHAIN(o_pak, m, packet_length);
5507 		if (port) {
5508 			if (!(SCTP_BASE_SYSCTL(sctp_no_csum_on_loopback) &&
5509 			    (stcb) &&
5510 			    (stcb->asoc.loopback_scope))) {
5511 				sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip) + sizeof(struct udphdr));
5512 				SCTP_STAT_INCR(sctps_sendswcrc);
5513 			} else {
5514 				SCTP_STAT_INCR(sctps_sendnocrc);
5515 			}
5516 			SCTP_ENABLE_UDP_CSUM(o_pak);
5517 		} else {
5518 			if (!(SCTP_BASE_SYSCTL(sctp_no_csum_on_loopback) &&
5519 			    (stcb) &&
5520 			    (stcb->asoc.loopback_scope))) {
5521 				m->m_pkthdr.csum_flags = CSUM_SCTP;
5522 				m->m_pkthdr.csum_data = 0;	/* FIXME MT */
5523 				SCTP_STAT_INCR(sctps_sendhwcrc);
5524 			} else {
5525 				SCTP_STAT_INCR(sctps_sendnocrc);
5526 			}
5527 		}
5528 		/* send it out.  table id is taken from stcb */
5529 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5530 		if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) {
5531 			so = SCTP_INP_SO(inp);
5532 			SCTP_SOCKET_UNLOCK(so, 0);
5533 		}
5534 #endif
5535 		SCTP_IP_OUTPUT(ret, o_pak, ro, stcb, vrf_id);
5536 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5537 		if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) {
5538 			atomic_add_int(&stcb->asoc.refcnt, 1);
5539 			SCTP_TCB_UNLOCK(stcb);
5540 			SCTP_SOCKET_LOCK(so, 0);
5541 			SCTP_TCB_LOCK(stcb);
5542 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
5543 		}
5544 #endif
5545 		SCTP_STAT_INCR(sctps_sendpackets);
5546 		SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
5547 		if (ret)
5548 			SCTP_STAT_INCR(sctps_senderrors);
5549 
5550 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "IP output returns %d\n", ret);
5551 		if (net == NULL) {
5552 			/* free tempy routes */
5553 			if (ro->ro_rt) {
5554 				RTFREE(ro->ro_rt);
5555 				ro->ro_rt = NULL;
5556 			}
5557 		} else {
5558 			/* PMTU check versus smallest asoc MTU goes here */
5559 			if ((ro->ro_rt != NULL) &&
5560 			    (net->ro._s_addr)) {
5561 				uint32_t mtu;
5562 
5563 				mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt);
5564 				if (net->port) {
5565 					mtu -= sizeof(struct udphdr);
5566 				}
5567 				if (mtu && (stcb->asoc.smallest_mtu > mtu)) {
5568 #ifdef SCTP_PRINT_FOR_B_AND_M
5569 					SCTP_PRINTF("sctp_mtu_size_reset called after ip_output mtu-change:%d\n", mtu);
5570 #endif
5571 					sctp_mtu_size_reset(inp, &stcb->asoc, mtu);
5572 					net->mtu = mtu;
5573 				}
5574 			} else if (ro->ro_rt == NULL) {
5575 				/* route was freed */
5576 				if (net->ro._s_addr &&
5577 				    net->src_addr_selected) {
5578 					sctp_free_ifa(net->ro._s_addr);
5579 					net->ro._s_addr = NULL;
5580 				}
5581 				net->src_addr_selected = 0;
5582 			}
5583 		}
5584 		return (ret);
5585 	}
5586 #ifdef INET6
5587 	else if (to->sa_family == AF_INET6) {
5588 		uint32_t flowlabel;
5589 		struct ip6_hdr *ip6h;
5590 		struct route_in6 ip6route;
5591 		struct ifnet *ifp;
5592 		u_char flowTop;
5593 		uint16_t flowBottom;
5594 		u_char tosBottom, tosTop;
5595 		struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
5596 		int prev_scope = 0;
5597 		struct sockaddr_in6 lsa6_storage;
5598 		int error;
5599 		u_short prev_port = 0;
5600 		int len;
5601 
5602 		if (net != NULL) {
5603 			flowlabel = net->tos_flowlabel;
5604 		} else {
5605 			flowlabel = ((struct in6pcb *)inp)->in6p_flowinfo;
5606 		}
5607 
5608 		len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr);
5609 		if (port) {
5610 			len += sizeof(struct udphdr);
5611 		}
5612 		newm = sctp_get_mbuf_for_msg(len, 1, M_DONTWAIT, 1, MT_DATA);
5613 		if (newm == NULL) {
5614 			sctp_m_freem(m);
5615 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
5616 			return (ENOMEM);
5617 		}
5618 		SCTP_ALIGN_TO_END(newm, len);
5619 		SCTP_BUF_LEN(newm) = len;
5620 		SCTP_BUF_NEXT(newm) = m;
5621 		m = newm;
5622 		packet_length = sctp_calculate_len(m);
5623 
5624 		ip6h = mtod(m, struct ip6_hdr *);
5625 		/*
5626 		 * We assume here that inp_flow is in host byte order within
5627 		 * the TCB!
5628 		 */
5629 		flowBottom = flowlabel & 0x0000ffff;
5630 		flowTop = ((flowlabel & 0x000f0000) >> 16);
5631 		tosTop = (((flowlabel & 0xf0) >> 4) | IPV6_VERSION);
5632 		/* protect *sin6 from overwrite */
5633 		sin6 = (struct sockaddr_in6 *)to;
5634 		tmp = *sin6;
5635 		sin6 = &tmp;
5636 
5637 		/* KAME hack: embed scopeid */
5638 		if (sa6_embedscope(sin6, MODULE_GLOBAL(MOD_INET6, ip6_use_defzone)) != 0) {
5639 			SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
5640 			return (EINVAL);
5641 		}
5642 		if (net == NULL) {
5643 			memset(&ip6route, 0, sizeof(ip6route));
5644 			ro = (sctp_route_t *) & ip6route;
5645 			memcpy(&ro->ro_dst, sin6, sin6->sin6_len);
5646 		} else {
5647 			ro = (sctp_route_t *) & net->ro;
5648 		}
5649 		if (stcb != NULL) {
5650 			if ((stcb->asoc.ecn_allowed) && ecn_ok) {
5651 				/* Enable ECN */
5652 				tosBottom = (((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
5653 			} else {
5654 				/* No ECN */
5655 				tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
5656 			}
5657 		} else {
5658 			/* we could get no asoc if it is a O-O-T-B packet */
5659 			tosBottom = ((((struct in6pcb *)inp)->in6p_flowinfo & 0x0c) << 4);
5660 		}
5661 		ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom | flowTop) << 16) | flowBottom));
5662 		if (port) {
5663 			ip6h->ip6_nxt = IPPROTO_UDP;
5664 		} else {
5665 			ip6h->ip6_nxt = IPPROTO_SCTP;
5666 		}
5667 		ip6h->ip6_plen = (packet_length - sizeof(struct ip6_hdr));
5668 		ip6h->ip6_dst = sin6->sin6_addr;
5669 
5670 		/*
5671 		 * Add SRC address selection here: we can only reuse to a
5672 		 * limited degree the kame src-addr-sel, since we can try
5673 		 * their selection but it may not be bound.
5674 		 */
5675 		bzero(&lsa6_tmp, sizeof(lsa6_tmp));
5676 		lsa6_tmp.sin6_family = AF_INET6;
5677 		lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
5678 		lsa6 = &lsa6_tmp;
5679 		if (net && out_of_asoc_ok == 0) {
5680 			if (net->ro._s_addr && (net->ro._s_addr->localifa_flags & (SCTP_BEING_DELETED | SCTP_ADDR_IFA_UNUSEABLE))) {
5681 				sctp_free_ifa(net->ro._s_addr);
5682 				net->ro._s_addr = NULL;
5683 				net->src_addr_selected = 0;
5684 				if (ro->ro_rt) {
5685 					RTFREE(ro->ro_rt);
5686 					ro->ro_rt = NULL;
5687 				}
5688 			}
5689 			if (net->src_addr_selected == 0) {
5690 				sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
5691 				/* KAME hack: embed scopeid */
5692 				if (sa6_embedscope(sin6, MODULE_GLOBAL(MOD_INET6, ip6_use_defzone)) != 0) {
5693 					SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
5694 					return (EINVAL);
5695 				}
5696 				/* Cache the source address */
5697 				net->ro._s_addr = sctp_source_address_selection(inp,
5698 				    stcb,
5699 				    ro,
5700 				    net,
5701 				    0,
5702 				    vrf_id);
5703 				(void)sa6_recoverscope(sin6);
5704 				net->src_addr_selected = 1;
5705 			}
5706 			if (net->ro._s_addr == NULL) {
5707 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "V6:No route to host\n");
5708 				net->src_addr_selected = 0;
5709 				goto no_route;
5710 			}
5711 			lsa6->sin6_addr = net->ro._s_addr->address.sin6.sin6_addr;
5712 		} else {
5713 			sin6 = (struct sockaddr_in6 *)&ro->ro_dst;
5714 			/* KAME hack: embed scopeid */
5715 			if (sa6_embedscope(sin6, MODULE_GLOBAL(MOD_INET6, ip6_use_defzone)) != 0) {
5716 				SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
5717 				return (EINVAL);
5718 			}
5719 			if (over_addr == NULL) {
5720 				struct sctp_ifa *_lsrc;
5721 
5722 				_lsrc = sctp_source_address_selection(inp, stcb, ro,
5723 				    net,
5724 				    out_of_asoc_ok,
5725 				    vrf_id);
5726 				if (_lsrc == NULL) {
5727 					goto no_route;
5728 				}
5729 				lsa6->sin6_addr = _lsrc->address.sin6.sin6_addr;
5730 				sctp_free_ifa(_lsrc);
5731 			} else {
5732 				lsa6->sin6_addr = over_addr->sin6.sin6_addr;
5733 				SCTP_RTALLOC((&ro->ro_rt), vrf_id);
5734 			}
5735 			(void)sa6_recoverscope(sin6);
5736 		}
5737 		lsa6->sin6_port = inp->sctp_lport;
5738 
5739 		if (ro->ro_rt == NULL) {
5740 			/*
5741 			 * src addr selection failed to find a route (or
5742 			 * valid source addr), so we can't get there from
5743 			 * here!
5744 			 */
5745 			goto no_route;
5746 		}
5747 		/*
5748 		 * XXX: sa6 may not have a valid sin6_scope_id in the
5749 		 * non-SCOPEDROUTING case.
5750 		 */
5751 		bzero(&lsa6_storage, sizeof(lsa6_storage));
5752 		lsa6_storage.sin6_family = AF_INET6;
5753 		lsa6_storage.sin6_len = sizeof(lsa6_storage);
5754 		lsa6_storage.sin6_addr = lsa6->sin6_addr;
5755 		if ((error = sa6_recoverscope(&lsa6_storage)) != 0) {
5756 			SCTPDBG(SCTP_DEBUG_OUTPUT3, "recover scope fails error %d\n", error);
5757 			sctp_m_freem(m);
5758 			return (error);
5759 		}
5760 		/* XXX */
5761 		lsa6_storage.sin6_addr = lsa6->sin6_addr;
5762 		lsa6_storage.sin6_port = inp->sctp_lport;
5763 		lsa6 = &lsa6_storage;
5764 		ip6h->ip6_src = lsa6->sin6_addr;
5765 
5766 		if (port) {
5767 			udp = (struct udphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr));
5768 			udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port));
5769 			udp->uh_dport = port;
5770 			udp->uh_ulen = htons(packet_length - sizeof(struct ip6_hdr));
5771 			udp->uh_sum = 0;
5772 			sctphdr = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr));
5773 		} else {
5774 			sctphdr = (struct sctphdr *)((caddr_t)ip6h + sizeof(struct ip6_hdr));
5775 		}
5776 
5777 		sctphdr->src_port = src_port;
5778 		sctphdr->dest_port = dest_port;
5779 		sctphdr->v_tag = v_tag;
5780 		sctphdr->checksum = 0;
5781 
5782 		/*
5783 		 * We set the hop limit now since there is a good chance
5784 		 * that our ro pointer is now filled
5785 		 */
5786 		ip6h->ip6_hlim = SCTP_GET_HLIM(inp, ro);
5787 		ifp = SCTP_GET_IFN_VOID_FROM_ROUTE(ro);
5788 
5789 #ifdef SCTP_DEBUG
5790 		/* Copy to be sure something bad is not happening */
5791 		sin6->sin6_addr = ip6h->ip6_dst;
5792 		lsa6->sin6_addr = ip6h->ip6_src;
5793 #endif
5794 
5795 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "Calling ipv6 output routine from low level\n");
5796 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "src: ");
5797 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)lsa6);
5798 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "dst: ");
5799 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT3, (struct sockaddr *)sin6);
5800 		if (net) {
5801 			sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
5802 			/* preserve the port and scope for link local send */
5803 			prev_scope = sin6->sin6_scope_id;
5804 			prev_port = sin6->sin6_port;
5805 		}
5806 		if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
5807 			/* failed to prepend data, give up */
5808 			sctp_m_freem(m);
5809 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
5810 			return (ENOMEM);
5811 		}
5812 #ifdef  SCTP_PACKET_LOGGING
5813 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
5814 			sctp_packet_log(m, packet_length);
5815 #endif
5816 		SCTP_ATTACH_CHAIN(o_pak, m, packet_length);
5817 		if (port) {
5818 			if (!(SCTP_BASE_SYSCTL(sctp_no_csum_on_loopback) &&
5819 			    (stcb) &&
5820 			    (stcb->asoc.loopback_scope))) {
5821 				sctphdr->checksum = sctp_calculate_cksum(m, sizeof(struct ip6_hdr) + sizeof(struct udphdr));
5822 				SCTP_STAT_INCR(sctps_sendswcrc);
5823 			} else {
5824 				SCTP_STAT_INCR(sctps_sendnocrc);
5825 			}
5826 			if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), packet_length - sizeof(struct ip6_hdr))) == 0) {
5827 				udp->uh_sum = 0xffff;
5828 			}
5829 		} else {
5830 			if (!(SCTP_BASE_SYSCTL(sctp_no_csum_on_loopback) &&
5831 			    (stcb) &&
5832 			    (stcb->asoc.loopback_scope))) {
5833 				m->m_pkthdr.csum_flags = CSUM_SCTP;
5834 				m->m_pkthdr.csum_data = 0;	/* FIXME MT */
5835 				SCTP_STAT_INCR(sctps_sendhwcrc);
5836 			} else {
5837 				SCTP_STAT_INCR(sctps_sendnocrc);
5838 			}
5839 		}
5840 		/* send it out. table id is taken from stcb */
5841 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5842 		if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) {
5843 			so = SCTP_INP_SO(inp);
5844 			SCTP_SOCKET_UNLOCK(so, 0);
5845 		}
5846 #endif
5847 		SCTP_IP6_OUTPUT(ret, o_pak, (struct route_in6 *)ro, &ifp, stcb, vrf_id);
5848 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5849 		if ((SCTP_BASE_SYSCTL(sctp_output_unlocked)) && (so_locked)) {
5850 			atomic_add_int(&stcb->asoc.refcnt, 1);
5851 			SCTP_TCB_UNLOCK(stcb);
5852 			SCTP_SOCKET_LOCK(so, 0);
5853 			SCTP_TCB_LOCK(stcb);
5854 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
5855 		}
5856 #endif
5857 		if (net) {
5858 			/* for link local this must be done */
5859 			sin6->sin6_scope_id = prev_scope;
5860 			sin6->sin6_port = prev_port;
5861 		}
5862 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "return from send is %d\n", ret);
5863 		SCTP_STAT_INCR(sctps_sendpackets);
5864 		SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
5865 		if (ret) {
5866 			SCTP_STAT_INCR(sctps_senderrors);
5867 		}
5868 		if (net == NULL) {
5869 			/* Now if we had a temp route free it */
5870 			if (ro->ro_rt) {
5871 				RTFREE(ro->ro_rt);
5872 			}
5873 		} else {
5874 			/* PMTU check versus smallest asoc MTU goes here */
5875 			if (ro->ro_rt == NULL) {
5876 				/* Route was freed */
5877 				if (net->ro._s_addr &&
5878 				    net->src_addr_selected) {
5879 					sctp_free_ifa(net->ro._s_addr);
5880 					net->ro._s_addr = NULL;
5881 				}
5882 				net->src_addr_selected = 0;
5883 			}
5884 			if ((ro->ro_rt != NULL) &&
5885 			    (net->ro._s_addr)) {
5886 				uint32_t mtu;
5887 
5888 				mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, ro->ro_rt);
5889 				if (mtu &&
5890 				    (stcb->asoc.smallest_mtu > mtu)) {
5891 #ifdef SCTP_PRINT_FOR_B_AND_M
5892 					SCTP_PRINTF("sctp_mtu_size_reset called after ip6_output mtu-change:%d\n",
5893 					    mtu);
5894 #endif
5895 					sctp_mtu_size_reset(inp, &stcb->asoc, mtu);
5896 					net->mtu = mtu;
5897 					if (net->port) {
5898 						net->mtu -= sizeof(struct udphdr);
5899 					}
5900 				}
5901 			} else if (ifp) {
5902 				if (ND_IFINFO(ifp)->linkmtu &&
5903 				    (stcb->asoc.smallest_mtu > ND_IFINFO(ifp)->linkmtu)) {
5904 #ifdef SCTP_PRINT_FOR_B_AND_M
5905 					SCTP_PRINTF("sctp_mtu_size_reset called via ifp ND_IFINFO() linkmtu:%d\n",
5906 					    ND_IFINFO(ifp)->linkmtu);
5907 #endif
5908 					sctp_mtu_size_reset(inp,
5909 					    &stcb->asoc,
5910 					    ND_IFINFO(ifp)->linkmtu);
5911 				}
5912 			}
5913 		}
5914 		return (ret);
5915 	}
5916 #endif
5917 	else {
5918 		SCTPDBG(SCTP_DEBUG_OUTPUT1, "Unknown protocol (TSNH) type %d\n",
5919 		    ((struct sockaddr *)to)->sa_family);
5920 		sctp_m_freem(m);
5921 		SCTP_LTRACE_ERR_RET_PKT(m, inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT);
5922 		return (EFAULT);
5923 	}
5924 }
5925 
5926 
5927 void
5928 sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int so_locked
5929 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
5930     SCTP_UNUSED
5931 #endif
5932 )
5933 {
5934 	struct mbuf *m, *m_at, *mp_last;
5935 	struct sctp_nets *net;
5936 	struct sctp_init_chunk *init;
5937 	struct sctp_supported_addr_param *sup_addr;
5938 	struct sctp_adaptation_layer_indication *ali;
5939 	struct sctp_ecn_supported_param *ecn;
5940 	struct sctp_prsctp_supported_param *prsctp;
5941 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
5942 	struct sctp_supported_chunk_types_param *pr_supported;
5943 	int cnt_inits_to = 0;
5944 	int padval, ret;
5945 	int num_ext;
5946 	int p_len;
5947 
5948 	/* INIT's always go to the primary (and usually ONLY address) */
5949 	mp_last = NULL;
5950 	net = stcb->asoc.primary_destination;
5951 	if (net == NULL) {
5952 		net = TAILQ_FIRST(&stcb->asoc.nets);
5953 		if (net == NULL) {
5954 			/* TSNH */
5955 			return;
5956 		}
5957 		/* we confirm any address we send an INIT to */
5958 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
5959 		(void)sctp_set_primary_addr(stcb, NULL, net);
5960 	} else {
5961 		/* we confirm any address we send an INIT to */
5962 		net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
5963 	}
5964 	SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT\n");
5965 #ifdef INET6
5966 	if (((struct sockaddr *)&(net->ro._l_addr))->sa_family == AF_INET6) {
5967 		/*
5968 		 * special hook, if we are sending to link local it will not
5969 		 * show up in our private address count.
5970 		 */
5971 		struct sockaddr_in6 *sin6l;
5972 
5973 		sin6l = &net->ro._l_addr.sin6;
5974 		if (IN6_IS_ADDR_LINKLOCAL(&sin6l->sin6_addr))
5975 			cnt_inits_to = 1;
5976 	}
5977 #endif
5978 	if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5979 		/* This case should not happen */
5980 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - failed timer?\n");
5981 		return;
5982 	}
5983 	/* start the INIT timer */
5984 	sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
5985 
5986 	m = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA);
5987 	if (m == NULL) {
5988 		/* No memory, INIT timer will re-attempt. */
5989 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - mbuf?\n");
5990 		return;
5991 	}
5992 	SCTP_BUF_LEN(m) = sizeof(struct sctp_init_chunk);
5993 	/*
5994 	 * assume peer supports asconf in order to be able to queue local
5995 	 * address changes while an INIT is in flight and before the assoc
5996 	 * is established.
5997 	 */
5998 	stcb->asoc.peer_supports_asconf = 1;
5999 	/* Now lets put the SCTP header in place */
6000 	init = mtod(m, struct sctp_init_chunk *);
6001 	/* now the chunk header */
6002 	init->ch.chunk_type = SCTP_INITIATION;
6003 	init->ch.chunk_flags = 0;
6004 	/* fill in later from mbuf we build */
6005 	init->ch.chunk_length = 0;
6006 	/* place in my tag */
6007 	init->init.initiate_tag = htonl(stcb->asoc.my_vtag);
6008 	/* set up some of the credits. */
6009 	init->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(inp->sctp_socket),
6010 	    SCTP_MINIMAL_RWND));
6011 
6012 	init->init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
6013 	init->init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
6014 	init->init.initial_tsn = htonl(stcb->asoc.init_seq_number);
6015 	/* now the address restriction */
6016 	sup_addr = (struct sctp_supported_addr_param *)((caddr_t)init +
6017 	    sizeof(*init));
6018 	sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
6019 #ifdef INET6
6020 	/* we support 2 types: IPv6/IPv4 */
6021 	sup_addr->ph.param_length = htons(sizeof(*sup_addr) + sizeof(uint16_t));
6022 	sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
6023 	sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
6024 #else
6025 	/* we support 1 type: IPv4 */
6026 	sup_addr->ph.param_length = htons(sizeof(*sup_addr) + sizeof(uint8_t));
6027 	sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
6028 	sup_addr->addr_type[1] = htons(0);	/* this is the padding */
6029 #endif
6030 	SCTP_BUF_LEN(m) += sizeof(*sup_addr) + sizeof(uint16_t);
6031 	/* adaptation layer indication parameter */
6032 	ali = (struct sctp_adaptation_layer_indication *)((caddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
6033 	ali->ph.param_type = htons(SCTP_ULP_ADAPTATION);
6034 	ali->ph.param_length = htons(sizeof(*ali));
6035 	ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator);
6036 	SCTP_BUF_LEN(m) += sizeof(*ali);
6037 	ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali + sizeof(*ali));
6038 
6039 	if (SCTP_BASE_SYSCTL(sctp_inits_include_nat_friendly)) {
6040 		/* Add NAT friendly parameter */
6041 		struct sctp_paramhdr *ph;
6042 
6043 		ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
6044 		ph->param_type = htons(SCTP_HAS_NAT_SUPPORT);
6045 		ph->param_length = htons(sizeof(struct sctp_paramhdr));
6046 		SCTP_BUF_LEN(m) += sizeof(struct sctp_paramhdr);
6047 		ecn = (struct sctp_ecn_supported_param *)((caddr_t)ph + sizeof(*ph));
6048 	}
6049 	/* now any cookie time extensions */
6050 	if (stcb->asoc.cookie_preserve_req) {
6051 		struct sctp_cookie_perserve_param *cookie_preserve;
6052 
6053 		cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
6054 		cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
6055 		cookie_preserve->ph.param_length = htons(
6056 		    sizeof(*cookie_preserve));
6057 		cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
6058 		SCTP_BUF_LEN(m) += sizeof(*cookie_preserve);
6059 		ecn = (struct sctp_ecn_supported_param *)(
6060 		    (caddr_t)cookie_preserve + sizeof(*cookie_preserve));
6061 		stcb->asoc.cookie_preserve_req = 0;
6062 	}
6063 	/* ECN parameter */
6064 	if (SCTP_BASE_SYSCTL(sctp_ecn_enable) == 1) {
6065 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
6066 		ecn->ph.param_length = htons(sizeof(*ecn));
6067 		SCTP_BUF_LEN(m) += sizeof(*ecn);
6068 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
6069 		    sizeof(*ecn));
6070 	} else {
6071 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
6072 	}
6073 	/* And now tell the peer we do pr-sctp */
6074 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
6075 	prsctp->ph.param_length = htons(sizeof(*prsctp));
6076 	SCTP_BUF_LEN(m) += sizeof(*prsctp);
6077 
6078 	/* And now tell the peer we do all the extensions */
6079 	pr_supported = (struct sctp_supported_chunk_types_param *)
6080 	    ((caddr_t)prsctp + sizeof(*prsctp));
6081 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
6082 	num_ext = 0;
6083 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF;
6084 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK;
6085 	pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN;
6086 	pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED;
6087 	pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET;
6088 	if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) {
6089 		pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION;
6090 	}
6091 	/*
6092 	 * EY  if the initiator supports nr_sacks, need to report that to
6093 	 * responder in INIT chunk
6094 	 */
6095 	if (SCTP_BASE_SYSCTL(sctp_nr_sack_on_off)) {
6096 		pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK;
6097 	}
6098 	p_len = sizeof(*pr_supported) + num_ext;
6099 	pr_supported->ph.param_length = htons(p_len);
6100 	bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len);
6101 	SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
6102 
6103 
6104 	/* ECN nonce: And now tell the peer we support ECN nonce */
6105 	if (SCTP_BASE_SYSCTL(sctp_ecn_nonce)) {
6106 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)
6107 		    ((caddr_t)pr_supported + SCTP_SIZE32(p_len));
6108 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
6109 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
6110 		SCTP_BUF_LEN(m) += sizeof(*ecn_nonce);
6111 	}
6112 	/* add authentication parameters */
6113 	if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) {
6114 		struct sctp_auth_random *randp;
6115 		struct sctp_auth_hmac_algo *hmacs;
6116 		struct sctp_auth_chunk_list *chunks;
6117 
6118 		/* attach RANDOM parameter, if available */
6119 		if (stcb->asoc.authinfo.random != NULL) {
6120 			randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
6121 			p_len = sizeof(*randp) + stcb->asoc.authinfo.random_len;
6122 #ifdef SCTP_AUTH_DRAFT_04
6123 			randp->ph.param_type = htons(SCTP_RANDOM);
6124 			randp->ph.param_length = htons(p_len);
6125 			bcopy(stcb->asoc.authinfo.random->key,
6126 			    randp->random_data,
6127 			    stcb->asoc.authinfo.random_len);
6128 #else
6129 			/* random key already contains the header */
6130 			bcopy(stcb->asoc.authinfo.random->key, randp, p_len);
6131 #endif
6132 			/* zero out any padding required */
6133 			bzero((caddr_t)randp + p_len, SCTP_SIZE32(p_len) - p_len);
6134 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
6135 		}
6136 		/* add HMAC_ALGO parameter */
6137 		hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
6138 		p_len = sctp_serialize_hmaclist(stcb->asoc.local_hmacs,
6139 		    (uint8_t *) hmacs->hmac_ids);
6140 		if (p_len > 0) {
6141 			p_len += sizeof(*hmacs);
6142 			hmacs->ph.param_type = htons(SCTP_HMAC_LIST);
6143 			hmacs->ph.param_length = htons(p_len);
6144 			/* zero out any padding required */
6145 			bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len);
6146 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
6147 		}
6148 		/* add CHUNKS parameter */
6149 		chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
6150 		p_len = sctp_serialize_auth_chunks(stcb->asoc.local_auth_chunks,
6151 		    chunks->chunk_types);
6152 		if (p_len > 0) {
6153 			p_len += sizeof(*chunks);
6154 			chunks->ph.param_type = htons(SCTP_CHUNK_LIST);
6155 			chunks->ph.param_length = htons(p_len);
6156 			/* zero out any padding required */
6157 			bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len);
6158 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
6159 		}
6160 	}
6161 	m_at = m;
6162 	/* now the addresses */
6163 	{
6164 		struct sctp_scoping scp;
6165 
6166 		/*
6167 		 * To optimize this we could put the scoping stuff into a
6168 		 * structure and remove the individual uint8's from the
6169 		 * assoc structure. Then we could just sifa in the address
6170 		 * within the stcb.. but for now this is a quick hack to get
6171 		 * the address stuff teased apart.
6172 		 */
6173 		scp.ipv4_addr_legal = stcb->asoc.ipv4_addr_legal;
6174 		scp.ipv6_addr_legal = stcb->asoc.ipv6_addr_legal;
6175 		scp.loopback_scope = stcb->asoc.loopback_scope;
6176 		scp.ipv4_local_scope = stcb->asoc.ipv4_local_scope;
6177 		scp.local_scope = stcb->asoc.local_scope;
6178 		scp.site_scope = stcb->asoc.site_scope;
6179 
6180 		m_at = sctp_add_addresses_to_i_ia(inp, &scp, m_at, cnt_inits_to);
6181 	}
6182 
6183 	/* calulate the size and update pkt header and chunk header */
6184 	p_len = 0;
6185 	for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
6186 		if (SCTP_BUF_NEXT(m_at) == NULL)
6187 			mp_last = m_at;
6188 		p_len += SCTP_BUF_LEN(m_at);
6189 	}
6190 	init->ch.chunk_length = htons(p_len);
6191 	/*
6192 	 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return
6193 	 * here since the timer will drive a retranmission.
6194 	 */
6195 
6196 	/* I don't expect this to execute but we will be safe here */
6197 	padval = p_len % 4;
6198 	if ((padval) && (mp_last)) {
6199 		/*
6200 		 * The compiler worries that mp_last may not be set even
6201 		 * though I think it is impossible :-> however we add
6202 		 * mp_last here just in case.
6203 		 */
6204 		ret = sctp_add_pad_tombuf(mp_last, (4 - padval));
6205 		if (ret) {
6206 			/* Houston we have a problem, no space */
6207 			sctp_m_freem(m);
6208 			return;
6209 		}
6210 		p_len += padval;
6211 	}
6212 	SCTPDBG(SCTP_DEBUG_OUTPUT4, "Sending INIT - calls lowlevel_output\n");
6213 	ret = sctp_lowlevel_chunk_output(inp, stcb, net,
6214 	    (struct sockaddr *)&net->ro._l_addr,
6215 	    m, 0, NULL, 0, 0, 0, NULL, 0,
6216 	    inp->sctp_lport, stcb->rport, htonl(0),
6217 	    net->port, so_locked, NULL);
6218 	SCTPDBG(SCTP_DEBUG_OUTPUT4, "lowlevel_output - %d\n", ret);
6219 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
6220 	sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
6221 	(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
6222 }
6223 
6224 struct mbuf *
6225 sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
6226     int param_offset, int *abort_processing, struct sctp_chunkhdr *cp, int *nat_friendly)
6227 {
6228 	/*
6229 	 * Given a mbuf containing an INIT or INIT-ACK with the param_offset
6230 	 * being equal to the beginning of the params i.e. (iphlen +
6231 	 * sizeof(struct sctp_init_msg) parse through the parameters to the
6232 	 * end of the mbuf verifying that all parameters are known.
6233 	 *
6234 	 * For unknown parameters build and return a mbuf with
6235 	 * UNRECOGNIZED_PARAMETER errors. If the flags indicate to stop
6236 	 * processing this chunk stop, and set *abort_processing to 1.
6237 	 *
6238 	 * By having param_offset be pre-set to where parameters begin it is
6239 	 * hoped that this routine may be reused in the future by new
6240 	 * features.
6241 	 */
6242 	struct sctp_paramhdr *phdr, params;
6243 
6244 	struct mbuf *mat, *op_err;
6245 	char tempbuf[SCTP_PARAM_BUFFER_SIZE];
6246 	int at, limit, pad_needed;
6247 	uint16_t ptype, plen, padded_size;
6248 	int err_at;
6249 
6250 	*abort_processing = 0;
6251 	mat = in_initpkt;
6252 	err_at = 0;
6253 	limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
6254 	at = param_offset;
6255 	op_err = NULL;
6256 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "Check for unrecognized param's\n");
6257 	phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
6258 	while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
6259 		ptype = ntohs(phdr->param_type);
6260 		plen = ntohs(phdr->param_length);
6261 		if ((plen > limit) || (plen < sizeof(struct sctp_paramhdr))) {
6262 			/* wacked parameter */
6263 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error %d\n", plen);
6264 			goto invalid_size;
6265 		}
6266 		limit -= SCTP_SIZE32(plen);
6267 		/*-
6268 		 * All parameters for all chunks that we know/understand are
6269 		 * listed here. We process them other places and make
6270 		 * appropriate stop actions per the upper bits. However this
6271 		 * is the generic routine processor's can call to get back
6272 		 * an operr.. to either incorporate (init-ack) or send.
6273 		 */
6274 		padded_size = SCTP_SIZE32(plen);
6275 		switch (ptype) {
6276 			/* Param's with variable size */
6277 		case SCTP_HEARTBEAT_INFO:
6278 		case SCTP_STATE_COOKIE:
6279 		case SCTP_UNRECOG_PARAM:
6280 		case SCTP_ERROR_CAUSE_IND:
6281 			/* ok skip fwd */
6282 			at += padded_size;
6283 			break;
6284 			/* Param's with variable size within a range */
6285 		case SCTP_CHUNK_LIST:
6286 		case SCTP_SUPPORTED_CHUNK_EXT:
6287 			if (padded_size > (sizeof(struct sctp_supported_chunk_types_param) + (sizeof(uint8_t) * SCTP_MAX_SUPPORTED_EXT))) {
6288 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error chklist %d\n", plen);
6289 				goto invalid_size;
6290 			}
6291 			at += padded_size;
6292 			break;
6293 		case SCTP_SUPPORTED_ADDRTYPE:
6294 			if (padded_size > SCTP_MAX_ADDR_PARAMS_SIZE) {
6295 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error supaddrtype %d\n", plen);
6296 				goto invalid_size;
6297 			}
6298 			at += padded_size;
6299 			break;
6300 		case SCTP_RANDOM:
6301 			if (padded_size > (sizeof(struct sctp_auth_random) + SCTP_RANDOM_MAX_SIZE)) {
6302 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error random %d\n", plen);
6303 				goto invalid_size;
6304 			}
6305 			at += padded_size;
6306 			break;
6307 		case SCTP_SET_PRIM_ADDR:
6308 		case SCTP_DEL_IP_ADDRESS:
6309 		case SCTP_ADD_IP_ADDRESS:
6310 			if ((padded_size != sizeof(struct sctp_asconf_addrv4_param)) &&
6311 			    (padded_size != sizeof(struct sctp_asconf_addr_param))) {
6312 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error setprim %d\n", plen);
6313 				goto invalid_size;
6314 			}
6315 			at += padded_size;
6316 			break;
6317 			/* Param's with a fixed size */
6318 		case SCTP_IPV4_ADDRESS:
6319 			if (padded_size != sizeof(struct sctp_ipv4addr_param)) {
6320 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv4 addr %d\n", plen);
6321 				goto invalid_size;
6322 			}
6323 			at += padded_size;
6324 			break;
6325 		case SCTP_IPV6_ADDRESS:
6326 			if (padded_size != sizeof(struct sctp_ipv6addr_param)) {
6327 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ipv6 addr %d\n", plen);
6328 				goto invalid_size;
6329 			}
6330 			at += padded_size;
6331 			break;
6332 		case SCTP_COOKIE_PRESERVE:
6333 			if (padded_size != sizeof(struct sctp_cookie_perserve_param)) {
6334 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error cookie-preserve %d\n", plen);
6335 				goto invalid_size;
6336 			}
6337 			at += padded_size;
6338 			break;
6339 		case SCTP_HAS_NAT_SUPPORT:
6340 			*nat_friendly = 1;
6341 			/* fall through */
6342 		case SCTP_ECN_NONCE_SUPPORTED:
6343 		case SCTP_PRSCTP_SUPPORTED:
6344 
6345 			if (padded_size != sizeof(struct sctp_paramhdr)) {
6346 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecnnonce/prsctp/nat support %d\n", plen);
6347 				goto invalid_size;
6348 			}
6349 			at += padded_size;
6350 			break;
6351 		case SCTP_ECN_CAPABLE:
6352 			if (padded_size != sizeof(struct sctp_ecn_supported_param)) {
6353 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error ecn %d\n", plen);
6354 				goto invalid_size;
6355 			}
6356 			at += padded_size;
6357 			break;
6358 		case SCTP_ULP_ADAPTATION:
6359 			if (padded_size != sizeof(struct sctp_adaptation_layer_indication)) {
6360 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error adapatation %d\n", plen);
6361 				goto invalid_size;
6362 			}
6363 			at += padded_size;
6364 			break;
6365 		case SCTP_SUCCESS_REPORT:
6366 			if (padded_size != sizeof(struct sctp_asconf_paramhdr)) {
6367 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Invalid size - error success %d\n", plen);
6368 				goto invalid_size;
6369 			}
6370 			at += padded_size;
6371 			break;
6372 		case SCTP_HOSTNAME_ADDRESS:
6373 			{
6374 				/* We can NOT handle HOST NAME addresses!! */
6375 				int l_len;
6376 
6377 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "Can't handle hostname addresses.. abort processing\n");
6378 				*abort_processing = 1;
6379 				if (op_err == NULL) {
6380 					/* Ok need to try to get a mbuf */
6381 #ifdef INET6
6382 					l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6383 #else
6384 					l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6385 #endif
6386 					l_len += plen;
6387 					l_len += sizeof(struct sctp_paramhdr);
6388 					op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA);
6389 					if (op_err) {
6390 						SCTP_BUF_LEN(op_err) = 0;
6391 						/*
6392 						 * pre-reserve space for ip
6393 						 * and sctp header  and
6394 						 * chunk hdr
6395 						 */
6396 #ifdef INET6
6397 						SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
6398 #else
6399 						SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
6400 #endif
6401 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
6402 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
6403 					}
6404 				}
6405 				if (op_err) {
6406 					/* If we have space */
6407 					struct sctp_paramhdr s;
6408 
6409 					if (err_at % 4) {
6410 						uint32_t cpthis = 0;
6411 
6412 						pad_needed = 4 - (err_at % 4);
6413 						m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
6414 						err_at += pad_needed;
6415 					}
6416 					s.param_type = htons(SCTP_CAUSE_UNRESOLVABLE_ADDR);
6417 					s.param_length = htons(sizeof(s) + plen);
6418 					m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
6419 					err_at += sizeof(s);
6420 					phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen));
6421 					if (phdr == NULL) {
6422 						sctp_m_freem(op_err);
6423 						/*
6424 						 * we are out of memory but
6425 						 * we still need to have a
6426 						 * look at what to do (the
6427 						 * system is in trouble
6428 						 * though).
6429 						 */
6430 						return (NULL);
6431 					}
6432 					m_copyback(op_err, err_at, plen, (caddr_t)phdr);
6433 					err_at += plen;
6434 				}
6435 				return (op_err);
6436 				break;
6437 			}
6438 		default:
6439 			/*
6440 			 * we do not recognize the parameter figure out what
6441 			 * we do.
6442 			 */
6443 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "Hit default param %x\n", ptype);
6444 			if ((ptype & 0x4000) == 0x4000) {
6445 				/* Report bit is set?? */
6446 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "report op err\n");
6447 				if (op_err == NULL) {
6448 					int l_len;
6449 
6450 					/* Ok need to try to get an mbuf */
6451 #ifdef INET6
6452 					l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6453 #else
6454 					l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6455 #endif
6456 					l_len += plen;
6457 					l_len += sizeof(struct sctp_paramhdr);
6458 					op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA);
6459 					if (op_err) {
6460 						SCTP_BUF_LEN(op_err) = 0;
6461 #ifdef INET6
6462 						SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
6463 #else
6464 						SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
6465 #endif
6466 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
6467 						SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
6468 					}
6469 				}
6470 				if (op_err) {
6471 					/* If we have space */
6472 					struct sctp_paramhdr s;
6473 
6474 					if (err_at % 4) {
6475 						uint32_t cpthis = 0;
6476 
6477 						pad_needed = 4 - (err_at % 4);
6478 						m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
6479 						err_at += pad_needed;
6480 					}
6481 					s.param_type = htons(SCTP_UNRECOG_PARAM);
6482 					s.param_length = htons(sizeof(s) + plen);
6483 					m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
6484 					err_at += sizeof(s);
6485 					if (plen > sizeof(tempbuf)) {
6486 						plen = sizeof(tempbuf);
6487 					}
6488 					phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, min(sizeof(tempbuf), plen));
6489 					if (phdr == NULL) {
6490 						sctp_m_freem(op_err);
6491 						/*
6492 						 * we are out of memory but
6493 						 * we still need to have a
6494 						 * look at what to do (the
6495 						 * system is in trouble
6496 						 * though).
6497 						 */
6498 						op_err = NULL;
6499 						goto more_processing;
6500 					}
6501 					m_copyback(op_err, err_at, plen, (caddr_t)phdr);
6502 					err_at += plen;
6503 				}
6504 			}
6505 	more_processing:
6506 			if ((ptype & 0x8000) == 0x0000) {
6507 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "stop proc\n");
6508 				return (op_err);
6509 			} else {
6510 				/* skip this chunk and continue processing */
6511 				SCTPDBG(SCTP_DEBUG_OUTPUT1, "move on\n");
6512 				at += SCTP_SIZE32(plen);
6513 			}
6514 			break;
6515 
6516 		}
6517 		phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
6518 	}
6519 	return (op_err);
6520 invalid_size:
6521 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "abort flag set\n");
6522 	*abort_processing = 1;
6523 	if ((op_err == NULL) && phdr) {
6524 		int l_len;
6525 
6526 #ifdef INET6
6527 		l_len = sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6528 #else
6529 		l_len = sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6530 #endif
6531 		l_len += (2 * sizeof(struct sctp_paramhdr));
6532 		op_err = sctp_get_mbuf_for_msg(l_len, 0, M_DONTWAIT, 1, MT_DATA);
6533 		if (op_err) {
6534 			SCTP_BUF_LEN(op_err) = 0;
6535 #ifdef INET6
6536 			SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
6537 #else
6538 			SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
6539 #endif
6540 			SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
6541 			SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
6542 		}
6543 	}
6544 	if ((op_err) && phdr) {
6545 		struct sctp_paramhdr s;
6546 
6547 		if (err_at % 4) {
6548 			uint32_t cpthis = 0;
6549 
6550 			pad_needed = 4 - (err_at % 4);
6551 			m_copyback(op_err, err_at, pad_needed, (caddr_t)&cpthis);
6552 			err_at += pad_needed;
6553 		}
6554 		s.param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
6555 		s.param_length = htons(sizeof(s) + sizeof(struct sctp_paramhdr));
6556 		m_copyback(op_err, err_at, sizeof(s), (caddr_t)&s);
6557 		err_at += sizeof(s);
6558 		/* Only copy back the p-hdr that caused the issue */
6559 		m_copyback(op_err, err_at, sizeof(struct sctp_paramhdr), (caddr_t)phdr);
6560 	}
6561 	return (op_err);
6562 }
6563 
6564 static int
6565 sctp_are_there_new_addresses(struct sctp_association *asoc,
6566     struct mbuf *in_initpkt, int iphlen, int offset)
6567 {
6568 	/*
6569 	 * Given a INIT packet, look through the packet to verify that there
6570 	 * are NO new addresses. As we go through the parameters add reports
6571 	 * of any un-understood parameters that require an error.  Also we
6572 	 * must return (1) to drop the packet if we see a un-understood
6573 	 * parameter that tells us to drop the chunk.
6574 	 */
6575 	struct sockaddr_in sin4, *sa4;
6576 
6577 #ifdef INET6
6578 	struct sockaddr_in6 sin6, *sa6;
6579 
6580 #endif
6581 	struct sockaddr *sa_touse;
6582 	struct sockaddr *sa;
6583 	struct sctp_paramhdr *phdr, params;
6584 	struct ip *iph;
6585 
6586 #ifdef INET6
6587 	struct ip6_hdr *ip6h;
6588 
6589 #endif
6590 	struct mbuf *mat;
6591 	uint16_t ptype, plen;
6592 	int err_at;
6593 	uint8_t fnd;
6594 	struct sctp_nets *net;
6595 
6596 	memset(&sin4, 0, sizeof(sin4));
6597 #ifdef INET6
6598 	memset(&sin6, 0, sizeof(sin6));
6599 #endif
6600 	sin4.sin_family = AF_INET;
6601 	sin4.sin_len = sizeof(sin4);
6602 #ifdef INET6
6603 	sin6.sin6_family = AF_INET6;
6604 	sin6.sin6_len = sizeof(sin6);
6605 #endif
6606 	sa_touse = NULL;
6607 	/* First what about the src address of the pkt ? */
6608 	iph = mtod(in_initpkt, struct ip *);
6609 	switch (iph->ip_v) {
6610 	case IPVERSION:
6611 		/* source addr is IPv4 */
6612 		sin4.sin_addr = iph->ip_src;
6613 		sa_touse = (struct sockaddr *)&sin4;
6614 		break;
6615 #ifdef INET6
6616 	case IPV6_VERSION >> 4:
6617 		/* source addr is IPv6 */
6618 		ip6h = mtod(in_initpkt, struct ip6_hdr *);
6619 		sin6.sin6_addr = ip6h->ip6_src;
6620 		sa_touse = (struct sockaddr *)&sin6;
6621 		break;
6622 #endif
6623 	default:
6624 		return (1);
6625 	}
6626 
6627 	fnd = 0;
6628 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6629 		sa = (struct sockaddr *)&net->ro._l_addr;
6630 		if (sa->sa_family == sa_touse->sa_family) {
6631 			if (sa->sa_family == AF_INET) {
6632 				sa4 = (struct sockaddr_in *)sa;
6633 				if (sa4->sin_addr.s_addr ==
6634 				    sin4.sin_addr.s_addr) {
6635 					fnd = 1;
6636 					break;
6637 				}
6638 			}
6639 #ifdef INET6
6640 			if (sa->sa_family == AF_INET6) {
6641 				sa6 = (struct sockaddr_in6 *)sa;
6642 				if (SCTP6_ARE_ADDR_EQUAL(sa6,
6643 				    &sin6)) {
6644 					fnd = 1;
6645 					break;
6646 				}
6647 			}
6648 #endif
6649 		}
6650 	}
6651 	if (fnd == 0) {
6652 		/* New address added! no need to look futher. */
6653 		return (1);
6654 	}
6655 	/* Ok so far lets munge through the rest of the packet */
6656 	mat = in_initpkt;
6657 	err_at = 0;
6658 	sa_touse = NULL;
6659 	offset += sizeof(struct sctp_init_chunk);
6660 	phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
6661 	while (phdr) {
6662 		ptype = ntohs(phdr->param_type);
6663 		plen = ntohs(phdr->param_length);
6664 		if (ptype == SCTP_IPV4_ADDRESS) {
6665 			struct sctp_ipv4addr_param *p4, p4_buf;
6666 
6667 			phdr = sctp_get_next_param(mat, offset,
6668 			    (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
6669 			if (plen != sizeof(struct sctp_ipv4addr_param) ||
6670 			    phdr == NULL) {
6671 				return (1);
6672 			}
6673 			p4 = (struct sctp_ipv4addr_param *)phdr;
6674 			sin4.sin_addr.s_addr = p4->addr;
6675 			sa_touse = (struct sockaddr *)&sin4;
6676 		} else if (ptype == SCTP_IPV6_ADDRESS) {
6677 			struct sctp_ipv6addr_param *p6, p6_buf;
6678 
6679 			phdr = sctp_get_next_param(mat, offset,
6680 			    (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
6681 			if (plen != sizeof(struct sctp_ipv6addr_param) ||
6682 			    phdr == NULL) {
6683 				return (1);
6684 			}
6685 			p6 = (struct sctp_ipv6addr_param *)phdr;
6686 #ifdef INET6
6687 			memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
6688 			    sizeof(p6->addr));
6689 #endif
6690 			sa_touse = (struct sockaddr *)&sin4;
6691 		}
6692 		if (sa_touse) {
6693 			/* ok, sa_touse points to one to check */
6694 			fnd = 0;
6695 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
6696 				sa = (struct sockaddr *)&net->ro._l_addr;
6697 				if (sa->sa_family != sa_touse->sa_family) {
6698 					continue;
6699 				}
6700 				if (sa->sa_family == AF_INET) {
6701 					sa4 = (struct sockaddr_in *)sa;
6702 					if (sa4->sin_addr.s_addr ==
6703 					    sin4.sin_addr.s_addr) {
6704 						fnd = 1;
6705 						break;
6706 					}
6707 				}
6708 #ifdef INET6
6709 				if (sa->sa_family == AF_INET6) {
6710 					sa6 = (struct sockaddr_in6 *)sa;
6711 					if (SCTP6_ARE_ADDR_EQUAL(
6712 					    sa6, &sin6)) {
6713 						fnd = 1;
6714 						break;
6715 					}
6716 				}
6717 #endif
6718 			}
6719 			if (!fnd) {
6720 				/* New addr added! no need to look further */
6721 				return (1);
6722 			}
6723 		}
6724 		offset += SCTP_SIZE32(plen);
6725 		phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
6726 	}
6727 	return (0);
6728 }
6729 
6730 /*
6731  * Given a MBUF chain that was sent into us containing an INIT. Build a
6732  * INIT-ACK with COOKIE and send back. We assume that the in_initpkt has done
6733  * a pullup to include IPv6/4header, SCTP header and initial part of INIT
6734  * message (i.e. the struct sctp_init_msg).
6735  */
6736 void
6737 sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
6738     struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
6739     struct sctp_init_chunk *init_chk, uint32_t vrf_id, uint16_t port, int hold_inp_lock)
6740 {
6741 	struct sctp_association *asoc;
6742 	struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *mp_last;
6743 	struct sctp_init_ack_chunk *initack;
6744 	struct sctp_adaptation_layer_indication *ali;
6745 	struct sctp_ecn_supported_param *ecn;
6746 	struct sctp_prsctp_supported_param *prsctp;
6747 	struct sctp_ecn_nonce_supported_param *ecn_nonce;
6748 	struct sctp_supported_chunk_types_param *pr_supported;
6749 	union sctp_sockstore store, store1, *over_addr;
6750 	struct sockaddr_in *sin, *to_sin;
6751 
6752 #ifdef INET6
6753 	struct sockaddr_in6 *sin6, *to_sin6;
6754 
6755 #endif
6756 	struct ip *iph;
6757 
6758 #ifdef INET6
6759 	struct ip6_hdr *ip6;
6760 
6761 #endif
6762 	struct sockaddr *to;
6763 	struct sctp_state_cookie stc;
6764 	struct sctp_nets *net = NULL;
6765 	uint8_t *signature = NULL;
6766 	int cnt_inits_to = 0;
6767 	uint16_t his_limit, i_want;
6768 	int abort_flag, padval;
6769 	int num_ext;
6770 	int p_len;
6771 	int nat_friendly = 0;
6772 	struct socket *so;
6773 
6774 	if (stcb)
6775 		asoc = &stcb->asoc;
6776 	else
6777 		asoc = NULL;
6778 	mp_last = NULL;
6779 	if ((asoc != NULL) &&
6780 	    (SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
6781 	    (sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
6782 		/* new addresses, out of here in non-cookie-wait states */
6783 		/*
6784 		 * Send a ABORT, we don't add the new address error clause
6785 		 * though we even set the T bit and copy in the 0 tag.. this
6786 		 * looks no different than if no listener was present.
6787 		 */
6788 		sctp_send_abort(init_pkt, iphlen, sh, 0, NULL, vrf_id, port);
6789 		return;
6790 	}
6791 	abort_flag = 0;
6792 	op_err = sctp_arethere_unrecognized_parameters(init_pkt,
6793 	    (offset + sizeof(struct sctp_init_chunk)),
6794 	    &abort_flag, (struct sctp_chunkhdr *)init_chk, &nat_friendly);
6795 	if (abort_flag) {
6796 do_a_abort:
6797 		sctp_send_abort(init_pkt, iphlen, sh,
6798 		    init_chk->init.initiate_tag, op_err, vrf_id, port);
6799 		return;
6800 	}
6801 	m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
6802 	if (m == NULL) {
6803 		/* No memory, INIT timer will re-attempt. */
6804 		if (op_err)
6805 			sctp_m_freem(op_err);
6806 		return;
6807 	}
6808 	SCTP_BUF_LEN(m) = sizeof(struct sctp_init_chunk);
6809 
6810 	/* the time I built cookie */
6811 	(void)SCTP_GETTIME_TIMEVAL(&stc.time_entered);
6812 
6813 	/* populate any tie tags */
6814 	if (asoc != NULL) {
6815 		/* unlock before tag selections */
6816 		stc.tie_tag_my_vtag = asoc->my_vtag_nonce;
6817 		stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;
6818 		stc.cookie_life = asoc->cookie_life;
6819 		net = asoc->primary_destination;
6820 	} else {
6821 		stc.tie_tag_my_vtag = 0;
6822 		stc.tie_tag_peer_vtag = 0;
6823 		/* life I will award this cookie */
6824 		stc.cookie_life = inp->sctp_ep.def_cookie_life;
6825 	}
6826 
6827 	/* copy in the ports for later check */
6828 	stc.myport = sh->dest_port;
6829 	stc.peerport = sh->src_port;
6830 
6831 	/*
6832 	 * If we wanted to honor cookie life extentions, we would add to
6833 	 * stc.cookie_life. For now we should NOT honor any extension
6834 	 */
6835 	stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
6836 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6837 		struct inpcb *in_inp;
6838 
6839 		/* Its a V6 socket */
6840 		in_inp = (struct inpcb *)inp;
6841 		stc.ipv6_addr_legal = 1;
6842 		/* Now look at the binding flag to see if V4 will be legal */
6843 		if (SCTP_IPV6_V6ONLY(in_inp) == 0) {
6844 			stc.ipv4_addr_legal = 1;
6845 		} else {
6846 			/* V4 addresses are NOT legal on the association */
6847 			stc.ipv4_addr_legal = 0;
6848 		}
6849 	} else {
6850 		/* Its a V4 socket, no - V6 */
6851 		stc.ipv4_addr_legal = 1;
6852 		stc.ipv6_addr_legal = 0;
6853 	}
6854 
6855 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
6856 	stc.ipv4_scope = 1;
6857 #else
6858 	stc.ipv4_scope = 0;
6859 #endif
6860 	/* now for scope setup */
6861 	memset((caddr_t)&store, 0, sizeof(store));
6862 	memset((caddr_t)&store1, 0, sizeof(store1));
6863 	sin = &store.sin;
6864 	to_sin = &store1.sin;
6865 #ifdef INET6
6866 	sin6 = &store.sin6;
6867 	to_sin6 = &store1.sin6;
6868 #endif
6869 	iph = mtod(init_pkt, struct ip *);
6870 	/* establish the to_addr's */
6871 	switch (iph->ip_v) {
6872 	case IPVERSION:
6873 		to_sin->sin_port = sh->dest_port;
6874 		to_sin->sin_family = AF_INET;
6875 		to_sin->sin_len = sizeof(struct sockaddr_in);
6876 		to_sin->sin_addr = iph->ip_dst;
6877 		break;
6878 #ifdef INET6
6879 	case IPV6_VERSION >> 4:
6880 		ip6 = mtod(init_pkt, struct ip6_hdr *);
6881 		to_sin6->sin6_addr = ip6->ip6_dst;
6882 		to_sin6->sin6_scope_id = 0;
6883 		to_sin6->sin6_port = sh->dest_port;
6884 		to_sin6->sin6_family = AF_INET6;
6885 		to_sin6->sin6_len = sizeof(struct sockaddr_in6);
6886 		break;
6887 #endif
6888 	default:
6889 		goto do_a_abort;
6890 		break;
6891 	};
6892 
6893 	if (net == NULL) {
6894 		to = (struct sockaddr *)&store;
6895 		switch (iph->ip_v) {
6896 		case IPVERSION:
6897 			{
6898 				sin->sin_family = AF_INET;
6899 				sin->sin_len = sizeof(struct sockaddr_in);
6900 				sin->sin_port = sh->src_port;
6901 				sin->sin_addr = iph->ip_src;
6902 				/* lookup address */
6903 				stc.address[0] = sin->sin_addr.s_addr;
6904 				stc.address[1] = 0;
6905 				stc.address[2] = 0;
6906 				stc.address[3] = 0;
6907 				stc.addr_type = SCTP_IPV4_ADDRESS;
6908 				/* local from address */
6909 				stc.laddress[0] = to_sin->sin_addr.s_addr;
6910 				stc.laddress[1] = 0;
6911 				stc.laddress[2] = 0;
6912 				stc.laddress[3] = 0;
6913 				stc.laddr_type = SCTP_IPV4_ADDRESS;
6914 				/* scope_id is only for v6 */
6915 				stc.scope_id = 0;
6916 #ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
6917 				if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
6918 					stc.ipv4_scope = 1;
6919 				}
6920 #else
6921 				stc.ipv4_scope = 1;
6922 #endif				/* SCTP_DONT_DO_PRIVADDR_SCOPE */
6923 				/* Must use the address in this case */
6924 				if (sctp_is_address_on_local_host((struct sockaddr *)sin, vrf_id)) {
6925 					stc.loopback_scope = 1;
6926 					stc.ipv4_scope = 1;
6927 					stc.site_scope = 1;
6928 					stc.local_scope = 0;
6929 				}
6930 				break;
6931 			}
6932 #ifdef INET6
6933 		case IPV6_VERSION >> 4:
6934 			{
6935 				ip6 = mtod(init_pkt, struct ip6_hdr *);
6936 				sin6->sin6_family = AF_INET6;
6937 				sin6->sin6_len = sizeof(struct sockaddr_in6);
6938 				sin6->sin6_port = sh->src_port;
6939 				sin6->sin6_addr = ip6->ip6_src;
6940 				/* lookup address */
6941 				memcpy(&stc.address, &sin6->sin6_addr,
6942 				    sizeof(struct in6_addr));
6943 				sin6->sin6_scope_id = 0;
6944 				stc.addr_type = SCTP_IPV6_ADDRESS;
6945 				stc.scope_id = 0;
6946 				if (sctp_is_address_on_local_host((struct sockaddr *)sin6, vrf_id)) {
6947 					/*
6948 					 * FIX ME: does this have scope from
6949 					 * rcvif?
6950 					 */
6951 					(void)sa6_recoverscope(sin6);
6952 					stc.scope_id = sin6->sin6_scope_id;
6953 					sa6_embedscope(sin6, MODULE_GLOBAL(MOD_INET6, ip6_use_defzone));
6954 					stc.loopback_scope = 1;
6955 					stc.local_scope = 0;
6956 					stc.site_scope = 1;
6957 					stc.ipv4_scope = 1;
6958 				} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6959 					/*
6960 					 * If the new destination is a
6961 					 * LINK_LOCAL we must have common
6962 					 * both site and local scope. Don't
6963 					 * set local scope though since we
6964 					 * must depend on the source to be
6965 					 * added implicitly. We cannot
6966 					 * assure just because we share one
6967 					 * link that all links are common.
6968 					 */
6969 					stc.local_scope = 0;
6970 					stc.site_scope = 1;
6971 					stc.ipv4_scope = 1;
6972 					/*
6973 					 * we start counting for the private
6974 					 * address stuff at 1. since the
6975 					 * link local we source from won't
6976 					 * show up in our scoped count.
6977 					 */
6978 					cnt_inits_to = 1;
6979 					/*
6980 					 * pull out the scope_id from
6981 					 * incoming pkt
6982 					 */
6983 					/*
6984 					 * FIX ME: does this have scope from
6985 					 * rcvif?
6986 					 */
6987 					(void)sa6_recoverscope(sin6);
6988 					stc.scope_id = sin6->sin6_scope_id;
6989 					sa6_embedscope(sin6, MODULE_GLOBAL(MOD_INET6, ip6_use_defzone));
6990 				} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
6991 					/*
6992 					 * If the new destination is
6993 					 * SITE_LOCAL then we must have site
6994 					 * scope in common.
6995 					 */
6996 					stc.site_scope = 1;
6997 				}
6998 				memcpy(&stc.laddress, &to_sin6->sin6_addr, sizeof(struct in6_addr));
6999 				stc.laddr_type = SCTP_IPV6_ADDRESS;
7000 				break;
7001 			}
7002 #endif
7003 		default:
7004 			/* TSNH */
7005 			goto do_a_abort;
7006 			break;
7007 		}
7008 	} else {
7009 		/* set the scope per the existing tcb */
7010 
7011 #ifdef INET6
7012 		struct sctp_nets *lnet;
7013 
7014 #endif
7015 
7016 		stc.loopback_scope = asoc->loopback_scope;
7017 		stc.ipv4_scope = asoc->ipv4_local_scope;
7018 		stc.site_scope = asoc->site_scope;
7019 		stc.local_scope = asoc->local_scope;
7020 #ifdef INET6
7021 		/* Why do we not consider IPv4 LL addresses? */
7022 		TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
7023 			if (lnet->ro._l_addr.sin6.sin6_family == AF_INET6) {
7024 				if (IN6_IS_ADDR_LINKLOCAL(&lnet->ro._l_addr.sin6.sin6_addr)) {
7025 					/*
7026 					 * if we have a LL address, start
7027 					 * counting at 1.
7028 					 */
7029 					cnt_inits_to = 1;
7030 				}
7031 			}
7032 		}
7033 #endif
7034 		/* use the net pointer */
7035 		to = (struct sockaddr *)&net->ro._l_addr;
7036 		switch (to->sa_family) {
7037 		case AF_INET:
7038 			sin = (struct sockaddr_in *)to;
7039 			stc.address[0] = sin->sin_addr.s_addr;
7040 			stc.address[1] = 0;
7041 			stc.address[2] = 0;
7042 			stc.address[3] = 0;
7043 			stc.addr_type = SCTP_IPV4_ADDRESS;
7044 			if (net->src_addr_selected == 0) {
7045 				/*
7046 				 * strange case here, the INIT should have
7047 				 * did the selection.
7048 				 */
7049 				net->ro._s_addr = sctp_source_address_selection(inp,
7050 				    stcb, (sctp_route_t *) & net->ro,
7051 				    net, 0, vrf_id);
7052 				if (net->ro._s_addr == NULL)
7053 					return;
7054 
7055 				net->src_addr_selected = 1;
7056 
7057 			}
7058 			stc.laddress[0] = net->ro._s_addr->address.sin.sin_addr.s_addr;
7059 			stc.laddress[1] = 0;
7060 			stc.laddress[2] = 0;
7061 			stc.laddress[3] = 0;
7062 			stc.laddr_type = SCTP_IPV4_ADDRESS;
7063 			break;
7064 #ifdef INET6
7065 		case AF_INET6:
7066 			sin6 = (struct sockaddr_in6 *)to;
7067 			memcpy(&stc.address, &sin6->sin6_addr,
7068 			    sizeof(struct in6_addr));
7069 			stc.addr_type = SCTP_IPV6_ADDRESS;
7070 			if (net->src_addr_selected == 0) {
7071 				/*
7072 				 * strange case here, the INIT should have
7073 				 * did the selection.
7074 				 */
7075 				net->ro._s_addr = sctp_source_address_selection(inp,
7076 				    stcb, (sctp_route_t *) & net->ro,
7077 				    net, 0, vrf_id);
7078 				if (net->ro._s_addr == NULL)
7079 					return;
7080 
7081 				net->src_addr_selected = 1;
7082 			}
7083 			memcpy(&stc.laddress, &net->ro._s_addr->address.sin6.sin6_addr,
7084 			    sizeof(struct in6_addr));
7085 			stc.laddr_type = SCTP_IPV6_ADDRESS;
7086 			break;
7087 #endif
7088 		}
7089 	}
7090 	/* Now lets put the SCTP header in place */
7091 	initack = mtod(m, struct sctp_init_ack_chunk *);
7092 	/* Save it off for quick ref */
7093 	stc.peers_vtag = init_chk->init.initiate_tag;
7094 	/* who are we */
7095 	memcpy(stc.identification, SCTP_VERSION_STRING,
7096 	    min(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
7097 	/* now the chunk header */
7098 	initack->ch.chunk_type = SCTP_INITIATION_ACK;
7099 	initack->ch.chunk_flags = 0;
7100 	/* fill in later from mbuf we build */
7101 	initack->ch.chunk_length = 0;
7102 	/* place in my tag */
7103 	if ((asoc != NULL) &&
7104 	    ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
7105 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_INUSE) ||
7106 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
7107 		/* re-use the v-tags and init-seq here */
7108 		initack->init.initiate_tag = htonl(asoc->my_vtag);
7109 		initack->init.initial_tsn = htonl(asoc->init_seq_number);
7110 	} else {
7111 		uint32_t vtag, itsn;
7112 
7113 		if (hold_inp_lock) {
7114 			SCTP_INP_INCR_REF(inp);
7115 			SCTP_INP_RUNLOCK(inp);
7116 		}
7117 		if (asoc) {
7118 			atomic_add_int(&asoc->refcnt, 1);
7119 			SCTP_TCB_UNLOCK(stcb);
7120 	new_tag:
7121 			vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1);
7122 			if ((asoc->peer_supports_nat) && (vtag == asoc->my_vtag)) {
7123 				/*
7124 				 * Got a duplicate vtag on some guy behind a
7125 				 * nat make sure we don't use it.
7126 				 */
7127 				goto new_tag;
7128 			}
7129 			initack->init.initiate_tag = htonl(vtag);
7130 			/* get a TSN to use too */
7131 			itsn = sctp_select_initial_TSN(&inp->sctp_ep);
7132 			initack->init.initial_tsn = htonl(itsn);
7133 			SCTP_TCB_LOCK(stcb);
7134 			atomic_add_int(&asoc->refcnt, -1);
7135 		} else {
7136 			vtag = sctp_select_a_tag(inp, inp->sctp_lport, sh->src_port, 1);
7137 			initack->init.initiate_tag = htonl(vtag);
7138 			/* get a TSN to use too */
7139 			initack->init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
7140 		}
7141 		if (hold_inp_lock) {
7142 			SCTP_INP_RLOCK(inp);
7143 			SCTP_INP_DECR_REF(inp);
7144 		}
7145 	}
7146 	/* save away my tag to */
7147 	stc.my_vtag = initack->init.initiate_tag;
7148 
7149 	/* set up some of the credits. */
7150 	so = inp->sctp_socket;
7151 	if (so == NULL) {
7152 		/* memory problem */
7153 		sctp_m_freem(m);
7154 		return;
7155 	} else {
7156 		initack->init.a_rwnd = htonl(max(SCTP_SB_LIMIT_RCV(so), SCTP_MINIMAL_RWND));
7157 	}
7158 	/* set what I want */
7159 	his_limit = ntohs(init_chk->init.num_inbound_streams);
7160 	/* choose what I want */
7161 	if (asoc != NULL) {
7162 		if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
7163 			i_want = asoc->streamoutcnt;
7164 		} else {
7165 			i_want = inp->sctp_ep.pre_open_stream_count;
7166 		}
7167 	} else {
7168 		i_want = inp->sctp_ep.pre_open_stream_count;
7169 	}
7170 	if (his_limit < i_want) {
7171 		/* I Want more :< */
7172 		initack->init.num_outbound_streams = init_chk->init.num_inbound_streams;
7173 	} else {
7174 		/* I can have what I want :> */
7175 		initack->init.num_outbound_streams = htons(i_want);
7176 	}
7177 	/* tell him his limt. */
7178 	initack->init.num_inbound_streams =
7179 	    htons(inp->sctp_ep.max_open_streams_intome);
7180 
7181 	/* adaptation layer indication parameter */
7182 	ali = (struct sctp_adaptation_layer_indication *)((caddr_t)initack + sizeof(*initack));
7183 	ali->ph.param_type = htons(SCTP_ULP_ADAPTATION);
7184 	ali->ph.param_length = htons(sizeof(*ali));
7185 	ali->indication = ntohl(inp->sctp_ep.adaptation_layer_indicator);
7186 	SCTP_BUF_LEN(m) += sizeof(*ali);
7187 	ecn = (struct sctp_ecn_supported_param *)((caddr_t)ali + sizeof(*ali));
7188 
7189 	/* ECN parameter */
7190 	if (SCTP_BASE_SYSCTL(sctp_ecn_enable) == 1) {
7191 		ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
7192 		ecn->ph.param_length = htons(sizeof(*ecn));
7193 		SCTP_BUF_LEN(m) += sizeof(*ecn);
7194 
7195 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn +
7196 		    sizeof(*ecn));
7197 	} else {
7198 		prsctp = (struct sctp_prsctp_supported_param *)((caddr_t)ecn);
7199 	}
7200 	/* And now tell the peer we do  pr-sctp */
7201 	prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
7202 	prsctp->ph.param_length = htons(sizeof(*prsctp));
7203 	SCTP_BUF_LEN(m) += sizeof(*prsctp);
7204 	if (nat_friendly) {
7205 		/* Add NAT friendly parameter */
7206 		struct sctp_paramhdr *ph;
7207 
7208 		ph = (struct sctp_paramhdr *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
7209 		ph->param_type = htons(SCTP_HAS_NAT_SUPPORT);
7210 		ph->param_length = htons(sizeof(struct sctp_paramhdr));
7211 		SCTP_BUF_LEN(m) += sizeof(struct sctp_paramhdr);
7212 	}
7213 	/* And now tell the peer we do all the extensions */
7214 	pr_supported = (struct sctp_supported_chunk_types_param *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
7215 	pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
7216 	num_ext = 0;
7217 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF;
7218 	pr_supported->chunk_types[num_ext++] = SCTP_ASCONF_ACK;
7219 	pr_supported->chunk_types[num_ext++] = SCTP_FORWARD_CUM_TSN;
7220 	pr_supported->chunk_types[num_ext++] = SCTP_PACKET_DROPPED;
7221 	pr_supported->chunk_types[num_ext++] = SCTP_STREAM_RESET;
7222 	if (!SCTP_BASE_SYSCTL(sctp_auth_disable))
7223 		pr_supported->chunk_types[num_ext++] = SCTP_AUTHENTICATION;
7224 	/*
7225 	 * EY  if the sysctl variable is set, tell the assoc. initiator that
7226 	 * we do nr_sack
7227 	 */
7228 	if (SCTP_BASE_SYSCTL(sctp_nr_sack_on_off))
7229 		pr_supported->chunk_types[num_ext++] = SCTP_NR_SELECTIVE_ACK;
7230 	p_len = sizeof(*pr_supported) + num_ext;
7231 	pr_supported->ph.param_length = htons(p_len);
7232 	bzero((caddr_t)pr_supported + p_len, SCTP_SIZE32(p_len) - p_len);
7233 	SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
7234 
7235 	/* ECN nonce: And now tell the peer we support ECN nonce */
7236 	if (SCTP_BASE_SYSCTL(sctp_ecn_nonce)) {
7237 		ecn_nonce = (struct sctp_ecn_nonce_supported_param *)
7238 		    ((caddr_t)pr_supported + SCTP_SIZE32(p_len));
7239 		ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
7240 		ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
7241 		SCTP_BUF_LEN(m) += sizeof(*ecn_nonce);
7242 	}
7243 	/* add authentication parameters */
7244 	if (!SCTP_BASE_SYSCTL(sctp_auth_disable)) {
7245 		struct sctp_auth_random *randp;
7246 		struct sctp_auth_hmac_algo *hmacs;
7247 		struct sctp_auth_chunk_list *chunks;
7248 		uint16_t random_len;
7249 
7250 		/* generate and add RANDOM parameter */
7251 		random_len = SCTP_AUTH_RANDOM_SIZE_DEFAULT;
7252 		randp = (struct sctp_auth_random *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
7253 		randp->ph.param_type = htons(SCTP_RANDOM);
7254 		p_len = sizeof(*randp) + random_len;
7255 		randp->ph.param_length = htons(p_len);
7256 		SCTP_READ_RANDOM(randp->random_data, random_len);
7257 		/* zero out any padding required */
7258 		bzero((caddr_t)randp + p_len, SCTP_SIZE32(p_len) - p_len);
7259 		SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
7260 
7261 		/* add HMAC_ALGO parameter */
7262 		hmacs = (struct sctp_auth_hmac_algo *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
7263 		p_len = sctp_serialize_hmaclist(inp->sctp_ep.local_hmacs,
7264 		    (uint8_t *) hmacs->hmac_ids);
7265 		if (p_len > 0) {
7266 			p_len += sizeof(*hmacs);
7267 			hmacs->ph.param_type = htons(SCTP_HMAC_LIST);
7268 			hmacs->ph.param_length = htons(p_len);
7269 			/* zero out any padding required */
7270 			bzero((caddr_t)hmacs + p_len, SCTP_SIZE32(p_len) - p_len);
7271 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
7272 		}
7273 		/* add CHUNKS parameter */
7274 		chunks = (struct sctp_auth_chunk_list *)(mtod(m, caddr_t)+SCTP_BUF_LEN(m));
7275 		p_len = sctp_serialize_auth_chunks(inp->sctp_ep.local_auth_chunks,
7276 		    chunks->chunk_types);
7277 		if (p_len > 0) {
7278 			p_len += sizeof(*chunks);
7279 			chunks->ph.param_type = htons(SCTP_CHUNK_LIST);
7280 			chunks->ph.param_length = htons(p_len);
7281 			/* zero out any padding required */
7282 			bzero((caddr_t)chunks + p_len, SCTP_SIZE32(p_len) - p_len);
7283 			SCTP_BUF_LEN(m) += SCTP_SIZE32(p_len);
7284 		}
7285 	}
7286 	m_at = m;
7287 	/* now the addresses */
7288 	{
7289 		struct sctp_scoping scp;
7290 
7291 		/*
7292 		 * To optimize this we could put the scoping stuff into a
7293 		 * structure and remove the individual uint8's from the stc
7294 		 * structure. Then we could just sifa in the address within
7295 		 * the stc.. but for now this is a quick hack to get the
7296 		 * address stuff teased apart.
7297 		 */
7298 		scp.ipv4_addr_legal = stc.ipv4_addr_legal;
7299 		scp.ipv6_addr_legal = stc.ipv6_addr_legal;
7300 		scp.loopback_scope = stc.loopback_scope;
7301 		scp.ipv4_local_scope = stc.ipv4_scope;
7302 		scp.local_scope = stc.local_scope;
7303 		scp.site_scope = stc.site_scope;
7304 		m_at = sctp_add_addresses_to_i_ia(inp, &scp, m_at, cnt_inits_to);
7305 	}
7306 
7307 	/* tack on the operational error if present */
7308 	if (op_err) {
7309 		struct mbuf *ol;
7310 		int llen;
7311 
7312 		llen = 0;
7313 		ol = op_err;
7314 		while (ol) {
7315 			llen += SCTP_BUF_LEN(ol);
7316 			ol = SCTP_BUF_NEXT(ol);
7317 		}
7318 		if (llen % 4) {
7319 			/* must add a pad to the param */
7320 			uint32_t cpthis = 0;
7321 			int padlen;
7322 
7323 			padlen = 4 - (llen % 4);
7324 			m_copyback(op_err, llen, padlen, (caddr_t)&cpthis);
7325 		}
7326 		while (SCTP_BUF_NEXT(m_at) != NULL) {
7327 			m_at = SCTP_BUF_NEXT(m_at);
7328 		}
7329 		SCTP_BUF_NEXT(m_at) = op_err;
7330 		while (SCTP_BUF_NEXT(m_at) != NULL) {
7331 			m_at = SCTP_BUF_NEXT(m_at);
7332 		}
7333 	}
7334 	/* pre-calulate the size and update pkt header and chunk header */
7335 	p_len = 0;
7336 	for (m_tmp = m; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) {
7337 		p_len += SCTP_BUF_LEN(m_tmp);
7338 		if (SCTP_BUF_NEXT(m_tmp) == NULL) {
7339 			/* m_tmp should now point to last one */
7340 			break;
7341 		}
7342 	}
7343 
7344 	/* Now we must build a cookie */
7345 	m_cookie = sctp_add_cookie(inp, init_pkt, offset, m, 0, &stc, &signature);
7346 	if (m_cookie == NULL) {
7347 		/* memory problem */
7348 		sctp_m_freem(m);
7349 		return;
7350 	}
7351 	/* Now append the cookie to the end and update the space/size */
7352 	SCTP_BUF_NEXT(m_tmp) = m_cookie;
7353 
7354 	for (m_tmp = m_cookie; m_tmp; m_tmp = SCTP_BUF_NEXT(m_tmp)) {
7355 		p_len += SCTP_BUF_LEN(m_tmp);
7356 		if (SCTP_BUF_NEXT(m_tmp) == NULL) {
7357 			/* m_tmp should now point to last one */
7358 			mp_last = m_tmp;
7359 			break;
7360 		}
7361 	}
7362 	/*
7363 	 * Place in the size, but we don't include the last pad (if any) in
7364 	 * the INIT-ACK.
7365 	 */
7366 	initack->ch.chunk_length = htons(p_len);
7367 
7368 	/*
7369 	 * Time to sign the cookie, we don't sign over the cookie signature
7370 	 * though thus we set trailer.
7371 	 */
7372 	(void)sctp_hmac_m(SCTP_HMAC,
7373 	    (uint8_t *) inp->sctp_ep.secret_key[(int)(inp->sctp_ep.current_secret_number)],
7374 	    SCTP_SECRET_SIZE, m_cookie, sizeof(struct sctp_paramhdr),
7375 	    (uint8_t *) signature, SCTP_SIGNATURE_SIZE);
7376 	/*
7377 	 * We sifa 0 here to NOT set IP_DF if its IPv4, we ignore the return
7378 	 * here since the timer will drive a retranmission.
7379 	 */
7380 	padval = p_len % 4;
7381 	if ((padval) && (mp_last)) {
7382 		/* see my previous comments on mp_last */
7383 		int ret;
7384 
7385 		ret = sctp_add_pad_tombuf(mp_last, (4 - padval));
7386 		if (ret) {
7387 			/* Houston we have a problem, no space */
7388 			sctp_m_freem(m);
7389 			return;
7390 		}
7391 		p_len += padval;
7392 	}
7393 	if (stc.loopback_scope) {
7394 		over_addr = &store1;
7395 	} else {
7396 		over_addr = NULL;
7397 	}
7398 
7399 	(void)sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, NULL, 0, 0,
7400 	    0, NULL, 0,
7401 	    inp->sctp_lport, sh->src_port, init_chk->init.initiate_tag,
7402 	    port, SCTP_SO_NOT_LOCKED, over_addr);
7403 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
7404 }
7405 
7406 
7407 void
7408 sctp_insert_on_wheel(struct sctp_tcb *stcb,
7409     struct sctp_association *asoc,
7410     struct sctp_stream_out *strq, int holds_lock)
7411 {
7412 	struct sctp_stream_out *stre, *strn;
7413 
7414 	if (holds_lock == 0) {
7415 		SCTP_TCB_SEND_LOCK(stcb);
7416 	}
7417 	if ((strq->next_spoke.tqe_next) ||
7418 	    (strq->next_spoke.tqe_prev)) {
7419 		/* already on wheel */
7420 		goto outof_here;
7421 	}
7422 	stre = TAILQ_FIRST(&asoc->out_wheel);
7423 	if (stre == NULL) {
7424 		/* only one on wheel */
7425 		TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
7426 		goto outof_here;
7427 	}
7428 	for (; stre; stre = strn) {
7429 		strn = TAILQ_NEXT(stre, next_spoke);
7430 		if (stre->stream_no > strq->stream_no) {
7431 			TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
7432 			goto outof_here;
7433 		} else if (stre->stream_no == strq->stream_no) {
7434 			/* huh, should not happen */
7435 			goto outof_here;
7436 		} else if (strn == NULL) {
7437 			/* next one is null */
7438 			TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
7439 			    next_spoke);
7440 		}
7441 	}
7442 outof_here:
7443 	if (holds_lock == 0) {
7444 		SCTP_TCB_SEND_UNLOCK(stcb);
7445 	}
7446 }
7447 
7448 static void
7449 sctp_remove_from_wheel(struct sctp_tcb *stcb,
7450     struct sctp_association *asoc,
7451     struct sctp_stream_out *strq)
7452 {
7453 	/* take off and then setup so we know it is not on the wheel */
7454 	SCTP_TCB_SEND_LOCK(stcb);
7455 	if (TAILQ_FIRST(&strq->outqueue)) {
7456 		/* more was added */
7457 		SCTP_TCB_SEND_UNLOCK(stcb);
7458 		return;
7459 	}
7460 	TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
7461 	strq->next_spoke.tqe_next = NULL;
7462 	strq->next_spoke.tqe_prev = NULL;
7463 	SCTP_TCB_SEND_UNLOCK(stcb);
7464 }
7465 
7466 static void
7467 sctp_prune_prsctp(struct sctp_tcb *stcb,
7468     struct sctp_association *asoc,
7469     struct sctp_sndrcvinfo *srcv,
7470     int dataout)
7471 {
7472 	int freed_spc = 0;
7473 	struct sctp_tmit_chunk *chk, *nchk;
7474 
7475 	SCTP_TCB_LOCK_ASSERT(stcb);
7476 	if ((asoc->peer_supports_prsctp) &&
7477 	    (asoc->sent_queue_cnt_removeable > 0)) {
7478 		TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
7479 			/*
7480 			 * Look for chunks marked with the PR_SCTP flag AND
7481 			 * the buffer space flag. If the one being sent is
7482 			 * equal or greater priority then purge the old one
7483 			 * and free some space.
7484 			 */
7485 			if (PR_SCTP_BUF_ENABLED(chk->flags)) {
7486 				/*
7487 				 * This one is PR-SCTP AND buffer space
7488 				 * limited type
7489 				 */
7490 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
7491 					/*
7492 					 * Lower numbers equates to higher
7493 					 * priority so if the one we are
7494 					 * looking at has a larger or equal
7495 					 * priority we want to drop the data
7496 					 * and NOT retransmit it.
7497 					 */
7498 					if (chk->data) {
7499 						/*
7500 						 * We release the book_size
7501 						 * if the mbuf is here
7502 						 */
7503 						int ret_spc;
7504 						int cause;
7505 
7506 						if (chk->sent > SCTP_DATAGRAM_UNSENT)
7507 							cause = SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT;
7508 						else
7509 							cause = SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_UNSENT;
7510 						ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
7511 						    cause,
7512 						    &asoc->sent_queue, SCTP_SO_LOCKED);
7513 						freed_spc += ret_spc;
7514 						if (freed_spc >= dataout) {
7515 							return;
7516 						}
7517 					}	/* if chunk was present */
7518 				}	/* if of sufficent priority */
7519 			}	/* if chunk has enabled */
7520 		}		/* tailqforeach */
7521 
7522 		chk = TAILQ_FIRST(&asoc->send_queue);
7523 		while (chk) {
7524 			nchk = TAILQ_NEXT(chk, sctp_next);
7525 			/* Here we must move to the sent queue and mark */
7526 			if (PR_SCTP_TTL_ENABLED(chk->flags)) {
7527 				if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
7528 					if (chk->data) {
7529 						/*
7530 						 * We release the book_size
7531 						 * if the mbuf is here
7532 						 */
7533 						int ret_spc;
7534 
7535 						ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
7536 						    SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_UNSENT,
7537 						    &asoc->send_queue, SCTP_SO_LOCKED);
7538 
7539 						freed_spc += ret_spc;
7540 						if (freed_spc >= dataout) {
7541 							return;
7542 						}
7543 					}	/* end if chk->data */
7544 				}	/* end if right class */
7545 			}	/* end if chk pr-sctp */
7546 			chk = nchk;
7547 		}		/* end while (chk) */
7548 	}			/* if enabled in asoc */
7549 }
7550 
7551 int
7552 sctp_get_frag_point(struct sctp_tcb *stcb,
7553     struct sctp_association *asoc)
7554 {
7555 	int siz, ovh;
7556 
7557 	/*
7558 	 * For endpoints that have both v6 and v4 addresses we must reserve
7559 	 * room for the ipv6 header, for those that are only dealing with V4
7560 	 * we use a larger frag point.
7561 	 */
7562 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
7563 		ovh = SCTP_MED_OVERHEAD;
7564 	} else {
7565 		ovh = SCTP_MED_V4_OVERHEAD;
7566 	}
7567 
7568 	if (stcb->asoc.sctp_frag_point > asoc->smallest_mtu)
7569 		siz = asoc->smallest_mtu - ovh;
7570 	else
7571 		siz = (stcb->asoc.sctp_frag_point - ovh);
7572 	/*
7573 	 * if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) {
7574 	 */
7575 	/* A data chunk MUST fit in a cluster */
7576 	/* siz = (MCLBYTES - sizeof(struct sctp_data_chunk)); */
7577 	/* } */
7578 
7579 	/* adjust for an AUTH chunk if DATA requires auth */
7580 	if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks))
7581 		siz -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
7582 
7583 	if (siz % 4) {
7584 		/* make it an even word boundary please */
7585 		siz -= (siz % 4);
7586 	}
7587 	return (siz);
7588 }
7589 
7590 static void
7591 sctp_set_prsctp_policy(struct sctp_tcb *stcb,
7592     struct sctp_stream_queue_pending *sp)
7593 {
7594 	sp->pr_sctp_on = 0;
7595 	if (stcb->asoc.peer_supports_prsctp) {
7596 		/*
7597 		 * We assume that the user wants PR_SCTP_TTL if the user
7598 		 * provides a positive lifetime but does not specify any
7599 		 * PR_SCTP policy. This is a BAD assumption and causes
7600 		 * problems at least with the U-Vancovers MPI folks. I will
7601 		 * change this to be no policy means NO PR-SCTP.
7602 		 */
7603 		if (PR_SCTP_ENABLED(sp->sinfo_flags)) {
7604 			sp->act_flags |= PR_SCTP_POLICY(sp->sinfo_flags);
7605 			sp->pr_sctp_on = 1;
7606 		} else {
7607 			return;
7608 		}
7609 		switch (PR_SCTP_POLICY(sp->sinfo_flags)) {
7610 		case CHUNK_FLAGS_PR_SCTP_BUF:
7611 			/*
7612 			 * Time to live is a priority stored in tv_sec when
7613 			 * doing the buffer drop thing.
7614 			 */
7615 			sp->ts.tv_sec = sp->timetolive;
7616 			sp->ts.tv_usec = 0;
7617 			break;
7618 		case CHUNK_FLAGS_PR_SCTP_TTL:
7619 			{
7620 				struct timeval tv;
7621 
7622 				(void)SCTP_GETTIME_TIMEVAL(&sp->ts);
7623 				tv.tv_sec = sp->timetolive / 1000;
7624 				tv.tv_usec = (sp->timetolive * 1000) % 1000000;
7625 				/*
7626 				 * TODO sctp_constants.h needs alternative
7627 				 * time macros when _KERNEL is undefined.
7628 				 */
7629 				timevaladd(&sp->ts, &tv);
7630 			}
7631 			break;
7632 		case CHUNK_FLAGS_PR_SCTP_RTX:
7633 			/*
7634 			 * Time to live is a the number or retransmissions
7635 			 * stored in tv_sec.
7636 			 */
7637 			sp->ts.tv_sec = sp->timetolive;
7638 			sp->ts.tv_usec = 0;
7639 			break;
7640 		default:
7641 			SCTPDBG(SCTP_DEBUG_USRREQ1,
7642 			    "Unknown PR_SCTP policy %u.\n",
7643 			    PR_SCTP_POLICY(sp->sinfo_flags));
7644 			break;
7645 		}
7646 	}
7647 }
7648 
7649 static int
7650 sctp_msg_append(struct sctp_tcb *stcb,
7651     struct sctp_nets *net,
7652     struct mbuf *m,
7653     struct sctp_sndrcvinfo *srcv, int hold_stcb_lock)
7654 {
7655 	int error = 0, holds_lock;
7656 	struct mbuf *at;
7657 	struct sctp_stream_queue_pending *sp = NULL;
7658 	struct sctp_stream_out *strm;
7659 
7660 	/*
7661 	 * Given an mbuf chain, put it into the association send queue and
7662 	 * place it on the wheel
7663 	 */
7664 	holds_lock = hold_stcb_lock;
7665 	if (srcv->sinfo_stream >= stcb->asoc.streamoutcnt) {
7666 		/* Invalid stream number */
7667 		SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
7668 		error = EINVAL;
7669 		goto out_now;
7670 	}
7671 	if ((stcb->asoc.stream_locked) &&
7672 	    (stcb->asoc.stream_locked_on != srcv->sinfo_stream)) {
7673 		SCTP_LTRACE_ERR_RET_PKT(m, NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
7674 		error = EINVAL;
7675 		goto out_now;
7676 	}
7677 	strm = &stcb->asoc.strmout[srcv->sinfo_stream];
7678 	/* Now can we send this? */
7679 	if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
7680 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
7681 	    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7682 	    (stcb->asoc.state & SCTP_STATE_SHUTDOWN_PENDING)) {
7683 		/* got data while shutting down */
7684 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
7685 		error = ECONNRESET;
7686 		goto out_now;
7687 	}
7688 	sctp_alloc_a_strmoq(stcb, sp);
7689 	if (sp == NULL) {
7690 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
7691 		error = ENOMEM;
7692 		goto out_now;
7693 	}
7694 	sp->sinfo_flags = srcv->sinfo_flags;
7695 	sp->timetolive = srcv->sinfo_timetolive;
7696 	sp->ppid = srcv->sinfo_ppid;
7697 	sp->context = srcv->sinfo_context;
7698 	sp->strseq = 0;
7699 	if (sp->sinfo_flags & SCTP_ADDR_OVER) {
7700 		sp->net = net;
7701 		sp->addr_over = 1;
7702 	} else {
7703 		sp->net = stcb->asoc.primary_destination;
7704 		sp->addr_over = 0;
7705 	}
7706 	atomic_add_int(&sp->net->ref_count, 1);
7707 	(void)SCTP_GETTIME_TIMEVAL(&sp->ts);
7708 	sp->stream = srcv->sinfo_stream;
7709 	sp->msg_is_complete = 1;
7710 	sp->sender_all_done = 1;
7711 	sp->some_taken = 0;
7712 	sp->data = m;
7713 	sp->tail_mbuf = NULL;
7714 	sp->length = 0;
7715 	at = m;
7716 	sctp_set_prsctp_policy(stcb, sp);
7717 	/*
7718 	 * We could in theory (for sendall) sifa the length in, but we would
7719 	 * still have to hunt through the chain since we need to setup the
7720 	 * tail_mbuf
7721 	 */
7722 	while (at) {
7723 		if (SCTP_BUF_NEXT(at) == NULL)
7724 			sp->tail_mbuf = at;
7725 		sp->length += SCTP_BUF_LEN(at);
7726 		at = SCTP_BUF_NEXT(at);
7727 	}
7728 	SCTP_TCB_SEND_LOCK(stcb);
7729 	sctp_snd_sb_alloc(stcb, sp->length);
7730 	atomic_add_int(&stcb->asoc.stream_queue_cnt, 1);
7731 	TAILQ_INSERT_TAIL(&strm->outqueue, sp, next);
7732 	if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
7733 		sp->strseq = strm->next_sequence_sent;
7734 		strm->next_sequence_sent++;
7735 	}
7736 	if ((strm->next_spoke.tqe_next == NULL) &&
7737 	    (strm->next_spoke.tqe_prev == NULL)) {
7738 		/* Not on wheel, insert */
7739 		sctp_insert_on_wheel(stcb, &stcb->asoc, strm, 1);
7740 	}
7741 	m = NULL;
7742 	SCTP_TCB_SEND_UNLOCK(stcb);
7743 out_now:
7744 	if (m) {
7745 		sctp_m_freem(m);
7746 	}
7747 	return (error);
7748 }
7749 
7750 
7751 static struct mbuf *
7752 sctp_copy_mbufchain(struct mbuf *clonechain,
7753     struct mbuf *outchain,
7754     struct mbuf **endofchain,
7755     int can_take_mbuf,
7756     int sizeofcpy,
7757     uint8_t copy_by_ref)
7758 {
7759 	struct mbuf *m;
7760 	struct mbuf *appendchain;
7761 	caddr_t cp;
7762 	int len;
7763 
7764 	if (endofchain == NULL) {
7765 		/* error */
7766 error_out:
7767 		if (outchain)
7768 			sctp_m_freem(outchain);
7769 		return (NULL);
7770 	}
7771 	if (can_take_mbuf) {
7772 		appendchain = clonechain;
7773 	} else {
7774 		if (!copy_by_ref &&
7775 		    (sizeofcpy <= (int)((((SCTP_BASE_SYSCTL(sctp_mbuf_threshold_count) - 1) * MLEN) + MHLEN)))
7776 		    ) {
7777 			/* Its not in a cluster */
7778 			if (*endofchain == NULL) {
7779 				/* lets get a mbuf cluster */
7780 				if (outchain == NULL) {
7781 					/* This is the general case */
7782 			new_mbuf:
7783 					outchain = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER);
7784 					if (outchain == NULL) {
7785 						goto error_out;
7786 					}
7787 					SCTP_BUF_LEN(outchain) = 0;
7788 					*endofchain = outchain;
7789 					/* get the prepend space */
7790 					SCTP_BUF_RESV_UF(outchain, (SCTP_FIRST_MBUF_RESV + 4));
7791 				} else {
7792 					/*
7793 					 * We really should not get a NULL
7794 					 * in endofchain
7795 					 */
7796 					/* find end */
7797 					m = outchain;
7798 					while (m) {
7799 						if (SCTP_BUF_NEXT(m) == NULL) {
7800 							*endofchain = m;
7801 							break;
7802 						}
7803 						m = SCTP_BUF_NEXT(m);
7804 					}
7805 					/* sanity */
7806 					if (*endofchain == NULL) {
7807 						/*
7808 						 * huh, TSNH XXX maybe we
7809 						 * should panic
7810 						 */
7811 						sctp_m_freem(outchain);
7812 						goto new_mbuf;
7813 					}
7814 				}
7815 				/* get the new end of length */
7816 				len = M_TRAILINGSPACE(*endofchain);
7817 			} else {
7818 				/* how much is left at the end? */
7819 				len = M_TRAILINGSPACE(*endofchain);
7820 			}
7821 			/* Find the end of the data, for appending */
7822 			cp = (mtod((*endofchain), caddr_t)+SCTP_BUF_LEN((*endofchain)));
7823 
7824 			/* Now lets copy it out */
7825 			if (len >= sizeofcpy) {
7826 				/* It all fits, copy it in */
7827 				m_copydata(clonechain, 0, sizeofcpy, cp);
7828 				SCTP_BUF_LEN((*endofchain)) += sizeofcpy;
7829 			} else {
7830 				/* fill up the end of the chain */
7831 				if (len > 0) {
7832 					m_copydata(clonechain, 0, len, cp);
7833 					SCTP_BUF_LEN((*endofchain)) += len;
7834 					/* now we need another one */
7835 					sizeofcpy -= len;
7836 				}
7837 				m = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_HEADER);
7838 				if (m == NULL) {
7839 					/* We failed */
7840 					goto error_out;
7841 				}
7842 				SCTP_BUF_NEXT((*endofchain)) = m;
7843 				*endofchain = m;
7844 				cp = mtod((*endofchain), caddr_t);
7845 				m_copydata(clonechain, len, sizeofcpy, cp);
7846 				SCTP_BUF_LEN((*endofchain)) += sizeofcpy;
7847 			}
7848 			return (outchain);
7849 		} else {
7850 			/* copy the old fashion way */
7851 			appendchain = SCTP_M_COPYM(clonechain, 0, M_COPYALL, M_DONTWAIT);
7852 #ifdef SCTP_MBUF_LOGGING
7853 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
7854 				struct mbuf *mat;
7855 
7856 				mat = appendchain;
7857 				while (mat) {
7858 					if (SCTP_BUF_IS_EXTENDED(mat)) {
7859 						sctp_log_mb(mat, SCTP_MBUF_ICOPY);
7860 					}
7861 					mat = SCTP_BUF_NEXT(mat);
7862 				}
7863 			}
7864 #endif
7865 		}
7866 	}
7867 	if (appendchain == NULL) {
7868 		/* error */
7869 		if (outchain)
7870 			sctp_m_freem(outchain);
7871 		return (NULL);
7872 	}
7873 	if (outchain) {
7874 		/* tack on to the end */
7875 		if (*endofchain != NULL) {
7876 			SCTP_BUF_NEXT(((*endofchain))) = appendchain;
7877 		} else {
7878 			m = outchain;
7879 			while (m) {
7880 				if (SCTP_BUF_NEXT(m) == NULL) {
7881 					SCTP_BUF_NEXT(m) = appendchain;
7882 					break;
7883 				}
7884 				m = SCTP_BUF_NEXT(m);
7885 			}
7886 		}
7887 		/*
7888 		 * save off the end and update the end-chain postion
7889 		 */
7890 		m = appendchain;
7891 		while (m) {
7892 			if (SCTP_BUF_NEXT(m) == NULL) {
7893 				*endofchain = m;
7894 				break;
7895 			}
7896 			m = SCTP_BUF_NEXT(m);
7897 		}
7898 		return (outchain);
7899 	} else {
7900 		/* save off the end and update the end-chain postion */
7901 		m = appendchain;
7902 		while (m) {
7903 			if (SCTP_BUF_NEXT(m) == NULL) {
7904 				*endofchain = m;
7905 				break;
7906 			}
7907 			m = SCTP_BUF_NEXT(m);
7908 		}
7909 		return (appendchain);
7910 	}
7911 }
7912 
7913 int
7914 sctp_med_chunk_output(struct sctp_inpcb *inp,
7915     struct sctp_tcb *stcb,
7916     struct sctp_association *asoc,
7917     int *num_out,
7918     int *reason_code,
7919     int control_only, int *cwnd_full, int from_where,
7920     struct timeval *now, int *now_filled, int frag_point, int so_locked
7921 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
7922     SCTP_UNUSED
7923 #endif
7924 );
7925 
7926 static void
7927 sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr,
7928     uint32_t val)
7929 {
7930 	struct sctp_copy_all *ca;
7931 	struct mbuf *m;
7932 	int ret = 0;
7933 	int added_control = 0;
7934 	int un_sent, do_chunk_output = 1;
7935 	struct sctp_association *asoc;
7936 
7937 	ca = (struct sctp_copy_all *)ptr;
7938 	if (ca->m == NULL) {
7939 		return;
7940 	}
7941 	if (ca->inp != inp) {
7942 		/* TSNH */
7943 		return;
7944 	}
7945 	if ((ca->m) && ca->sndlen) {
7946 		m = SCTP_M_COPYM(ca->m, 0, M_COPYALL, M_DONTWAIT);
7947 		if (m == NULL) {
7948 			/* can't copy so we are done */
7949 			ca->cnt_failed++;
7950 			return;
7951 		}
7952 #ifdef SCTP_MBUF_LOGGING
7953 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
7954 			struct mbuf *mat;
7955 
7956 			mat = m;
7957 			while (mat) {
7958 				if (SCTP_BUF_IS_EXTENDED(mat)) {
7959 					sctp_log_mb(mat, SCTP_MBUF_ICOPY);
7960 				}
7961 				mat = SCTP_BUF_NEXT(mat);
7962 			}
7963 		}
7964 #endif
7965 	} else {
7966 		m = NULL;
7967 	}
7968 	SCTP_TCB_LOCK_ASSERT(stcb);
7969 	if (ca->sndrcv.sinfo_flags & SCTP_ABORT) {
7970 		/* Abort this assoc with m as the user defined reason */
7971 		if (m) {
7972 			struct sctp_paramhdr *ph;
7973 
7974 			SCTP_BUF_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT);
7975 			if (m) {
7976 				ph = mtod(m, struct sctp_paramhdr *);
7977 				ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
7978 				ph->param_length = htons(ca->sndlen);
7979 			}
7980 			/*
7981 			 * We add one here to keep the assoc from
7982 			 * dis-appearing on us.
7983 			 */
7984 			atomic_add_int(&stcb->asoc.refcnt, 1);
7985 			sctp_abort_an_association(inp, stcb,
7986 			    SCTP_RESPONSE_TO_USER_REQ,
7987 			    m, SCTP_SO_NOT_LOCKED);
7988 			/*
7989 			 * sctp_abort_an_association calls sctp_free_asoc()
7990 			 * free association will NOT free it since we
7991 			 * incremented the refcnt .. we do this to prevent
7992 			 * it being freed and things getting tricky since we
7993 			 * could end up (from free_asoc) calling inpcb_free
7994 			 * which would get a recursive lock call to the
7995 			 * iterator lock.. But as a consequence of that the
7996 			 * stcb will return to us un-locked.. since
7997 			 * free_asoc returns with either no TCB or the TCB
7998 			 * unlocked, we must relock.. to unlock in the
7999 			 * iterator timer :-0
8000 			 */
8001 			SCTP_TCB_LOCK(stcb);
8002 			atomic_add_int(&stcb->asoc.refcnt, -1);
8003 			goto no_chunk_output;
8004 		}
8005 	} else {
8006 		if (m) {
8007 			ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m,
8008 			    &ca->sndrcv, 1);
8009 		}
8010 		asoc = &stcb->asoc;
8011 		if (ca->sndrcv.sinfo_flags & SCTP_EOF) {
8012 			/* shutdown this assoc */
8013 			int cnt;
8014 
8015 			cnt = sctp_is_there_unsent_data(stcb);
8016 
8017 			if (TAILQ_EMPTY(&asoc->send_queue) &&
8018 			    TAILQ_EMPTY(&asoc->sent_queue) &&
8019 			    (cnt == 0)) {
8020 				if (asoc->locked_on_sending) {
8021 					goto abort_anyway;
8022 				}
8023 				/*
8024 				 * there is nothing queued to send, so I'm
8025 				 * done...
8026 				 */
8027 				if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
8028 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
8029 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
8030 					/*
8031 					 * only send SHUTDOWN the first time
8032 					 * through
8033 					 */
8034 					sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
8035 					if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
8036 						SCTP_STAT_DECR_GAUGE32(sctps_currestab);
8037 					}
8038 					SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
8039 					SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
8040 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
8041 					    asoc->primary_destination);
8042 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
8043 					    asoc->primary_destination);
8044 					added_control = 1;
8045 					do_chunk_output = 0;
8046 				}
8047 			} else {
8048 				/*
8049 				 * we still got (or just got) data to send,
8050 				 * so set SHUTDOWN_PENDING
8051 				 */
8052 				/*
8053 				 * XXX sockets draft says that SCTP_EOF
8054 				 * should be sent with no data.  currently,
8055 				 * we will allow user data to be sent first
8056 				 * and move to SHUTDOWN-PENDING
8057 				 */
8058 				if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
8059 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
8060 				    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
8061 					if (asoc->locked_on_sending) {
8062 						/*
8063 						 * Locked to send out the
8064 						 * data
8065 						 */
8066 						struct sctp_stream_queue_pending *sp;
8067 
8068 						sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead);
8069 						if (sp) {
8070 							if ((sp->length == 0) && (sp->msg_is_complete == 0))
8071 								asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
8072 						}
8073 					}
8074 					asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
8075 					if (TAILQ_EMPTY(&asoc->send_queue) &&
8076 					    TAILQ_EMPTY(&asoc->sent_queue) &&
8077 					    (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
8078 				abort_anyway:
8079 						atomic_add_int(&stcb->asoc.refcnt, 1);
8080 						sctp_abort_an_association(stcb->sctp_ep, stcb,
8081 						    SCTP_RESPONSE_TO_USER_REQ,
8082 						    NULL, SCTP_SO_NOT_LOCKED);
8083 						atomic_add_int(&stcb->asoc.refcnt, -1);
8084 						goto no_chunk_output;
8085 					}
8086 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
8087 					    asoc->primary_destination);
8088 				}
8089 			}
8090 
8091 		}
8092 	}
8093 	un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
8094 	    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
8095 
8096 	if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) &&
8097 	    (stcb->asoc.total_flight > 0) &&
8098 	    (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))
8099 	    ) {
8100 		do_chunk_output = 0;
8101 	}
8102 	if (do_chunk_output)
8103 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_NOT_LOCKED);
8104 	else if (added_control) {
8105 		int num_out = 0, reason = 0, cwnd_full = 0, now_filled = 0;
8106 		struct timeval now;
8107 		int frag_point;
8108 
8109 		frag_point = sctp_get_frag_point(stcb, &stcb->asoc);
8110 		(void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
8111 		    &reason, 1, &cwnd_full, 1, &now, &now_filled, frag_point, SCTP_SO_NOT_LOCKED);
8112 	}
8113 no_chunk_output:
8114 	if (ret) {
8115 		ca->cnt_failed++;
8116 	} else {
8117 		ca->cnt_sent++;
8118 	}
8119 }
8120 
8121 static void
8122 sctp_sendall_completes(void *ptr, uint32_t val)
8123 {
8124 	struct sctp_copy_all *ca;
8125 
8126 	ca = (struct sctp_copy_all *)ptr;
8127 	/*
8128 	 * Do a notify here? Kacheong suggests that the notify be done at
8129 	 * the send time.. so you would push up a notification if any send
8130 	 * failed. Don't know if this is feasable since the only failures we
8131 	 * have is "memory" related and if you cannot get an mbuf to send
8132 	 * the data you surely can't get an mbuf to send up to notify the
8133 	 * user you can't send the data :->
8134 	 */
8135 
8136 	/* now free everything */
8137 	sctp_m_freem(ca->m);
8138 	SCTP_FREE(ca, SCTP_M_COPYAL);
8139 }
8140 
8141 
8142 #define	MC_ALIGN(m, len) do {						\
8143 	SCTP_BUF_RESV_UF(m, ((MCLBYTES - (len)) & ~(sizeof(long) - 1));	\
8144 } while (0)
8145 
8146 
8147 
8148 static struct mbuf *
8149 sctp_copy_out_all(struct uio *uio, int len)
8150 {
8151 	struct mbuf *ret, *at;
8152 	int left, willcpy, cancpy, error;
8153 
8154 	ret = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_WAIT, 1, MT_DATA);
8155 	if (ret == NULL) {
8156 		/* TSNH */
8157 		return (NULL);
8158 	}
8159 	left = len;
8160 	SCTP_BUF_LEN(ret) = 0;
8161 	/* save space for the data chunk header */
8162 	cancpy = M_TRAILINGSPACE(ret);
8163 	willcpy = min(cancpy, left);
8164 	at = ret;
8165 	while (left > 0) {
8166 		/* Align data to the end */
8167 		error = uiomove(mtod(at, caddr_t), willcpy, uio);
8168 		if (error) {
8169 	err_out_now:
8170 			sctp_m_freem(at);
8171 			return (NULL);
8172 		}
8173 		SCTP_BUF_LEN(at) = willcpy;
8174 		SCTP_BUF_NEXT_PKT(at) = SCTP_BUF_NEXT(at) = 0;
8175 		left -= willcpy;
8176 		if (left > 0) {
8177 			SCTP_BUF_NEXT(at) = sctp_get_mbuf_for_msg(left, 0, M_WAIT, 1, MT_DATA);
8178 			if (SCTP_BUF_NEXT(at) == NULL) {
8179 				goto err_out_now;
8180 			}
8181 			at = SCTP_BUF_NEXT(at);
8182 			SCTP_BUF_LEN(at) = 0;
8183 			cancpy = M_TRAILINGSPACE(at);
8184 			willcpy = min(cancpy, left);
8185 		}
8186 	}
8187 	return (ret);
8188 }
8189 
8190 static int
8191 sctp_sendall(struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m,
8192     struct sctp_sndrcvinfo *srcv)
8193 {
8194 	int ret;
8195 	struct sctp_copy_all *ca;
8196 
8197 	SCTP_MALLOC(ca, struct sctp_copy_all *, sizeof(struct sctp_copy_all),
8198 	    SCTP_M_COPYAL);
8199 	if (ca == NULL) {
8200 		sctp_m_freem(m);
8201 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
8202 		return (ENOMEM);
8203 	}
8204 	memset(ca, 0, sizeof(struct sctp_copy_all));
8205 
8206 	ca->inp = inp;
8207 	memcpy(&ca->sndrcv, srcv, sizeof(struct sctp_nonpad_sndrcvinfo));
8208 	/*
8209 	 * take off the sendall flag, it would be bad if we failed to do
8210 	 * this :-0
8211 	 */
8212 	ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL;
8213 	/* get length and mbuf chain */
8214 	if (uio) {
8215 		ca->sndlen = uio->uio_resid;
8216 		ca->m = sctp_copy_out_all(uio, ca->sndlen);
8217 		if (ca->m == NULL) {
8218 			SCTP_FREE(ca, SCTP_M_COPYAL);
8219 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
8220 			return (ENOMEM);
8221 		}
8222 	} else {
8223 		/* Gather the length of the send */
8224 		struct mbuf *mat;
8225 
8226 		mat = m;
8227 		ca->sndlen = 0;
8228 		while (m) {
8229 			ca->sndlen += SCTP_BUF_LEN(m);
8230 			m = SCTP_BUF_NEXT(m);
8231 		}
8232 		ca->m = mat;
8233 	}
8234 	ret = sctp_initiate_iterator(NULL, sctp_sendall_iterator, NULL,
8235 	    SCTP_PCB_ANY_FLAGS, SCTP_PCB_ANY_FEATURES,
8236 	    SCTP_ASOC_ANY_STATE,
8237 	    (void *)ca, 0,
8238 	    sctp_sendall_completes, inp, 1);
8239 	if (ret) {
8240 		SCTP_PRINTF("Failed to initiate iterator for sendall\n");
8241 		SCTP_FREE(ca, SCTP_M_COPYAL);
8242 		SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
8243 		return (EFAULT);
8244 	}
8245 	return (0);
8246 }
8247 
8248 
8249 void
8250 sctp_toss_old_cookies(struct sctp_tcb *stcb, struct sctp_association *asoc)
8251 {
8252 	struct sctp_tmit_chunk *chk, *nchk;
8253 
8254 	chk = TAILQ_FIRST(&asoc->control_send_queue);
8255 	while (chk) {
8256 		nchk = TAILQ_NEXT(chk, sctp_next);
8257 		if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
8258 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
8259 			if (chk->data) {
8260 				sctp_m_freem(chk->data);
8261 				chk->data = NULL;
8262 			}
8263 			asoc->ctrl_queue_cnt--;
8264 			sctp_free_a_chunk(stcb, chk);
8265 		}
8266 		chk = nchk;
8267 	}
8268 }
8269 
8270 void
8271 sctp_toss_old_asconf(struct sctp_tcb *stcb)
8272 {
8273 	struct sctp_association *asoc;
8274 	struct sctp_tmit_chunk *chk, *chk_tmp;
8275 	struct sctp_asconf_chunk *acp;
8276 
8277 	asoc = &stcb->asoc;
8278 	for (chk = TAILQ_FIRST(&asoc->asconf_send_queue); chk != NULL;
8279 	    chk = chk_tmp) {
8280 		/* get next chk */
8281 		chk_tmp = TAILQ_NEXT(chk, sctp_next);
8282 		/* find SCTP_ASCONF chunk in queue */
8283 		if (chk->rec.chunk_id.id == SCTP_ASCONF) {
8284 			if (chk->data) {
8285 				acp = mtod(chk->data, struct sctp_asconf_chunk *);
8286 				if (compare_with_wrap(ntohl(acp->serial_number), stcb->asoc.asconf_seq_out_acked, MAX_SEQ)) {
8287 					/* Not Acked yet */
8288 					break;
8289 				}
8290 			}
8291 			TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next);
8292 			if (chk->data) {
8293 				sctp_m_freem(chk->data);
8294 				chk->data = NULL;
8295 			}
8296 			asoc->ctrl_queue_cnt--;
8297 			sctp_free_a_chunk(stcb, chk);
8298 		}
8299 	}
8300 }
8301 
8302 
8303 static void
8304 sctp_clean_up_datalist(struct sctp_tcb *stcb,
8305 
8306     struct sctp_association *asoc,
8307     struct sctp_tmit_chunk **data_list,
8308     int bundle_at,
8309     struct sctp_nets *net)
8310 {
8311 	int i;
8312 	struct sctp_tmit_chunk *tp1;
8313 
8314 	for (i = 0; i < bundle_at; i++) {
8315 		/* off of the send queue */
8316 		if (i) {
8317 			/*
8318 			 * Any chunk NOT 0 you zap the time chunk 0 gets
8319 			 * zapped or set based on if a RTO measurment is
8320 			 * needed.
8321 			 */
8322 			data_list[i]->do_rtt = 0;
8323 		}
8324 		/* record time */
8325 		data_list[i]->sent_rcv_time = net->last_sent_time;
8326 		data_list[i]->rec.data.fast_retran_tsn = data_list[i]->rec.data.TSN_seq;
8327 		TAILQ_REMOVE(&asoc->send_queue,
8328 		    data_list[i],
8329 		    sctp_next);
8330 		/* on to the sent queue */
8331 		tp1 = TAILQ_LAST(&asoc->sent_queue, sctpchunk_listhead);
8332 		if ((tp1) && (compare_with_wrap(tp1->rec.data.TSN_seq,
8333 		    data_list[i]->rec.data.TSN_seq, MAX_TSN))) {
8334 			struct sctp_tmit_chunk *tpp;
8335 
8336 			/* need to move back */
8337 	back_up_more:
8338 			tpp = TAILQ_PREV(tp1, sctpchunk_listhead, sctp_next);
8339 			if (tpp == NULL) {
8340 				TAILQ_INSERT_BEFORE(tp1, data_list[i], sctp_next);
8341 				goto all_done;
8342 			}
8343 			tp1 = tpp;
8344 			if (compare_with_wrap(tp1->rec.data.TSN_seq,
8345 			    data_list[i]->rec.data.TSN_seq, MAX_TSN)) {
8346 				goto back_up_more;
8347 			}
8348 			TAILQ_INSERT_AFTER(&asoc->sent_queue, tp1, data_list[i], sctp_next);
8349 		} else {
8350 			TAILQ_INSERT_TAIL(&asoc->sent_queue,
8351 			    data_list[i],
8352 			    sctp_next);
8353 		}
8354 all_done:
8355 		/* This does not lower until the cum-ack passes it */
8356 		asoc->sent_queue_cnt++;
8357 		asoc->send_queue_cnt--;
8358 		if ((asoc->peers_rwnd <= 0) &&
8359 		    (asoc->total_flight == 0) &&
8360 		    (bundle_at == 1)) {
8361 			/* Mark the chunk as being a window probe */
8362 			SCTP_STAT_INCR(sctps_windowprobed);
8363 		}
8364 #ifdef SCTP_AUDITING_ENABLED
8365 		sctp_audit_log(0xC2, 3);
8366 #endif
8367 		data_list[i]->sent = SCTP_DATAGRAM_SENT;
8368 		data_list[i]->snd_count = 1;
8369 		data_list[i]->rec.data.chunk_was_revoked = 0;
8370 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
8371 			sctp_misc_ints(SCTP_FLIGHT_LOG_UP,
8372 			    data_list[i]->whoTo->flight_size,
8373 			    data_list[i]->book_size,
8374 			    (uintptr_t) data_list[i]->whoTo,
8375 			    data_list[i]->rec.data.TSN_seq);
8376 		}
8377 		sctp_flight_size_increase(data_list[i]);
8378 		sctp_total_flight_increase(stcb, data_list[i]);
8379 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
8380 			sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
8381 			    asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
8382 		}
8383 		asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
8384 		    (uint32_t) (data_list[i]->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)));
8385 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
8386 			/* SWS sender side engages */
8387 			asoc->peers_rwnd = 0;
8388 		}
8389 	}
8390 }
8391 
8392 static void
8393 sctp_clean_up_ctl(struct sctp_tcb *stcb, struct sctp_association *asoc)
8394 {
8395 	struct sctp_tmit_chunk *chk, *nchk;
8396 
8397 	for (chk = TAILQ_FIRST(&asoc->control_send_queue);
8398 	    chk; chk = nchk) {
8399 		nchk = TAILQ_NEXT(chk, sctp_next);
8400 		if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) ||
8401 		    (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) ||	/* EY */
8402 		    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) ||
8403 		    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) ||
8404 		    (chk->rec.chunk_id.id == SCTP_SHUTDOWN) ||
8405 		    (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) ||
8406 		    (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) ||
8407 		    (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) ||
8408 		    (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) ||
8409 		    (chk->rec.chunk_id.id == SCTP_ECN_CWR) ||
8410 		    (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) {
8411 			/* Stray chunks must be cleaned up */
8412 	clean_up_anyway:
8413 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
8414 			if (chk->data) {
8415 				sctp_m_freem(chk->data);
8416 				chk->data = NULL;
8417 			}
8418 			asoc->ctrl_queue_cnt--;
8419 			sctp_free_a_chunk(stcb, chk);
8420 		} else if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) {
8421 			/* special handling, we must look into the param */
8422 			if (chk != asoc->str_reset) {
8423 				goto clean_up_anyway;
8424 			}
8425 		}
8426 	}
8427 }
8428 
8429 
8430 static int
8431 sctp_can_we_split_this(struct sctp_tcb *stcb,
8432     uint32_t length,
8433     uint32_t goal_mtu, uint32_t frag_point, int eeor_on)
8434 {
8435 	/*
8436 	 * Make a decision on if I should split a msg into multiple parts.
8437 	 * This is only asked of incomplete messages.
8438 	 */
8439 	if (eeor_on) {
8440 		/*
8441 		 * If we are doing EEOR we need to always send it if its the
8442 		 * entire thing, since it might be all the guy is putting in
8443 		 * the hopper.
8444 		 */
8445 		if (goal_mtu >= length) {
8446 			/*-
8447 			 * If we have data outstanding,
8448 			 * we get another chance when the sack
8449 			 * arrives to transmit - wait for more data
8450 			 */
8451 			if (stcb->asoc.total_flight == 0) {
8452 				/*
8453 				 * If nothing is in flight, we zero the
8454 				 * packet counter.
8455 				 */
8456 				return (length);
8457 			}
8458 			return (0);
8459 
8460 		} else {
8461 			/* You can fill the rest */
8462 			return (goal_mtu);
8463 		}
8464 	}
8465 	/*-
8466 	 * For those strange folk that make the send buffer
8467 	 * smaller than our fragmentation point, we can't
8468 	 * get a full msg in so we have to allow splitting.
8469 	 */
8470 	if (SCTP_SB_LIMIT_SND(stcb->sctp_socket) < frag_point) {
8471 		return (length);
8472 	}
8473 	if ((length <= goal_mtu) ||
8474 	    ((length - goal_mtu) < SCTP_BASE_SYSCTL(sctp_min_residual))) {
8475 		/* Sub-optimial residual don't split in non-eeor mode. */
8476 		return (0);
8477 	}
8478 	/*
8479 	 * If we reach here length is larger than the goal_mtu. Do we wish
8480 	 * to split it for the sake of packet putting together?
8481 	 */
8482 	if (goal_mtu >= min(SCTP_BASE_SYSCTL(sctp_min_split_point), frag_point)) {
8483 		/* Its ok to split it */
8484 		return (min(goal_mtu, frag_point));
8485 	}
8486 	/* Nope, can't split */
8487 	return (0);
8488 
8489 }
8490 
8491 static uint32_t
8492 sctp_move_to_outqueue(struct sctp_tcb *stcb, struct sctp_nets *net,
8493     struct sctp_stream_out *strq,
8494     uint32_t goal_mtu,
8495     uint32_t frag_point,
8496     int *locked,
8497     int *giveup,
8498     int eeor_mode,
8499     int *bail)
8500 {
8501 	/* Move from the stream to the send_queue keeping track of the total */
8502 	struct sctp_association *asoc;
8503 	struct sctp_stream_queue_pending *sp;
8504 	struct sctp_tmit_chunk *chk;
8505 	struct sctp_data_chunk *dchkh;
8506 	uint32_t to_move, length;
8507 	uint8_t rcv_flags = 0;
8508 	uint8_t some_taken;
8509 	uint8_t send_lock_up = 0;
8510 
8511 	SCTP_TCB_LOCK_ASSERT(stcb);
8512 	asoc = &stcb->asoc;
8513 one_more_time:
8514 	/* sa_ignore FREED_MEMORY */
8515 	sp = TAILQ_FIRST(&strq->outqueue);
8516 	if (sp == NULL) {
8517 		*locked = 0;
8518 		if (send_lock_up == 0) {
8519 			SCTP_TCB_SEND_LOCK(stcb);
8520 			send_lock_up = 1;
8521 		}
8522 		sp = TAILQ_FIRST(&strq->outqueue);
8523 		if (sp) {
8524 			goto one_more_time;
8525 		}
8526 		if (strq->last_msg_incomplete) {
8527 			SCTP_PRINTF("Huh? Stream:%d lm_in_c=%d but queue is NULL\n",
8528 			    strq->stream_no,
8529 			    strq->last_msg_incomplete);
8530 			strq->last_msg_incomplete = 0;
8531 		}
8532 		to_move = 0;
8533 		if (send_lock_up) {
8534 			SCTP_TCB_SEND_UNLOCK(stcb);
8535 			send_lock_up = 0;
8536 		}
8537 		goto out_of;
8538 	}
8539 	if ((sp->msg_is_complete) && (sp->length == 0)) {
8540 		if (sp->sender_all_done) {
8541 			/*
8542 			 * We are doing differed cleanup. Last time through
8543 			 * when we took all the data the sender_all_done was
8544 			 * not set.
8545 			 */
8546 			if (sp->put_last_out == 0) {
8547 				SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
8548 				SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n",
8549 				    sp->sender_all_done,
8550 				    sp->length,
8551 				    sp->msg_is_complete,
8552 				    sp->put_last_out,
8553 				    send_lock_up);
8554 			}
8555 			if ((TAILQ_NEXT(sp, next) == NULL) && (send_lock_up == 0)) {
8556 				SCTP_TCB_SEND_LOCK(stcb);
8557 				send_lock_up = 1;
8558 			}
8559 			atomic_subtract_int(&asoc->stream_queue_cnt, 1);
8560 			TAILQ_REMOVE(&strq->outqueue, sp, next);
8561 			sctp_free_remote_addr(sp->net);
8562 			if (sp->data) {
8563 				sctp_m_freem(sp->data);
8564 				sp->data = NULL;
8565 			}
8566 			sctp_free_a_strmoq(stcb, sp);
8567 
8568 			/* we can't be locked to it */
8569 			*locked = 0;
8570 			stcb->asoc.locked_on_sending = NULL;
8571 			if (send_lock_up) {
8572 				SCTP_TCB_SEND_UNLOCK(stcb);
8573 				send_lock_up = 0;
8574 			}
8575 			/* back to get the next msg */
8576 			goto one_more_time;
8577 		} else {
8578 			/*
8579 			 * sender just finished this but still holds a
8580 			 * reference
8581 			 */
8582 			*locked = 1;
8583 			*giveup = 1;
8584 			to_move = 0;
8585 			goto out_of;
8586 		}
8587 	} else {
8588 		/* is there some to get */
8589 		if (sp->length == 0) {
8590 			/* no */
8591 			*locked = 1;
8592 			*giveup = 1;
8593 			to_move = 0;
8594 			goto out_of;
8595 		}
8596 	}
8597 	some_taken = sp->some_taken;
8598 	if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
8599 		sp->msg_is_complete = 1;
8600 	}
8601 re_look:
8602 	length = sp->length;
8603 	if (sp->msg_is_complete) {
8604 		/* The message is complete */
8605 		to_move = min(length, frag_point);
8606 		if (to_move == length) {
8607 			/* All of it fits in the MTU */
8608 			if (sp->some_taken) {
8609 				rcv_flags |= SCTP_DATA_LAST_FRAG;
8610 				sp->put_last_out = 1;
8611 			} else {
8612 				rcv_flags |= SCTP_DATA_NOT_FRAG;
8613 				sp->put_last_out = 1;
8614 			}
8615 		} else {
8616 			/* Not all of it fits, we fragment */
8617 			if (sp->some_taken == 0) {
8618 				rcv_flags |= SCTP_DATA_FIRST_FRAG;
8619 			}
8620 			sp->some_taken = 1;
8621 		}
8622 	} else {
8623 		to_move = sctp_can_we_split_this(stcb, length, goal_mtu,
8624 		    frag_point, eeor_mode);
8625 		if (to_move) {
8626 			/*-
8627 		         * We use a snapshot of length in case it
8628 		         * is expanding during the compare.
8629 		         */
8630 			uint32_t llen;
8631 
8632 			llen = length;
8633 			if (to_move >= llen) {
8634 				to_move = llen;
8635 				if (send_lock_up == 0) {
8636 					/*-
8637 				         * We are taking all of an incomplete msg
8638 				         * thus we need a send lock.
8639 				         */
8640 					SCTP_TCB_SEND_LOCK(stcb);
8641 					send_lock_up = 1;
8642 					if (sp->msg_is_complete) {
8643 						/*
8644 						 * the sender finished the
8645 						 * msg
8646 						 */
8647 						goto re_look;
8648 					}
8649 				}
8650 			}
8651 			if (sp->some_taken == 0) {
8652 				rcv_flags |= SCTP_DATA_FIRST_FRAG;
8653 				sp->some_taken = 1;
8654 			}
8655 		} else {
8656 			/* Nothing to take. */
8657 			if (sp->some_taken) {
8658 				*locked = 1;
8659 			}
8660 			*giveup = 1;
8661 			to_move = 0;
8662 			goto out_of;
8663 		}
8664 	}
8665 
8666 	/* If we reach here, we can copy out a chunk */
8667 	sctp_alloc_a_chunk(stcb, chk);
8668 	if (chk == NULL) {
8669 		/* No chunk memory */
8670 		*giveup = 1;
8671 		to_move = 0;
8672 		goto out_of;
8673 	}
8674 	/*
8675 	 * Setup for unordered if needed by looking at the user sent info
8676 	 * flags.
8677 	 */
8678 	if (sp->sinfo_flags & SCTP_UNORDERED) {
8679 		rcv_flags |= SCTP_DATA_UNORDERED;
8680 	}
8681 	if ((SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) && ((sp->sinfo_flags & SCTP_EOF) == SCTP_EOF)) ||
8682 	    ((sp->sinfo_flags & SCTP_SACK_IMMEDIATELY) == SCTP_SACK_IMMEDIATELY)) {
8683 		rcv_flags |= SCTP_DATA_SACK_IMMEDIATELY;
8684 	}
8685 	/* clear out the chunk before setting up */
8686 	memset(chk, 0, sizeof(*chk));
8687 	chk->rec.data.rcv_flags = rcv_flags;
8688 
8689 	if (to_move >= length) {
8690 		/* we think we can steal the whole thing */
8691 		if ((sp->sender_all_done == 0) && (send_lock_up == 0)) {
8692 			SCTP_TCB_SEND_LOCK(stcb);
8693 			send_lock_up = 1;
8694 		}
8695 		if (to_move < sp->length) {
8696 			/* bail, it changed */
8697 			goto dont_do_it;
8698 		}
8699 		chk->data = sp->data;
8700 		chk->last_mbuf = sp->tail_mbuf;
8701 		/* register the stealing */
8702 		sp->data = sp->tail_mbuf = NULL;
8703 	} else {
8704 		struct mbuf *m;
8705 
8706 dont_do_it:
8707 		chk->data = SCTP_M_COPYM(sp->data, 0, to_move, M_DONTWAIT);
8708 		chk->last_mbuf = NULL;
8709 		if (chk->data == NULL) {
8710 			sp->some_taken = some_taken;
8711 			sctp_free_a_chunk(stcb, chk);
8712 			*bail = 1;
8713 			to_move = 0;
8714 			goto out_of;
8715 		}
8716 #ifdef SCTP_MBUF_LOGGING
8717 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
8718 			struct mbuf *mat;
8719 
8720 			mat = chk->data;
8721 			while (mat) {
8722 				if (SCTP_BUF_IS_EXTENDED(mat)) {
8723 					sctp_log_mb(mat, SCTP_MBUF_ICOPY);
8724 				}
8725 				mat = SCTP_BUF_NEXT(mat);
8726 			}
8727 		}
8728 #endif
8729 		/* Pull off the data */
8730 		m_adj(sp->data, to_move);
8731 		/* Now lets work our way down and compact it */
8732 		m = sp->data;
8733 		while (m && (SCTP_BUF_LEN(m) == 0)) {
8734 			sp->data = SCTP_BUF_NEXT(m);
8735 			SCTP_BUF_NEXT(m) = NULL;
8736 			if (sp->tail_mbuf == m) {
8737 				/*-
8738 				 * Freeing tail? TSNH since
8739 				 * we supposedly were taking less
8740 				 * than the sp->length.
8741 				 */
8742 #ifdef INVARIANTS
8743 				panic("Huh, freing tail? - TSNH");
8744 #else
8745 				SCTP_PRINTF("Huh, freeing tail? - TSNH\n");
8746 				sp->tail_mbuf = sp->data = NULL;
8747 				sp->length = 0;
8748 #endif
8749 
8750 			}
8751 			sctp_m_free(m);
8752 			m = sp->data;
8753 		}
8754 	}
8755 	if (SCTP_BUF_IS_EXTENDED(chk->data)) {
8756 		chk->copy_by_ref = 1;
8757 	} else {
8758 		chk->copy_by_ref = 0;
8759 	}
8760 	/*
8761 	 * get last_mbuf and counts of mb useage This is ugly but hopefully
8762 	 * its only one mbuf.
8763 	 */
8764 	if (chk->last_mbuf == NULL) {
8765 		chk->last_mbuf = chk->data;
8766 		while (SCTP_BUF_NEXT(chk->last_mbuf) != NULL) {
8767 			chk->last_mbuf = SCTP_BUF_NEXT(chk->last_mbuf);
8768 		}
8769 	}
8770 	if (to_move > length) {
8771 		/*- This should not happen either
8772 		 * since we always lower to_move to the size
8773 		 * of sp->length if its larger.
8774 		 */
8775 #ifdef INVARIANTS
8776 		panic("Huh, how can to_move be larger?");
8777 #else
8778 		SCTP_PRINTF("Huh, how can to_move be larger?\n");
8779 		sp->length = 0;
8780 #endif
8781 	} else {
8782 		atomic_subtract_int(&sp->length, to_move);
8783 	}
8784 	if (M_LEADINGSPACE(chk->data) < (int)sizeof(struct sctp_data_chunk)) {
8785 		/* Not enough room for a chunk header, get some */
8786 		struct mbuf *m;
8787 
8788 		m = sctp_get_mbuf_for_msg(1, 0, M_DONTWAIT, 0, MT_DATA);
8789 		if (m == NULL) {
8790 			/*
8791 			 * we're in trouble here. _PREPEND below will free
8792 			 * all the data if there is no leading space, so we
8793 			 * must put the data back and restore.
8794 			 */
8795 			if (send_lock_up == 0) {
8796 				SCTP_TCB_SEND_LOCK(stcb);
8797 				send_lock_up = 1;
8798 			}
8799 			if (chk->data == NULL) {
8800 				/* unsteal the data */
8801 				sp->data = chk->data;
8802 				sp->tail_mbuf = chk->last_mbuf;
8803 			} else {
8804 				struct mbuf *m_tmp;
8805 
8806 				/* reassemble the data */
8807 				m_tmp = sp->data;
8808 				sp->data = chk->data;
8809 				SCTP_BUF_NEXT(chk->last_mbuf) = m_tmp;
8810 			}
8811 			sp->some_taken = some_taken;
8812 			atomic_add_int(&sp->length, to_move);
8813 			chk->data = NULL;
8814 			*bail = 1;
8815 			sctp_free_a_chunk(stcb, chk);
8816 			to_move = 0;
8817 			goto out_of;
8818 		} else {
8819 			SCTP_BUF_LEN(m) = 0;
8820 			SCTP_BUF_NEXT(m) = chk->data;
8821 			chk->data = m;
8822 			M_ALIGN(chk->data, 4);
8823 		}
8824 	}
8825 	SCTP_BUF_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT);
8826 	if (chk->data == NULL) {
8827 		/* HELP, TSNH since we assured it would not above? */
8828 #ifdef INVARIANTS
8829 		panic("prepend failes HELP?");
8830 #else
8831 		SCTP_PRINTF("prepend fails HELP?\n");
8832 		sctp_free_a_chunk(stcb, chk);
8833 #endif
8834 		*bail = 1;
8835 		to_move = 0;
8836 		goto out_of;
8837 	}
8838 	sctp_snd_sb_alloc(stcb, sizeof(struct sctp_data_chunk));
8839 	chk->book_size = chk->send_size = (to_move +
8840 	    sizeof(struct sctp_data_chunk));
8841 	chk->book_size_scale = 0;
8842 	chk->sent = SCTP_DATAGRAM_UNSENT;
8843 
8844 	chk->flags = 0;
8845 	chk->asoc = &stcb->asoc;
8846 	chk->pad_inplace = 0;
8847 	chk->no_fr_allowed = 0;
8848 	chk->rec.data.stream_seq = sp->strseq;
8849 	chk->rec.data.stream_number = sp->stream;
8850 	chk->rec.data.payloadtype = sp->ppid;
8851 	chk->rec.data.context = sp->context;
8852 	chk->rec.data.doing_fast_retransmit = 0;
8853 	chk->rec.data.ect_nonce = 0;	/* ECN Nonce */
8854 
8855 	chk->rec.data.timetodrop = sp->ts;
8856 	chk->flags = sp->act_flags;
8857 	chk->addr_over = sp->addr_over;
8858 
8859 	chk->whoTo = net;
8860 	atomic_add_int(&chk->whoTo->ref_count, 1);
8861 
8862 	if (sp->holds_key_ref) {
8863 		chk->auth_keyid = sp->auth_keyid;
8864 		sctp_auth_key_acquire(stcb, chk->auth_keyid);
8865 		chk->holds_key_ref = 1;
8866 	}
8867 	chk->rec.data.TSN_seq = atomic_fetchadd_int(&asoc->sending_seq, 1);
8868 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_OUTQ) {
8869 		sctp_misc_ints(SCTP_STRMOUT_LOG_SEND,
8870 		    (uintptr_t) stcb, sp->length,
8871 		    (uint32_t) ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq),
8872 		    chk->rec.data.TSN_seq);
8873 	}
8874 	dchkh = mtod(chk->data, struct sctp_data_chunk *);
8875 	/*
8876 	 * Put the rest of the things in place now. Size was done earlier in
8877 	 * previous loop prior to padding.
8878 	 */
8879 
8880 #ifdef SCTP_ASOCLOG_OF_TSNS
8881 	SCTP_TCB_LOCK_ASSERT(stcb);
8882 	if (asoc->tsn_out_at >= SCTP_TSN_LOG_SIZE) {
8883 		asoc->tsn_out_at = 0;
8884 		asoc->tsn_out_wrapped = 1;
8885 	}
8886 	asoc->out_tsnlog[asoc->tsn_out_at].tsn = chk->rec.data.TSN_seq;
8887 	asoc->out_tsnlog[asoc->tsn_out_at].strm = chk->rec.data.stream_number;
8888 	asoc->out_tsnlog[asoc->tsn_out_at].seq = chk->rec.data.stream_seq;
8889 	asoc->out_tsnlog[asoc->tsn_out_at].sz = chk->send_size;
8890 	asoc->out_tsnlog[asoc->tsn_out_at].flgs = chk->rec.data.rcv_flags;
8891 	asoc->out_tsnlog[asoc->tsn_out_at].stcb = (void *)stcb;
8892 	asoc->out_tsnlog[asoc->tsn_out_at].in_pos = asoc->tsn_out_at;
8893 	asoc->out_tsnlog[asoc->tsn_out_at].in_out = 2;
8894 	asoc->tsn_out_at++;
8895 #endif
8896 
8897 	dchkh->ch.chunk_type = SCTP_DATA;
8898 	dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
8899 	dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
8900 	dchkh->dp.stream_id = htons(strq->stream_no);
8901 	dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
8902 	dchkh->dp.protocol_id = chk->rec.data.payloadtype;
8903 	dchkh->ch.chunk_length = htons(chk->send_size);
8904 	/* Now advance the chk->send_size by the actual pad needed. */
8905 	if (chk->send_size < SCTP_SIZE32(chk->book_size)) {
8906 		/* need a pad */
8907 		struct mbuf *lm;
8908 		int pads;
8909 
8910 		pads = SCTP_SIZE32(chk->book_size) - chk->send_size;
8911 		if (sctp_pad_lastmbuf(chk->data, pads, chk->last_mbuf) == 0) {
8912 			chk->pad_inplace = 1;
8913 		}
8914 		if ((lm = SCTP_BUF_NEXT(chk->last_mbuf)) != NULL) {
8915 			/* pad added an mbuf */
8916 			chk->last_mbuf = lm;
8917 		}
8918 		chk->send_size += pads;
8919 	}
8920 	/* We only re-set the policy if it is on */
8921 	if (sp->pr_sctp_on) {
8922 		sctp_set_prsctp_policy(stcb, sp);
8923 		asoc->pr_sctp_cnt++;
8924 		chk->pr_sctp_on = 1;
8925 	} else {
8926 		chk->pr_sctp_on = 0;
8927 	}
8928 	if (sp->msg_is_complete && (sp->length == 0) && (sp->sender_all_done)) {
8929 		/* All done pull and kill the message */
8930 		atomic_subtract_int(&asoc->stream_queue_cnt, 1);
8931 		if (sp->put_last_out == 0) {
8932 			SCTP_PRINTF("Gak, put out entire msg with NO end!-2\n");
8933 			SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d send_lock:%d\n",
8934 			    sp->sender_all_done,
8935 			    sp->length,
8936 			    sp->msg_is_complete,
8937 			    sp->put_last_out,
8938 			    send_lock_up);
8939 		}
8940 		if ((send_lock_up == 0) && (TAILQ_NEXT(sp, next) == NULL)) {
8941 			SCTP_TCB_SEND_LOCK(stcb);
8942 			send_lock_up = 1;
8943 		}
8944 		TAILQ_REMOVE(&strq->outqueue, sp, next);
8945 		sctp_free_remote_addr(sp->net);
8946 		if (sp->data) {
8947 			sctp_m_freem(sp->data);
8948 			sp->data = NULL;
8949 		}
8950 		sctp_free_a_strmoq(stcb, sp);
8951 
8952 		/* we can't be locked to it */
8953 		*locked = 0;
8954 		stcb->asoc.locked_on_sending = NULL;
8955 	} else {
8956 		/* more to go, we are locked */
8957 		*locked = 1;
8958 	}
8959 	asoc->chunks_on_out_queue++;
8960 	TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
8961 	asoc->send_queue_cnt++;
8962 out_of:
8963 	if (send_lock_up) {
8964 		SCTP_TCB_SEND_UNLOCK(stcb);
8965 		send_lock_up = 0;
8966 	}
8967 	return (to_move);
8968 }
8969 
8970 
8971 static struct sctp_stream_out *
8972 sctp_select_a_stream(struct sctp_tcb *stcb, struct sctp_association *asoc)
8973 {
8974 	struct sctp_stream_out *strq;
8975 
8976 	/* Find the next stream to use */
8977 	if (asoc->last_out_stream == NULL) {
8978 		strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
8979 		if (asoc->last_out_stream == NULL) {
8980 			/* huh nothing on the wheel, TSNH */
8981 			return (NULL);
8982 		}
8983 		goto done_it;
8984 	}
8985 	strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
8986 done_it:
8987 	if (strq == NULL) {
8988 		strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
8989 	}
8990 	/* Save off the last stream */
8991 	asoc->last_out_stream = strq;
8992 	return (strq);
8993 
8994 }
8995 
8996 
8997 static void
8998 sctp_fill_outqueue(struct sctp_tcb *stcb,
8999     struct sctp_nets *net, int frag_point, int eeor_mode, int *quit_now)
9000 {
9001 	struct sctp_association *asoc;
9002 	struct sctp_stream_out *strq, *strqn, *strqt;
9003 	int goal_mtu, moved_how_much, total_moved = 0, bail = 0;
9004 	int locked, giveup;
9005 	struct sctp_stream_queue_pending *sp;
9006 
9007 	SCTP_TCB_LOCK_ASSERT(stcb);
9008 	asoc = &stcb->asoc;
9009 #ifdef INET6
9010 	if (net->ro._l_addr.sin6.sin6_family == AF_INET6) {
9011 		goal_mtu = net->mtu - SCTP_MIN_OVERHEAD;
9012 	} else {
9013 		/* ?? not sure what else to do */
9014 		goal_mtu = net->mtu - SCTP_MIN_V4_OVERHEAD;
9015 	}
9016 #else
9017 	goal_mtu = net->mtu - SCTP_MIN_OVERHEAD;
9018 #endif
9019 	/* Need an allowance for the data chunk header too */
9020 	goal_mtu -= sizeof(struct sctp_data_chunk);
9021 
9022 	/* must make even word boundary */
9023 	goal_mtu &= 0xfffffffc;
9024 	if (asoc->locked_on_sending) {
9025 		/* We are stuck on one stream until the message completes. */
9026 		strqn = strq = asoc->locked_on_sending;
9027 		locked = 1;
9028 	} else {
9029 		strqn = strq = sctp_select_a_stream(stcb, asoc);
9030 		locked = 0;
9031 	}
9032 
9033 	while ((goal_mtu > 0) && strq) {
9034 		sp = TAILQ_FIRST(&strq->outqueue);
9035 		/*
9036 		 * If CMT is off, we must validate that the stream in
9037 		 * question has the first item pointed towards are network
9038 		 * destionation requested by the caller. Note that if we
9039 		 * turn out to be locked to a stream (assigning TSN's then
9040 		 * we must stop, since we cannot look for another stream
9041 		 * with data to send to that destination). In CMT's case, by
9042 		 * skipping this check, we will send one data packet towards
9043 		 * the requested net.
9044 		 */
9045 		if (sp == NULL) {
9046 			break;
9047 		}
9048 		if ((sp->net != net) && (SCTP_BASE_SYSCTL(sctp_cmt_on_off) == 0)) {
9049 			/* none for this network */
9050 			if (locked) {
9051 				break;
9052 			} else {
9053 				strq = sctp_select_a_stream(stcb, asoc);
9054 				if (strq == NULL)
9055 					/* none left */
9056 					break;
9057 				if (strqn == strq) {
9058 					/* I have circled */
9059 					break;
9060 				}
9061 				continue;
9062 			}
9063 		}
9064 		giveup = 0;
9065 		bail = 0;
9066 		moved_how_much = sctp_move_to_outqueue(stcb, net, strq, goal_mtu, frag_point, &locked,
9067 		    &giveup, eeor_mode, &bail);
9068 		asoc->last_out_stream = strq;
9069 		if (locked) {
9070 			asoc->locked_on_sending = strq;
9071 			if ((moved_how_much == 0) || (giveup) || bail)
9072 				/* no more to move for now */
9073 				break;
9074 		} else {
9075 			asoc->locked_on_sending = NULL;
9076 			strqt = sctp_select_a_stream(stcb, asoc);
9077 			if (TAILQ_FIRST(&strq->outqueue) == NULL) {
9078 				if (strq == strqn) {
9079 					/* Must move start to next one */
9080 					strqn = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
9081 					if (strqn == NULL) {
9082 						strqn = TAILQ_FIRST(&asoc->out_wheel);
9083 						if (strqn == NULL) {
9084 							break;
9085 						}
9086 					}
9087 				}
9088 				sctp_remove_from_wheel(stcb, asoc, strq);
9089 			}
9090 			if ((giveup) || bail) {
9091 				break;
9092 			}
9093 			strq = strqt;
9094 			if (strq == NULL) {
9095 				break;
9096 			}
9097 		}
9098 		total_moved += moved_how_much;
9099 		goal_mtu -= (moved_how_much + sizeof(struct sctp_data_chunk));
9100 		goal_mtu &= 0xfffffffc;
9101 	}
9102 	if (bail)
9103 		*quit_now = 1;
9104 
9105 	if (total_moved == 0) {
9106 		if ((SCTP_BASE_SYSCTL(sctp_cmt_on_off) == 0) &&
9107 		    (net == stcb->asoc.primary_destination)) {
9108 			/* ran dry for primary network net */
9109 			SCTP_STAT_INCR(sctps_primary_randry);
9110 		} else if (SCTP_BASE_SYSCTL(sctp_cmt_on_off)) {
9111 			/* ran dry with CMT on */
9112 			SCTP_STAT_INCR(sctps_cmt_randry);
9113 		}
9114 	}
9115 }
9116 
9117 void
9118 sctp_fix_ecn_echo(struct sctp_association *asoc)
9119 {
9120 	struct sctp_tmit_chunk *chk;
9121 
9122 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
9123 		if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) {
9124 			chk->sent = SCTP_DATAGRAM_UNSENT;
9125 		}
9126 	}
9127 }
9128 
9129 static void
9130 sctp_move_to_an_alt(struct sctp_tcb *stcb,
9131     struct sctp_association *asoc,
9132     struct sctp_nets *net)
9133 {
9134 	struct sctp_tmit_chunk *chk;
9135 	struct sctp_nets *a_net;
9136 
9137 	SCTP_TCB_LOCK_ASSERT(stcb);
9138 	/*
9139 	 * JRS 5/14/07 - If CMT PF is turned on, find an alternate
9140 	 * destination using the PF algorithm for finding alternate
9141 	 * destinations.
9142 	 */
9143 	if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) && SCTP_BASE_SYSCTL(sctp_cmt_pf)) {
9144 		a_net = sctp_find_alternate_net(stcb, net, 2);
9145 	} else {
9146 		a_net = sctp_find_alternate_net(stcb, net, 0);
9147 	}
9148 	if ((a_net != net) &&
9149 	    ((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
9150 		/*
9151 		 * We only proceed if a valid alternate is found that is not
9152 		 * this one and is reachable. Here we must move all chunks
9153 		 * queued in the send queue off of the destination address
9154 		 * to our alternate.
9155 		 */
9156 		TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
9157 			if (chk->whoTo == net) {
9158 				/* Move the chunk to our alternate */
9159 				sctp_free_remote_addr(chk->whoTo);
9160 				chk->whoTo = a_net;
9161 				atomic_add_int(&a_net->ref_count, 1);
9162 			}
9163 		}
9164 	}
9165 }
9166 
9167 int
9168 sctp_med_chunk_output(struct sctp_inpcb *inp,
9169     struct sctp_tcb *stcb,
9170     struct sctp_association *asoc,
9171     int *num_out,
9172     int *reason_code,
9173     int control_only, int *cwnd_full, int from_where,
9174     struct timeval *now, int *now_filled, int frag_point, int so_locked
9175 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
9176     SCTP_UNUSED
9177 #endif
9178 )
9179 {
9180 	/*
9181 	 * Ok this is the generic chunk service queue. we must do the
9182 	 * following: - Service the stream queue that is next, moving any
9183 	 * message (note I must get a complete message i.e. FIRST/MIDDLE and
9184 	 * LAST to the out queue in one pass) and assigning TSN's - Check to
9185 	 * see if the cwnd/rwnd allows any output, if so we go ahead and
9186 	 * fomulate and send the low level chunks. Making sure to combine
9187 	 * any control in the control chunk queue also.
9188 	 */
9189 	struct sctp_nets *net;
9190 	struct mbuf *outchain, *endoutchain;
9191 	struct sctp_tmit_chunk *chk, *nchk;
9192 
9193 	/* temp arrays for unlinking */
9194 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
9195 	int no_fragmentflg, error;
9196 	int one_chunk, hbflag, skip_data_for_this_net;
9197 	int asconf, cookie, no_out_cnt;
9198 	int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind, eeor_mode;
9199 	unsigned int mtu, r_mtu, omtu, mx_mtu, to_out;
9200 	struct sctp_nets *start_at, *old_startat = NULL, *send_start_at;
9201 	int tsns_sent = 0;
9202 	uint32_t auth_offset = 0;
9203 	struct sctp_auth_chunk *auth = NULL;
9204 	uint16_t auth_keyid;
9205 	int override_ok = 1;
9206 	int data_auth_reqd = 0;
9207 
9208 	/*
9209 	 * JRS 5/14/07 - Add flag for whether a heartbeat is sent to the
9210 	 * destination.
9211 	 */
9212 	int pf_hbflag = 0;
9213 	int quit_now = 0;
9214 
9215 	*num_out = 0;
9216 	cwnd_full_ind = 0;
9217 	auth_keyid = stcb->asoc.authinfo.active_keyid;
9218 
9219 	if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
9220 	    (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED) ||
9221 	    (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR))) {
9222 		eeor_mode = 1;
9223 	} else {
9224 		eeor_mode = 0;
9225 	}
9226 	ctl_cnt = no_out_cnt = asconf = cookie = 0;
9227 	/*
9228 	 * First lets prime the pump. For each destination, if there is room
9229 	 * in the flight size, attempt to pull an MTU's worth out of the
9230 	 * stream queues into the general send_queue
9231 	 */
9232 #ifdef SCTP_AUDITING_ENABLED
9233 	sctp_audit_log(0xC2, 2);
9234 #endif
9235 	SCTP_TCB_LOCK_ASSERT(stcb);
9236 	hbflag = 0;
9237 	if ((control_only) || (asoc->stream_reset_outstanding))
9238 		no_data_chunks = 1;
9239 	else
9240 		no_data_chunks = 0;
9241 
9242 	/* Nothing to possible to send? */
9243 	if (TAILQ_EMPTY(&asoc->control_send_queue) &&
9244 	    TAILQ_EMPTY(&asoc->asconf_send_queue) &&
9245 	    TAILQ_EMPTY(&asoc->send_queue) &&
9246 	    TAILQ_EMPTY(&asoc->out_wheel)) {
9247 		*reason_code = 9;
9248 		return (0);
9249 	}
9250 	if (asoc->peers_rwnd == 0) {
9251 		/* No room in peers rwnd */
9252 		*cwnd_full = 1;
9253 		*reason_code = 1;
9254 		if (asoc->total_flight > 0) {
9255 			/* we are allowed one chunk in flight */
9256 			no_data_chunks = 1;
9257 		}
9258 	}
9259 	if ((no_data_chunks == 0) && (!TAILQ_EMPTY(&asoc->out_wheel))) {
9260 		if (SCTP_BASE_SYSCTL(sctp_cmt_on_off)) {
9261 			/*
9262 			 * for CMT we start at the next one past the one we
9263 			 * last added data to.
9264 			 */
9265 			if (TAILQ_FIRST(&asoc->send_queue) != NULL) {
9266 				goto skip_the_fill_from_streams;
9267 			}
9268 			if (asoc->last_net_data_came_from) {
9269 				net = TAILQ_NEXT(asoc->last_net_data_came_from, sctp_next);
9270 				if (net == NULL) {
9271 					net = TAILQ_FIRST(&asoc->nets);
9272 				}
9273 			} else {
9274 				/* back to start */
9275 				net = TAILQ_FIRST(&asoc->nets);
9276 			}
9277 
9278 			/*
9279 			 * JRI-TODO: CMT-MPI. Simply set the first
9280 			 * destination (net) to be optimized for the next
9281 			 * message to be pulled out of the outwheel. 1. peek
9282 			 * at outwheel 2. If large message, set net =
9283 			 * highest_cwnd 3. If small message, set net =
9284 			 * lowest rtt
9285 			 */
9286 		} else {
9287 			net = asoc->primary_destination;
9288 			if (net == NULL) {
9289 				/* TSNH */
9290 				net = TAILQ_FIRST(&asoc->nets);
9291 			}
9292 		}
9293 		start_at = net;
9294 
9295 one_more_time:
9296 		for (; net != NULL; net = TAILQ_NEXT(net, sctp_next)) {
9297 			net->window_probe = 0;
9298 			if (old_startat && (old_startat == net)) {
9299 				break;
9300 			}
9301 			/*
9302 			 * JRI: if dest is unreachable or unconfirmed, do
9303 			 * not send data to it
9304 			 */
9305 			if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) || (net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
9306 				continue;
9307 			}
9308 			/*
9309 			 * JRI: if dest is in PF state, do not send data to
9310 			 * it
9311 			 */
9312 			if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) &&
9313 			    SCTP_BASE_SYSCTL(sctp_cmt_pf) &&
9314 			    (net->dest_state & SCTP_ADDR_PF)) {
9315 				continue;
9316 			}
9317 			if ((SCTP_BASE_SYSCTL(sctp_cmt_on_off) == 0) && (net->ref_count < 2)) {
9318 				/* nothing can be in queue for this guy */
9319 				continue;
9320 			}
9321 			if (net->flight_size >= net->cwnd) {
9322 				/* skip this network, no room */
9323 				cwnd_full_ind++;
9324 				continue;
9325 			}
9326 			/*
9327 			 * JRI : this for loop we are in takes in each net,
9328 			 * if its's got space in cwnd and has data sent to
9329 			 * it (when CMT is off) then it calls
9330 			 * sctp_fill_outqueue for the net. This gets data on
9331 			 * the send queue for that network.
9332 			 *
9333 			 * In sctp_fill_outqueue TSN's are assigned and data is
9334 			 * copied out of the stream buffers. Note mostly
9335 			 * copy by reference (we hope).
9336 			 */
9337 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
9338 				sctp_log_cwnd(stcb, net, 0, SCTP_CWND_LOG_FILL_OUTQ_CALLED);
9339 			}
9340 			sctp_fill_outqueue(stcb, net, frag_point, eeor_mode, &quit_now);
9341 			if (quit_now) {
9342 				/* memory alloc failure */
9343 				no_data_chunks = 1;
9344 				goto skip_the_fill_from_streams;
9345 			}
9346 		}
9347 		if (start_at != TAILQ_FIRST(&asoc->nets)) {
9348 			/* got to pick up the beginning stuff. */
9349 			old_startat = start_at;
9350 			start_at = net = TAILQ_FIRST(&asoc->nets);
9351 			if (old_startat)
9352 				goto one_more_time;
9353 		}
9354 	}
9355 skip_the_fill_from_streams:
9356 	*cwnd_full = cwnd_full_ind;
9357 
9358 	/* now service each destination and send out what we can for it */
9359 	/* Nothing to send? */
9360 	if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
9361 	    (TAILQ_FIRST(&asoc->asconf_send_queue) == NULL) &&
9362 	    (TAILQ_FIRST(&asoc->send_queue) == NULL)) {
9363 		*reason_code = 8;
9364 		return (0);
9365 	}
9366 	if (no_data_chunks) {
9367 		chk = TAILQ_FIRST(&asoc->asconf_send_queue);
9368 		if (chk == NULL)
9369 			chk = TAILQ_FIRST(&asoc->control_send_queue);
9370 	} else {
9371 		chk = TAILQ_FIRST(&asoc->send_queue);
9372 	}
9373 	if (chk) {
9374 		send_start_at = chk->whoTo;
9375 	} else {
9376 		send_start_at = TAILQ_FIRST(&asoc->nets);
9377 	}
9378 	old_startat = NULL;
9379 again_one_more_time:
9380 	for (net = send_start_at; net != NULL; net = TAILQ_NEXT(net, sctp_next)) {
9381 		/* how much can we send? */
9382 		/* SCTPDBG("Examine for sending net:%x\n", (uint32_t)net); */
9383 		if (old_startat && (old_startat == net)) {
9384 			/* through list ocmpletely. */
9385 			break;
9386 		}
9387 		tsns_sent = 0;
9388 		if (net->ref_count < 2) {
9389 			/*
9390 			 * Ref-count of 1 so we cannot have data or control
9391 			 * queued to this address. Skip it.
9392 			 */
9393 			continue;
9394 		}
9395 		ctl_cnt = bundle_at = 0;
9396 		endoutchain = outchain = NULL;
9397 		no_fragmentflg = 1;
9398 		one_chunk = 0;
9399 		if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
9400 			skip_data_for_this_net = 1;
9401 		} else {
9402 			skip_data_for_this_net = 0;
9403 		}
9404 		if ((net->ro.ro_rt) && (net->ro.ro_rt->rt_ifp)) {
9405 			/*
9406 			 * if we have a route and an ifp check to see if we
9407 			 * have room to send to this guy
9408 			 */
9409 			struct ifnet *ifp;
9410 
9411 			ifp = net->ro.ro_rt->rt_ifp;
9412 			if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
9413 				SCTP_STAT_INCR(sctps_ifnomemqueued);
9414 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) {
9415 					sctp_log_maxburst(stcb, net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
9416 				}
9417 				continue;
9418 			}
9419 		}
9420 		switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) {
9421 		case AF_INET:
9422 			mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
9423 			break;
9424 #ifdef INET6
9425 		case AF_INET6:
9426 			mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
9427 			break;
9428 #endif
9429 		default:
9430 			/* TSNH */
9431 			mtu = net->mtu;
9432 			break;
9433 		}
9434 		mx_mtu = mtu;
9435 		to_out = 0;
9436 		if (mtu > asoc->peers_rwnd) {
9437 			if (asoc->total_flight > 0) {
9438 				/* We have a packet in flight somewhere */
9439 				r_mtu = asoc->peers_rwnd;
9440 			} else {
9441 				/* We are always allowed to send one MTU out */
9442 				one_chunk = 1;
9443 				r_mtu = mtu;
9444 			}
9445 		} else {
9446 			r_mtu = mtu;
9447 		}
9448 		/************************/
9449 		/* ASCONF transmission */
9450 		/************************/
9451 		/* Now first lets go through the asconf queue */
9452 		for (chk = TAILQ_FIRST(&asoc->asconf_send_queue);
9453 		    chk; chk = nchk) {
9454 			nchk = TAILQ_NEXT(chk, sctp_next);
9455 			if (chk->rec.chunk_id.id != SCTP_ASCONF) {
9456 				continue;
9457 			}
9458 			if (chk->whoTo != net) {
9459 				/*
9460 				 * No, not sent to the network we are
9461 				 * looking at
9462 				 */
9463 				break;
9464 			}
9465 			if (chk->data == NULL) {
9466 				break;
9467 			}
9468 			if (chk->sent != SCTP_DATAGRAM_UNSENT &&
9469 			    chk->sent != SCTP_DATAGRAM_RESEND) {
9470 				break;
9471 			}
9472 			/*
9473 			 * if no AUTH is yet included and this chunk
9474 			 * requires it, make sure to account for it.  We
9475 			 * don't apply the size until the AUTH chunk is
9476 			 * actually added below in case there is no room for
9477 			 * this chunk. NOTE: we overload the use of "omtu"
9478 			 * here
9479 			 */
9480 			if ((auth == NULL) &&
9481 			    sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
9482 			    stcb->asoc.peer_auth_chunks)) {
9483 				omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
9484 			} else
9485 				omtu = 0;
9486 			/* Here we do NOT factor the r_mtu */
9487 			if ((chk->send_size < (int)(mtu - omtu)) ||
9488 			    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
9489 				/*
9490 				 * We probably should glom the mbuf chain
9491 				 * from the chk->data for control but the
9492 				 * problem is it becomes yet one more level
9493 				 * of tracking to do if for some reason
9494 				 * output fails. Then I have got to
9495 				 * reconstruct the merged control chain.. el
9496 				 * yucko.. for now we take the easy way and
9497 				 * do the copy
9498 				 */
9499 				/*
9500 				 * Add an AUTH chunk, if chunk requires it
9501 				 * save the offset into the chain for AUTH
9502 				 */
9503 				if ((auth == NULL) &&
9504 				    (sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
9505 				    stcb->asoc.peer_auth_chunks))) {
9506 					outchain = sctp_add_auth_chunk(outchain,
9507 					    &endoutchain,
9508 					    &auth,
9509 					    &auth_offset,
9510 					    stcb,
9511 					    chk->rec.chunk_id.id);
9512 					SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9513 				}
9514 				outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain,
9515 				    (int)chk->rec.chunk_id.can_take_data,
9516 				    chk->send_size, chk->copy_by_ref);
9517 				if (outchain == NULL) {
9518 					*reason_code = 8;
9519 					SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
9520 					return (ENOMEM);
9521 				}
9522 				SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9523 				/* update our MTU size */
9524 				if (mtu > (chk->send_size + omtu))
9525 					mtu -= (chk->send_size + omtu);
9526 				else
9527 					mtu = 0;
9528 				to_out += (chk->send_size + omtu);
9529 				/* Do clear IP_DF ? */
9530 				if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
9531 					no_fragmentflg = 0;
9532 				}
9533 				if (chk->rec.chunk_id.can_take_data)
9534 					chk->data = NULL;
9535 				/*
9536 				 * set hb flag since we can use these for
9537 				 * RTO
9538 				 */
9539 				hbflag = 1;
9540 				asconf = 1;
9541 				/*
9542 				 * should sysctl this: don't bundle data
9543 				 * with ASCONF since it requires AUTH
9544 				 */
9545 				no_data_chunks = 1;
9546 				chk->sent = SCTP_DATAGRAM_SENT;
9547 				chk->snd_count++;
9548 				if (mtu == 0) {
9549 					/*
9550 					 * Ok we are out of room but we can
9551 					 * output without effecting the
9552 					 * flight size since this little guy
9553 					 * is a control only packet.
9554 					 */
9555 					sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
9556 					/*
9557 					 * do NOT clear the asconf flag as
9558 					 * it is used to do appropriate
9559 					 * source address selection.
9560 					 */
9561 					if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
9562 					    (struct sockaddr *)&net->ro._l_addr,
9563 					    outchain, auth_offset, auth,
9564 					    stcb->asoc.authinfo.active_keyid,
9565 					    no_fragmentflg, 0, NULL, asconf,
9566 					    inp->sctp_lport, stcb->rport,
9567 					    htonl(stcb->asoc.peer_vtag),
9568 					    net->port, so_locked, NULL))) {
9569 						if (error == ENOBUFS) {
9570 							asoc->ifp_had_enobuf = 1;
9571 							SCTP_STAT_INCR(sctps_lowlevelerr);
9572 						}
9573 						if (from_where == 0) {
9574 							SCTP_STAT_INCR(sctps_lowlevelerrusr);
9575 						}
9576 						if (*now_filled == 0) {
9577 							(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
9578 							*now_filled = 1;
9579 							*now = net->last_sent_time;
9580 						} else {
9581 							net->last_sent_time = *now;
9582 						}
9583 						hbflag = 0;
9584 						/* error, could not output */
9585 						if (error == EHOSTUNREACH) {
9586 							/*
9587 							 * Destination went
9588 							 * unreachable
9589 							 * during this send
9590 							 */
9591 							sctp_move_to_an_alt(stcb, asoc, net);
9592 						}
9593 						*reason_code = 7;
9594 						continue;
9595 					} else
9596 						asoc->ifp_had_enobuf = 0;
9597 					if (*now_filled == 0) {
9598 						(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
9599 						*now_filled = 1;
9600 						*now = net->last_sent_time;
9601 					} else {
9602 						net->last_sent_time = *now;
9603 					}
9604 					hbflag = 0;
9605 					/*
9606 					 * increase the number we sent, if a
9607 					 * cookie is sent we don't tell them
9608 					 * any was sent out.
9609 					 */
9610 					outchain = endoutchain = NULL;
9611 					auth = NULL;
9612 					auth_offset = 0;
9613 					if (!no_out_cnt)
9614 						*num_out += ctl_cnt;
9615 					/* recalc a clean slate and setup */
9616 					if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9617 						mtu = (net->mtu - SCTP_MIN_OVERHEAD);
9618 					} else {
9619 						mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
9620 					}
9621 					to_out = 0;
9622 					no_fragmentflg = 1;
9623 				}
9624 			}
9625 		}
9626 		/************************/
9627 		/* Control transmission */
9628 		/************************/
9629 		/* Now first lets go through the control queue */
9630 		for (chk = TAILQ_FIRST(&asoc->control_send_queue);
9631 		    chk; chk = nchk) {
9632 			nchk = TAILQ_NEXT(chk, sctp_next);
9633 			if (chk->whoTo != net) {
9634 				/*
9635 				 * No, not sent to the network we are
9636 				 * looking at
9637 				 */
9638 				continue;
9639 			}
9640 			if (chk->data == NULL) {
9641 				continue;
9642 			}
9643 			if (chk->sent != SCTP_DATAGRAM_UNSENT) {
9644 				/*
9645 				 * It must be unsent. Cookies and ASCONF's
9646 				 * hang around but there timers will force
9647 				 * when marked for resend.
9648 				 */
9649 				continue;
9650 			}
9651 			/*
9652 			 * if no AUTH is yet included and this chunk
9653 			 * requires it, make sure to account for it.  We
9654 			 * don't apply the size until the AUTH chunk is
9655 			 * actually added below in case there is no room for
9656 			 * this chunk. NOTE: we overload the use of "omtu"
9657 			 * here
9658 			 */
9659 			if ((auth == NULL) &&
9660 			    sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
9661 			    stcb->asoc.peer_auth_chunks)) {
9662 				omtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
9663 			} else
9664 				omtu = 0;
9665 			/* Here we do NOT factor the r_mtu */
9666 			if ((chk->send_size < (int)(mtu - omtu)) ||
9667 			    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
9668 				/*
9669 				 * We probably should glom the mbuf chain
9670 				 * from the chk->data for control but the
9671 				 * problem is it becomes yet one more level
9672 				 * of tracking to do if for some reason
9673 				 * output fails. Then I have got to
9674 				 * reconstruct the merged control chain.. el
9675 				 * yucko.. for now we take the easy way and
9676 				 * do the copy
9677 				 */
9678 				/*
9679 				 * Add an AUTH chunk, if chunk requires it
9680 				 * save the offset into the chain for AUTH
9681 				 */
9682 				if ((auth == NULL) &&
9683 				    (sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
9684 				    stcb->asoc.peer_auth_chunks))) {
9685 					outchain = sctp_add_auth_chunk(outchain,
9686 					    &endoutchain,
9687 					    &auth,
9688 					    &auth_offset,
9689 					    stcb,
9690 					    chk->rec.chunk_id.id);
9691 					SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9692 				}
9693 				outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain,
9694 				    (int)chk->rec.chunk_id.can_take_data,
9695 				    chk->send_size, chk->copy_by_ref);
9696 				if (outchain == NULL) {
9697 					*reason_code = 8;
9698 					SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
9699 					return (ENOMEM);
9700 				}
9701 				SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9702 				/* update our MTU size */
9703 				if (mtu > (chk->send_size + omtu))
9704 					mtu -= (chk->send_size + omtu);
9705 				else
9706 					mtu = 0;
9707 				to_out += (chk->send_size + omtu);
9708 				/* Do clear IP_DF ? */
9709 				if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
9710 					no_fragmentflg = 0;
9711 				}
9712 				if (chk->rec.chunk_id.can_take_data)
9713 					chk->data = NULL;
9714 				/* Mark things to be removed, if needed */
9715 				if ((chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) ||
9716 				    (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) ||	/* EY */
9717 				    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) ||
9718 				    (chk->rec.chunk_id.id == SCTP_HEARTBEAT_ACK) ||
9719 				    (chk->rec.chunk_id.id == SCTP_SHUTDOWN) ||
9720 				    (chk->rec.chunk_id.id == SCTP_SHUTDOWN_ACK) ||
9721 				    (chk->rec.chunk_id.id == SCTP_OPERATION_ERROR) ||
9722 				    (chk->rec.chunk_id.id == SCTP_COOKIE_ACK) ||
9723 				    (chk->rec.chunk_id.id == SCTP_ECN_CWR) ||
9724 				    (chk->rec.chunk_id.id == SCTP_PACKET_DROPPED) ||
9725 				    (chk->rec.chunk_id.id == SCTP_ASCONF_ACK)) {
9726 
9727 					if (chk->rec.chunk_id.id == SCTP_HEARTBEAT_REQUEST) {
9728 						hbflag = 1;
9729 						/*
9730 						 * JRS 5/14/07 - Set the
9731 						 * flag to say a heartbeat
9732 						 * is being sent.
9733 						 */
9734 						pf_hbflag = 1;
9735 					}
9736 					/* remove these chunks at the end */
9737 					if (chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) {
9738 						/* turn off the timer */
9739 						if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
9740 							sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
9741 							    inp, stcb, net, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1);
9742 						}
9743 					}
9744 					/*
9745 					 * EY -Nr-sack version of the above
9746 					 * if statement
9747 					 */
9748 					if ((SCTP_BASE_SYSCTL(sctp_nr_sack_on_off) && asoc->peer_supports_nr_sack) &&
9749 					    (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK)) {	/* EY !?! */
9750 						/* turn off the timer */
9751 						if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
9752 							sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
9753 							    inp, stcb, net, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_1);
9754 						}
9755 					}
9756 					ctl_cnt++;
9757 				} else {
9758 					/*
9759 					 * Other chunks, since they have
9760 					 * timers running (i.e. COOKIE) we
9761 					 * just "trust" that it gets sent or
9762 					 * retransmitted.
9763 					 */
9764 					ctl_cnt++;
9765 					if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
9766 						cookie = 1;
9767 						no_out_cnt = 1;
9768 					}
9769 					chk->sent = SCTP_DATAGRAM_SENT;
9770 					chk->snd_count++;
9771 				}
9772 				if (mtu == 0) {
9773 					/*
9774 					 * Ok we are out of room but we can
9775 					 * output without effecting the
9776 					 * flight size since this little guy
9777 					 * is a control only packet.
9778 					 */
9779 					if (asconf) {
9780 						sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
9781 						/*
9782 						 * do NOT clear the asconf
9783 						 * flag as it is used to do
9784 						 * appropriate source
9785 						 * address selection.
9786 						 */
9787 					}
9788 					if (cookie) {
9789 						sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
9790 						cookie = 0;
9791 					}
9792 					if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
9793 					    (struct sockaddr *)&net->ro._l_addr,
9794 					    outchain,
9795 					    auth_offset, auth,
9796 					    stcb->asoc.authinfo.active_keyid,
9797 					    no_fragmentflg, 0, NULL, asconf,
9798 					    inp->sctp_lport, stcb->rport,
9799 					    htonl(stcb->asoc.peer_vtag),
9800 					    net->port, so_locked, NULL))) {
9801 						if (error == ENOBUFS) {
9802 							asoc->ifp_had_enobuf = 1;
9803 							SCTP_STAT_INCR(sctps_lowlevelerr);
9804 						}
9805 						if (from_where == 0) {
9806 							SCTP_STAT_INCR(sctps_lowlevelerrusr);
9807 						}
9808 						/* error, could not output */
9809 						if (hbflag) {
9810 							if (*now_filled == 0) {
9811 								(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
9812 								*now_filled = 1;
9813 								*now = net->last_sent_time;
9814 							} else {
9815 								net->last_sent_time = *now;
9816 							}
9817 							hbflag = 0;
9818 						}
9819 						if (error == EHOSTUNREACH) {
9820 							/*
9821 							 * Destination went
9822 							 * unreachable
9823 							 * during this send
9824 							 */
9825 							sctp_move_to_an_alt(stcb, asoc, net);
9826 						}
9827 						*reason_code = 7;
9828 						continue;
9829 					} else
9830 						asoc->ifp_had_enobuf = 0;
9831 					/* Only HB or ASCONF advances time */
9832 					if (hbflag) {
9833 						if (*now_filled == 0) {
9834 							(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
9835 							*now_filled = 1;
9836 							*now = net->last_sent_time;
9837 						} else {
9838 							net->last_sent_time = *now;
9839 						}
9840 						hbflag = 0;
9841 					}
9842 					/*
9843 					 * increase the number we sent, if a
9844 					 * cookie is sent we don't tell them
9845 					 * any was sent out.
9846 					 */
9847 					outchain = endoutchain = NULL;
9848 					auth = NULL;
9849 					auth_offset = 0;
9850 					if (!no_out_cnt)
9851 						*num_out += ctl_cnt;
9852 					/* recalc a clean slate and setup */
9853 					if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
9854 						mtu = (net->mtu - SCTP_MIN_OVERHEAD);
9855 					} else {
9856 						mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
9857 					}
9858 					to_out = 0;
9859 					no_fragmentflg = 1;
9860 				}
9861 			}
9862 		}
9863 		/*********************/
9864 		/* Data transmission */
9865 		/*********************/
9866 		/*
9867 		 * if AUTH for DATA is required and no AUTH has been added
9868 		 * yet, account for this in the mtu now... if no data can be
9869 		 * bundled, this adjustment won't matter anyways since the
9870 		 * packet will be going out...
9871 		 */
9872 		data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA,
9873 		    stcb->asoc.peer_auth_chunks);
9874 		if (data_auth_reqd && (auth == NULL)) {
9875 			mtu -= sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
9876 		}
9877 		/* now lets add any data within the MTU constraints */
9878 		switch (((struct sockaddr *)&net->ro._l_addr)->sa_family) {
9879 		case AF_INET:
9880 			if (net->mtu > (sizeof(struct ip) + sizeof(struct sctphdr)))
9881 				omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
9882 			else
9883 				omtu = 0;
9884 			break;
9885 #ifdef INET6
9886 		case AF_INET6:
9887 			if (net->mtu > (sizeof(struct ip6_hdr) + sizeof(struct sctphdr)))
9888 				omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
9889 			else
9890 				omtu = 0;
9891 			break;
9892 #endif
9893 		default:
9894 			/* TSNH */
9895 			omtu = 0;
9896 			break;
9897 		}
9898 		if ((((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) && (skip_data_for_this_net == 0)) ||
9899 		    (cookie)) {
9900 			for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
9901 				if (no_data_chunks) {
9902 					/* let only control go out */
9903 					*reason_code = 1;
9904 					break;
9905 				}
9906 				if (net->flight_size >= net->cwnd) {
9907 					/* skip this net, no room for data */
9908 					*reason_code = 2;
9909 					break;
9910 				}
9911 				nchk = TAILQ_NEXT(chk, sctp_next);
9912 				if (chk->whoTo != net) {
9913 					/* No, not sent to this net */
9914 					continue;
9915 				}
9916 				if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
9917 					/*-
9918 					 * strange, we have a chunk that is
9919 					 * to big for its destination and
9920 					 * yet no fragment ok flag.
9921 					 * Something went wrong when the
9922 					 * PMTU changed...we did not mark
9923 					 * this chunk for some reason?? I
9924 					 * will fix it here by letting IP
9925 					 * fragment it for now and printing
9926 					 * a warning. This really should not
9927 					 * happen ...
9928 					 */
9929 					SCTP_PRINTF("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
9930 					    chk->send_size, mtu);
9931 					chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
9932 				}
9933 				if (SCTP_BASE_SYSCTL(sctp_enable_sack_immediately) &&
9934 				    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) == SCTP_STATE_SHUTDOWN_PENDING)) {
9935 					struct sctp_data_chunk *dchkh;
9936 
9937 					dchkh = mtod(chk->data, struct sctp_data_chunk *);
9938 					dchkh->ch.chunk_flags |= SCTP_DATA_SACK_IMMEDIATELY;
9939 				}
9940 				if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
9941 				    ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
9942 					/* ok we will add this one */
9943 
9944 					/*
9945 					 * Add an AUTH chunk, if chunk
9946 					 * requires it, save the offset into
9947 					 * the chain for AUTH
9948 					 */
9949 					if (data_auth_reqd) {
9950 						if (auth == NULL) {
9951 							outchain = sctp_add_auth_chunk(outchain,
9952 							    &endoutchain,
9953 							    &auth,
9954 							    &auth_offset,
9955 							    stcb,
9956 							    SCTP_DATA);
9957 							auth_keyid = chk->auth_keyid;
9958 							override_ok = 0;
9959 							SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
9960 						} else if (override_ok) {
9961 							/*
9962 							 * use this data's
9963 							 * keyid
9964 							 */
9965 							auth_keyid = chk->auth_keyid;
9966 							override_ok = 0;
9967 						} else if (auth_keyid != chk->auth_keyid) {
9968 							/*
9969 							 * different keyid,
9970 							 * so done bundling
9971 							 */
9972 							break;
9973 						}
9974 					}
9975 					outchain = sctp_copy_mbufchain(chk->data, outchain, &endoutchain, 0,
9976 					    chk->send_size, chk->copy_by_ref);
9977 					if (outchain == NULL) {
9978 						SCTPDBG(SCTP_DEBUG_OUTPUT3, "No memory?\n");
9979 						if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
9980 							sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
9981 						}
9982 						*reason_code = 3;
9983 						SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
9984 						return (ENOMEM);
9985 					}
9986 					/* upate our MTU size */
9987 					/* Do clear IP_DF ? */
9988 					if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
9989 						no_fragmentflg = 0;
9990 					}
9991 					/* unsigned subtraction of mtu */
9992 					if (mtu > chk->send_size)
9993 						mtu -= chk->send_size;
9994 					else
9995 						mtu = 0;
9996 					/* unsigned subtraction of r_mtu */
9997 					if (r_mtu > chk->send_size)
9998 						r_mtu -= chk->send_size;
9999 					else
10000 						r_mtu = 0;
10001 
10002 					to_out += chk->send_size;
10003 					if ((to_out > mx_mtu) && no_fragmentflg) {
10004 #ifdef INVARIANTS
10005 						panic("Exceeding mtu of %d out size is %d", mx_mtu, to_out);
10006 #else
10007 						SCTP_PRINTF("Exceeding mtu of %d out size is %d\n",
10008 						    mx_mtu, to_out);
10009 #endif
10010 					}
10011 					chk->window_probe = 0;
10012 					data_list[bundle_at++] = chk;
10013 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
10014 						mtu = 0;
10015 						break;
10016 					}
10017 					if (chk->sent == SCTP_DATAGRAM_UNSENT) {
10018 						if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
10019 							SCTP_STAT_INCR_COUNTER64(sctps_outorderchunks);
10020 						} else {
10021 							SCTP_STAT_INCR_COUNTER64(sctps_outunorderchunks);
10022 						}
10023 						if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) &&
10024 						    ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0))
10025 							/*
10026 							 * Count number of
10027 							 * user msg's that
10028 							 * were fragmented
10029 							 * we do this by
10030 							 * counting when we
10031 							 * see a LAST
10032 							 * fragment only.
10033 							 */
10034 							SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs);
10035 					}
10036 					if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) {
10037 						if (one_chunk) {
10038 							data_list[0]->window_probe = 1;
10039 							net->window_probe = 1;
10040 						}
10041 						break;
10042 					}
10043 				} else {
10044 					/*
10045 					 * Must be sent in order of the
10046 					 * TSN's (on a network)
10047 					 */
10048 					break;
10049 				}
10050 			}	/* for (chunk gather loop for this net) */
10051 		}		/* if asoc.state OPEN */
10052 		/* Is there something to send for this destination? */
10053 		if (outchain) {
10054 			/* We may need to start a control timer or two */
10055 			if (asconf) {
10056 				sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
10057 				    stcb, net);
10058 				/*
10059 				 * do NOT clear the asconf flag as it is
10060 				 * used to do appropriate source address
10061 				 * selection.
10062 				 */
10063 			}
10064 			if (cookie) {
10065 				sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
10066 				cookie = 0;
10067 			}
10068 			/* must start a send timer if data is being sent */
10069 			if (bundle_at && (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) {
10070 				/*
10071 				 * no timer running on this destination
10072 				 * restart it.
10073 				 */
10074 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
10075 			} else if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) &&
10076 				    SCTP_BASE_SYSCTL(sctp_cmt_pf) &&
10077 				    pf_hbflag &&
10078 				    ((net->dest_state & SCTP_ADDR_PF) == SCTP_ADDR_PF) &&
10079 			    (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer))) {
10080 				/*
10081 				 * JRS 5/14/07 - If a HB has been sent to a
10082 				 * PF destination and no T3 timer is
10083 				 * currently running, start the T3 timer to
10084 				 * track the HBs that were sent.
10085 				 */
10086 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
10087 			}
10088 			/* Now send it, if there is anything to send :> */
10089 			if ((error = sctp_lowlevel_chunk_output(inp,
10090 			    stcb,
10091 			    net,
10092 			    (struct sockaddr *)&net->ro._l_addr,
10093 			    outchain,
10094 			    auth_offset,
10095 			    auth,
10096 			    auth_keyid,
10097 			    no_fragmentflg,
10098 			    bundle_at,
10099 			    data_list[0],
10100 			    asconf,
10101 			    inp->sctp_lport, stcb->rport,
10102 			    htonl(stcb->asoc.peer_vtag),
10103 			    net->port, so_locked, NULL))) {
10104 				/* error, we could not output */
10105 				if (error == ENOBUFS) {
10106 					SCTP_STAT_INCR(sctps_lowlevelerr);
10107 					asoc->ifp_had_enobuf = 1;
10108 				}
10109 				if (from_where == 0) {
10110 					SCTP_STAT_INCR(sctps_lowlevelerrusr);
10111 				}
10112 				SCTPDBG(SCTP_DEBUG_OUTPUT3, "Gak send error %d\n", error);
10113 				if (hbflag) {
10114 					if (*now_filled == 0) {
10115 						(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
10116 						*now_filled = 1;
10117 						*now = net->last_sent_time;
10118 					} else {
10119 						net->last_sent_time = *now;
10120 					}
10121 					hbflag = 0;
10122 				}
10123 				if (error == EHOSTUNREACH) {
10124 					/*
10125 					 * Destination went unreachable
10126 					 * during this send
10127 					 */
10128 					sctp_move_to_an_alt(stcb, asoc, net);
10129 				}
10130 				*reason_code = 6;
10131 				/*-
10132 				 * I add this line to be paranoid. As far as
10133 				 * I can tell the continue, takes us back to
10134 				 * the top of the for, but just to make sure
10135 				 * I will reset these again here.
10136 				 */
10137 				ctl_cnt = bundle_at = 0;
10138 				continue;	/* This takes us back to the
10139 						 * for() for the nets. */
10140 			} else {
10141 				asoc->ifp_had_enobuf = 0;
10142 			}
10143 			outchain = endoutchain = NULL;
10144 			auth = NULL;
10145 			auth_offset = 0;
10146 			if (bundle_at || hbflag) {
10147 				/* For data/asconf and hb set time */
10148 				if (*now_filled == 0) {
10149 					(void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
10150 					*now_filled = 1;
10151 					*now = net->last_sent_time;
10152 				} else {
10153 					net->last_sent_time = *now;
10154 				}
10155 			}
10156 			if (!no_out_cnt) {
10157 				*num_out += (ctl_cnt + bundle_at);
10158 			}
10159 			if (bundle_at) {
10160 				/* setup for a RTO measurement */
10161 				tsns_sent = data_list[0]->rec.data.TSN_seq;
10162 				/* fill time if not already filled */
10163 				if (*now_filled == 0) {
10164 					(void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
10165 					*now_filled = 1;
10166 					*now = asoc->time_last_sent;
10167 				} else {
10168 					asoc->time_last_sent = *now;
10169 				}
10170 				data_list[0]->do_rtt = 1;
10171 				SCTP_STAT_INCR_BY(sctps_senddata, bundle_at);
10172 				sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
10173 				if (SCTP_BASE_SYSCTL(sctp_early_fr)) {
10174 					if (net->flight_size < net->cwnd) {
10175 						/* start or restart it */
10176 						if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
10177 							sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net,
10178 							    SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_2);
10179 						}
10180 						SCTP_STAT_INCR(sctps_earlyfrstrout);
10181 						sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net);
10182 					} else {
10183 						/* stop it if its running */
10184 						if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
10185 							SCTP_STAT_INCR(sctps_earlyfrstpout);
10186 							sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, inp, stcb, net,
10187 							    SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_3);
10188 						}
10189 					}
10190 				}
10191 			}
10192 			if (one_chunk) {
10193 				break;
10194 			}
10195 		}
10196 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
10197 			sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_SEND);
10198 		}
10199 	}
10200 	if (old_startat == NULL) {
10201 		old_startat = send_start_at;
10202 		send_start_at = TAILQ_FIRST(&asoc->nets);
10203 		if (old_startat)
10204 			goto again_one_more_time;
10205 	}
10206 	/*
10207 	 * At the end there should be no NON timed chunks hanging on this
10208 	 * queue.
10209 	 */
10210 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
10211 		sctp_log_cwnd(stcb, net, *num_out, SCTP_CWND_LOG_FROM_SEND);
10212 	}
10213 	if ((*num_out == 0) && (*reason_code == 0)) {
10214 		*reason_code = 4;
10215 	} else {
10216 		*reason_code = 5;
10217 	}
10218 	sctp_clean_up_ctl(stcb, asoc);
10219 	return (0);
10220 }
10221 
10222 void
10223 sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
10224 {
10225 	/*-
10226 	 * Prepend a OPERATIONAL_ERROR chunk header and put on the end of
10227 	 * the control chunk queue.
10228 	 */
10229 	struct sctp_chunkhdr *hdr;
10230 	struct sctp_tmit_chunk *chk;
10231 	struct mbuf *mat;
10232 
10233 	SCTP_TCB_LOCK_ASSERT(stcb);
10234 	sctp_alloc_a_chunk(stcb, chk);
10235 	if (chk == NULL) {
10236 		/* no memory */
10237 		sctp_m_freem(op_err);
10238 		return;
10239 	}
10240 	chk->copy_by_ref = 0;
10241 	SCTP_BUF_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT);
10242 	if (op_err == NULL) {
10243 		sctp_free_a_chunk(stcb, chk);
10244 		return;
10245 	}
10246 	chk->send_size = 0;
10247 	mat = op_err;
10248 	while (mat != NULL) {
10249 		chk->send_size += SCTP_BUF_LEN(mat);
10250 		mat = SCTP_BUF_NEXT(mat);
10251 	}
10252 	chk->rec.chunk_id.id = SCTP_OPERATION_ERROR;
10253 	chk->rec.chunk_id.can_take_data = 1;
10254 	chk->sent = SCTP_DATAGRAM_UNSENT;
10255 	chk->snd_count = 0;
10256 	chk->flags = 0;
10257 	chk->asoc = &stcb->asoc;
10258 	chk->data = op_err;
10259 	chk->whoTo = chk->asoc->primary_destination;
10260 	atomic_add_int(&chk->whoTo->ref_count, 1);
10261 	hdr = mtod(op_err, struct sctp_chunkhdr *);
10262 	hdr->chunk_type = SCTP_OPERATION_ERROR;
10263 	hdr->chunk_flags = 0;
10264 	hdr->chunk_length = htons(chk->send_size);
10265 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
10266 	    chk,
10267 	    sctp_next);
10268 	chk->asoc->ctrl_queue_cnt++;
10269 }
10270 
10271 int
10272 sctp_send_cookie_echo(struct mbuf *m,
10273     int offset,
10274     struct sctp_tcb *stcb,
10275     struct sctp_nets *net)
10276 {
10277 	/*-
10278 	 * pull out the cookie and put it at the front of the control chunk
10279 	 * queue.
10280 	 */
10281 	int at;
10282 	struct mbuf *cookie;
10283 	struct sctp_paramhdr parm, *phdr;
10284 	struct sctp_chunkhdr *hdr;
10285 	struct sctp_tmit_chunk *chk;
10286 	uint16_t ptype, plen;
10287 
10288 	/* First find the cookie in the param area */
10289 	cookie = NULL;
10290 	at = offset + sizeof(struct sctp_init_chunk);
10291 
10292 	SCTP_TCB_LOCK_ASSERT(stcb);
10293 	do {
10294 		phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
10295 		if (phdr == NULL) {
10296 			return (-3);
10297 		}
10298 		ptype = ntohs(phdr->param_type);
10299 		plen = ntohs(phdr->param_length);
10300 		if (ptype == SCTP_STATE_COOKIE) {
10301 			int pad;
10302 
10303 			/* found the cookie */
10304 			if ((pad = (plen % 4))) {
10305 				plen += 4 - pad;
10306 			}
10307 			cookie = SCTP_M_COPYM(m, at, plen, M_DONTWAIT);
10308 			if (cookie == NULL) {
10309 				/* No memory */
10310 				return (-2);
10311 			}
10312 #ifdef SCTP_MBUF_LOGGING
10313 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
10314 				struct mbuf *mat;
10315 
10316 				mat = cookie;
10317 				while (mat) {
10318 					if (SCTP_BUF_IS_EXTENDED(mat)) {
10319 						sctp_log_mb(mat, SCTP_MBUF_ICOPY);
10320 					}
10321 					mat = SCTP_BUF_NEXT(mat);
10322 				}
10323 			}
10324 #endif
10325 			break;
10326 		}
10327 		at += SCTP_SIZE32(plen);
10328 	} while (phdr);
10329 	if (cookie == NULL) {
10330 		/* Did not find the cookie */
10331 		return (-3);
10332 	}
10333 	/* ok, we got the cookie lets change it into a cookie echo chunk */
10334 
10335 	/* first the change from param to cookie */
10336 	hdr = mtod(cookie, struct sctp_chunkhdr *);
10337 	hdr->chunk_type = SCTP_COOKIE_ECHO;
10338 	hdr->chunk_flags = 0;
10339 	/* get the chunk stuff now and place it in the FRONT of the queue */
10340 	sctp_alloc_a_chunk(stcb, chk);
10341 	if (chk == NULL) {
10342 		/* no memory */
10343 		sctp_m_freem(cookie);
10344 		return (-5);
10345 	}
10346 	chk->copy_by_ref = 0;
10347 	chk->send_size = plen;
10348 	chk->rec.chunk_id.id = SCTP_COOKIE_ECHO;
10349 	chk->rec.chunk_id.can_take_data = 0;
10350 	chk->sent = SCTP_DATAGRAM_UNSENT;
10351 	chk->snd_count = 0;
10352 	chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
10353 	chk->asoc = &stcb->asoc;
10354 	chk->data = cookie;
10355 	chk->whoTo = chk->asoc->primary_destination;
10356 	atomic_add_int(&chk->whoTo->ref_count, 1);
10357 	TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
10358 	chk->asoc->ctrl_queue_cnt++;
10359 	return (0);
10360 }
10361 
10362 void
10363 sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
10364     struct mbuf *m,
10365     int offset,
10366     int chk_length,
10367     struct sctp_nets *net)
10368 {
10369 	/*
10370 	 * take a HB request and make it into a HB ack and send it.
10371 	 */
10372 	struct mbuf *outchain;
10373 	struct sctp_chunkhdr *chdr;
10374 	struct sctp_tmit_chunk *chk;
10375 
10376 
10377 	if (net == NULL)
10378 		/* must have a net pointer */
10379 		return;
10380 
10381 	outchain = SCTP_M_COPYM(m, offset, chk_length, M_DONTWAIT);
10382 	if (outchain == NULL) {
10383 		/* gak out of memory */
10384 		return;
10385 	}
10386 #ifdef SCTP_MBUF_LOGGING
10387 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
10388 		struct mbuf *mat;
10389 
10390 		mat = outchain;
10391 		while (mat) {
10392 			if (SCTP_BUF_IS_EXTENDED(mat)) {
10393 				sctp_log_mb(mat, SCTP_MBUF_ICOPY);
10394 			}
10395 			mat = SCTP_BUF_NEXT(mat);
10396 		}
10397 	}
10398 #endif
10399 	chdr = mtod(outchain, struct sctp_chunkhdr *);
10400 	chdr->chunk_type = SCTP_HEARTBEAT_ACK;
10401 	chdr->chunk_flags = 0;
10402 	if (chk_length % 4) {
10403 		/* need pad */
10404 		uint32_t cpthis = 0;
10405 		int padlen;
10406 
10407 		padlen = 4 - (chk_length % 4);
10408 		m_copyback(outchain, chk_length, padlen, (caddr_t)&cpthis);
10409 	}
10410 	sctp_alloc_a_chunk(stcb, chk);
10411 	if (chk == NULL) {
10412 		/* no memory */
10413 		sctp_m_freem(outchain);
10414 		return;
10415 	}
10416 	chk->copy_by_ref = 0;
10417 	chk->send_size = chk_length;
10418 	chk->rec.chunk_id.id = SCTP_HEARTBEAT_ACK;
10419 	chk->rec.chunk_id.can_take_data = 1;
10420 	chk->sent = SCTP_DATAGRAM_UNSENT;
10421 	chk->snd_count = 0;
10422 	chk->flags = 0;
10423 	chk->asoc = &stcb->asoc;
10424 	chk->data = outchain;
10425 	chk->whoTo = net;
10426 	atomic_add_int(&chk->whoTo->ref_count, 1);
10427 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
10428 	chk->asoc->ctrl_queue_cnt++;
10429 }
10430 
10431 void
10432 sctp_send_cookie_ack(struct sctp_tcb *stcb)
10433 {
10434 	/* formulate and queue a cookie-ack back to sender */
10435 	struct mbuf *cookie_ack;
10436 	struct sctp_chunkhdr *hdr;
10437 	struct sctp_tmit_chunk *chk;
10438 
10439 	cookie_ack = NULL;
10440 	SCTP_TCB_LOCK_ASSERT(stcb);
10441 
10442 	cookie_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_DONTWAIT, 1, MT_HEADER);
10443 	if (cookie_ack == NULL) {
10444 		/* no mbuf's */
10445 		return;
10446 	}
10447 	SCTP_BUF_RESV_UF(cookie_ack, SCTP_MIN_OVERHEAD);
10448 	sctp_alloc_a_chunk(stcb, chk);
10449 	if (chk == NULL) {
10450 		/* no memory */
10451 		sctp_m_freem(cookie_ack);
10452 		return;
10453 	}
10454 	chk->copy_by_ref = 0;
10455 	chk->send_size = sizeof(struct sctp_chunkhdr);
10456 	chk->rec.chunk_id.id = SCTP_COOKIE_ACK;
10457 	chk->rec.chunk_id.can_take_data = 1;
10458 	chk->sent = SCTP_DATAGRAM_UNSENT;
10459 	chk->snd_count = 0;
10460 	chk->flags = 0;
10461 	chk->asoc = &stcb->asoc;
10462 	chk->data = cookie_ack;
10463 	if (chk->asoc->last_control_chunk_from != NULL) {
10464 		chk->whoTo = chk->asoc->last_control_chunk_from;
10465 	} else {
10466 		chk->whoTo = chk->asoc->primary_destination;
10467 	}
10468 	atomic_add_int(&chk->whoTo->ref_count, 1);
10469 	hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
10470 	hdr->chunk_type = SCTP_COOKIE_ACK;
10471 	hdr->chunk_flags = 0;
10472 	hdr->chunk_length = htons(chk->send_size);
10473 	SCTP_BUF_LEN(cookie_ack) = chk->send_size;
10474 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
10475 	chk->asoc->ctrl_queue_cnt++;
10476 	return;
10477 }
10478 
10479 
10480 void
10481 sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
10482 {
10483 	/* formulate and queue a SHUTDOWN-ACK back to the sender */
10484 	struct mbuf *m_shutdown_ack;
10485 	struct sctp_shutdown_ack_chunk *ack_cp;
10486 	struct sctp_tmit_chunk *chk;
10487 
10488 	m_shutdown_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_ack_chunk), 0, M_DONTWAIT, 1, MT_HEADER);
10489 	if (m_shutdown_ack == NULL) {
10490 		/* no mbuf's */
10491 		return;
10492 	}
10493 	SCTP_BUF_RESV_UF(m_shutdown_ack, SCTP_MIN_OVERHEAD);
10494 	sctp_alloc_a_chunk(stcb, chk);
10495 	if (chk == NULL) {
10496 		/* no memory */
10497 		sctp_m_freem(m_shutdown_ack);
10498 		return;
10499 	}
10500 	chk->copy_by_ref = 0;
10501 	chk->send_size = sizeof(struct sctp_chunkhdr);
10502 	chk->rec.chunk_id.id = SCTP_SHUTDOWN_ACK;
10503 	chk->rec.chunk_id.can_take_data = 1;
10504 	chk->sent = SCTP_DATAGRAM_UNSENT;
10505 	chk->snd_count = 0;
10506 	chk->flags = 0;
10507 	chk->asoc = &stcb->asoc;
10508 	chk->data = m_shutdown_ack;
10509 	chk->whoTo = net;
10510 	atomic_add_int(&net->ref_count, 1);
10511 
10512 	ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
10513 	ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
10514 	ack_cp->ch.chunk_flags = 0;
10515 	ack_cp->ch.chunk_length = htons(chk->send_size);
10516 	SCTP_BUF_LEN(m_shutdown_ack) = chk->send_size;
10517 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
10518 	chk->asoc->ctrl_queue_cnt++;
10519 	return;
10520 }
10521 
10522 void
10523 sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
10524 {
10525 	/* formulate and queue a SHUTDOWN to the sender */
10526 	struct mbuf *m_shutdown;
10527 	struct sctp_shutdown_chunk *shutdown_cp;
10528 	struct sctp_tmit_chunk *chk;
10529 
10530 	m_shutdown = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_chunk), 0, M_DONTWAIT, 1, MT_HEADER);
10531 	if (m_shutdown == NULL) {
10532 		/* no mbuf's */
10533 		return;
10534 	}
10535 	SCTP_BUF_RESV_UF(m_shutdown, SCTP_MIN_OVERHEAD);
10536 	sctp_alloc_a_chunk(stcb, chk);
10537 	if (chk == NULL) {
10538 		/* no memory */
10539 		sctp_m_freem(m_shutdown);
10540 		return;
10541 	}
10542 	chk->copy_by_ref = 0;
10543 	chk->send_size = sizeof(struct sctp_shutdown_chunk);
10544 	chk->rec.chunk_id.id = SCTP_SHUTDOWN;
10545 	chk->rec.chunk_id.can_take_data = 1;
10546 	chk->sent = SCTP_DATAGRAM_UNSENT;
10547 	chk->snd_count = 0;
10548 	chk->flags = 0;
10549 	chk->asoc = &stcb->asoc;
10550 	chk->data = m_shutdown;
10551 	chk->whoTo = net;
10552 	atomic_add_int(&net->ref_count, 1);
10553 
10554 	shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
10555 	shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
10556 	shutdown_cp->ch.chunk_flags = 0;
10557 	shutdown_cp->ch.chunk_length = htons(chk->send_size);
10558 	shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
10559 	SCTP_BUF_LEN(m_shutdown) = chk->send_size;
10560 	TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
10561 	chk->asoc->ctrl_queue_cnt++;
10562 	return;
10563 }
10564 
10565 void
10566 sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net, int addr_locked)
10567 {
10568 	/*
10569 	 * formulate and queue an ASCONF to the peer. ASCONF parameters
10570 	 * should be queued on the assoc queue.
10571 	 */
10572 	struct sctp_tmit_chunk *chk;
10573 	struct mbuf *m_asconf;
10574 	int len;
10575 
10576 	SCTP_TCB_LOCK_ASSERT(stcb);
10577 
10578 	if ((!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) &&
10579 	    (!sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS))) {
10580 		/* can't send a new one if there is one in flight already */
10581 		return;
10582 	}
10583 	/* compose an ASCONF chunk, maximum length is PMTU */
10584 	m_asconf = sctp_compose_asconf(stcb, &len, addr_locked);
10585 	if (m_asconf == NULL) {
10586 		return;
10587 	}
10588 	sctp_alloc_a_chunk(stcb, chk);
10589 	if (chk == NULL) {
10590 		/* no memory */
10591 		sctp_m_freem(m_asconf);
10592 		return;
10593 	}
10594 	chk->copy_by_ref = 0;
10595 	chk->data = m_asconf;
10596 	chk->send_size = len;
10597 	chk->rec.chunk_id.id = SCTP_ASCONF;
10598 	chk->rec.chunk_id.can_take_data = 0;
10599 	chk->sent = SCTP_DATAGRAM_UNSENT;
10600 	chk->snd_count = 0;
10601 	chk->flags = CHUNK_FLAGS_FRAGMENT_OK;
10602 	chk->asoc = &stcb->asoc;
10603 	chk->whoTo = net;
10604 	atomic_add_int(&chk->whoTo->ref_count, 1);
10605 	TAILQ_INSERT_TAIL(&chk->asoc->asconf_send_queue, chk, sctp_next);
10606 	chk->asoc->ctrl_queue_cnt++;
10607 	return;
10608 }
10609 
10610 void
10611 sctp_send_asconf_ack(struct sctp_tcb *stcb)
10612 {
10613 	/*
10614 	 * formulate and queue a asconf-ack back to sender. the asconf-ack
10615 	 * must be stored in the tcb.
10616 	 */
10617 	struct sctp_tmit_chunk *chk;
10618 	struct sctp_asconf_ack *ack, *latest_ack;
10619 	struct mbuf *m_ack, *m;
10620 	struct sctp_nets *net = NULL;
10621 
10622 	SCTP_TCB_LOCK_ASSERT(stcb);
10623 	/* Get the latest ASCONF-ACK */
10624 	latest_ack = TAILQ_LAST(&stcb->asoc.asconf_ack_sent, sctp_asconf_ackhead);
10625 	if (latest_ack == NULL) {
10626 		return;
10627 	}
10628 	if (latest_ack->last_sent_to != NULL &&
10629 	    latest_ack->last_sent_to == stcb->asoc.last_control_chunk_from) {
10630 		/* we're doing a retransmission */
10631 		net = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from, 0);
10632 		if (net == NULL) {
10633 			/* no alternate */
10634 			if (stcb->asoc.last_control_chunk_from == NULL)
10635 				net = stcb->asoc.primary_destination;
10636 			else
10637 				net = stcb->asoc.last_control_chunk_from;
10638 		}
10639 	} else {
10640 		/* normal case */
10641 		if (stcb->asoc.last_control_chunk_from == NULL)
10642 			net = stcb->asoc.primary_destination;
10643 		else
10644 			net = stcb->asoc.last_control_chunk_from;
10645 	}
10646 	latest_ack->last_sent_to = net;
10647 
10648 	TAILQ_FOREACH(ack, &stcb->asoc.asconf_ack_sent, next) {
10649 		if (ack->data == NULL) {
10650 			continue;
10651 		}
10652 		/* copy the asconf_ack */
10653 		m_ack = SCTP_M_COPYM(ack->data, 0, M_COPYALL, M_DONTWAIT);
10654 		if (m_ack == NULL) {
10655 			/* couldn't copy it */
10656 			return;
10657 		}
10658 #ifdef SCTP_MBUF_LOGGING
10659 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
10660 			struct mbuf *mat;
10661 
10662 			mat = m_ack;
10663 			while (mat) {
10664 				if (SCTP_BUF_IS_EXTENDED(mat)) {
10665 					sctp_log_mb(mat, SCTP_MBUF_ICOPY);
10666 				}
10667 				mat = SCTP_BUF_NEXT(mat);
10668 			}
10669 		}
10670 #endif
10671 
10672 		sctp_alloc_a_chunk(stcb, chk);
10673 		if (chk == NULL) {
10674 			/* no memory */
10675 			if (m_ack)
10676 				sctp_m_freem(m_ack);
10677 			return;
10678 		}
10679 		chk->copy_by_ref = 0;
10680 
10681 		chk->whoTo = net;
10682 		chk->data = m_ack;
10683 		chk->send_size = 0;
10684 		/* Get size */
10685 		m = m_ack;
10686 		chk->send_size = ack->len;
10687 		chk->rec.chunk_id.id = SCTP_ASCONF_ACK;
10688 		chk->rec.chunk_id.can_take_data = 1;
10689 		chk->sent = SCTP_DATAGRAM_UNSENT;
10690 		chk->snd_count = 0;
10691 		chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;	/* XXX */
10692 		chk->asoc = &stcb->asoc;
10693 		atomic_add_int(&chk->whoTo->ref_count, 1);
10694 
10695 		TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
10696 		chk->asoc->ctrl_queue_cnt++;
10697 	}
10698 	return;
10699 }
10700 
10701 
10702 static int
10703 sctp_chunk_retransmission(struct sctp_inpcb *inp,
10704     struct sctp_tcb *stcb,
10705     struct sctp_association *asoc,
10706     int *cnt_out, struct timeval *now, int *now_filled, int *fr_done, int so_locked
10707 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
10708     SCTP_UNUSED
10709 #endif
10710 )
10711 {
10712 	/*-
10713 	 * send out one MTU of retransmission. If fast_retransmit is
10714 	 * happening we ignore the cwnd. Otherwise we obey the cwnd and
10715 	 * rwnd. For a Cookie or Asconf in the control chunk queue we
10716 	 * retransmit them by themselves.
10717 	 *
10718 	 * For data chunks we will pick out the lowest TSN's in the sent_queue
10719 	 * marked for resend and bundle them all together (up to a MTU of
10720 	 * destination). The address to send to should have been
10721 	 * selected/changed where the retransmission was marked (i.e. in FR
10722 	 * or t3-timeout routines).
10723 	 */
10724 	struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
10725 	struct sctp_tmit_chunk *chk, *fwd;
10726 	struct mbuf *m, *endofchain;
10727 	struct sctp_nets *net = NULL;
10728 	uint32_t tsns_sent = 0;
10729 	int no_fragmentflg, bundle_at, cnt_thru;
10730 	unsigned int mtu;
10731 	int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;
10732 	struct sctp_auth_chunk *auth = NULL;
10733 	uint32_t auth_offset = 0;
10734 	uint16_t auth_keyid;
10735 	int override_ok = 1;
10736 	int data_auth_reqd = 0;
10737 	uint32_t dmtu = 0;
10738 
10739 	SCTP_TCB_LOCK_ASSERT(stcb);
10740 	tmr_started = ctl_cnt = bundle_at = error = 0;
10741 	no_fragmentflg = 1;
10742 	fwd_tsn = 0;
10743 	*cnt_out = 0;
10744 	fwd = NULL;
10745 	endofchain = m = NULL;
10746 	auth_keyid = stcb->asoc.authinfo.active_keyid;
10747 #ifdef SCTP_AUDITING_ENABLED
10748 	sctp_audit_log(0xC3, 1);
10749 #endif
10750 	if ((TAILQ_EMPTY(&asoc->sent_queue)) &&
10751 	    (TAILQ_EMPTY(&asoc->control_send_queue))) {
10752 		SCTPDBG(SCTP_DEBUG_OUTPUT1, "SCTP hits empty queue with cnt set to %d?\n",
10753 		    asoc->sent_queue_retran_cnt);
10754 		asoc->sent_queue_cnt = 0;
10755 		asoc->sent_queue_cnt_removeable = 0;
10756 		/* send back 0/0 so we enter normal transmission */
10757 		*cnt_out = 0;
10758 		return (0);
10759 	}
10760 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
10761 		if ((chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) ||
10762 		    (chk->rec.chunk_id.id == SCTP_STREAM_RESET) ||
10763 		    (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN)) {
10764 			if (chk->rec.chunk_id.id == SCTP_STREAM_RESET) {
10765 				if (chk != asoc->str_reset) {
10766 					/*
10767 					 * not eligible for retran if its
10768 					 * not ours
10769 					 */
10770 					continue;
10771 				}
10772 			}
10773 			ctl_cnt++;
10774 			if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) {
10775 				fwd_tsn = 1;
10776 				fwd = chk;
10777 			}
10778 			/*
10779 			 * Add an AUTH chunk, if chunk requires it save the
10780 			 * offset into the chain for AUTH
10781 			 */
10782 			if ((auth == NULL) &&
10783 			    (sctp_auth_is_required_chunk(chk->rec.chunk_id.id,
10784 			    stcb->asoc.peer_auth_chunks))) {
10785 				m = sctp_add_auth_chunk(m, &endofchain,
10786 				    &auth, &auth_offset,
10787 				    stcb,
10788 				    chk->rec.chunk_id.id);
10789 				SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
10790 			}
10791 			m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref);
10792 			break;
10793 		}
10794 	}
10795 	one_chunk = 0;
10796 	cnt_thru = 0;
10797 	/* do we have control chunks to retransmit? */
10798 	if (m != NULL) {
10799 		/* Start a timer no matter if we suceed or fail */
10800 		if (chk->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
10801 			sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
10802 		} else if (chk->rec.chunk_id.id == SCTP_ASCONF)
10803 			sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);
10804 		chk->snd_count++;	/* update our count */
10805 		if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
10806 		    (struct sockaddr *)&chk->whoTo->ro._l_addr, m,
10807 		    auth_offset, auth, stcb->asoc.authinfo.active_keyid,
10808 		    no_fragmentflg, 0, NULL, 0,
10809 		    inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag),
10810 		    chk->whoTo->port, so_locked, NULL))) {
10811 			SCTP_STAT_INCR(sctps_lowlevelerr);
10812 			return (error);
10813 		}
10814 		m = endofchain = NULL;
10815 		auth = NULL;
10816 		auth_offset = 0;
10817 		/*
10818 		 * We don't want to mark the net->sent time here since this
10819 		 * we use this for HB and retrans cannot measure RTT
10820 		 */
10821 		/* (void)SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time); */
10822 		*cnt_out += 1;
10823 		chk->sent = SCTP_DATAGRAM_SENT;
10824 		sctp_ucount_decr(asoc->sent_queue_retran_cnt);
10825 		if (fwd_tsn == 0) {
10826 			return (0);
10827 		} else {
10828 			/* Clean up the fwd-tsn list */
10829 			sctp_clean_up_ctl(stcb, asoc);
10830 			return (0);
10831 		}
10832 	}
10833 	/*
10834 	 * Ok, it is just data retransmission we need to do or that and a
10835 	 * fwd-tsn with it all.
10836 	 */
10837 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
10838 		return (SCTP_RETRAN_DONE);
10839 	}
10840 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
10841 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
10842 		/* not yet open, resend the cookie and that is it */
10843 		return (1);
10844 	}
10845 #ifdef SCTP_AUDITING_ENABLED
10846 	sctp_auditing(20, inp, stcb, NULL);
10847 #endif
10848 	data_auth_reqd = sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks);
10849 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
10850 		if (chk->sent != SCTP_DATAGRAM_RESEND) {
10851 			/* No, not sent to this net or not ready for rtx */
10852 			continue;
10853 		}
10854 		if ((SCTP_BASE_SYSCTL(sctp_max_retran_chunk)) &&
10855 		    (chk->snd_count >= SCTP_BASE_SYSCTL(sctp_max_retran_chunk))) {
10856 			/* Gak, we have exceeded max unlucky retran, abort! */
10857 			SCTP_PRINTF("Gak, chk->snd_count:%d >= max:%d - send abort\n",
10858 			    chk->snd_count,
10859 			    SCTP_BASE_SYSCTL(sctp_max_retran_chunk));
10860 			atomic_add_int(&stcb->asoc.refcnt, 1);
10861 			sctp_abort_an_association(stcb->sctp_ep, stcb, 0, NULL, so_locked);
10862 			SCTP_TCB_LOCK(stcb);
10863 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
10864 			return (SCTP_RETRAN_EXIT);
10865 		}
10866 		/* pick up the net */
10867 		net = chk->whoTo;
10868 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
10869 			mtu = (net->mtu - SCTP_MIN_OVERHEAD);
10870 		} else {
10871 			mtu = net->mtu - SCTP_MIN_V4_OVERHEAD;
10872 		}
10873 
10874 		if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
10875 			/* No room in peers rwnd */
10876 			uint32_t tsn;
10877 
10878 			tsn = asoc->last_acked_seq + 1;
10879 			if (tsn == chk->rec.data.TSN_seq) {
10880 				/*
10881 				 * we make a special exception for this
10882 				 * case. The peer has no rwnd but is missing
10883 				 * the lowest chunk.. which is probably what
10884 				 * is holding up the rwnd.
10885 				 */
10886 				goto one_chunk_around;
10887 			}
10888 			return (1);
10889 		}
10890 one_chunk_around:
10891 		if (asoc->peers_rwnd < mtu) {
10892 			one_chunk = 1;
10893 			if ((asoc->peers_rwnd == 0) &&
10894 			    (asoc->total_flight == 0)) {
10895 				chk->window_probe = 1;
10896 				chk->whoTo->window_probe = 1;
10897 			}
10898 		}
10899 #ifdef SCTP_AUDITING_ENABLED
10900 		sctp_audit_log(0xC3, 2);
10901 #endif
10902 		bundle_at = 0;
10903 		m = NULL;
10904 		net->fast_retran_ip = 0;
10905 		if (chk->rec.data.doing_fast_retransmit == 0) {
10906 			/*
10907 			 * if no FR in progress skip destination that have
10908 			 * flight_size > cwnd.
10909 			 */
10910 			if (net->flight_size >= net->cwnd) {
10911 				continue;
10912 			}
10913 		} else {
10914 			/*
10915 			 * Mark the destination net to have FR recovery
10916 			 * limits put on it.
10917 			 */
10918 			*fr_done = 1;
10919 			net->fast_retran_ip = 1;
10920 		}
10921 
10922 		/*
10923 		 * if no AUTH is yet included and this chunk requires it,
10924 		 * make sure to account for it.  We don't apply the size
10925 		 * until the AUTH chunk is actually added below in case
10926 		 * there is no room for this chunk.
10927 		 */
10928 		if (data_auth_reqd && (auth == NULL)) {
10929 			dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
10930 		} else
10931 			dmtu = 0;
10932 
10933 		if ((chk->send_size <= (mtu - dmtu)) ||
10934 		    (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
10935 			/* ok we will add this one */
10936 			if (data_auth_reqd) {
10937 				if (auth == NULL) {
10938 					m = sctp_add_auth_chunk(m,
10939 					    &endofchain,
10940 					    &auth,
10941 					    &auth_offset,
10942 					    stcb,
10943 					    SCTP_DATA);
10944 					auth_keyid = chk->auth_keyid;
10945 					override_ok = 0;
10946 					SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
10947 				} else if (override_ok) {
10948 					auth_keyid = chk->auth_keyid;
10949 					override_ok = 0;
10950 				} else if (chk->auth_keyid != auth_keyid) {
10951 					/* different keyid, so done bundling */
10952 					break;
10953 				}
10954 			}
10955 			m = sctp_copy_mbufchain(chk->data, m, &endofchain, 0, chk->send_size, chk->copy_by_ref);
10956 			if (m == NULL) {
10957 				SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
10958 				return (ENOMEM);
10959 			}
10960 			/* Do clear IP_DF ? */
10961 			if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
10962 				no_fragmentflg = 0;
10963 			}
10964 			/* upate our MTU size */
10965 			if (mtu > (chk->send_size + dmtu))
10966 				mtu -= (chk->send_size + dmtu);
10967 			else
10968 				mtu = 0;
10969 			data_list[bundle_at++] = chk;
10970 			if (one_chunk && (asoc->total_flight <= 0)) {
10971 				SCTP_STAT_INCR(sctps_windowprobed);
10972 			}
10973 		}
10974 		if (one_chunk == 0) {
10975 			/*
10976 			 * now are there anymore forward from chk to pick
10977 			 * up?
10978 			 */
10979 			fwd = TAILQ_NEXT(chk, sctp_next);
10980 			while (fwd) {
10981 				if (fwd->sent != SCTP_DATAGRAM_RESEND) {
10982 					/* Nope, not for retran */
10983 					fwd = TAILQ_NEXT(fwd, sctp_next);
10984 					continue;
10985 				}
10986 				if (fwd->whoTo != net) {
10987 					/* Nope, not the net in question */
10988 					fwd = TAILQ_NEXT(fwd, sctp_next);
10989 					continue;
10990 				}
10991 				if (data_auth_reqd && (auth == NULL)) {
10992 					dmtu = sctp_get_auth_chunk_len(stcb->asoc.peer_hmac_id);
10993 				} else
10994 					dmtu = 0;
10995 				if (fwd->send_size <= (mtu - dmtu)) {
10996 					if (data_auth_reqd) {
10997 						if (auth == NULL) {
10998 							m = sctp_add_auth_chunk(m,
10999 							    &endofchain,
11000 							    &auth,
11001 							    &auth_offset,
11002 							    stcb,
11003 							    SCTP_DATA);
11004 							auth_keyid = fwd->auth_keyid;
11005 							override_ok = 0;
11006 							SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
11007 						} else if (override_ok) {
11008 							auth_keyid = fwd->auth_keyid;
11009 							override_ok = 0;
11010 						} else if (fwd->auth_keyid != auth_keyid) {
11011 							/*
11012 							 * different keyid,
11013 							 * so done bundling
11014 							 */
11015 							break;
11016 						}
11017 					}
11018 					m = sctp_copy_mbufchain(fwd->data, m, &endofchain, 0, fwd->send_size, fwd->copy_by_ref);
11019 					if (m == NULL) {
11020 						SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
11021 						return (ENOMEM);
11022 					}
11023 					/* Do clear IP_DF ? */
11024 					if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
11025 						no_fragmentflg = 0;
11026 					}
11027 					/* upate our MTU size */
11028 					if (mtu > (fwd->send_size + dmtu))
11029 						mtu -= (fwd->send_size + dmtu);
11030 					else
11031 						mtu = 0;
11032 					data_list[bundle_at++] = fwd;
11033 					if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
11034 						break;
11035 					}
11036 					fwd = TAILQ_NEXT(fwd, sctp_next);
11037 				} else {
11038 					/* can't fit so we are done */
11039 					break;
11040 				}
11041 			}
11042 		}
11043 		/* Is there something to send for this destination? */
11044 		if (m) {
11045 			/*
11046 			 * No matter if we fail/or suceed we should start a
11047 			 * timer. A failure is like a lost IP packet :-)
11048 			 */
11049 			if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
11050 				/*
11051 				 * no timer running on this destination
11052 				 * restart it.
11053 				 */
11054 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
11055 				tmr_started = 1;
11056 			}
11057 			/* Now lets send it, if there is anything to send :> */
11058 			if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
11059 			    (struct sockaddr *)&net->ro._l_addr, m,
11060 			    auth_offset, auth, auth_keyid,
11061 			    no_fragmentflg, 0, NULL, 0,
11062 			    inp->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag),
11063 			    net->port, so_locked, NULL))) {
11064 				/* error, we could not output */
11065 				SCTP_STAT_INCR(sctps_lowlevelerr);
11066 				return (error);
11067 			}
11068 			m = endofchain = NULL;
11069 			auth = NULL;
11070 			auth_offset = 0;
11071 			/* For HB's */
11072 			/*
11073 			 * We don't want to mark the net->sent time here
11074 			 * since this we use this for HB and retrans cannot
11075 			 * measure RTT
11076 			 */
11077 			/* (void)SCTP_GETTIME_TIMEVAL(&net->last_sent_time); */
11078 
11079 			/* For auto-close */
11080 			cnt_thru++;
11081 			if (*now_filled == 0) {
11082 				(void)SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
11083 				*now = asoc->time_last_sent;
11084 				*now_filled = 1;
11085 			} else {
11086 				asoc->time_last_sent = *now;
11087 			}
11088 			*cnt_out += bundle_at;
11089 #ifdef SCTP_AUDITING_ENABLED
11090 			sctp_audit_log(0xC4, bundle_at);
11091 #endif
11092 			if (bundle_at) {
11093 				tsns_sent = data_list[0]->rec.data.TSN_seq;
11094 			}
11095 			for (i = 0; i < bundle_at; i++) {
11096 				SCTP_STAT_INCR(sctps_sendretransdata);
11097 				data_list[i]->sent = SCTP_DATAGRAM_SENT;
11098 				/*
11099 				 * When we have a revoked data, and we
11100 				 * retransmit it, then we clear the revoked
11101 				 * flag since this flag dictates if we
11102 				 * subtracted from the fs
11103 				 */
11104 				if (data_list[i]->rec.data.chunk_was_revoked) {
11105 					/* Deflate the cwnd */
11106 					data_list[i]->whoTo->cwnd -= data_list[i]->book_size;
11107 					data_list[i]->rec.data.chunk_was_revoked = 0;
11108 				}
11109 				data_list[i]->snd_count++;
11110 				sctp_ucount_decr(asoc->sent_queue_retran_cnt);
11111 				/* record the time */
11112 				data_list[i]->sent_rcv_time = asoc->time_last_sent;
11113 				if (data_list[i]->book_size_scale) {
11114 					/*
11115 					 * need to double the book size on
11116 					 * this one
11117 					 */
11118 					data_list[i]->book_size_scale = 0;
11119 					/*
11120 					 * Since we double the booksize, we
11121 					 * must also double the output queue
11122 					 * size, since this get shrunk when
11123 					 * we free by this amount.
11124 					 */
11125 					atomic_add_int(&((asoc)->total_output_queue_size), data_list[i]->book_size);
11126 					data_list[i]->book_size *= 2;
11127 
11128 
11129 				} else {
11130 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
11131 						sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
11132 						    asoc->peers_rwnd, data_list[i]->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
11133 					}
11134 					asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
11135 					    (uint32_t) (data_list[i]->send_size +
11136 					    SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)));
11137 				}
11138 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
11139 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_RSND,
11140 					    data_list[i]->whoTo->flight_size,
11141 					    data_list[i]->book_size,
11142 					    (uintptr_t) data_list[i]->whoTo,
11143 					    data_list[i]->rec.data.TSN_seq);
11144 				}
11145 				sctp_flight_size_increase(data_list[i]);
11146 				sctp_total_flight_increase(stcb, data_list[i]);
11147 				if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
11148 					/* SWS sender side engages */
11149 					asoc->peers_rwnd = 0;
11150 				}
11151 				if ((i == 0) &&
11152 				    (data_list[i]->rec.data.doing_fast_retransmit)) {
11153 					SCTP_STAT_INCR(sctps_sendfastretrans);
11154 					if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
11155 					    (tmr_started == 0)) {
11156 						/*-
11157 						 * ok we just fast-retrans'd
11158 						 * the lowest TSN, i.e the
11159 						 * first on the list. In
11160 						 * this case we want to give
11161 						 * some more time to get a
11162 						 * SACK back without a
11163 						 * t3-expiring.
11164 						 */
11165 						sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net,
11166 						    SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_4);
11167 						sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
11168 					}
11169 				}
11170 			}
11171 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
11172 				sctp_log_cwnd(stcb, net, tsns_sent, SCTP_CWND_LOG_FROM_RESEND);
11173 			}
11174 #ifdef SCTP_AUDITING_ENABLED
11175 			sctp_auditing(21, inp, stcb, NULL);
11176 #endif
11177 		} else {
11178 			/* None will fit */
11179 			return (1);
11180 		}
11181 		if (asoc->sent_queue_retran_cnt <= 0) {
11182 			/* all done we have no more to retran */
11183 			asoc->sent_queue_retran_cnt = 0;
11184 			break;
11185 		}
11186 		if (one_chunk) {
11187 			/* No more room in rwnd */
11188 			return (1);
11189 		}
11190 		/* stop the for loop here. we sent out a packet */
11191 		break;
11192 	}
11193 	return (0);
11194 }
11195 
11196 
11197 static int
11198 sctp_timer_validation(struct sctp_inpcb *inp,
11199     struct sctp_tcb *stcb,
11200     struct sctp_association *asoc,
11201     int ret)
11202 {
11203 	struct sctp_nets *net;
11204 
11205 	/* Validate that a timer is running somewhere */
11206 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
11207 		if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
11208 			/* Here is a timer */
11209 			return (ret);
11210 		}
11211 	}
11212 	SCTP_TCB_LOCK_ASSERT(stcb);
11213 	/* Gak, we did not have a timer somewhere */
11214 	SCTPDBG(SCTP_DEBUG_OUTPUT3, "Deadlock avoided starting timer on a dest at retran\n");
11215 	sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
11216 	return (ret);
11217 }
11218 
11219 void
11220 sctp_chunk_output(struct sctp_inpcb *inp,
11221     struct sctp_tcb *stcb,
11222     int from_where,
11223     int so_locked
11224 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
11225     SCTP_UNUSED
11226 #endif
11227 )
11228 {
11229 	/*-
11230 	 * Ok this is the generic chunk service queue. we must do the
11231 	 * following:
11232 	 * - See if there are retransmits pending, if so we must
11233 	 *   do these first.
11234 	 * - Service the stream queue that is next, moving any
11235 	 *   message (note I must get a complete message i.e.
11236 	 *   FIRST/MIDDLE and LAST to the out queue in one pass) and assigning
11237 	 *   TSN's
11238 	 * - Check to see if the cwnd/rwnd allows any output, if so we
11239 	 *   go ahead and fomulate and send the low level chunks. Making sure
11240 	 *   to combine any control in the control chunk queue also.
11241 	 */
11242 	struct sctp_association *asoc;
11243 	struct sctp_nets *net;
11244 	int error = 0, num_out = 0, tot_out = 0, ret = 0, reason_code = 0,
11245 	    burst_cnt = 0, burst_limit = 0;
11246 	struct timeval now;
11247 	int now_filled = 0;
11248 	int cwnd_full = 0;
11249 	int nagle_on = 0;
11250 	int frag_point = sctp_get_frag_point(stcb, &stcb->asoc);
11251 	int un_sent = 0;
11252 	int fr_done, tot_frs = 0;
11253 
11254 	asoc = &stcb->asoc;
11255 	if (from_where == SCTP_OUTPUT_FROM_USR_SEND) {
11256 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NODELAY)) {
11257 			nagle_on = 0;
11258 		} else {
11259 			nagle_on = 1;
11260 		}
11261 	}
11262 	SCTP_TCB_LOCK_ASSERT(stcb);
11263 
11264 	un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
11265 
11266 	if ((un_sent <= 0) &&
11267 	    (TAILQ_EMPTY(&asoc->control_send_queue)) &&
11268 	    (asoc->sent_queue_retran_cnt == 0)) {
11269 		/* Nothing to do unless there is something to be sent left */
11270 		return;
11271 	}
11272 	/*
11273 	 * Do we have something to send, data or control AND a sack timer
11274 	 * running, if so piggy-back the sack.
11275 	 */
11276 	if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
11277 		/*
11278 		 * EY if nr_sacks used then send an nr-sack , a sack
11279 		 * otherwise
11280 		 */
11281 		if (SCTP_BASE_SYSCTL(sctp_nr_sack_on_off) && asoc->peer_supports_nr_sack)
11282 			sctp_send_nr_sack(stcb);
11283 		else
11284 			sctp_send_sack(stcb);
11285 		(void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
11286 	}
11287 	while (asoc->sent_queue_retran_cnt) {
11288 		/*-
11289 		 * Ok, it is retransmission time only, we send out only ONE
11290 		 * packet with a single call off to the retran code.
11291 		 */
11292 		if (from_where == SCTP_OUTPUT_FROM_COOKIE_ACK) {
11293 			/*-
11294 			 * Special hook for handling cookiess discarded
11295 			 * by peer that carried data. Send cookie-ack only
11296 			 * and then the next call with get the retran's.
11297 			 */
11298 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
11299 			    &cwnd_full, from_where,
11300 			    &now, &now_filled, frag_point, so_locked);
11301 			return;
11302 		} else if (from_where != SCTP_OUTPUT_FROM_HB_TMR) {
11303 			/* if its not from a HB then do it */
11304 			fr_done = 0;
11305 			ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled, &fr_done, so_locked);
11306 			if (fr_done) {
11307 				tot_frs++;
11308 			}
11309 		} else {
11310 			/*
11311 			 * its from any other place, we don't allow retran
11312 			 * output (only control)
11313 			 */
11314 			ret = 1;
11315 		}
11316 		if (ret > 0) {
11317 			/* Can't send anymore */
11318 			/*-
11319 			 * now lets push out control by calling med-level
11320 			 * output once. this assures that we WILL send HB's
11321 			 * if queued too.
11322 			 */
11323 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
11324 			    &cwnd_full, from_where,
11325 			    &now, &now_filled, frag_point, so_locked);
11326 #ifdef SCTP_AUDITING_ENABLED
11327 			sctp_auditing(8, inp, stcb, NULL);
11328 #endif
11329 			(void)sctp_timer_validation(inp, stcb, asoc, ret);
11330 			return;
11331 		}
11332 		if (ret < 0) {
11333 			/*-
11334 			 * The count was off.. retran is not happening so do
11335 			 * the normal retransmission.
11336 			 */
11337 #ifdef SCTP_AUDITING_ENABLED
11338 			sctp_auditing(9, inp, stcb, NULL);
11339 #endif
11340 			if (ret == SCTP_RETRAN_EXIT) {
11341 				return;
11342 			}
11343 			break;
11344 		}
11345 		if (from_where == SCTP_OUTPUT_FROM_T3) {
11346 			/* Only one transmission allowed out of a timeout */
11347 #ifdef SCTP_AUDITING_ENABLED
11348 			sctp_auditing(10, inp, stcb, NULL);
11349 #endif
11350 			/* Push out any control */
11351 			(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
11352 			    &now, &now_filled, frag_point, so_locked);
11353 			return;
11354 		}
11355 		if (tot_frs > asoc->max_burst) {
11356 			/* Hit FR burst limit */
11357 			return;
11358 		}
11359 		if ((num_out == 0) && (ret == 0)) {
11360 
11361 			/* No more retrans to send */
11362 			break;
11363 		}
11364 	}
11365 #ifdef SCTP_AUDITING_ENABLED
11366 	sctp_auditing(12, inp, stcb, NULL);
11367 #endif
11368 	/* Check for bad destinations, if they exist move chunks around. */
11369 	burst_limit = asoc->max_burst;
11370 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
11371 		if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
11372 		    SCTP_ADDR_NOT_REACHABLE) {
11373 			/*-
11374 			 * if possible move things off of this address we
11375 			 * still may send below due to the dormant state but
11376 			 * we try to find an alternate address to send to
11377 			 * and if we have one we move all queued data on the
11378 			 * out wheel to this alternate address.
11379 			 */
11380 			if (net->ref_count > 1)
11381 				sctp_move_to_an_alt(stcb, asoc, net);
11382 		} else if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) &&
11383 			    SCTP_BASE_SYSCTL(sctp_cmt_pf) &&
11384 		    ((net->dest_state & SCTP_ADDR_PF) == SCTP_ADDR_PF)) {
11385 			/*
11386 			 * JRS 5/14/07 - If CMT PF is on and the current
11387 			 * destination is in PF state, move all queued data
11388 			 * to an alternate desination.
11389 			 */
11390 			if (net->ref_count > 1)
11391 				sctp_move_to_an_alt(stcb, asoc, net);
11392 		} else {
11393 			/*-
11394 			 * if ((asoc->sat_network) || (net->addr_is_local))
11395 			 * { burst_limit = asoc->max_burst *
11396 			 * SCTP_SAT_NETWORK_BURST_INCR; }
11397 			 */
11398 			if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst)) {
11399 				if ((net->flight_size + (burst_limit * net->mtu)) < net->cwnd) {
11400 					/*
11401 					 * JRS - Use the congestion control
11402 					 * given in the congestion control
11403 					 * module
11404 					 */
11405 					asoc->cc_functions.sctp_cwnd_update_after_output(stcb, net, burst_limit);
11406 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) {
11407 						sctp_log_maxburst(stcb, net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
11408 					}
11409 					SCTP_STAT_INCR(sctps_maxburstqueued);
11410 				}
11411 				net->fast_retran_ip = 0;
11412 			} else {
11413 				if (net->flight_size == 0) {
11414 					/* Should be decaying the cwnd here */
11415 					;
11416 				}
11417 			}
11418 		}
11419 
11420 	}
11421 	burst_cnt = 0;
11422 	cwnd_full = 0;
11423 	do {
11424 		error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
11425 		    &reason_code, 0, &cwnd_full, from_where,
11426 		    &now, &now_filled, frag_point, so_locked);
11427 		if (error) {
11428 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "Error %d was returned from med-c-op\n", error);
11429 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) {
11430 				sctp_log_maxburst(stcb, asoc->primary_destination, error, burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
11431 			}
11432 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
11433 				sctp_log_cwnd(stcb, NULL, error, SCTP_SEND_NOW_COMPLETES);
11434 				sctp_log_cwnd(stcb, NULL, 0xdeadbeef, SCTP_SEND_NOW_COMPLETES);
11435 			}
11436 			break;
11437 		}
11438 		SCTPDBG(SCTP_DEBUG_OUTPUT3, "m-c-o put out %d\n", num_out);
11439 
11440 		tot_out += num_out;
11441 		burst_cnt++;
11442 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
11443 			sctp_log_cwnd(stcb, NULL, num_out, SCTP_SEND_NOW_COMPLETES);
11444 			if (num_out == 0) {
11445 				sctp_log_cwnd(stcb, NULL, reason_code, SCTP_SEND_NOW_COMPLETES);
11446 			}
11447 		}
11448 		if (nagle_on) {
11449 			/*-
11450 			 * When nagle is on, we look at how much is un_sent, then
11451 			 * if its smaller than an MTU and we have data in
11452 			 * flight we stop.
11453 			 */
11454 			un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
11455 			    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
11456 			if ((un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD)) &&
11457 			    (stcb->asoc.total_flight > 0)) {
11458 				break;
11459 			}
11460 		}
11461 		if (TAILQ_EMPTY(&asoc->control_send_queue) &&
11462 		    TAILQ_EMPTY(&asoc->send_queue) &&
11463 		    TAILQ_EMPTY(&asoc->out_wheel)) {
11464 			/* Nothing left to send */
11465 			break;
11466 		}
11467 		if ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) <= 0) {
11468 			/* Nothing left to send */
11469 			break;
11470 		}
11471 	} while (num_out && (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) ||
11472 	    (burst_cnt < burst_limit)));
11473 
11474 	if (SCTP_BASE_SYSCTL(sctp_use_cwnd_based_maxburst) == 0) {
11475 		if (burst_cnt >= burst_limit) {
11476 			SCTP_STAT_INCR(sctps_maxburstqueued);
11477 			asoc->burst_limit_applied = 1;
11478 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_MAXBURST_ENABLE) {
11479 				sctp_log_maxburst(stcb, asoc->primary_destination, 0, burst_cnt, SCTP_MAX_BURST_APPLIED);
11480 			}
11481 		} else {
11482 			asoc->burst_limit_applied = 0;
11483 		}
11484 	}
11485 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
11486 		sctp_log_cwnd(stcb, NULL, tot_out, SCTP_SEND_NOW_COMPLETES);
11487 	}
11488 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, we have put out %d chunks\n",
11489 	    tot_out);
11490 
11491 	/*-
11492 	 * Now we need to clean up the control chunk chain if a ECNE is on
11493 	 * it. It must be marked as UNSENT again so next call will continue
11494 	 * to send it until such time that we get a CWR, to remove it.
11495 	 */
11496 	if (stcb->asoc.ecn_echo_cnt_onq)
11497 		sctp_fix_ecn_echo(asoc);
11498 	return;
11499 }
11500 
11501 
11502 int
11503 sctp_output(inp, m, addr, control, p, flags)
11504 	struct sctp_inpcb *inp;
11505 	struct mbuf *m;
11506 	struct sockaddr *addr;
11507 	struct mbuf *control;
11508 	struct thread *p;
11509 	int flags;
11510 {
11511 	if (inp == NULL) {
11512 		SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11513 		return (EINVAL);
11514 	}
11515 	if (inp->sctp_socket == NULL) {
11516 		SCTP_LTRACE_ERR_RET_PKT(m, inp, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
11517 		return (EINVAL);
11518 	}
11519 	return (sctp_sosend(inp->sctp_socket,
11520 	    addr,
11521 	    (struct uio *)NULL,
11522 	    m,
11523 	    control,
11524 	    flags, p
11525 	    ));
11526 }
11527 
11528 void
11529 send_forward_tsn(struct sctp_tcb *stcb,
11530     struct sctp_association *asoc)
11531 {
11532 	struct sctp_tmit_chunk *chk;
11533 	struct sctp_forward_tsn_chunk *fwdtsn;
11534 
11535 	SCTP_TCB_LOCK_ASSERT(stcb);
11536 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
11537 		if (chk->rec.chunk_id.id == SCTP_FORWARD_CUM_TSN) {
11538 			/* mark it to unsent */
11539 			chk->sent = SCTP_DATAGRAM_UNSENT;
11540 			chk->snd_count = 0;
11541 			/* Do we correct its output location? */
11542 			if (chk->whoTo != asoc->primary_destination) {
11543 				sctp_free_remote_addr(chk->whoTo);
11544 				chk->whoTo = asoc->primary_destination;
11545 				atomic_add_int(&chk->whoTo->ref_count, 1);
11546 			}
11547 			goto sctp_fill_in_rest;
11548 		}
11549 	}
11550 	/* Ok if we reach here we must build one */
11551 	sctp_alloc_a_chunk(stcb, chk);
11552 	if (chk == NULL) {
11553 		return;
11554 	}
11555 	chk->copy_by_ref = 0;
11556 	chk->rec.chunk_id.id = SCTP_FORWARD_CUM_TSN;
11557 	chk->rec.chunk_id.can_take_data = 0;
11558 	chk->asoc = asoc;
11559 	chk->whoTo = NULL;
11560 
11561 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
11562 	if (chk->data == NULL) {
11563 		sctp_free_a_chunk(stcb, chk);
11564 		return;
11565 	}
11566 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
11567 	chk->sent = SCTP_DATAGRAM_UNSENT;
11568 	chk->snd_count = 0;
11569 	chk->whoTo = asoc->primary_destination;
11570 	atomic_add_int(&chk->whoTo->ref_count, 1);
11571 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
11572 	asoc->ctrl_queue_cnt++;
11573 sctp_fill_in_rest:
11574 	/*-
11575 	 * Here we go through and fill out the part that deals with
11576 	 * stream/seq of the ones we skip.
11577 	 */
11578 	SCTP_BUF_LEN(chk->data) = 0;
11579 	{
11580 		struct sctp_tmit_chunk *at, *tp1, *last;
11581 		struct sctp_strseq *strseq;
11582 		unsigned int cnt_of_space, i, ovh;
11583 		unsigned int space_needed;
11584 		unsigned int cnt_of_skipped = 0;
11585 
11586 		TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
11587 			if (at->sent != SCTP_FORWARD_TSN_SKIP) {
11588 				/* no more to look at */
11589 				break;
11590 			}
11591 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
11592 				/* We don't report these */
11593 				continue;
11594 			}
11595 			cnt_of_skipped++;
11596 		}
11597 		space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
11598 		    (cnt_of_skipped * sizeof(struct sctp_strseq)));
11599 
11600 		cnt_of_space = M_TRAILINGSPACE(chk->data);
11601 
11602 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
11603 			ovh = SCTP_MIN_OVERHEAD;
11604 		} else {
11605 			ovh = SCTP_MIN_V4_OVERHEAD;
11606 		}
11607 		if (cnt_of_space > (asoc->smallest_mtu - ovh)) {
11608 			/* trim to a mtu size */
11609 			cnt_of_space = asoc->smallest_mtu - ovh;
11610 		}
11611 		if (cnt_of_space < space_needed) {
11612 			/*-
11613 			 * ok we must trim down the chunk by lowering the
11614 			 * advance peer ack point.
11615 			 */
11616 			cnt_of_skipped = (cnt_of_space -
11617 			    ((sizeof(struct sctp_forward_tsn_chunk)) /
11618 			    sizeof(struct sctp_strseq)));
11619 			/*-
11620 			 * Go through and find the TSN that will be the one
11621 			 * we report.
11622 			 */
11623 			at = TAILQ_FIRST(&asoc->sent_queue);
11624 			for (i = 0; i < cnt_of_skipped; i++) {
11625 				tp1 = TAILQ_NEXT(at, sctp_next);
11626 				at = tp1;
11627 			}
11628 			last = at;
11629 			/*-
11630 			 * last now points to last one I can report, update
11631 			 * peer ack point
11632 			 */
11633 			asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
11634 			space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
11635 		}
11636 		chk->send_size = space_needed;
11637 		/* Setup the chunk */
11638 		fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
11639 		fwdtsn->ch.chunk_length = htons(chk->send_size);
11640 		fwdtsn->ch.chunk_flags = 0;
11641 		fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
11642 		fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
11643 		chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
11644 		    (cnt_of_skipped * sizeof(struct sctp_strseq)));
11645 		SCTP_BUF_LEN(chk->data) = chk->send_size;
11646 		fwdtsn++;
11647 		/*-
11648 		 * Move pointer to after the fwdtsn and transfer to the
11649 		 * strseq pointer.
11650 		 */
11651 		strseq = (struct sctp_strseq *)fwdtsn;
11652 		/*-
11653 		 * Now populate the strseq list. This is done blindly
11654 		 * without pulling out duplicate stream info. This is
11655 		 * inefficent but won't harm the process since the peer will
11656 		 * look at these in sequence and will thus release anything.
11657 		 * It could mean we exceed the PMTU and chop off some that
11658 		 * we could have included.. but this is unlikely (aka 1432/4
11659 		 * would mean 300+ stream seq's would have to be reported in
11660 		 * one FWD-TSN. With a bit of work we can later FIX this to
11661 		 * optimize and pull out duplcates.. but it does add more
11662 		 * overhead. So for now... not!
11663 		 */
11664 		at = TAILQ_FIRST(&asoc->sent_queue);
11665 		for (i = 0; i < cnt_of_skipped; i++) {
11666 			tp1 = TAILQ_NEXT(at, sctp_next);
11667 			if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
11668 				/* We don't report these */
11669 				i--;
11670 				at = tp1;
11671 				continue;
11672 			}
11673 			strseq->stream = ntohs(at->rec.data.stream_number);
11674 			strseq->sequence = ntohs(at->rec.data.stream_seq);
11675 			strseq++;
11676 			at = tp1;
11677 		}
11678 	}
11679 	return;
11680 
11681 }
11682 
11683 void
11684 sctp_send_sack(struct sctp_tcb *stcb)
11685 {
11686 	/*-
11687 	 * Queue up a SACK in the control queue. We must first check to see
11688 	 * if a SACK is somehow on the control queue. If so, we will take
11689 	 * and and remove the old one.
11690 	 */
11691 	struct sctp_association *asoc;
11692 	struct sctp_tmit_chunk *chk, *a_chk;
11693 	struct sctp_sack_chunk *sack;
11694 	struct sctp_gap_ack_block *gap_descriptor;
11695 	struct sack_track *selector;
11696 	int mergeable = 0;
11697 	int offset;
11698 	caddr_t limit;
11699 	uint32_t *dup;
11700 	int limit_reached = 0;
11701 	unsigned int i, jstart, siz, j;
11702 	unsigned int num_gap_blocks = 0, space;
11703 	int num_dups = 0;
11704 	int space_req;
11705 
11706 	a_chk = NULL;
11707 	asoc = &stcb->asoc;
11708 	SCTP_TCB_LOCK_ASSERT(stcb);
11709 	if (asoc->last_data_chunk_from == NULL) {
11710 		/* Hmm we never received anything */
11711 		return;
11712 	}
11713 	sctp_set_rwnd(stcb, asoc);
11714 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
11715 		if (chk->rec.chunk_id.id == SCTP_SELECTIVE_ACK) {
11716 			/* Hmm, found a sack already on queue, remove it */
11717 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
11718 			asoc->ctrl_queue_cnt++;
11719 			a_chk = chk;
11720 			if (a_chk->data) {
11721 				sctp_m_freem(a_chk->data);
11722 				a_chk->data = NULL;
11723 			}
11724 			sctp_free_remote_addr(a_chk->whoTo);
11725 			a_chk->whoTo = NULL;
11726 			break;
11727 		}
11728 	}
11729 	if (a_chk == NULL) {
11730 		sctp_alloc_a_chunk(stcb, a_chk);
11731 		if (a_chk == NULL) {
11732 			/* No memory so we drop the idea, and set a timer */
11733 			if (stcb->asoc.delayed_ack) {
11734 				sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
11735 				    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5);
11736 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
11737 				    stcb->sctp_ep, stcb, NULL);
11738 			} else {
11739 				stcb->asoc.send_sack = 1;
11740 			}
11741 			return;
11742 		}
11743 		a_chk->copy_by_ref = 0;
11744 		/* a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK; */
11745 		a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK;
11746 		a_chk->rec.chunk_id.can_take_data = 1;
11747 	}
11748 	/* Clear our pkt counts */
11749 	asoc->data_pkts_seen = 0;
11750 
11751 	a_chk->asoc = asoc;
11752 	a_chk->snd_count = 0;
11753 	a_chk->send_size = 0;	/* fill in later */
11754 	a_chk->sent = SCTP_DATAGRAM_UNSENT;
11755 	a_chk->whoTo = NULL;
11756 
11757 	if ((asoc->numduptsns) ||
11758 	    (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
11759 	    ) {
11760 		/*-
11761 		 * Ok, we have some duplicates or the destination for the
11762 		 * sack is unreachable, lets see if we can select an
11763 		 * alternate than asoc->last_data_chunk_from
11764 		 */
11765 		if ((!(asoc->last_data_chunk_from->dest_state &
11766 		    SCTP_ADDR_NOT_REACHABLE)) &&
11767 		    (asoc->used_alt_onsack > asoc->numnets)) {
11768 			/* We used an alt last time, don't this time */
11769 			a_chk->whoTo = NULL;
11770 		} else {
11771 			asoc->used_alt_onsack++;
11772 			a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0);
11773 		}
11774 		if (a_chk->whoTo == NULL) {
11775 			/* Nope, no alternate */
11776 			a_chk->whoTo = asoc->last_data_chunk_from;
11777 			asoc->used_alt_onsack = 0;
11778 		}
11779 	} else {
11780 		/*
11781 		 * No duplicates so we use the last place we received data
11782 		 * from.
11783 		 */
11784 		asoc->used_alt_onsack = 0;
11785 		a_chk->whoTo = asoc->last_data_chunk_from;
11786 	}
11787 	if (a_chk->whoTo) {
11788 		atomic_add_int(&a_chk->whoTo->ref_count, 1);
11789 	}
11790 	if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
11791 		/* no gaps */
11792 		space_req = sizeof(struct sctp_sack_chunk);
11793 	} else {
11794 		/* gaps get a cluster */
11795 		space_req = MCLBYTES;
11796 	}
11797 	/* Ok now lets formulate a MBUF with our sack */
11798 	a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_DONTWAIT, 1, MT_DATA);
11799 	if ((a_chk->data == NULL) ||
11800 	    (a_chk->whoTo == NULL)) {
11801 		/* rats, no mbuf memory */
11802 		if (a_chk->data) {
11803 			/* was a problem with the destination */
11804 			sctp_m_freem(a_chk->data);
11805 			a_chk->data = NULL;
11806 		}
11807 		sctp_free_a_chunk(stcb, a_chk);
11808 		/* sa_ignore NO_NULL_CHK */
11809 		if (stcb->asoc.delayed_ack) {
11810 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
11811 			    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6);
11812 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
11813 			    stcb->sctp_ep, stcb, NULL);
11814 		} else {
11815 			stcb->asoc.send_sack = 1;
11816 		}
11817 		return;
11818 	}
11819 	/* ok, lets go through and fill it in */
11820 	SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD);
11821 	space = M_TRAILINGSPACE(a_chk->data);
11822 	if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) {
11823 		space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD);
11824 	}
11825 	limit = mtod(a_chk->data, caddr_t);
11826 	limit += space;
11827 
11828 	sack = mtod(a_chk->data, struct sctp_sack_chunk *);
11829 	sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
11830 	/* 0x01 is used by nonce for ecn */
11831 	if ((SCTP_BASE_SYSCTL(sctp_ecn_enable)) &&
11832 	    (SCTP_BASE_SYSCTL(sctp_ecn_nonce)) &&
11833 	    (asoc->peer_supports_ecn_nonce))
11834 		sack->ch.chunk_flags = (asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM);
11835 	else
11836 		sack->ch.chunk_flags = 0;
11837 
11838 	if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) && SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
11839 		/*-
11840 		 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been
11841 		 * received, then set high bit to 1, else 0. Reset
11842 		 * pkts_rcvd.
11843 		 */
11844 		sack->ch.chunk_flags |= (asoc->cmt_dac_pkts_rcvd << 6);
11845 		asoc->cmt_dac_pkts_rcvd = 0;
11846 	}
11847 #ifdef SCTP_ASOCLOG_OF_TSNS
11848 	stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn;
11849 	stcb->asoc.cumack_log_atsnt++;
11850 	if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) {
11851 		stcb->asoc.cumack_log_atsnt = 0;
11852 	}
11853 #endif
11854 	sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
11855 	sack->sack.a_rwnd = htonl(asoc->my_rwnd);
11856 	asoc->my_last_reported_rwnd = asoc->my_rwnd;
11857 
11858 	/* reset the readers interpretation */
11859 	stcb->freed_by_sorcv_sincelast = 0;
11860 
11861 	gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)sack + sizeof(struct sctp_sack_chunk));
11862 
11863 	siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8;
11864 	if (compare_with_wrap(asoc->mapping_array_base_tsn, asoc->cumulative_tsn, MAX_TSN)) {
11865 		offset = 1;
11866 		/*-
11867 		 * cum-ack behind the mapping array, so we start and use all
11868 		 * entries.
11869 		 */
11870 		jstart = 0;
11871 	} else {
11872 		offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn;
11873 		/*-
11874 		 * we skip the first one when the cum-ack is at or above the
11875 		 * mapping array base. Note this only works if
11876 		 */
11877 		jstart = 1;
11878 	}
11879 	if (compare_with_wrap(asoc->highest_tsn_inside_map, asoc->cumulative_tsn, MAX_TSN)) {
11880 		/* we have a gap .. maybe */
11881 		for (i = 0; i < siz; i++) {
11882 			selector = &sack_array[asoc->mapping_array[i]];
11883 			if (mergeable && selector->right_edge) {
11884 				/*
11885 				 * Backup, left and right edges were ok to
11886 				 * merge.
11887 				 */
11888 				num_gap_blocks--;
11889 				gap_descriptor--;
11890 			}
11891 			if (selector->num_entries == 0)
11892 				mergeable = 0;
11893 			else {
11894 				for (j = jstart; j < selector->num_entries; j++) {
11895 					if (mergeable && selector->right_edge) {
11896 						/*
11897 						 * do a merge by NOT setting
11898 						 * the left side
11899 						 */
11900 						mergeable = 0;
11901 					} else {
11902 						/*
11903 						 * no merge, set the left
11904 						 * side
11905 						 */
11906 						mergeable = 0;
11907 						gap_descriptor->start = htons((selector->gaps[j].start + offset));
11908 					}
11909 					gap_descriptor->end = htons((selector->gaps[j].end + offset));
11910 					num_gap_blocks++;
11911 					gap_descriptor++;
11912 					if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) {
11913 						/* no more room */
11914 						limit_reached = 1;
11915 						break;
11916 					}
11917 				}
11918 				if (selector->left_edge) {
11919 					mergeable = 1;
11920 				}
11921 			}
11922 			if (limit_reached) {
11923 				/* Reached the limit stop */
11924 				break;
11925 			}
11926 			jstart = 0;
11927 			offset += 8;
11928 		}
11929 		if (num_gap_blocks == 0) {
11930 			/*
11931 			 * slide not yet happened, and somehow we got called
11932 			 * to send a sack. Cumack needs to move up.
11933 			 */
11934 			int abort_flag = 0;
11935 
11936 			asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
11937 			sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
11938 			sctp_sack_check(stcb, 0, 0, &abort_flag);
11939 		}
11940 	}
11941 	/* now we must add any dups we are going to report. */
11942 	if ((limit_reached == 0) && (asoc->numduptsns)) {
11943 		dup = (uint32_t *) gap_descriptor;
11944 		for (i = 0; i < asoc->numduptsns; i++) {
11945 			*dup = htonl(asoc->dup_tsns[i]);
11946 			dup++;
11947 			num_dups++;
11948 			if (((caddr_t)dup + sizeof(uint32_t)) > limit) {
11949 				/* no more room */
11950 				break;
11951 			}
11952 		}
11953 		asoc->numduptsns = 0;
11954 	}
11955 	/*
11956 	 * now that the chunk is prepared queue it to the control chunk
11957 	 * queue.
11958 	 */
11959 	a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
11960 	    (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
11961 	    (num_dups * sizeof(int32_t)));
11962 	SCTP_BUF_LEN(a_chk->data) = a_chk->send_size;
11963 	sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
11964 	sack->sack.num_dup_tsns = htons(num_dups);
11965 	sack->ch.chunk_length = htons(a_chk->send_size);
11966 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
11967 	asoc->ctrl_queue_cnt++;
11968 	asoc->send_sack = 0;
11969 	SCTP_STAT_INCR(sctps_sendsacks);
11970 	return;
11971 }
11972 
11973 /* EY - This method will replace sctp_send_sack method if nr_sacks negotiated*/
11974 void
11975 sctp_send_nr_sack(struct sctp_tcb *stcb)
11976 {
11977 	/*-
11978 	 * Queue up an NR-SACK in the control queue. We must first check to see
11979 	 * if an NR-SACK is somehow on the control queue. If so, we will take
11980 	 * and and remove the old one.
11981 	 */
11982 	struct sctp_association *asoc;
11983 	struct sctp_tmit_chunk *chk, *a_chk;
11984 
11985 	struct sctp_nr_sack_chunk *nr_sack;
11986 
11987 	struct sctp_gap_ack_block *gap_descriptor;
11988 	struct sctp_nr_gap_ack_block *nr_gap_descriptor;
11989 
11990 	struct sack_track *selector;
11991 	struct nr_sack_track *nr_selector;
11992 
11993 	/* EY do we need nr_mergeable, NO */
11994 	int mergeable = 0;
11995 	int offset;
11996 	caddr_t limit;
11997 	uint32_t *dup;
11998 	int limit_reached = 0;
11999 	unsigned int i, jstart, siz, j;
12000 	unsigned int num_gap_blocks = 0, num_nr_gap_blocks = 0, space;
12001 	int num_dups = 0;
12002 	int space_req;
12003 	unsigned int reserved = 0;
12004 
12005 	a_chk = NULL;
12006 	asoc = &stcb->asoc;
12007 	SCTP_TCB_LOCK_ASSERT(stcb);
12008 	if (asoc->last_data_chunk_from == NULL) {
12009 		/* Hmm we never received anything */
12010 		return;
12011 	}
12012 	sctp_set_rwnd(stcb, asoc);
12013 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
12014 		if (chk->rec.chunk_id.id == SCTP_NR_SELECTIVE_ACK) {
12015 			/* Hmm, found a sack already on queue, remove it */
12016 			TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
12017 			asoc->ctrl_queue_cnt++;
12018 			a_chk = chk;
12019 			if (a_chk->data) {
12020 				sctp_m_freem(a_chk->data);
12021 				a_chk->data = NULL;
12022 			}
12023 			sctp_free_remote_addr(a_chk->whoTo);
12024 			a_chk->whoTo = NULL;
12025 			break;
12026 		}
12027 	}
12028 	if (a_chk == NULL) {
12029 		sctp_alloc_a_chunk(stcb, a_chk);
12030 		if (a_chk == NULL) {
12031 			/* No memory so we drop the idea, and set a timer */
12032 			if (stcb->asoc.delayed_ack) {
12033 				sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
12034 				    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_5);
12035 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
12036 				    stcb->sctp_ep, stcb, NULL);
12037 			} else {
12038 				stcb->asoc.send_sack = 1;
12039 			}
12040 			return;
12041 		}
12042 		a_chk->copy_by_ref = 0;
12043 		/* a_chk->rec.chunk_id.id = SCTP_SELECTIVE_ACK; */
12044 		a_chk->rec.chunk_id.id = SCTP_NR_SELECTIVE_ACK;
12045 		a_chk->rec.chunk_id.can_take_data = 1;
12046 	}
12047 	/* Clear our pkt counts */
12048 	asoc->data_pkts_seen = 0;
12049 
12050 	a_chk->asoc = asoc;
12051 	a_chk->snd_count = 0;
12052 	a_chk->send_size = 0;	/* fill in later */
12053 	a_chk->sent = SCTP_DATAGRAM_UNSENT;
12054 	a_chk->whoTo = NULL;
12055 
12056 	if ((asoc->numduptsns) ||
12057 	    (asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
12058 	    ) {
12059 		/*-
12060 		 * Ok, we have some duplicates or the destination for the
12061 		 * sack is unreachable, lets see if we can select an
12062 		 * alternate than asoc->last_data_chunk_from
12063 		 */
12064 		if ((!(asoc->last_data_chunk_from->dest_state &
12065 		    SCTP_ADDR_NOT_REACHABLE)) &&
12066 		    (asoc->used_alt_onsack > asoc->numnets)) {
12067 			/* We used an alt last time, don't this time */
12068 			a_chk->whoTo = NULL;
12069 		} else {
12070 			asoc->used_alt_onsack++;
12071 			a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from, 0);
12072 		}
12073 		if (a_chk->whoTo == NULL) {
12074 			/* Nope, no alternate */
12075 			a_chk->whoTo = asoc->last_data_chunk_from;
12076 			asoc->used_alt_onsack = 0;
12077 		}
12078 	} else {
12079 		/*
12080 		 * No duplicates so we use the last place we received data
12081 		 * from.
12082 		 */
12083 		asoc->used_alt_onsack = 0;
12084 		a_chk->whoTo = asoc->last_data_chunk_from;
12085 	}
12086 	if (a_chk->whoTo) {
12087 		atomic_add_int(&a_chk->whoTo->ref_count, 1);
12088 	}
12089 	if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
12090 		/* no gaps */
12091 		space_req = sizeof(struct sctp_nr_sack_chunk);
12092 	} else {
12093 		/* EY - what is this about? */
12094 		/* gaps get a cluster */
12095 		space_req = MCLBYTES;
12096 	}
12097 	/* Ok now lets formulate a MBUF with our sack */
12098 	a_chk->data = sctp_get_mbuf_for_msg(space_req, 0, M_DONTWAIT, 1, MT_DATA);
12099 	if ((a_chk->data == NULL) ||
12100 	    (a_chk->whoTo == NULL)) {
12101 		/* rats, no mbuf memory */
12102 		if (a_chk->data) {
12103 			/* was a problem with the destination */
12104 			sctp_m_freem(a_chk->data);
12105 			a_chk->data = NULL;
12106 		}
12107 		sctp_free_a_chunk(stcb, a_chk);
12108 		/* sa_ignore NO_NULL_CHK */
12109 		if (stcb->asoc.delayed_ack) {
12110 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
12111 			    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_OUTPUT + SCTP_LOC_6);
12112 			sctp_timer_start(SCTP_TIMER_TYPE_RECV,
12113 			    stcb->sctp_ep, stcb, NULL);
12114 		} else {
12115 			stcb->asoc.send_sack = 1;
12116 		}
12117 		return;
12118 	}
12119 	/* ok, lets go through and fill it in */
12120 	SCTP_BUF_RESV_UF(a_chk->data, SCTP_MIN_OVERHEAD);
12121 	space = M_TRAILINGSPACE(a_chk->data);
12122 	if (space > (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD)) {
12123 		space = (a_chk->whoTo->mtu - SCTP_MIN_OVERHEAD);
12124 	}
12125 	limit = mtod(a_chk->data, caddr_t);
12126 	limit += space;
12127 
12128 	nr_sack = mtod(a_chk->data, struct sctp_nr_sack_chunk *);
12129 	nr_sack->ch.chunk_type = SCTP_NR_SELECTIVE_ACK;
12130 	/* EYJ */
12131 	/* 0x01 is used by nonce for ecn */
12132 	if ((SCTP_BASE_SYSCTL(sctp_ecn_enable)) &&
12133 	    (SCTP_BASE_SYSCTL(sctp_ecn_nonce)) &&
12134 	    (asoc->peer_supports_ecn_nonce))
12135 		nr_sack->ch.chunk_flags = (asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM);
12136 	else
12137 		nr_sack->ch.chunk_flags = 0;
12138 
12139 	if (SCTP_BASE_SYSCTL(sctp_cmt_on_off) && SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
12140 		/*-
12141 		 * CMT DAC algorithm: If 2 (i.e., 0x10) packets have been
12142 		 * received, then set high bit to 1, else 0. Reset
12143 		 * pkts_rcvd.
12144 		 */
12145 		/* EY - TODO: which chunk flag is used in here? -The LSB */
12146 		nr_sack->ch.chunk_flags |= (asoc->cmt_dac_pkts_rcvd << 6);
12147 		asoc->cmt_dac_pkts_rcvd = 0;
12148 	}
12149 	/*
12150 	 * EY - this is a never reneging receiver, that makes all gaps are
12151 	 * nr-gaps, set the All bit
12152 	 */
12153 	if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
12154 		nr_sack->ch.chunk_flags |= SCTP_NR_SACK_ALL_BIT;
12155 	}
12156 #ifdef SCTP_ASOCLOG_OF_TSNS
12157 	stcb->asoc.cumack_logsnt[stcb->asoc.cumack_log_atsnt] = asoc->cumulative_tsn;
12158 	stcb->asoc.cumack_log_atsnt++;
12159 	if (stcb->asoc.cumack_log_atsnt >= SCTP_TSN_LOG_SIZE) {
12160 		stcb->asoc.cumack_log_atsnt = 0;
12161 	}
12162 #endif
12163 	nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
12164 	nr_sack->nr_sack.a_rwnd = htonl(asoc->my_rwnd);
12165 	asoc->my_last_reported_rwnd = asoc->my_rwnd;
12166 
12167 	/* reset the readers interpretation */
12168 	stcb->freed_by_sorcv_sincelast = 0;
12169 
12170 	gap_descriptor = (struct sctp_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk));
12171 	nr_gap_descriptor = (struct sctp_nr_gap_ack_block *)((caddr_t)nr_sack + sizeof(struct sctp_nr_sack_chunk));
12172 
12173 	siz = (((asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn) + 1) + 7) / 8;
12174 	if (compare_with_wrap(asoc->mapping_array_base_tsn, asoc->cumulative_tsn, MAX_TSN)) {
12175 		offset = 1;
12176 		/*-
12177 		 * cum-ack behind the mapping array, so we start and use all
12178 		 * entries.
12179 		 */
12180 		jstart = 0;
12181 	} else {
12182 		offset = asoc->mapping_array_base_tsn - asoc->cumulative_tsn;
12183 		/*-
12184 		 * we skip the first one when the cum-ack is at or above the
12185 		 * mapping array base. Note this only works if
12186 		 */
12187 		jstart = 1;
12188 	}
12189 	if (compare_with_wrap(asoc->highest_tsn_inside_map, asoc->cumulative_tsn, MAX_TSN)) {
12190 		/* we have a gap .. maybe */
12191 		for (i = 0; i < siz; i++) {
12192 			selector = &sack_array[asoc->mapping_array[i]];
12193 			if (mergeable && selector->right_edge) {
12194 				/*
12195 				 * Backup, left and right edges were ok to
12196 				 * merge.
12197 				 */
12198 				num_gap_blocks--;
12199 				gap_descriptor--;
12200 			}
12201 			if (selector->num_entries == 0)
12202 				mergeable = 0;
12203 			else {
12204 				for (j = jstart; j < selector->num_entries; j++) {
12205 					if (mergeable && selector->right_edge) {
12206 						/*
12207 						 * do a merge by NOT setting
12208 						 * the left side
12209 						 */
12210 						mergeable = 0;
12211 					} else {
12212 						/*
12213 						 * no merge, set the left
12214 						 * side
12215 						 */
12216 						mergeable = 0;
12217 						gap_descriptor->start = htons((selector->gaps[j].start + offset));
12218 					}
12219 					gap_descriptor->end = htons((selector->gaps[j].end + offset));
12220 					num_gap_blocks++;
12221 					gap_descriptor++;
12222 					if (((caddr_t)gap_descriptor + sizeof(struct sctp_gap_ack_block)) > limit) {
12223 						/* no more room */
12224 						limit_reached = 1;
12225 						break;
12226 					}
12227 				}
12228 				if (selector->left_edge) {
12229 					mergeable = 1;
12230 				}
12231 			}
12232 			if (limit_reached) {
12233 				/* Reached the limit stop */
12234 				break;
12235 			}
12236 			jstart = 0;
12237 			offset += 8;
12238 		}
12239 		if (num_gap_blocks == 0) {
12240 			/*
12241 			 * slide not yet happened, and somehow we got called
12242 			 * to send a sack. Cumack needs to move up.
12243 			 */
12244 			int abort_flag = 0;
12245 
12246 			asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
12247 			nr_sack->nr_sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
12248 			sctp_sack_check(stcb, 0, 0, &abort_flag);
12249 		}
12250 	}
12251 	/*---------------------------------------------------------filling the nr_gap_ack blocks----------------------------------------------------*/
12252 
12253 	nr_gap_descriptor = (struct sctp_nr_gap_ack_block *)gap_descriptor;
12254 
12255 	/* EY - there will be gaps + nr_gaps if draining is possible */
12256 	if (SCTP_BASE_SYSCTL(sctp_do_drain)) {
12257 
12258 		mergeable = 0;
12259 
12260 		siz = (((asoc->highest_tsn_inside_nr_map - asoc->nr_mapping_array_base_tsn) + 1) + 7) / 8;
12261 		if (compare_with_wrap(asoc->nr_mapping_array_base_tsn, asoc->cumulative_tsn, MAX_TSN)) {
12262 			offset = 1;
12263 			/*-
12264 			* cum-ack behind the mapping array, so we start and use all
12265 			* entries.
12266 			*/
12267 			jstart = 0;
12268 		} else {
12269 			offset = asoc->nr_mapping_array_base_tsn - asoc->cumulative_tsn;
12270 			/*-
12271 			* we skip the first one when the cum-ack is at or above the
12272 			* mapping array base. Note this only works if
12273 			*/
12274 			jstart = 1;
12275 		}
12276 		if (compare_with_wrap(asoc->highest_tsn_inside_nr_map, asoc->cumulative_tsn, MAX_TSN)) {
12277 			/* we have a gap .. maybe */
12278 			for (i = 0; i < siz; i++) {
12279 				nr_selector = &nr_sack_array[asoc->nr_mapping_array[i]];
12280 				if (mergeable && nr_selector->right_edge) {
12281 					/*
12282 					 * Backup, left and right edges were
12283 					 * ok to merge.
12284 					 */
12285 					num_nr_gap_blocks--;
12286 					nr_gap_descriptor--;
12287 				}
12288 				if (nr_selector->num_entries == 0)
12289 					mergeable = 0;
12290 				else {
12291 					for (j = jstart; j < nr_selector->num_entries; j++) {
12292 						if (mergeable && nr_selector->right_edge) {
12293 							/*
12294 							 * do a merge by NOT
12295 							 * setting the left
12296 							 * side
12297 							 */
12298 							mergeable = 0;
12299 						} else {
12300 							/*
12301 							 * no merge, set the
12302 							 * left side
12303 							 */
12304 							mergeable = 0;
12305 							nr_gap_descriptor->start = htons((nr_selector->nr_gaps[j].start + offset));
12306 						}
12307 						nr_gap_descriptor->end = htons((nr_selector->nr_gaps[j].end + offset));
12308 						num_nr_gap_blocks++;
12309 						nr_gap_descriptor++;
12310 						if (((caddr_t)nr_gap_descriptor + sizeof(struct sctp_nr_gap_ack_block)) > limit) {
12311 							/* no more room */
12312 							limit_reached = 1;
12313 							break;
12314 						}
12315 					}
12316 					if (nr_selector->left_edge) {
12317 						mergeable = 1;
12318 					}
12319 				}
12320 				if (limit_reached) {
12321 					/* Reached the limit stop */
12322 					break;
12323 				}
12324 				jstart = 0;
12325 				offset += 8;
12326 			}
12327 		}
12328 	}
12329 	/*---------------------------------------------------End of---filling the nr_gap_ack blocks----------------------------------------------------*/
12330 
12331 	/* now we must add any dups we are going to report. */
12332 	if ((limit_reached == 0) && (asoc->numduptsns)) {
12333 		dup = (uint32_t *) nr_gap_descriptor;
12334 		for (i = 0; i < asoc->numduptsns; i++) {
12335 			*dup = htonl(asoc->dup_tsns[i]);
12336 			dup++;
12337 			num_dups++;
12338 			if (((caddr_t)dup + sizeof(uint32_t)) > limit) {
12339 				/* no more room */
12340 				break;
12341 			}
12342 		}
12343 		asoc->numduptsns = 0;
12344 	}
12345 	/*
12346 	 * now that the chunk is prepared queue it to the control chunk
12347 	 * queue.
12348 	 */
12349 	if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
12350 		num_nr_gap_blocks = num_gap_blocks;
12351 		num_gap_blocks = 0;
12352 	}
12353 	a_chk->send_size = (sizeof(struct sctp_nr_sack_chunk) +
12354 	    (num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
12355 	    (num_nr_gap_blocks * sizeof(struct sctp_nr_gap_ack_block)) +
12356 	    (num_dups * sizeof(int32_t)));
12357 
12358 	SCTP_BUF_LEN(a_chk->data) = a_chk->send_size;
12359 	nr_sack->nr_sack.num_gap_ack_blks = htons(num_gap_blocks);
12360 	nr_sack->nr_sack.num_nr_gap_ack_blks = htons(num_nr_gap_blocks);
12361 	nr_sack->nr_sack.num_dup_tsns = htons(num_dups);
12362 	nr_sack->nr_sack.reserved = htons(reserved);
12363 	nr_sack->ch.chunk_length = htons(a_chk->send_size);
12364 	TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
12365 	asoc->ctrl_queue_cnt++;
12366 	asoc->send_sack = 0;
12367 	SCTP_STAT_INCR(sctps_sendsacks);
12368 	return;
12369 }
12370 
12371 void
12372 sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr, int so_locked
12373 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
12374     SCTP_UNUSED
12375 #endif
12376 )
12377 {
12378 	struct mbuf *m_abort;
12379 	struct mbuf *m_out = NULL, *m_end = NULL;
12380 	struct sctp_abort_chunk *abort = NULL;
12381 	int sz;
12382 	uint32_t auth_offset = 0;
12383 	struct sctp_auth_chunk *auth = NULL;
12384 
12385 	/*-
12386 	 * Add an AUTH chunk, if chunk requires it and save the offset into
12387 	 * the chain for AUTH
12388 	 */
12389 	if (sctp_auth_is_required_chunk(SCTP_ABORT_ASSOCIATION,
12390 	    stcb->asoc.peer_auth_chunks)) {
12391 		m_out = sctp_add_auth_chunk(m_out, &m_end, &auth, &auth_offset,
12392 		    stcb, SCTP_ABORT_ASSOCIATION);
12393 		SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
12394 	}
12395 	SCTP_TCB_LOCK_ASSERT(stcb);
12396 	m_abort = sctp_get_mbuf_for_msg(sizeof(struct sctp_abort_chunk), 0, M_DONTWAIT, 1, MT_HEADER);
12397 	if (m_abort == NULL) {
12398 		/* no mbuf's */
12399 		if (m_out)
12400 			sctp_m_freem(m_out);
12401 		return;
12402 	}
12403 	/* link in any error */
12404 	SCTP_BUF_NEXT(m_abort) = operr;
12405 	sz = 0;
12406 	if (operr) {
12407 		struct mbuf *n;
12408 
12409 		n = operr;
12410 		while (n) {
12411 			sz += SCTP_BUF_LEN(n);
12412 			n = SCTP_BUF_NEXT(n);
12413 		}
12414 	}
12415 	SCTP_BUF_LEN(m_abort) = sizeof(*abort);
12416 	if (m_out == NULL) {
12417 		/* NO Auth chunk prepended, so reserve space in front */
12418 		SCTP_BUF_RESV_UF(m_abort, SCTP_MIN_OVERHEAD);
12419 		m_out = m_abort;
12420 	} else {
12421 		/* Put AUTH chunk at the front of the chain */
12422 		SCTP_BUF_NEXT(m_end) = m_abort;
12423 	}
12424 
12425 	/* fill in the ABORT chunk */
12426 	abort = mtod(m_abort, struct sctp_abort_chunk *);
12427 	abort->ch.chunk_type = SCTP_ABORT_ASSOCIATION;
12428 	abort->ch.chunk_flags = 0;
12429 	abort->ch.chunk_length = htons(sizeof(*abort) + sz);
12430 
12431 	(void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
12432 	    stcb->asoc.primary_destination,
12433 	    (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr,
12434 	    m_out, auth_offset, auth, stcb->asoc.authinfo.active_keyid, 1, 0, NULL, 0,
12435 	    stcb->sctp_ep->sctp_lport, stcb->rport, htonl(stcb->asoc.peer_vtag),
12436 	    stcb->asoc.primary_destination->port, so_locked, NULL);
12437 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
12438 }
12439 
12440 void
12441 sctp_send_shutdown_complete(struct sctp_tcb *stcb,
12442     struct sctp_nets *net)
12443 {
12444 	/* formulate and SEND a SHUTDOWN-COMPLETE */
12445 	struct mbuf *m_shutdown_comp;
12446 	struct sctp_shutdown_complete_chunk *shutdown_complete;
12447 
12448 	m_shutdown_comp = sctp_get_mbuf_for_msg(sizeof(struct sctp_chunkhdr), 0, M_DONTWAIT, 1, MT_HEADER);
12449 	if (m_shutdown_comp == NULL) {
12450 		/* no mbuf's */
12451 		return;
12452 	}
12453 	shutdown_complete = mtod(m_shutdown_comp, struct sctp_shutdown_complete_chunk *);
12454 	shutdown_complete->ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
12455 	shutdown_complete->ch.chunk_flags = 0;
12456 	shutdown_complete->ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
12457 	SCTP_BUF_LEN(m_shutdown_comp) = sizeof(struct sctp_shutdown_complete_chunk);
12458 	(void)sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
12459 	    (struct sockaddr *)&net->ro._l_addr,
12460 	    m_shutdown_comp, 0, NULL, 0, 1, 0, NULL, 0,
12461 	    stcb->sctp_ep->sctp_lport, stcb->rport,
12462 	    htonl(stcb->asoc.peer_vtag),
12463 	    net->port, SCTP_SO_NOT_LOCKED, NULL);
12464 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
12465 	return;
12466 }
12467 
12468 void
12469 sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh,
12470     uint32_t vrf_id, uint16_t port)
12471 {
12472 	/* formulate and SEND a SHUTDOWN-COMPLETE */
12473 	struct mbuf *o_pak;
12474 	struct mbuf *mout;
12475 	struct ip *iph, *iph_out;
12476 	struct udphdr *udp = NULL;
12477 
12478 #ifdef INET6
12479 	struct ip6_hdr *ip6, *ip6_out;
12480 
12481 #endif
12482 	int offset_out, len, mlen;
12483 	struct sctp_shutdown_complete_msg *comp_cp;
12484 
12485 	iph = mtod(m, struct ip *);
12486 	switch (iph->ip_v) {
12487 	case IPVERSION:
12488 		len = (sizeof(struct ip) + sizeof(struct sctp_shutdown_complete_msg));
12489 		break;
12490 #ifdef INET6
12491 	case IPV6_VERSION >> 4:
12492 		len = (sizeof(struct ip6_hdr) + sizeof(struct sctp_shutdown_complete_msg));
12493 		break;
12494 #endif
12495 	default:
12496 		return;
12497 	}
12498 	if (port) {
12499 		len += sizeof(struct udphdr);
12500 	}
12501 	mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_DONTWAIT, 1, MT_DATA);
12502 	if (mout == NULL) {
12503 		return;
12504 	}
12505 	SCTP_BUF_RESV_UF(mout, max_linkhdr);
12506 	SCTP_BUF_LEN(mout) = len;
12507 	SCTP_BUF_NEXT(mout) = NULL;
12508 	iph_out = NULL;
12509 #ifdef INET6
12510 	ip6_out = NULL;
12511 #endif
12512 	offset_out = 0;
12513 
12514 	switch (iph->ip_v) {
12515 	case IPVERSION:
12516 		iph_out = mtod(mout, struct ip *);
12517 
12518 		/* Fill in the IP header for the ABORT */
12519 		iph_out->ip_v = IPVERSION;
12520 		iph_out->ip_hl = (sizeof(struct ip) / 4);
12521 		iph_out->ip_tos = (u_char)0;
12522 		iph_out->ip_id = 0;
12523 		iph_out->ip_off = 0;
12524 		iph_out->ip_ttl = MAXTTL;
12525 		if (port) {
12526 			iph_out->ip_p = IPPROTO_UDP;
12527 		} else {
12528 			iph_out->ip_p = IPPROTO_SCTP;
12529 		}
12530 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
12531 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
12532 
12533 		/* let IP layer calculate this */
12534 		iph_out->ip_sum = 0;
12535 		offset_out += sizeof(*iph_out);
12536 		comp_cp = (struct sctp_shutdown_complete_msg *)(
12537 		    (caddr_t)iph_out + offset_out);
12538 		break;
12539 #ifdef INET6
12540 	case IPV6_VERSION >> 4:
12541 		ip6 = (struct ip6_hdr *)iph;
12542 		ip6_out = mtod(mout, struct ip6_hdr *);
12543 
12544 		/* Fill in the IPv6 header for the ABORT */
12545 		ip6_out->ip6_flow = ip6->ip6_flow;
12546 		ip6_out->ip6_hlim = MODULE_GLOBAL(MOD_INET6, ip6_defhlim);
12547 		if (port) {
12548 			ip6_out->ip6_nxt = IPPROTO_UDP;
12549 		} else {
12550 			ip6_out->ip6_nxt = IPPROTO_SCTP;
12551 		}
12552 		ip6_out->ip6_src = ip6->ip6_dst;
12553 		ip6_out->ip6_dst = ip6->ip6_src;
12554 		/*
12555 		 * ?? The old code had both the iph len + payload, I think
12556 		 * this is wrong and would never have worked
12557 		 */
12558 		ip6_out->ip6_plen = sizeof(struct sctp_shutdown_complete_msg);
12559 		offset_out += sizeof(*ip6_out);
12560 		comp_cp = (struct sctp_shutdown_complete_msg *)(
12561 		    (caddr_t)ip6_out + offset_out);
12562 		break;
12563 #endif				/* INET6 */
12564 	default:
12565 		/* Currently not supported. */
12566 		sctp_m_freem(mout);
12567 		return;
12568 	}
12569 	if (port) {
12570 		udp = (struct udphdr *)comp_cp;
12571 		udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port));
12572 		udp->uh_dport = port;
12573 		udp->uh_ulen = htons(sizeof(struct sctp_shutdown_complete_msg) + sizeof(struct udphdr));
12574 		udp->uh_sum = in_pseudo(iph_out->ip_src.s_addr, iph_out->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP));
12575 		offset_out += sizeof(struct udphdr);
12576 		comp_cp = (struct sctp_shutdown_complete_msg *)((caddr_t)comp_cp + sizeof(struct udphdr));
12577 	}
12578 	if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
12579 		/* no mbuf's */
12580 		sctp_m_freem(mout);
12581 		return;
12582 	}
12583 	/* Now copy in and fill in the ABORT tags etc. */
12584 	comp_cp->sh.src_port = sh->dest_port;
12585 	comp_cp->sh.dest_port = sh->src_port;
12586 	comp_cp->sh.checksum = 0;
12587 	comp_cp->sh.v_tag = sh->v_tag;
12588 	comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
12589 	comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
12590 	comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
12591 
12592 	if (iph_out != NULL) {
12593 		sctp_route_t ro;
12594 		int ret;
12595 		struct sctp_tcb *stcb = NULL;
12596 
12597 		mlen = SCTP_BUF_LEN(mout);
12598 		bzero(&ro, sizeof ro);
12599 		/* set IPv4 length */
12600 		iph_out->ip_len = mlen;
12601 #ifdef  SCTP_PACKET_LOGGING
12602 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
12603 			sctp_packet_log(mout, mlen);
12604 #endif
12605 		if (port) {
12606 			comp_cp->sh.checksum = sctp_calculate_cksum(mout, offset_out);
12607 			SCTP_STAT_INCR(sctps_sendswcrc);
12608 			SCTP_ENABLE_UDP_CSUM(mout);
12609 		} else {
12610 			mout->m_pkthdr.csum_flags = CSUM_SCTP;
12611 			mout->m_pkthdr.csum_data = 0;	/* FIXME MT */
12612 			SCTP_STAT_INCR(sctps_sendhwcrc);
12613 		}
12614 		SCTP_ATTACH_CHAIN(o_pak, mout, mlen);
12615 		/* out it goes */
12616 		SCTP_IP_OUTPUT(ret, o_pak, &ro, stcb, vrf_id);
12617 
12618 		/* Free the route if we got one back */
12619 		if (ro.ro_rt)
12620 			RTFREE(ro.ro_rt);
12621 	}
12622 #ifdef INET6
12623 	if (ip6_out != NULL) {
12624 		struct route_in6 ro;
12625 		int ret;
12626 		struct sctp_tcb *stcb = NULL;
12627 		struct ifnet *ifp = NULL;
12628 
12629 		bzero(&ro, sizeof(ro));
12630 		mlen = SCTP_BUF_LEN(mout);
12631 #ifdef  SCTP_PACKET_LOGGING
12632 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
12633 			sctp_packet_log(mout, mlen);
12634 #endif
12635 		comp_cp->sh.checksum = sctp_calculate_cksum(mout, offset_out);
12636 		SCTP_STAT_INCR(sctps_sendswcrc);
12637 		SCTP_ATTACH_CHAIN(o_pak, mout, mlen);
12638 		if (port) {
12639 			if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr),
12640 			    sizeof(struct sctp_shutdown_complete_msg) + sizeof(struct udphdr))) == 0) {
12641 				udp->uh_sum = 0xffff;
12642 			}
12643 		}
12644 		SCTP_IP6_OUTPUT(ret, o_pak, &ro, &ifp, stcb, vrf_id);
12645 
12646 		/* Free the route if we got one back */
12647 		if (ro.ro_rt)
12648 			RTFREE(ro.ro_rt);
12649 	}
12650 #endif
12651 	SCTP_STAT_INCR(sctps_sendpackets);
12652 	SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
12653 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
12654 	return;
12655 
12656 }
12657 
12658 static struct sctp_nets *
12659 sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
12660 {
12661 	struct sctp_nets *net, *hnet;
12662 	int ms_goneby, highest_ms, state_overide = 0;
12663 
12664 	(void)SCTP_GETTIME_TIMEVAL(now);
12665 	highest_ms = 0;
12666 	hnet = NULL;
12667 	SCTP_TCB_LOCK_ASSERT(stcb);
12668 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
12669 		if (
12670 		    ((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
12671 		    (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
12672 		    ) {
12673 			/*
12674 			 * Skip this guy from consideration if HB is off AND
12675 			 * its confirmed
12676 			 */
12677 			continue;
12678 		}
12679 		if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro._l_addr) == 0) {
12680 			/* skip this dest net from consideration */
12681 			continue;
12682 		}
12683 		if (net->last_sent_time.tv_sec) {
12684 			/* Sent to so we subtract */
12685 			ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
12686 		} else
12687 			/* Never been sent to */
12688 			ms_goneby = 0x7fffffff;
12689 		/*-
12690 		 * When the address state is unconfirmed but still
12691 		 * considered reachable, we HB at a higher rate. Once it
12692 		 * goes confirmed OR reaches the "unreachable" state, thenw
12693 		 * we cut it back to HB at a more normal pace.
12694 		 */
12695 		if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED | SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
12696 			state_overide = 1;
12697 		} else {
12698 			state_overide = 0;
12699 		}
12700 
12701 		if ((((unsigned int)ms_goneby >= net->RTO) || (state_overide)) &&
12702 		    (ms_goneby > highest_ms)) {
12703 			highest_ms = ms_goneby;
12704 			hnet = net;
12705 		}
12706 	}
12707 	if (hnet &&
12708 	    ((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED | SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
12709 		state_overide = 1;
12710 	} else {
12711 		state_overide = 0;
12712 	}
12713 
12714 	if (hnet && highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_overide)) {
12715 		/*-
12716 		 * Found the one with longest delay bounds OR it is
12717 		 * unconfirmed and still not marked unreachable.
12718 		 */
12719 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "net:%p is the hb winner -", hnet);
12720 #ifdef SCTP_DEBUG
12721 		if (hnet) {
12722 			SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT4,
12723 			    (struct sockaddr *)&hnet->ro._l_addr);
12724 		} else {
12725 			SCTPDBG(SCTP_DEBUG_OUTPUT4, " none\n");
12726 		}
12727 #endif
12728 		/* update the timer now */
12729 		hnet->last_sent_time = *now;
12730 		return (hnet);
12731 	}
12732 	/* Nothing to HB */
12733 	return (NULL);
12734 }
12735 
12736 int
12737 sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
12738 {
12739 	struct sctp_tmit_chunk *chk;
12740 	struct sctp_nets *net;
12741 	struct sctp_heartbeat_chunk *hb;
12742 	struct timeval now;
12743 	struct sockaddr_in *sin;
12744 	struct sockaddr_in6 *sin6;
12745 
12746 	SCTP_TCB_LOCK_ASSERT(stcb);
12747 	if (user_req == 0) {
12748 		net = sctp_select_hb_destination(stcb, &now);
12749 		if (net == NULL) {
12750 			/*-
12751 			 * All our busy none to send to, just start the
12752 			 * timer again.
12753 			 */
12754 			if (stcb->asoc.state == 0) {
12755 				return (0);
12756 			}
12757 			sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
12758 			    stcb->sctp_ep,
12759 			    stcb,
12760 			    net);
12761 			return (0);
12762 		}
12763 	} else {
12764 		net = u_net;
12765 		if (net == NULL) {
12766 			return (0);
12767 		}
12768 		(void)SCTP_GETTIME_TIMEVAL(&now);
12769 	}
12770 	sin = (struct sockaddr_in *)&net->ro._l_addr;
12771 	if (sin->sin_family != AF_INET) {
12772 		if (sin->sin_family != AF_INET6) {
12773 			/* huh */
12774 			return (0);
12775 		}
12776 	}
12777 	sctp_alloc_a_chunk(stcb, chk);
12778 	if (chk == NULL) {
12779 		SCTPDBG(SCTP_DEBUG_OUTPUT4, "Gak, can't get a chunk for hb\n");
12780 		return (0);
12781 	}
12782 	chk->copy_by_ref = 0;
12783 	chk->rec.chunk_id.id = SCTP_HEARTBEAT_REQUEST;
12784 	chk->rec.chunk_id.can_take_data = 1;
12785 	chk->asoc = &stcb->asoc;
12786 	chk->send_size = sizeof(struct sctp_heartbeat_chunk);
12787 
12788 	chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER);
12789 	if (chk->data == NULL) {
12790 		sctp_free_a_chunk(stcb, chk);
12791 		return (0);
12792 	}
12793 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
12794 	SCTP_BUF_LEN(chk->data) = chk->send_size;
12795 	chk->sent = SCTP_DATAGRAM_UNSENT;
12796 	chk->snd_count = 0;
12797 	chk->whoTo = net;
12798 	atomic_add_int(&chk->whoTo->ref_count, 1);
12799 	/* Now we have a mbuf that we can fill in with the details */
12800 	hb = mtod(chk->data, struct sctp_heartbeat_chunk *);
12801 	memset(hb, 0, sizeof(struct sctp_heartbeat_chunk));
12802 	/* fill out chunk header */
12803 	hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
12804 	hb->ch.chunk_flags = 0;
12805 	hb->ch.chunk_length = htons(chk->send_size);
12806 	/* Fill out hb parameter */
12807 	hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
12808 	hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
12809 	hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
12810 	hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
12811 	/* Did our user request this one, put it in */
12812 	hb->heartbeat.hb_info.user_req = user_req;
12813 	hb->heartbeat.hb_info.addr_family = sin->sin_family;
12814 	hb->heartbeat.hb_info.addr_len = sin->sin_len;
12815 	if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
12816 		/*
12817 		 * we only take from the entropy pool if the address is not
12818 		 * confirmed.
12819 		 */
12820 		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
12821 		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
12822 	} else {
12823 		net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
12824 		net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
12825 	}
12826 	if (sin->sin_family == AF_INET) {
12827 		memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
12828 	} else if (sin->sin_family == AF_INET6) {
12829 		/* We leave the scope the way it is in our lookup table. */
12830 		sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
12831 		memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
12832 	} else {
12833 		/* huh compiler bug */
12834 		return (0);
12835 	}
12836 
12837 	/*
12838 	 * JRS 5/14/07 - In CMT PF, the T3 timer is used to track
12839 	 * PF-heartbeats.  Because of this, threshold management is done by
12840 	 * the t3 timer handler, and does not need to be done upon the send
12841 	 * of a PF-heartbeat. If CMT PF is on and the destination to which a
12842 	 * heartbeat is being sent is in PF state, do NOT do threshold
12843 	 * management.
12844 	 */
12845 	if ((SCTP_BASE_SYSCTL(sctp_cmt_pf) == 0) || ((net->dest_state & SCTP_ADDR_PF) != SCTP_ADDR_PF)) {
12846 		/* ok we have a destination that needs a beat */
12847 		/* lets do the theshold management Qiaobing style */
12848 		if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
12849 		    stcb->asoc.max_send_times)) {
12850 			/*-
12851 			 * we have lost the association, in a way this is
12852 			 * quite bad since we really are one less time since
12853 			 * we really did not send yet. This is the down side
12854 			 * to the Q's style as defined in the RFC and not my
12855 			 * alternate style defined in the RFC.
12856 			 */
12857 			if (chk->data != NULL) {
12858 				sctp_m_freem(chk->data);
12859 				chk->data = NULL;
12860 			}
12861 			/*
12862 			 * Here we do NOT use the macro since the
12863 			 * association is now gone.
12864 			 */
12865 			if (chk->whoTo) {
12866 				sctp_free_remote_addr(chk->whoTo);
12867 				chk->whoTo = NULL;
12868 			}
12869 			sctp_free_a_chunk((struct sctp_tcb *)NULL, chk);
12870 			return (-1);
12871 		}
12872 	}
12873 	net->hb_responded = 0;
12874 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
12875 	stcb->asoc.ctrl_queue_cnt++;
12876 	SCTP_STAT_INCR(sctps_sendheartbeat);
12877 	/*-
12878 	 * Call directly med level routine to put out the chunk. It will
12879 	 * always tumble out control chunks aka HB but it may even tumble
12880 	 * out data too.
12881 	 */
12882 	return (1);
12883 }
12884 
12885 void
12886 sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
12887     uint32_t high_tsn)
12888 {
12889 	struct sctp_association *asoc;
12890 	struct sctp_ecne_chunk *ecne;
12891 	struct sctp_tmit_chunk *chk;
12892 
12893 	asoc = &stcb->asoc;
12894 	SCTP_TCB_LOCK_ASSERT(stcb);
12895 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
12896 		if (chk->rec.chunk_id.id == SCTP_ECN_ECHO) {
12897 			/* found a previous ECN_ECHO update it if needed */
12898 			ecne = mtod(chk->data, struct sctp_ecne_chunk *);
12899 			ecne->tsn = htonl(high_tsn);
12900 			return;
12901 		}
12902 	}
12903 	/* nope could not find one to update so we must build one */
12904 	sctp_alloc_a_chunk(stcb, chk);
12905 	if (chk == NULL) {
12906 		return;
12907 	}
12908 	chk->copy_by_ref = 0;
12909 	SCTP_STAT_INCR(sctps_sendecne);
12910 	chk->rec.chunk_id.id = SCTP_ECN_ECHO;
12911 	chk->rec.chunk_id.can_take_data = 0;
12912 	chk->asoc = &stcb->asoc;
12913 	chk->send_size = sizeof(struct sctp_ecne_chunk);
12914 	chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER);
12915 	if (chk->data == NULL) {
12916 		sctp_free_a_chunk(stcb, chk);
12917 		return;
12918 	}
12919 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
12920 	SCTP_BUF_LEN(chk->data) = chk->send_size;
12921 	chk->sent = SCTP_DATAGRAM_UNSENT;
12922 	chk->snd_count = 0;
12923 	chk->whoTo = net;
12924 	atomic_add_int(&chk->whoTo->ref_count, 1);
12925 	stcb->asoc.ecn_echo_cnt_onq++;
12926 	ecne = mtod(chk->data, struct sctp_ecne_chunk *);
12927 	ecne->ch.chunk_type = SCTP_ECN_ECHO;
12928 	ecne->ch.chunk_flags = 0;
12929 	ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
12930 	ecne->tsn = htonl(high_tsn);
12931 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
12932 	asoc->ctrl_queue_cnt++;
12933 }
12934 
12935 void
12936 sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
12937     struct mbuf *m, int iphlen, int bad_crc)
12938 {
12939 	struct sctp_association *asoc;
12940 	struct sctp_pktdrop_chunk *drp;
12941 	struct sctp_tmit_chunk *chk;
12942 	uint8_t *datap;
12943 	int len;
12944 	int was_trunc = 0;
12945 	struct ip *iph;
12946 
12947 #ifdef INET6
12948 	struct ip6_hdr *ip6h;
12949 
12950 #endif
12951 	int fullsz = 0, extra = 0;
12952 	long spc;
12953 	int offset;
12954 	struct sctp_chunkhdr *ch, chunk_buf;
12955 	unsigned int chk_length;
12956 
12957 	if (!stcb) {
12958 		return;
12959 	}
12960 	asoc = &stcb->asoc;
12961 	SCTP_TCB_LOCK_ASSERT(stcb);
12962 	if (asoc->peer_supports_pktdrop == 0) {
12963 		/*-
12964 		 * peer must declare support before I send one.
12965 		 */
12966 		return;
12967 	}
12968 	if (stcb->sctp_socket == NULL) {
12969 		return;
12970 	}
12971 	sctp_alloc_a_chunk(stcb, chk);
12972 	if (chk == NULL) {
12973 		return;
12974 	}
12975 	chk->copy_by_ref = 0;
12976 	iph = mtod(m, struct ip *);
12977 	if (iph == NULL) {
12978 		sctp_free_a_chunk(stcb, chk);
12979 		return;
12980 	}
12981 	switch (iph->ip_v) {
12982 	case IPVERSION:
12983 		/* IPv4 */
12984 		len = chk->send_size = iph->ip_len;
12985 		break;
12986 #ifdef INET6
12987 	case IPV6_VERSION >> 4:
12988 		/* IPv6 */
12989 		ip6h = mtod(m, struct ip6_hdr *);
12990 		len = chk->send_size = htons(ip6h->ip6_plen);
12991 		break;
12992 #endif
12993 	default:
12994 		return;
12995 	}
12996 	/* Validate that we do not have an ABORT in here. */
12997 	offset = iphlen + sizeof(struct sctphdr);
12998 	ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
12999 	    sizeof(*ch), (uint8_t *) & chunk_buf);
13000 	while (ch != NULL) {
13001 		chk_length = ntohs(ch->chunk_length);
13002 		if (chk_length < sizeof(*ch)) {
13003 			/* break to abort land */
13004 			break;
13005 		}
13006 		switch (ch->chunk_type) {
13007 		case SCTP_PACKET_DROPPED:
13008 		case SCTP_ABORT_ASSOCIATION:
13009 			/*-
13010 			 * we don't respond with an PKT-DROP to an ABORT
13011 			 * or PKT-DROP
13012 			 */
13013 			sctp_free_a_chunk(stcb, chk);
13014 			return;
13015 		default:
13016 			break;
13017 		}
13018 		offset += SCTP_SIZE32(chk_length);
13019 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
13020 		    sizeof(*ch), (uint8_t *) & chunk_buf);
13021 	}
13022 
13023 	if ((len + SCTP_MAX_OVERHEAD + sizeof(struct sctp_pktdrop_chunk)) >
13024 	    min(stcb->asoc.smallest_mtu, MCLBYTES)) {
13025 		/*
13026 		 * only send 1 mtu worth, trim off the excess on the end.
13027 		 */
13028 		fullsz = len - extra;
13029 		len = min(stcb->asoc.smallest_mtu, MCLBYTES) - SCTP_MAX_OVERHEAD;
13030 		was_trunc = 1;
13031 	}
13032 	chk->asoc = &stcb->asoc;
13033 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
13034 	if (chk->data == NULL) {
13035 jump_out:
13036 		sctp_free_a_chunk(stcb, chk);
13037 		return;
13038 	}
13039 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
13040 	drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
13041 	if (drp == NULL) {
13042 		sctp_m_freem(chk->data);
13043 		chk->data = NULL;
13044 		goto jump_out;
13045 	}
13046 	chk->book_size = SCTP_SIZE32((chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
13047 	    sizeof(struct sctphdr) + SCTP_MED_OVERHEAD));
13048 	chk->book_size_scale = 0;
13049 	if (was_trunc) {
13050 		drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
13051 		drp->trunc_len = htons(fullsz);
13052 		/*
13053 		 * Len is already adjusted to size minus overhead above take
13054 		 * out the pkt_drop chunk itself from it.
13055 		 */
13056 		chk->send_size = len - sizeof(struct sctp_pktdrop_chunk);
13057 		len = chk->send_size;
13058 	} else {
13059 		/* no truncation needed */
13060 		drp->ch.chunk_flags = 0;
13061 		drp->trunc_len = htons(0);
13062 	}
13063 	if (bad_crc) {
13064 		drp->ch.chunk_flags |= SCTP_BADCRC;
13065 	}
13066 	chk->send_size += sizeof(struct sctp_pktdrop_chunk);
13067 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13068 	chk->sent = SCTP_DATAGRAM_UNSENT;
13069 	chk->snd_count = 0;
13070 	if (net) {
13071 		/* we should hit here */
13072 		chk->whoTo = net;
13073 	} else {
13074 		chk->whoTo = asoc->primary_destination;
13075 	}
13076 	atomic_add_int(&chk->whoTo->ref_count, 1);
13077 	chk->rec.chunk_id.id = SCTP_PACKET_DROPPED;
13078 	chk->rec.chunk_id.can_take_data = 1;
13079 	drp->ch.chunk_type = SCTP_PACKET_DROPPED;
13080 	drp->ch.chunk_length = htons(chk->send_size);
13081 	spc = SCTP_SB_LIMIT_RCV(stcb->sctp_socket);
13082 	if (spc < 0) {
13083 		spc = 0;
13084 	}
13085 	drp->bottle_bw = htonl(spc);
13086 	if (asoc->my_rwnd) {
13087 		drp->current_onq = htonl(asoc->size_on_reasm_queue +
13088 		    asoc->size_on_all_streams +
13089 		    asoc->my_rwnd_control_len +
13090 		    stcb->sctp_socket->so_rcv.sb_cc);
13091 	} else {
13092 		/*-
13093 		 * If my rwnd is 0, possibly from mbuf depletion as well as
13094 		 * space used, tell the peer there is NO space aka onq == bw
13095 		 */
13096 		drp->current_onq = htonl(spc);
13097 	}
13098 	drp->reserved = 0;
13099 	datap = drp->data;
13100 	m_copydata(m, iphlen, len, (caddr_t)datap);
13101 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
13102 	asoc->ctrl_queue_cnt++;
13103 }
13104 
13105 void
13106 sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
13107 {
13108 	struct sctp_association *asoc;
13109 	struct sctp_cwr_chunk *cwr;
13110 	struct sctp_tmit_chunk *chk;
13111 
13112 	asoc = &stcb->asoc;
13113 	SCTP_TCB_LOCK_ASSERT(stcb);
13114 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
13115 		if (chk->rec.chunk_id.id == SCTP_ECN_CWR) {
13116 			/* found a previous ECN_CWR update it if needed */
13117 			cwr = mtod(chk->data, struct sctp_cwr_chunk *);
13118 			if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
13119 			    MAX_TSN)) {
13120 				cwr->tsn = htonl(high_tsn);
13121 			}
13122 			return;
13123 		}
13124 	}
13125 	/* nope could not find one to update so we must build one */
13126 	sctp_alloc_a_chunk(stcb, chk);
13127 	if (chk == NULL) {
13128 		return;
13129 	}
13130 	chk->copy_by_ref = 0;
13131 	chk->rec.chunk_id.id = SCTP_ECN_CWR;
13132 	chk->rec.chunk_id.can_take_data = 1;
13133 	chk->asoc = &stcb->asoc;
13134 	chk->send_size = sizeof(struct sctp_cwr_chunk);
13135 	chk->data = sctp_get_mbuf_for_msg(chk->send_size, 0, M_DONTWAIT, 1, MT_HEADER);
13136 	if (chk->data == NULL) {
13137 		sctp_free_a_chunk(stcb, chk);
13138 		return;
13139 	}
13140 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
13141 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13142 	chk->sent = SCTP_DATAGRAM_UNSENT;
13143 	chk->snd_count = 0;
13144 	chk->whoTo = net;
13145 	atomic_add_int(&chk->whoTo->ref_count, 1);
13146 	cwr = mtod(chk->data, struct sctp_cwr_chunk *);
13147 	cwr->ch.chunk_type = SCTP_ECN_CWR;
13148 	cwr->ch.chunk_flags = 0;
13149 	cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
13150 	cwr->tsn = htonl(high_tsn);
13151 	TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
13152 	asoc->ctrl_queue_cnt++;
13153 }
13154 
13155 void
13156 sctp_add_stream_reset_out(struct sctp_tmit_chunk *chk,
13157     int number_entries, uint16_t * list,
13158     uint32_t seq, uint32_t resp_seq, uint32_t last_sent)
13159 {
13160 	int len, old_len, i;
13161 	struct sctp_stream_reset_out_request *req_out;
13162 	struct sctp_chunkhdr *ch;
13163 
13164 	ch = mtod(chk->data, struct sctp_chunkhdr *);
13165 
13166 
13167 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
13168 
13169 	/* get to new offset for the param. */
13170 	req_out = (struct sctp_stream_reset_out_request *)((caddr_t)ch + len);
13171 	/* now how long will this param be? */
13172 	len = (sizeof(struct sctp_stream_reset_out_request) + (sizeof(uint16_t) * number_entries));
13173 	req_out->ph.param_type = htons(SCTP_STR_RESET_OUT_REQUEST);
13174 	req_out->ph.param_length = htons(len);
13175 	req_out->request_seq = htonl(seq);
13176 	req_out->response_seq = htonl(resp_seq);
13177 	req_out->send_reset_at_tsn = htonl(last_sent);
13178 	if (number_entries) {
13179 		for (i = 0; i < number_entries; i++) {
13180 			req_out->list_of_streams[i] = htons(list[i]);
13181 		}
13182 	}
13183 	if (SCTP_SIZE32(len) > len) {
13184 		/*-
13185 		 * Need to worry about the pad we may end up adding to the
13186 		 * end. This is easy since the struct is either aligned to 4
13187 		 * bytes or 2 bytes off.
13188 		 */
13189 		req_out->list_of_streams[number_entries] = 0;
13190 	}
13191 	/* now fix the chunk length */
13192 	ch->chunk_length = htons(len + old_len);
13193 	chk->book_size = len + old_len;
13194 	chk->book_size_scale = 0;
13195 	chk->send_size = SCTP_SIZE32(chk->book_size);
13196 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13197 	return;
13198 }
13199 
13200 
13201 void
13202 sctp_add_stream_reset_in(struct sctp_tmit_chunk *chk,
13203     int number_entries, uint16_t * list,
13204     uint32_t seq)
13205 {
13206 	int len, old_len, i;
13207 	struct sctp_stream_reset_in_request *req_in;
13208 	struct sctp_chunkhdr *ch;
13209 
13210 	ch = mtod(chk->data, struct sctp_chunkhdr *);
13211 
13212 
13213 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
13214 
13215 	/* get to new offset for the param. */
13216 	req_in = (struct sctp_stream_reset_in_request *)((caddr_t)ch + len);
13217 	/* now how long will this param be? */
13218 	len = (sizeof(struct sctp_stream_reset_in_request) + (sizeof(uint16_t) * number_entries));
13219 	req_in->ph.param_type = htons(SCTP_STR_RESET_IN_REQUEST);
13220 	req_in->ph.param_length = htons(len);
13221 	req_in->request_seq = htonl(seq);
13222 	if (number_entries) {
13223 		for (i = 0; i < number_entries; i++) {
13224 			req_in->list_of_streams[i] = htons(list[i]);
13225 		}
13226 	}
13227 	if (SCTP_SIZE32(len) > len) {
13228 		/*-
13229 		 * Need to worry about the pad we may end up adding to the
13230 		 * end. This is easy since the struct is either aligned to 4
13231 		 * bytes or 2 bytes off.
13232 		 */
13233 		req_in->list_of_streams[number_entries] = 0;
13234 	}
13235 	/* now fix the chunk length */
13236 	ch->chunk_length = htons(len + old_len);
13237 	chk->book_size = len + old_len;
13238 	chk->book_size_scale = 0;
13239 	chk->send_size = SCTP_SIZE32(chk->book_size);
13240 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13241 	return;
13242 }
13243 
13244 
13245 void
13246 sctp_add_stream_reset_tsn(struct sctp_tmit_chunk *chk,
13247     uint32_t seq)
13248 {
13249 	int len, old_len;
13250 	struct sctp_stream_reset_tsn_request *req_tsn;
13251 	struct sctp_chunkhdr *ch;
13252 
13253 	ch = mtod(chk->data, struct sctp_chunkhdr *);
13254 
13255 
13256 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
13257 
13258 	/* get to new offset for the param. */
13259 	req_tsn = (struct sctp_stream_reset_tsn_request *)((caddr_t)ch + len);
13260 	/* now how long will this param be? */
13261 	len = sizeof(struct sctp_stream_reset_tsn_request);
13262 	req_tsn->ph.param_type = htons(SCTP_STR_RESET_TSN_REQUEST);
13263 	req_tsn->ph.param_length = htons(len);
13264 	req_tsn->request_seq = htonl(seq);
13265 
13266 	/* now fix the chunk length */
13267 	ch->chunk_length = htons(len + old_len);
13268 	chk->send_size = len + old_len;
13269 	chk->book_size = SCTP_SIZE32(chk->send_size);
13270 	chk->book_size_scale = 0;
13271 	SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
13272 	return;
13273 }
13274 
13275 void
13276 sctp_add_stream_reset_result(struct sctp_tmit_chunk *chk,
13277     uint32_t resp_seq, uint32_t result)
13278 {
13279 	int len, old_len;
13280 	struct sctp_stream_reset_response *resp;
13281 	struct sctp_chunkhdr *ch;
13282 
13283 	ch = mtod(chk->data, struct sctp_chunkhdr *);
13284 
13285 
13286 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
13287 
13288 	/* get to new offset for the param. */
13289 	resp = (struct sctp_stream_reset_response *)((caddr_t)ch + len);
13290 	/* now how long will this param be? */
13291 	len = sizeof(struct sctp_stream_reset_response);
13292 	resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE);
13293 	resp->ph.param_length = htons(len);
13294 	resp->response_seq = htonl(resp_seq);
13295 	resp->result = ntohl(result);
13296 
13297 	/* now fix the chunk length */
13298 	ch->chunk_length = htons(len + old_len);
13299 	chk->book_size = len + old_len;
13300 	chk->book_size_scale = 0;
13301 	chk->send_size = SCTP_SIZE32(chk->book_size);
13302 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13303 	return;
13304 
13305 }
13306 
13307 
13308 void
13309 sctp_add_stream_reset_result_tsn(struct sctp_tmit_chunk *chk,
13310     uint32_t resp_seq, uint32_t result,
13311     uint32_t send_una, uint32_t recv_next)
13312 {
13313 	int len, old_len;
13314 	struct sctp_stream_reset_response_tsn *resp;
13315 	struct sctp_chunkhdr *ch;
13316 
13317 	ch = mtod(chk->data, struct sctp_chunkhdr *);
13318 
13319 
13320 	old_len = len = SCTP_SIZE32(ntohs(ch->chunk_length));
13321 
13322 	/* get to new offset for the param. */
13323 	resp = (struct sctp_stream_reset_response_tsn *)((caddr_t)ch + len);
13324 	/* now how long will this param be? */
13325 	len = sizeof(struct sctp_stream_reset_response_tsn);
13326 	resp->ph.param_type = htons(SCTP_STR_RESET_RESPONSE);
13327 	resp->ph.param_length = htons(len);
13328 	resp->response_seq = htonl(resp_seq);
13329 	resp->result = htonl(result);
13330 	resp->senders_next_tsn = htonl(send_una);
13331 	resp->receivers_next_tsn = htonl(recv_next);
13332 
13333 	/* now fix the chunk length */
13334 	ch->chunk_length = htons(len + old_len);
13335 	chk->book_size = len + old_len;
13336 	chk->send_size = SCTP_SIZE32(chk->book_size);
13337 	chk->book_size_scale = 0;
13338 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13339 	return;
13340 }
13341 
13342 
13343 int
13344 sctp_send_str_reset_req(struct sctp_tcb *stcb,
13345     int number_entries, uint16_t * list,
13346     uint8_t send_out_req, uint32_t resp_seq,
13347     uint8_t send_in_req,
13348     uint8_t send_tsn_req)
13349 {
13350 
13351 	struct sctp_association *asoc;
13352 	struct sctp_tmit_chunk *chk;
13353 	struct sctp_chunkhdr *ch;
13354 	uint32_t seq;
13355 
13356 	asoc = &stcb->asoc;
13357 	if (asoc->stream_reset_outstanding) {
13358 		/*-
13359 		 * Already one pending, must get ACK back to clear the flag.
13360 		 */
13361 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EBUSY);
13362 		return (EBUSY);
13363 	}
13364 	if ((send_out_req == 0) && (send_in_req == 0) && (send_tsn_req == 0)) {
13365 		/* nothing to do */
13366 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
13367 		return (EINVAL);
13368 	}
13369 	if (send_tsn_req && (send_out_req || send_in_req)) {
13370 		/* error, can't do that */
13371 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, EINVAL);
13372 		return (EINVAL);
13373 	}
13374 	sctp_alloc_a_chunk(stcb, chk);
13375 	if (chk == NULL) {
13376 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
13377 		return (ENOMEM);
13378 	}
13379 	chk->copy_by_ref = 0;
13380 	chk->rec.chunk_id.id = SCTP_STREAM_RESET;
13381 	chk->rec.chunk_id.can_take_data = 0;
13382 	chk->asoc = &stcb->asoc;
13383 	chk->book_size = sizeof(struct sctp_chunkhdr);
13384 	chk->send_size = SCTP_SIZE32(chk->book_size);
13385 	chk->book_size_scale = 0;
13386 
13387 	chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
13388 	if (chk->data == NULL) {
13389 		sctp_free_a_chunk(stcb, chk);
13390 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
13391 		return (ENOMEM);
13392 	}
13393 	SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
13394 
13395 	/* setup chunk parameters */
13396 	chk->sent = SCTP_DATAGRAM_UNSENT;
13397 	chk->snd_count = 0;
13398 	chk->whoTo = asoc->primary_destination;
13399 	atomic_add_int(&chk->whoTo->ref_count, 1);
13400 
13401 	ch = mtod(chk->data, struct sctp_chunkhdr *);
13402 	ch->chunk_type = SCTP_STREAM_RESET;
13403 	ch->chunk_flags = 0;
13404 	ch->chunk_length = htons(chk->book_size);
13405 	SCTP_BUF_LEN(chk->data) = chk->send_size;
13406 
13407 	seq = stcb->asoc.str_reset_seq_out;
13408 	if (send_out_req) {
13409 		sctp_add_stream_reset_out(chk, number_entries, list,
13410 		    seq, resp_seq, (stcb->asoc.sending_seq - 1));
13411 		asoc->stream_reset_out_is_outstanding = 1;
13412 		seq++;
13413 		asoc->stream_reset_outstanding++;
13414 	}
13415 	if (send_in_req) {
13416 		sctp_add_stream_reset_in(chk, number_entries, list, seq);
13417 		asoc->stream_reset_outstanding++;
13418 	}
13419 	if (send_tsn_req) {
13420 		sctp_add_stream_reset_tsn(chk, seq);
13421 		asoc->stream_reset_outstanding++;
13422 	}
13423 	asoc->str_reset = chk;
13424 
13425 	/* insert the chunk for sending */
13426 	TAILQ_INSERT_TAIL(&asoc->control_send_queue,
13427 	    chk,
13428 	    sctp_next);
13429 	asoc->ctrl_queue_cnt++;
13430 	sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
13431 	return (0);
13432 }
13433 
13434 void
13435 sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
13436     struct mbuf *err_cause, uint32_t vrf_id, uint16_t port)
13437 {
13438 	/*-
13439 	 * Formulate the abort message, and send it back down.
13440 	 */
13441 	struct mbuf *o_pak;
13442 	struct mbuf *mout;
13443 	struct sctp_abort_msg *abm;
13444 	struct ip *iph, *iph_out;
13445 	struct udphdr *udp;
13446 
13447 #ifdef INET6
13448 	struct ip6_hdr *ip6, *ip6_out;
13449 
13450 #endif
13451 	int iphlen_out, len;
13452 
13453 	/* don't respond to ABORT with ABORT */
13454 	if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
13455 		if (err_cause)
13456 			sctp_m_freem(err_cause);
13457 		return;
13458 	}
13459 	iph = mtod(m, struct ip *);
13460 	switch (iph->ip_v) {
13461 	case IPVERSION:
13462 		len = (sizeof(struct ip) + sizeof(struct sctp_abort_msg));
13463 		break;
13464 #ifdef INET6
13465 	case IPV6_VERSION >> 4:
13466 		len = (sizeof(struct ip6_hdr) + sizeof(struct sctp_abort_msg));
13467 		break;
13468 #endif
13469 	default:
13470 		if (err_cause) {
13471 			sctp_m_freem(err_cause);
13472 		}
13473 		return;
13474 	}
13475 	if (port) {
13476 		len += sizeof(struct udphdr);
13477 	}
13478 	mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_DONTWAIT, 1, MT_DATA);
13479 	if (mout == NULL) {
13480 		if (err_cause) {
13481 			sctp_m_freem(err_cause);
13482 		}
13483 		return;
13484 	}
13485 	SCTP_BUF_RESV_UF(mout, max_linkhdr);
13486 	SCTP_BUF_LEN(mout) = len;
13487 	SCTP_BUF_NEXT(mout) = err_cause;
13488 	iph_out = NULL;
13489 #ifdef INET6
13490 	ip6_out = NULL;
13491 #endif
13492 	switch (iph->ip_v) {
13493 	case IPVERSION:
13494 		iph_out = mtod(mout, struct ip *);
13495 
13496 		/* Fill in the IP header for the ABORT */
13497 		iph_out->ip_v = IPVERSION;
13498 		iph_out->ip_hl = (sizeof(struct ip) / 4);
13499 		iph_out->ip_tos = (u_char)0;
13500 		iph_out->ip_id = 0;
13501 		iph_out->ip_off = 0;
13502 		iph_out->ip_ttl = MAXTTL;
13503 		if (port) {
13504 			iph_out->ip_p = IPPROTO_UDP;
13505 		} else {
13506 			iph_out->ip_p = IPPROTO_SCTP;
13507 		}
13508 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
13509 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
13510 		/* let IP layer calculate this */
13511 		iph_out->ip_sum = 0;
13512 
13513 		iphlen_out = sizeof(*iph_out);
13514 		abm = (struct sctp_abort_msg *)((caddr_t)iph_out + iphlen_out);
13515 		break;
13516 #ifdef INET6
13517 	case IPV6_VERSION >> 4:
13518 		ip6 = (struct ip6_hdr *)iph;
13519 		ip6_out = mtod(mout, struct ip6_hdr *);
13520 
13521 		/* Fill in the IP6 header for the ABORT */
13522 		ip6_out->ip6_flow = ip6->ip6_flow;
13523 		ip6_out->ip6_hlim = MODULE_GLOBAL(MOD_INET6, ip6_defhlim);
13524 		if (port) {
13525 			ip6_out->ip6_nxt = IPPROTO_UDP;
13526 		} else {
13527 			ip6_out->ip6_nxt = IPPROTO_SCTP;
13528 		}
13529 		ip6_out->ip6_src = ip6->ip6_dst;
13530 		ip6_out->ip6_dst = ip6->ip6_src;
13531 
13532 		iphlen_out = sizeof(*ip6_out);
13533 		abm = (struct sctp_abort_msg *)((caddr_t)ip6_out + iphlen_out);
13534 		break;
13535 #endif				/* INET6 */
13536 	default:
13537 		/* Currently not supported */
13538 		sctp_m_freem(mout);
13539 		return;
13540 	}
13541 
13542 	udp = (struct udphdr *)abm;
13543 	if (port) {
13544 		udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port));
13545 		udp->uh_dport = port;
13546 		/* set udp->uh_ulen later */
13547 		udp->uh_sum = 0;
13548 		iphlen_out += sizeof(struct udphdr);
13549 		abm = (struct sctp_abort_msg *)((caddr_t)abm + sizeof(struct udphdr));
13550 	}
13551 	abm->sh.src_port = sh->dest_port;
13552 	abm->sh.dest_port = sh->src_port;
13553 	abm->sh.checksum = 0;
13554 	if (vtag == 0) {
13555 		abm->sh.v_tag = sh->v_tag;
13556 		abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
13557 	} else {
13558 		abm->sh.v_tag = htonl(vtag);
13559 		abm->msg.ch.chunk_flags = 0;
13560 	}
13561 	abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
13562 
13563 	if (err_cause) {
13564 		struct mbuf *m_tmp = err_cause;
13565 		int err_len = 0;
13566 
13567 		/* get length of the err_cause chain */
13568 		while (m_tmp != NULL) {
13569 			err_len += SCTP_BUF_LEN(m_tmp);
13570 			m_tmp = SCTP_BUF_NEXT(m_tmp);
13571 		}
13572 		len = SCTP_BUF_LEN(mout) + err_len;
13573 		if (err_len % 4) {
13574 			/* need pad at end of chunk */
13575 			uint32_t cpthis = 0;
13576 			int padlen;
13577 
13578 			padlen = 4 - (len % 4);
13579 			m_copyback(mout, len, padlen, (caddr_t)&cpthis);
13580 			len += padlen;
13581 		}
13582 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
13583 	} else {
13584 		len = SCTP_BUF_LEN(mout);
13585 		abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
13586 	}
13587 
13588 	if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
13589 		/* no mbuf's */
13590 		sctp_m_freem(mout);
13591 		return;
13592 	}
13593 	if (iph_out != NULL) {
13594 		sctp_route_t ro;
13595 		struct sctp_tcb *stcb = NULL;
13596 		int ret;
13597 
13598 		/* zap the stack pointer to the route */
13599 		bzero(&ro, sizeof ro);
13600 		if (port) {
13601 			udp->uh_ulen = htons(len - sizeof(struct ip));
13602 			udp->uh_sum = in_pseudo(iph_out->ip_src.s_addr, iph_out->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP));
13603 		}
13604 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "sctp_send_abort calling ip_output:\n");
13605 		SCTPDBG_PKT(SCTP_DEBUG_OUTPUT2, iph_out, &abm->sh);
13606 		/* set IPv4 length */
13607 		iph_out->ip_len = len;
13608 		/* out it goes */
13609 #ifdef  SCTP_PACKET_LOGGING
13610 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
13611 			sctp_packet_log(mout, len);
13612 #endif
13613 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
13614 		if (port) {
13615 			abm->sh.checksum = sctp_calculate_cksum(mout, iphlen_out);
13616 			SCTP_STAT_INCR(sctps_sendswcrc);
13617 			SCTP_ENABLE_UDP_CSUM(o_pak);
13618 		} else {
13619 			mout->m_pkthdr.csum_flags = CSUM_SCTP;
13620 			mout->m_pkthdr.csum_data = 0;	/* FIXME MT */
13621 			SCTP_STAT_INCR(sctps_sendhwcrc);
13622 		}
13623 		SCTP_IP_OUTPUT(ret, o_pak, &ro, stcb, vrf_id);
13624 
13625 		/* Free the route if we got one back */
13626 		if (ro.ro_rt)
13627 			RTFREE(ro.ro_rt);
13628 	}
13629 #ifdef INET6
13630 	if (ip6_out != NULL) {
13631 		struct route_in6 ro;
13632 		int ret;
13633 		struct sctp_tcb *stcb = NULL;
13634 		struct ifnet *ifp = NULL;
13635 
13636 		/* zap the stack pointer to the route */
13637 		bzero(&ro, sizeof(ro));
13638 		if (port) {
13639 			udp->uh_ulen = htons(len - sizeof(struct ip6_hdr));
13640 		}
13641 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "sctp_send_abort calling ip6_output:\n");
13642 		SCTPDBG_PKT(SCTP_DEBUG_OUTPUT2, (struct ip *)ip6_out, &abm->sh);
13643 		ip6_out->ip6_plen = len - sizeof(*ip6_out);
13644 #ifdef  SCTP_PACKET_LOGGING
13645 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
13646 			sctp_packet_log(mout, len);
13647 #endif
13648 		abm->sh.checksum = sctp_calculate_cksum(mout, iphlen_out);
13649 		SCTP_STAT_INCR(sctps_sendswcrc);
13650 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
13651 		if (port) {
13652 			if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) {
13653 				udp->uh_sum = 0xffff;
13654 			}
13655 		}
13656 		SCTP_IP6_OUTPUT(ret, o_pak, &ro, &ifp, stcb, vrf_id);
13657 
13658 		/* Free the route if we got one back */
13659 		if (ro.ro_rt)
13660 			RTFREE(ro.ro_rt);
13661 	}
13662 #endif
13663 	SCTP_STAT_INCR(sctps_sendpackets);
13664 	SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
13665 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
13666 }
13667 
13668 void
13669 sctp_send_operr_to(struct mbuf *m, int iphlen, struct mbuf *scm, uint32_t vtag,
13670     uint32_t vrf_id, uint16_t port)
13671 {
13672 	struct mbuf *o_pak;
13673 	struct sctphdr *sh, *sh_out;
13674 	struct sctp_chunkhdr *ch;
13675 	struct ip *iph, *iph_out;
13676 	struct udphdr *udp = NULL;
13677 	struct mbuf *mout;
13678 
13679 #ifdef INET6
13680 	struct ip6_hdr *ip6, *ip6_out;
13681 
13682 #endif
13683 	int iphlen_out, len;
13684 
13685 	iph = mtod(m, struct ip *);
13686 	sh = (struct sctphdr *)((caddr_t)iph + iphlen);
13687 	switch (iph->ip_v) {
13688 	case IPVERSION:
13689 		len = (sizeof(struct ip) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr));
13690 		break;
13691 #ifdef INET6
13692 	case IPV6_VERSION >> 4:
13693 		len = (sizeof(struct ip6_hdr) + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr));
13694 		break;
13695 #endif
13696 	default:
13697 		if (scm) {
13698 			sctp_m_freem(scm);
13699 		}
13700 		return;
13701 	}
13702 	if (port) {
13703 		len += sizeof(struct udphdr);
13704 	}
13705 	mout = sctp_get_mbuf_for_msg(len + max_linkhdr, 1, M_DONTWAIT, 1, MT_DATA);
13706 	if (mout == NULL) {
13707 		if (scm) {
13708 			sctp_m_freem(scm);
13709 		}
13710 		return;
13711 	}
13712 	SCTP_BUF_RESV_UF(mout, max_linkhdr);
13713 	SCTP_BUF_LEN(mout) = len;
13714 	SCTP_BUF_NEXT(mout) = scm;
13715 	iph_out = NULL;
13716 #ifdef INET6
13717 	ip6_out = NULL;
13718 #endif
13719 	switch (iph->ip_v) {
13720 	case IPVERSION:
13721 		iph_out = mtod(mout, struct ip *);
13722 
13723 		/* Fill in the IP header for the ABORT */
13724 		iph_out->ip_v = IPVERSION;
13725 		iph_out->ip_hl = (sizeof(struct ip) / 4);
13726 		iph_out->ip_tos = (u_char)0;
13727 		iph_out->ip_id = 0;
13728 		iph_out->ip_off = 0;
13729 		iph_out->ip_ttl = MAXTTL;
13730 		if (port) {
13731 			iph_out->ip_p = IPPROTO_UDP;
13732 		} else {
13733 			iph_out->ip_p = IPPROTO_SCTP;
13734 		}
13735 		iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
13736 		iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
13737 		/* let IP layer calculate this */
13738 		iph_out->ip_sum = 0;
13739 
13740 		iphlen_out = sizeof(struct ip);
13741 		sh_out = (struct sctphdr *)((caddr_t)iph_out + iphlen_out);
13742 		break;
13743 #ifdef INET6
13744 	case IPV6_VERSION >> 4:
13745 		ip6 = (struct ip6_hdr *)iph;
13746 		ip6_out = mtod(mout, struct ip6_hdr *);
13747 
13748 		/* Fill in the IP6 header for the ABORT */
13749 		ip6_out->ip6_flow = ip6->ip6_flow;
13750 		ip6_out->ip6_hlim = MODULE_GLOBAL(MOD_INET6, ip6_defhlim);
13751 		if (port) {
13752 			ip6_out->ip6_nxt = IPPROTO_UDP;
13753 		} else {
13754 			ip6_out->ip6_nxt = IPPROTO_SCTP;
13755 		}
13756 		ip6_out->ip6_src = ip6->ip6_dst;
13757 		ip6_out->ip6_dst = ip6->ip6_src;
13758 
13759 		iphlen_out = sizeof(struct ip6_hdr);
13760 		sh_out = (struct sctphdr *)((caddr_t)ip6_out + iphlen_out);
13761 		break;
13762 #endif				/* INET6 */
13763 	default:
13764 		/* Currently not supported */
13765 		sctp_m_freem(mout);
13766 		return;
13767 	}
13768 
13769 	udp = (struct udphdr *)sh_out;
13770 	if (port) {
13771 		udp->uh_sport = htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port));
13772 		udp->uh_dport = port;
13773 		/* set udp->uh_ulen later */
13774 		udp->uh_sum = 0;
13775 		iphlen_out += sizeof(struct udphdr);
13776 		sh_out = (struct sctphdr *)((caddr_t)udp + sizeof(struct udphdr));
13777 	}
13778 	sh_out->src_port = sh->dest_port;
13779 	sh_out->dest_port = sh->src_port;
13780 	sh_out->v_tag = vtag;
13781 	sh_out->checksum = 0;
13782 
13783 	ch = (struct sctp_chunkhdr *)((caddr_t)sh_out + sizeof(struct sctphdr));
13784 	ch->chunk_type = SCTP_OPERATION_ERROR;
13785 	ch->chunk_flags = 0;
13786 
13787 	if (scm) {
13788 		struct mbuf *m_tmp = scm;
13789 		int cause_len = 0;
13790 
13791 		/* get length of the err_cause chain */
13792 		while (m_tmp != NULL) {
13793 			cause_len += SCTP_BUF_LEN(m_tmp);
13794 			m_tmp = SCTP_BUF_NEXT(m_tmp);
13795 		}
13796 		len = SCTP_BUF_LEN(mout) + cause_len;
13797 		if (cause_len % 4) {
13798 			/* need pad at end of chunk */
13799 			uint32_t cpthis = 0;
13800 			int padlen;
13801 
13802 			padlen = 4 - (len % 4);
13803 			m_copyback(mout, len, padlen, (caddr_t)&cpthis);
13804 			len += padlen;
13805 		}
13806 		ch->chunk_length = htons(sizeof(struct sctp_chunkhdr) + cause_len);
13807 	} else {
13808 		len = SCTP_BUF_LEN(mout);
13809 		ch->chunk_length = htons(sizeof(struct sctp_chunkhdr));
13810 	}
13811 
13812 	if (SCTP_GET_HEADER_FOR_OUTPUT(o_pak)) {
13813 		/* no mbuf's */
13814 		sctp_m_freem(mout);
13815 		return;
13816 	}
13817 	if (iph_out != NULL) {
13818 		sctp_route_t ro;
13819 		struct sctp_tcb *stcb = NULL;
13820 		int ret;
13821 
13822 		/* zap the stack pointer to the route */
13823 		bzero(&ro, sizeof ro);
13824 		if (port) {
13825 			udp->uh_ulen = htons(len - sizeof(struct ip));
13826 			udp->uh_sum = in_pseudo(iph_out->ip_src.s_addr, iph_out->ip_dst.s_addr, udp->uh_ulen + htons(IPPROTO_UDP));
13827 		}
13828 		/* set IPv4 length */
13829 		iph_out->ip_len = len;
13830 		/* out it goes */
13831 #ifdef  SCTP_PACKET_LOGGING
13832 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
13833 			sctp_packet_log(mout, len);
13834 #endif
13835 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
13836 		if (port) {
13837 			sh_out->checksum = sctp_calculate_cksum(mout, iphlen_out);
13838 			SCTP_STAT_INCR(sctps_sendswcrc);
13839 			SCTP_ENABLE_UDP_CSUM(o_pak);
13840 		} else {
13841 			mout->m_pkthdr.csum_flags = CSUM_SCTP;
13842 			mout->m_pkthdr.csum_data = 0;	/* FIXME MT */
13843 			SCTP_STAT_INCR(sctps_sendhwcrc);
13844 		}
13845 		SCTP_IP_OUTPUT(ret, o_pak, &ro, stcb, vrf_id);
13846 
13847 		/* Free the route if we got one back */
13848 		if (ro.ro_rt)
13849 			RTFREE(ro.ro_rt);
13850 	}
13851 #ifdef INET6
13852 	if (ip6_out != NULL) {
13853 		struct route_in6 ro;
13854 		int ret;
13855 		struct sctp_tcb *stcb = NULL;
13856 		struct ifnet *ifp = NULL;
13857 
13858 		/* zap the stack pointer to the route */
13859 		bzero(&ro, sizeof(ro));
13860 		if (port) {
13861 			udp->uh_ulen = htons(len - sizeof(struct ip6_hdr));
13862 		}
13863 		ip6_out->ip6_plen = len - sizeof(*ip6_out);
13864 #ifdef  SCTP_PACKET_LOGGING
13865 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
13866 			sctp_packet_log(mout, len);
13867 #endif
13868 		sh_out->checksum = sctp_calculate_cksum(mout, iphlen_out);
13869 		SCTP_STAT_INCR(sctps_sendswcrc);
13870 		SCTP_ATTACH_CHAIN(o_pak, mout, len);
13871 		if (port) {
13872 			if ((udp->uh_sum = in6_cksum(o_pak, IPPROTO_UDP, sizeof(struct ip6_hdr), len - sizeof(struct ip6_hdr))) == 0) {
13873 				udp->uh_sum = 0xffff;
13874 			}
13875 		}
13876 		SCTP_IP6_OUTPUT(ret, o_pak, &ro, &ifp, stcb, vrf_id);
13877 
13878 		/* Free the route if we got one back */
13879 		if (ro.ro_rt)
13880 			RTFREE(ro.ro_rt);
13881 	}
13882 #endif
13883 	SCTP_STAT_INCR(sctps_sendpackets);
13884 	SCTP_STAT_INCR_COUNTER64(sctps_outpackets);
13885 	SCTP_STAT_INCR_COUNTER64(sctps_outcontrolchunks);
13886 }
13887 
13888 static struct mbuf *
13889 sctp_copy_resume(struct sctp_stream_queue_pending *sp,
13890     struct uio *uio,
13891     struct sctp_sndrcvinfo *srcv,
13892     int max_send_len,
13893     int user_marks_eor,
13894     int *error,
13895     uint32_t * sndout,
13896     struct mbuf **new_tail)
13897 {
13898 	struct mbuf *m;
13899 
13900 	m = m_uiotombuf(uio, M_WAITOK, max_send_len, 0,
13901 	    (M_PKTHDR | (user_marks_eor ? M_EOR : 0)));
13902 	if (m == NULL) {
13903 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
13904 		*error = ENOMEM;
13905 	} else {
13906 		*sndout = m_length(m, NULL);
13907 		*new_tail = m_last(m);
13908 	}
13909 	return (m);
13910 }
13911 
13912 static int
13913 sctp_copy_one(struct sctp_stream_queue_pending *sp,
13914     struct uio *uio,
13915     int resv_upfront)
13916 {
13917 	int left;
13918 
13919 	left = sp->length;
13920 	sp->data = m_uiotombuf(uio, M_WAITOK, sp->length,
13921 	    resv_upfront, 0);
13922 	if (sp->data == NULL) {
13923 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
13924 		return (ENOMEM);
13925 	}
13926 	sp->tail_mbuf = m_last(sp->data);
13927 	return (0);
13928 }
13929 
13930 
13931 
13932 static struct sctp_stream_queue_pending *
13933 sctp_copy_it_in(struct sctp_tcb *stcb,
13934     struct sctp_association *asoc,
13935     struct sctp_sndrcvinfo *srcv,
13936     struct uio *uio,
13937     struct sctp_nets *net,
13938     int max_send_len,
13939     int user_marks_eor,
13940     int *error,
13941     int non_blocking)
13942 {
13943 	/*-
13944 	 * This routine must be very careful in its work. Protocol
13945 	 * processing is up and running so care must be taken to spl...()
13946 	 * when you need to do something that may effect the stcb/asoc. The
13947 	 * sb is locked however. When data is copied the protocol processing
13948 	 * should be enabled since this is a slower operation...
13949 	 */
13950 	struct sctp_stream_queue_pending *sp = NULL;
13951 	int resv_in_first;
13952 
13953 	*error = 0;
13954 	/* Now can we send this? */
13955 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
13956 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
13957 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
13958 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
13959 		/* got data while shutting down */
13960 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
13961 		*error = ECONNRESET;
13962 		goto out_now;
13963 	}
13964 	sctp_alloc_a_strmoq(stcb, sp);
13965 	if (sp == NULL) {
13966 		SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
13967 		*error = ENOMEM;
13968 		goto out_now;
13969 	}
13970 	sp->act_flags = 0;
13971 	sp->sender_all_done = 0;
13972 	sp->sinfo_flags = srcv->sinfo_flags;
13973 	sp->timetolive = srcv->sinfo_timetolive;
13974 	sp->ppid = srcv->sinfo_ppid;
13975 	sp->context = srcv->sinfo_context;
13976 	sp->strseq = 0;
13977 	(void)SCTP_GETTIME_TIMEVAL(&sp->ts);
13978 
13979 	sp->stream = srcv->sinfo_stream;
13980 	sp->length = min(uio->uio_resid, max_send_len);
13981 	if ((sp->length == (uint32_t) uio->uio_resid) &&
13982 	    ((user_marks_eor == 0) ||
13983 	    (srcv->sinfo_flags & SCTP_EOF) ||
13984 	    (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) {
13985 		sp->msg_is_complete = 1;
13986 	} else {
13987 		sp->msg_is_complete = 0;
13988 	}
13989 	sp->sender_all_done = 0;
13990 	sp->some_taken = 0;
13991 	sp->put_last_out = 0;
13992 	resv_in_first = sizeof(struct sctp_data_chunk);
13993 	sp->data = sp->tail_mbuf = NULL;
13994 	if (sp->length == 0) {
13995 		*error = 0;
13996 		goto skip_copy;
13997 	}
13998 	sp->auth_keyid = stcb->asoc.authinfo.active_keyid;
13999 	if (sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.peer_auth_chunks)) {
14000 		sctp_auth_key_acquire(stcb, stcb->asoc.authinfo.active_keyid);
14001 		sp->holds_key_ref = 1;
14002 	}
14003 	*error = sctp_copy_one(sp, uio, resv_in_first);
14004 skip_copy:
14005 	if (*error) {
14006 		sctp_free_a_strmoq(stcb, sp);
14007 		sp = NULL;
14008 	} else {
14009 		if (sp->sinfo_flags & SCTP_ADDR_OVER) {
14010 			sp->net = net;
14011 			sp->addr_over = 1;
14012 		} else {
14013 			sp->net = asoc->primary_destination;
14014 			sp->addr_over = 0;
14015 		}
14016 		atomic_add_int(&sp->net->ref_count, 1);
14017 		sctp_set_prsctp_policy(stcb, sp);
14018 	}
14019 out_now:
14020 	return (sp);
14021 }
14022 
14023 
14024 int
14025 sctp_sosend(struct socket *so,
14026     struct sockaddr *addr,
14027     struct uio *uio,
14028     struct mbuf *top,
14029     struct mbuf *control,
14030     int flags,
14031     struct thread *p
14032 )
14033 {
14034 	struct sctp_inpcb *inp;
14035 	int error, use_rcvinfo = 0;
14036 	struct sctp_sndrcvinfo srcv;
14037 	struct sockaddr *addr_to_use;
14038 
14039 #ifdef INET6
14040 	struct sockaddr_in sin;
14041 
14042 #endif
14043 
14044 	inp = (struct sctp_inpcb *)so->so_pcb;
14045 	if (control) {
14046 		/* process cmsg snd/rcv info (maybe a assoc-id) */
14047 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
14048 		    sizeof(srcv))) {
14049 			/* got one */
14050 			use_rcvinfo = 1;
14051 		}
14052 	}
14053 	addr_to_use = addr;
14054 #if defined(INET6)  && !defined(__Userspace__)	/* TODO port in6_sin6_2_sin */
14055 	if ((addr) && (addr->sa_family == AF_INET6)) {
14056 		struct sockaddr_in6 *sin6;
14057 
14058 		sin6 = (struct sockaddr_in6 *)addr;
14059 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
14060 			in6_sin6_2_sin(&sin, sin6);
14061 			addr_to_use = (struct sockaddr *)&sin;
14062 		}
14063 	}
14064 #endif
14065 	error = sctp_lower_sosend(so, addr_to_use, uio, top,
14066 	    control,
14067 	    flags,
14068 	    use_rcvinfo, &srcv
14069 	    ,p
14070 	    );
14071 	return (error);
14072 }
14073 
14074 
14075 int
14076 sctp_lower_sosend(struct socket *so,
14077     struct sockaddr *addr,
14078     struct uio *uio,
14079     struct mbuf *i_pak,
14080     struct mbuf *control,
14081     int flags,
14082     int use_rcvinfo,
14083     struct sctp_sndrcvinfo *srcv
14084     ,
14085     struct thread *p
14086 )
14087 {
14088 	unsigned int sndlen = 0, max_len;
14089 	int error, len;
14090 	struct mbuf *top = NULL;
14091 	int queue_only = 0, queue_only_for_init = 0;
14092 	int free_cnt_applied = 0;
14093 	int un_sent = 0;
14094 	int now_filled = 0;
14095 	unsigned int inqueue_bytes = 0;
14096 	struct sctp_block_entry be;
14097 	struct sctp_inpcb *inp;
14098 	struct sctp_tcb *stcb = NULL;
14099 	struct timeval now;
14100 	struct sctp_nets *net;
14101 	struct sctp_association *asoc;
14102 	struct sctp_inpcb *t_inp;
14103 	int user_marks_eor;
14104 	int create_lock_applied = 0;
14105 	int nagle_applies = 0;
14106 	int some_on_control = 0;
14107 	int got_all_of_the_send = 0;
14108 	int hold_tcblock = 0;
14109 	int non_blocking = 0;
14110 	int temp_flags = 0;
14111 	uint32_t local_add_more, local_soresv = 0;
14112 
14113 	error = 0;
14114 	net = NULL;
14115 	stcb = NULL;
14116 	asoc = NULL;
14117 
14118 	t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
14119 	if (inp == NULL) {
14120 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
14121 		error = EFAULT;
14122 		if (i_pak) {
14123 			SCTP_RELEASE_PKT(i_pak);
14124 		}
14125 		return (error);
14126 	}
14127 	if ((uio == NULL) && (i_pak == NULL)) {
14128 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14129 		return (EINVAL);
14130 	}
14131 	user_marks_eor = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
14132 	atomic_add_int(&inp->total_sends, 1);
14133 	if (uio) {
14134 		if (uio->uio_resid < 0) {
14135 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14136 			return (EINVAL);
14137 		}
14138 		sndlen = uio->uio_resid;
14139 	} else {
14140 		top = SCTP_HEADER_TO_CHAIN(i_pak);
14141 		sndlen = SCTP_HEADER_LEN(i_pak);
14142 	}
14143 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "Send called addr:%p send length %d\n",
14144 	    addr,
14145 	    sndlen);
14146 	/*-
14147 	 * Pre-screen address, if one is given the sin-len
14148 	 * must be set correctly!
14149 	 */
14150 	if (addr) {
14151 		if ((addr->sa_family == AF_INET) &&
14152 		    (addr->sa_len != sizeof(struct sockaddr_in))) {
14153 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14154 			error = EINVAL;
14155 			goto out_unlocked;
14156 		} else if ((addr->sa_family == AF_INET6) &&
14157 		    (addr->sa_len != sizeof(struct sockaddr_in6))) {
14158 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14159 			error = EINVAL;
14160 			goto out_unlocked;
14161 		}
14162 	}
14163 	hold_tcblock = 0;
14164 
14165 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
14166 	    (inp->sctp_socket->so_qlimit)) {
14167 		/* The listener can NOT send */
14168 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
14169 		error = EFAULT;
14170 		goto out_unlocked;
14171 	}
14172 	if ((use_rcvinfo) && srcv) {
14173 		if (INVALID_SINFO_FLAG(srcv->sinfo_flags) ||
14174 		    PR_SCTP_INVALID_POLICY(srcv->sinfo_flags)) {
14175 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14176 			error = EINVAL;
14177 			goto out_unlocked;
14178 		}
14179 		if (srcv->sinfo_flags)
14180 			SCTP_STAT_INCR(sctps_sends_with_flags);
14181 
14182 		if (srcv->sinfo_flags & SCTP_SENDALL) {
14183 			/* its a sendall */
14184 			error = sctp_sendall(inp, uio, top, srcv);
14185 			top = NULL;
14186 			goto out_unlocked;
14187 		}
14188 	}
14189 	/* now we must find the assoc */
14190 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) ||
14191 	    (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
14192 		SCTP_INP_RLOCK(inp);
14193 		stcb = LIST_FIRST(&inp->sctp_asoc_list);
14194 		if (stcb == NULL) {
14195 			SCTP_INP_RUNLOCK(inp);
14196 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN);
14197 			error = ENOTCONN;
14198 			goto out_unlocked;
14199 		}
14200 		hold_tcblock = 0;
14201 		SCTP_INP_RUNLOCK(inp);
14202 		if (addr) {
14203 			/* Must locate the net structure if addr given */
14204 			net = sctp_findnet(stcb, addr);
14205 			if (net) {
14206 				/* validate port was 0 or correct */
14207 				struct sockaddr_in *sin;
14208 
14209 				sin = (struct sockaddr_in *)addr;
14210 				if ((sin->sin_port != 0) &&
14211 				    (sin->sin_port != stcb->rport)) {
14212 					net = NULL;
14213 				}
14214 			}
14215 			temp_flags |= SCTP_ADDR_OVER;
14216 		} else
14217 			net = stcb->asoc.primary_destination;
14218 		if (addr && (net == NULL)) {
14219 			/* Could not find address, was it legal */
14220 			if (addr->sa_family == AF_INET) {
14221 				struct sockaddr_in *sin;
14222 
14223 				sin = (struct sockaddr_in *)addr;
14224 				if (sin->sin_addr.s_addr == 0) {
14225 					if ((sin->sin_port == 0) ||
14226 					    (sin->sin_port == stcb->rport)) {
14227 						net = stcb->asoc.primary_destination;
14228 					}
14229 				}
14230 			} else {
14231 				struct sockaddr_in6 *sin6;
14232 
14233 				sin6 = (struct sockaddr_in6 *)addr;
14234 				if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
14235 					if ((sin6->sin6_port == 0) ||
14236 					    (sin6->sin6_port == stcb->rport)) {
14237 						net = stcb->asoc.primary_destination;
14238 					}
14239 				}
14240 			}
14241 		}
14242 		if (net == NULL) {
14243 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14244 			error = EINVAL;
14245 			goto out_unlocked;
14246 		}
14247 	} else if (use_rcvinfo && srcv && srcv->sinfo_assoc_id) {
14248 		stcb = sctp_findassociation_ep_asocid(inp, srcv->sinfo_assoc_id, 0);
14249 		if (stcb) {
14250 			if (addr)
14251 				/*
14252 				 * Must locate the net structure if addr
14253 				 * given
14254 				 */
14255 				net = sctp_findnet(stcb, addr);
14256 			else
14257 				net = stcb->asoc.primary_destination;
14258 			if ((srcv->sinfo_flags & SCTP_ADDR_OVER) &&
14259 			    ((net == NULL) || (addr == NULL))) {
14260 				struct sockaddr_in *sin;
14261 
14262 				if (addr == NULL) {
14263 					SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14264 					error = EINVAL;
14265 					goto out_unlocked;
14266 				}
14267 				sin = (struct sockaddr_in *)addr;
14268 				/* Validate port is 0 or correct */
14269 				if ((sin->sin_port != 0) &&
14270 				    (sin->sin_port != stcb->rport)) {
14271 					net = NULL;
14272 				}
14273 			}
14274 		}
14275 		hold_tcblock = 0;
14276 	} else if (addr) {
14277 		/*-
14278 		 * Since we did not use findep we must
14279 		 * increment it, and if we don't find a tcb
14280 		 * decrement it.
14281 		 */
14282 		SCTP_INP_WLOCK(inp);
14283 		SCTP_INP_INCR_REF(inp);
14284 		SCTP_INP_WUNLOCK(inp);
14285 		stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
14286 		if (stcb == NULL) {
14287 			SCTP_INP_WLOCK(inp);
14288 			SCTP_INP_DECR_REF(inp);
14289 			SCTP_INP_WUNLOCK(inp);
14290 		} else {
14291 			hold_tcblock = 1;
14292 		}
14293 	}
14294 	if ((stcb == NULL) && (addr)) {
14295 		/* Possible implicit send? */
14296 		SCTP_ASOC_CREATE_LOCK(inp);
14297 		create_lock_applied = 1;
14298 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
14299 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
14300 			/* Should I really unlock ? */
14301 			SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_OUTPUT, EFAULT);
14302 			error = EFAULT;
14303 			goto out_unlocked;
14304 
14305 		}
14306 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
14307 		    (addr->sa_family == AF_INET6)) {
14308 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14309 			error = EINVAL;
14310 			goto out_unlocked;
14311 		}
14312 		SCTP_INP_WLOCK(inp);
14313 		SCTP_INP_INCR_REF(inp);
14314 		SCTP_INP_WUNLOCK(inp);
14315 		/* With the lock applied look again */
14316 		stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
14317 		if (stcb == NULL) {
14318 			SCTP_INP_WLOCK(inp);
14319 			SCTP_INP_DECR_REF(inp);
14320 			SCTP_INP_WUNLOCK(inp);
14321 		} else {
14322 			hold_tcblock = 1;
14323 		}
14324 		if (t_inp != inp) {
14325 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOTCONN);
14326 			error = ENOTCONN;
14327 			goto out_unlocked;
14328 		}
14329 	}
14330 	if (stcb == NULL) {
14331 		if (addr == NULL) {
14332 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT);
14333 			error = ENOENT;
14334 			goto out_unlocked;
14335 		} else {
14336 			/*
14337 			 * UDP style, we must go ahead and start the INIT
14338 			 * process
14339 			 */
14340 			uint32_t vrf_id;
14341 
14342 			if ((use_rcvinfo) && (srcv) &&
14343 			    ((srcv->sinfo_flags & SCTP_ABORT) ||
14344 			    ((srcv->sinfo_flags & SCTP_EOF) &&
14345 			    (sndlen == 0)))) {
14346 				/*-
14347 				 * User asks to abort a non-existant assoc,
14348 				 * or EOF a non-existant assoc with no data
14349 				 */
14350 				SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOENT);
14351 				error = ENOENT;
14352 				goto out_unlocked;
14353 			}
14354 			/* get an asoc/stcb struct */
14355 			vrf_id = inp->def_vrf_id;
14356 #ifdef INVARIANTS
14357 			if (create_lock_applied == 0) {
14358 				panic("Error, should hold create lock and I don't?");
14359 			}
14360 #endif
14361 			stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0, vrf_id,
14362 			    p
14363 			    );
14364 			if (stcb == NULL) {
14365 				/* Error is setup for us in the call */
14366 				goto out_unlocked;
14367 			}
14368 			if (create_lock_applied) {
14369 				SCTP_ASOC_CREATE_UNLOCK(inp);
14370 				create_lock_applied = 0;
14371 			} else {
14372 				SCTP_PRINTF("Huh-3? create lock should have been on??\n");
14373 			}
14374 			/*
14375 			 * Turn on queue only flag to prevent data from
14376 			 * being sent
14377 			 */
14378 			queue_only = 1;
14379 			asoc = &stcb->asoc;
14380 			SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT);
14381 			(void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
14382 
14383 			/* initialize authentication params for the assoc */
14384 			sctp_initialize_auth_params(inp, stcb);
14385 
14386 			if (control) {
14387 				/*
14388 				 * see if a init structure exists in cmsg
14389 				 * headers
14390 				 */
14391 				struct sctp_initmsg initm;
14392 				int i;
14393 
14394 				if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
14395 				    sizeof(initm))) {
14396 					/*
14397 					 * we have an INIT override of the
14398 					 * default
14399 					 */
14400 					if (initm.sinit_max_attempts)
14401 						asoc->max_init_times = initm.sinit_max_attempts;
14402 					if (initm.sinit_num_ostreams)
14403 						asoc->pre_open_streams = initm.sinit_num_ostreams;
14404 					if (initm.sinit_max_instreams)
14405 						asoc->max_inbound_streams = initm.sinit_max_instreams;
14406 					if (initm.sinit_max_init_timeo)
14407 						asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
14408 					if (asoc->streamoutcnt < asoc->pre_open_streams) {
14409 						struct sctp_stream_out *tmp_str;
14410 						int had_lock = 0;
14411 
14412 						/* Default is NOT correct */
14413 						SCTPDBG(SCTP_DEBUG_OUTPUT1, "Ok, defout:%d pre_open:%d\n",
14414 						    asoc->streamoutcnt, asoc->pre_open_streams);
14415 						/*
14416 						 * What happens if this
14417 						 * fails? we panic ...
14418 						 */
14419 
14420 						if (hold_tcblock) {
14421 							had_lock = 1;
14422 							SCTP_TCB_UNLOCK(stcb);
14423 						}
14424 						SCTP_MALLOC(tmp_str,
14425 						    struct sctp_stream_out *,
14426 						    (asoc->pre_open_streams *
14427 						    sizeof(struct sctp_stream_out)),
14428 						    SCTP_M_STRMO);
14429 						if (had_lock) {
14430 							SCTP_TCB_LOCK(stcb);
14431 						}
14432 						if (tmp_str != NULL) {
14433 							SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
14434 							asoc->strmout = tmp_str;
14435 							asoc->streamoutcnt = asoc->pre_open_streams;
14436 						} else {
14437 							asoc->pre_open_streams = asoc->streamoutcnt;
14438 						}
14439 						for (i = 0; i < asoc->streamoutcnt; i++) {
14440 							/*-
14441 							 * inbound side must be set
14442 							 * to 0xffff, also NOTE when
14443 							 * we get the INIT-ACK back
14444 							 * (for INIT sender) we MUST
14445 							 * reduce the count
14446 							 * (streamoutcnt) but first
14447 							 * check if we sent to any
14448 							 * of the upper streams that
14449 							 * were dropped (if some
14450 							 * were). Those that were
14451 							 * dropped must be notified
14452 							 * to the upper layer as
14453 							 * failed to send.
14454 							 */
14455 							asoc->strmout[i].next_sequence_sent = 0x0;
14456 							TAILQ_INIT(&asoc->strmout[i].outqueue);
14457 							asoc->strmout[i].stream_no = i;
14458 							asoc->strmout[i].last_msg_incomplete = 0;
14459 							asoc->strmout[i].next_spoke.tqe_next = 0;
14460 							asoc->strmout[i].next_spoke.tqe_prev = 0;
14461 						}
14462 					}
14463 				}
14464 			}
14465 			hold_tcblock = 1;
14466 			/* out with the INIT */
14467 			queue_only_for_init = 1;
14468 			/*-
14469 			 * we may want to dig in after this call and adjust the MTU
14470 			 * value. It defaulted to 1500 (constant) but the ro
14471 			 * structure may now have an update and thus we may need to
14472 			 * change it BEFORE we append the message.
14473 			 */
14474 			net = stcb->asoc.primary_destination;
14475 			asoc = &stcb->asoc;
14476 		}
14477 	}
14478 	if ((SCTP_SO_IS_NBIO(so)
14479 	    || (flags & MSG_NBIO)
14480 	    )) {
14481 		non_blocking = 1;
14482 	}
14483 	asoc = &stcb->asoc;
14484 	atomic_add_int(&stcb->total_sends, 1);
14485 
14486 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NO_FRAGMENT)) {
14487 		if (sndlen > asoc->smallest_mtu) {
14488 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE);
14489 			error = EMSGSIZE;
14490 			goto out_unlocked;
14491 		}
14492 	}
14493 	/* would we block? */
14494 	if (non_blocking) {
14495 		if (hold_tcblock == 0) {
14496 			SCTP_TCB_LOCK(stcb);
14497 			hold_tcblock = 1;
14498 		}
14499 		inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
14500 		if ((SCTP_SB_LIMIT_SND(so) < (sndlen + inqueue_bytes + stcb->asoc.sb_send_resv)) ||
14501 		    (stcb->asoc.chunks_on_out_queue >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) {
14502 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EWOULDBLOCK);
14503 			if (sndlen > SCTP_SB_LIMIT_SND(so))
14504 				error = EMSGSIZE;
14505 			else
14506 				error = EWOULDBLOCK;
14507 			goto out_unlocked;
14508 		}
14509 		stcb->asoc.sb_send_resv += sndlen;
14510 		SCTP_TCB_UNLOCK(stcb);
14511 		hold_tcblock = 0;
14512 	} else {
14513 		atomic_add_int(&stcb->asoc.sb_send_resv, sndlen);
14514 	}
14515 	local_soresv = sndlen;
14516 	/* Keep the stcb from being freed under our feet */
14517 	if (free_cnt_applied) {
14518 #ifdef INVARIANTS
14519 		panic("refcnt already incremented");
14520 #else
14521 		printf("refcnt:1 already incremented?\n");
14522 #endif
14523 	} else {
14524 		atomic_add_int(&stcb->asoc.refcnt, 1);
14525 		free_cnt_applied = 1;
14526 	}
14527 	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
14528 		SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
14529 		error = ECONNRESET;
14530 		goto out_unlocked;
14531 	}
14532 	if (create_lock_applied) {
14533 		SCTP_ASOC_CREATE_UNLOCK(inp);
14534 		create_lock_applied = 0;
14535 	}
14536 	if (asoc->stream_reset_outstanding) {
14537 		/*
14538 		 * Can't queue any data while stream reset is underway.
14539 		 */
14540 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EAGAIN);
14541 		error = EAGAIN;
14542 		goto out_unlocked;
14543 	}
14544 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
14545 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
14546 		queue_only = 1;
14547 	}
14548 	if ((use_rcvinfo == 0) || (srcv == NULL)) {
14549 		/* Grab the default stuff from the asoc */
14550 		srcv = (struct sctp_sndrcvinfo *)&stcb->asoc.def_send;
14551 	}
14552 	/* we are now done with all control */
14553 	if (control) {
14554 		sctp_m_freem(control);
14555 		control = NULL;
14556 	}
14557 	if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
14558 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
14559 	    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
14560 	    (asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
14561 		if ((use_rcvinfo) &&
14562 		    (srcv->sinfo_flags & SCTP_ABORT)) {
14563 			;
14564 		} else {
14565 			SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
14566 			error = ECONNRESET;
14567 			goto out_unlocked;
14568 		}
14569 	}
14570 	/* Ok, we will attempt a msgsnd :> */
14571 	if (p) {
14572 		p->td_ru.ru_msgsnd++;
14573 	}
14574 	if (stcb) {
14575 		if (((srcv->sinfo_flags | temp_flags) & SCTP_ADDR_OVER) == 0) {
14576 			net = stcb->asoc.primary_destination;
14577 		}
14578 	}
14579 	if (net == NULL) {
14580 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14581 		error = EINVAL;
14582 		goto out_unlocked;
14583 	}
14584 	if ((net->flight_size > net->cwnd) && (SCTP_BASE_SYSCTL(sctp_cmt_on_off) == 0)) {
14585 		/*-
14586 		 * CMT: Added check for CMT above. net above is the primary
14587 		 * dest. If CMT is ON, sender should always attempt to send
14588 		 * with the output routine sctp_fill_outqueue() that loops
14589 		 * through all destination addresses. Therefore, if CMT is
14590 		 * ON, queue_only is NOT set to 1 here, so that
14591 		 * sctp_chunk_output() can be called below.
14592 		 */
14593 		queue_only = 1;
14594 	} else if (asoc->ifp_had_enobuf) {
14595 		SCTP_STAT_INCR(sctps_ifnomemqueued);
14596 		if (net->flight_size > (net->mtu * 2))
14597 			queue_only = 1;
14598 		asoc->ifp_had_enobuf = 0;
14599 	} else {
14600 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
14601 		    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
14602 	}
14603 	/* Are we aborting? */
14604 	if (srcv->sinfo_flags & SCTP_ABORT) {
14605 		struct mbuf *mm;
14606 		int tot_demand, tot_out = 0, max_out;
14607 
14608 		SCTP_STAT_INCR(sctps_sends_with_abort);
14609 		if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
14610 		    (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
14611 			/* It has to be up before we abort */
14612 			/* how big is the user initiated abort? */
14613 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14614 			error = EINVAL;
14615 			goto out;
14616 		}
14617 		if (hold_tcblock) {
14618 			SCTP_TCB_UNLOCK(stcb);
14619 			hold_tcblock = 0;
14620 		}
14621 		if (top) {
14622 			struct mbuf *cntm = NULL;
14623 
14624 			mm = sctp_get_mbuf_for_msg(1, 0, M_WAIT, 1, MT_DATA);
14625 			if (sndlen != 0) {
14626 				cntm = top;
14627 				while (cntm) {
14628 					tot_out += SCTP_BUF_LEN(cntm);
14629 					cntm = SCTP_BUF_NEXT(cntm);
14630 				}
14631 			}
14632 			tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
14633 		} else {
14634 			/* Must fit in a MTU */
14635 			tot_out = sndlen;
14636 			tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
14637 			if (tot_demand > SCTP_DEFAULT_ADD_MORE) {
14638 				/* To big */
14639 				SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE);
14640 				error = EMSGSIZE;
14641 				goto out;
14642 			}
14643 			mm = sctp_get_mbuf_for_msg(tot_demand, 0, M_WAIT, 1, MT_DATA);
14644 		}
14645 		if (mm == NULL) {
14646 			SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, ENOMEM);
14647 			error = ENOMEM;
14648 			goto out;
14649 		}
14650 		max_out = asoc->smallest_mtu - sizeof(struct sctp_paramhdr);
14651 		max_out -= sizeof(struct sctp_abort_msg);
14652 		if (tot_out > max_out) {
14653 			tot_out = max_out;
14654 		}
14655 		if (mm) {
14656 			struct sctp_paramhdr *ph;
14657 
14658 			/* now move forward the data pointer */
14659 			ph = mtod(mm, struct sctp_paramhdr *);
14660 			ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
14661 			ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
14662 			ph++;
14663 			SCTP_BUF_LEN(mm) = tot_out + sizeof(struct sctp_paramhdr);
14664 			if (top == NULL) {
14665 				error = uiomove((caddr_t)ph, (int)tot_out, uio);
14666 				if (error) {
14667 					/*-
14668 					 * Here if we can't get his data we
14669 					 * still abort we just don't get to
14670 					 * send the users note :-0
14671 					 */
14672 					sctp_m_freem(mm);
14673 					mm = NULL;
14674 				}
14675 			} else {
14676 				if (sndlen != 0) {
14677 					SCTP_BUF_NEXT(mm) = top;
14678 				}
14679 			}
14680 		}
14681 		if (hold_tcblock == 0) {
14682 			SCTP_TCB_LOCK(stcb);
14683 			hold_tcblock = 1;
14684 		}
14685 		atomic_add_int(&stcb->asoc.refcnt, -1);
14686 		free_cnt_applied = 0;
14687 		/* release this lock, otherwise we hang on ourselves */
14688 		sctp_abort_an_association(stcb->sctp_ep, stcb,
14689 		    SCTP_RESPONSE_TO_USER_REQ,
14690 		    mm, SCTP_SO_LOCKED);
14691 		/* now relock the stcb so everything is sane */
14692 		hold_tcblock = 0;
14693 		stcb = NULL;
14694 		/*
14695 		 * In this case top is already chained to mm avoid double
14696 		 * free, since we free it below if top != NULL and driver
14697 		 * would free it after sending the packet out
14698 		 */
14699 		if (sndlen != 0) {
14700 			top = NULL;
14701 		}
14702 		goto out_unlocked;
14703 	}
14704 	/* Calculate the maximum we can send */
14705 	inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
14706 	if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) {
14707 		if (non_blocking) {
14708 			/* we already checked for non-blocking above. */
14709 			max_len = sndlen;
14710 		} else {
14711 			max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes;
14712 		}
14713 	} else {
14714 		max_len = 0;
14715 	}
14716 	if (hold_tcblock) {
14717 		SCTP_TCB_UNLOCK(stcb);
14718 		hold_tcblock = 0;
14719 	}
14720 	/* Is the stream no. valid? */
14721 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
14722 		/* Invalid stream number */
14723 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14724 		error = EINVAL;
14725 		goto out_unlocked;
14726 	}
14727 	if (asoc->strmout == NULL) {
14728 		/* huh? software error */
14729 		SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EFAULT);
14730 		error = EFAULT;
14731 		goto out_unlocked;
14732 	}
14733 	/* Unless E_EOR mode is on, we must make a send FIT in one call. */
14734 	if ((user_marks_eor == 0) &&
14735 	    (sndlen > SCTP_SB_LIMIT_SND(stcb->sctp_socket))) {
14736 		/* It will NEVER fit */
14737 		SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EMSGSIZE);
14738 		error = EMSGSIZE;
14739 		goto out_unlocked;
14740 	}
14741 	if ((uio == NULL) && user_marks_eor) {
14742 		/*-
14743 		 * We do not support eeor mode for
14744 		 * sending with mbuf chains (like sendfile).
14745 		 */
14746 		SCTP_LTRACE_ERR_RET(NULL, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14747 		error = EINVAL;
14748 		goto out_unlocked;
14749 	}
14750 	if (user_marks_eor) {
14751 		local_add_more = min(SCTP_SB_LIMIT_SND(so), SCTP_BASE_SYSCTL(sctp_add_more_threshold));
14752 	} else {
14753 		/*-
14754 		 * For non-eeor the whole message must fit in
14755 		 * the socket send buffer.
14756 		 */
14757 		local_add_more = sndlen;
14758 	}
14759 	len = 0;
14760 	if (non_blocking) {
14761 		goto skip_preblock;
14762 	}
14763 	if (((max_len <= local_add_more) &&
14764 	    (SCTP_SB_LIMIT_SND(so) >= local_add_more)) ||
14765 	    (max_len == 0) ||
14766 	    ((stcb->asoc.chunks_on_out_queue + stcb->asoc.stream_queue_cnt) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) {
14767 		/* No room right now ! */
14768 		SOCKBUF_LOCK(&so->so_snd);
14769 		inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
14770 		while ((SCTP_SB_LIMIT_SND(so) < (inqueue_bytes + local_add_more)) ||
14771 		    ((stcb->asoc.stream_queue_cnt + stcb->asoc.chunks_on_out_queue) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue))) {
14772 			SCTPDBG(SCTP_DEBUG_OUTPUT1, "pre_block limit:%u <(inq:%d + %d) || (%d+%d > %d)\n",
14773 			    (unsigned int)SCTP_SB_LIMIT_SND(so),
14774 			    inqueue_bytes,
14775 			    local_add_more,
14776 			    stcb->asoc.stream_queue_cnt,
14777 			    stcb->asoc.chunks_on_out_queue,
14778 			    SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue));
14779 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
14780 				sctp_log_block(SCTP_BLOCK_LOG_INTO_BLKA, so, asoc, sndlen);
14781 			}
14782 			be.error = 0;
14783 			stcb->block_entry = &be;
14784 			error = sbwait(&so->so_snd);
14785 			stcb->block_entry = NULL;
14786 			if (error || so->so_error || be.error) {
14787 				if (error == 0) {
14788 					if (so->so_error)
14789 						error = so->so_error;
14790 					if (be.error) {
14791 						error = be.error;
14792 					}
14793 				}
14794 				SOCKBUF_UNLOCK(&so->so_snd);
14795 				goto out_unlocked;
14796 			}
14797 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
14798 				sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
14799 				    so, asoc, stcb->asoc.total_output_queue_size);
14800 			}
14801 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
14802 				goto out_unlocked;
14803 			}
14804 			inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
14805 		}
14806 		inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
14807 		if (SCTP_SB_LIMIT_SND(so) > inqueue_bytes) {
14808 			max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes;
14809 		} else {
14810 			max_len = 0;
14811 		}
14812 		SOCKBUF_UNLOCK(&so->so_snd);
14813 	}
14814 skip_preblock:
14815 	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
14816 		goto out_unlocked;
14817 	}
14818 	/*
14819 	 * sndlen covers for mbuf case uio_resid covers for the non-mbuf
14820 	 * case NOTE: uio will be null when top/mbuf is passed
14821 	 */
14822 	if (sndlen == 0) {
14823 		if (srcv->sinfo_flags & SCTP_EOF) {
14824 			got_all_of_the_send = 1;
14825 			goto dataless_eof;
14826 		} else {
14827 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14828 			error = EINVAL;
14829 			goto out;
14830 		}
14831 	}
14832 	if (top == NULL) {
14833 		struct sctp_stream_queue_pending *sp;
14834 		struct sctp_stream_out *strm;
14835 		uint32_t sndout, initial_out;
14836 
14837 		initial_out = uio->uio_resid;
14838 
14839 		SCTP_TCB_SEND_LOCK(stcb);
14840 		if ((asoc->stream_locked) &&
14841 		    (asoc->stream_locked_on != srcv->sinfo_stream)) {
14842 			SCTP_TCB_SEND_UNLOCK(stcb);
14843 			SCTP_LTRACE_ERR_RET(inp, stcb, net, SCTP_FROM_SCTP_OUTPUT, EINVAL);
14844 			error = EINVAL;
14845 			goto out;
14846 		}
14847 		SCTP_TCB_SEND_UNLOCK(stcb);
14848 
14849 		strm = &stcb->asoc.strmout[srcv->sinfo_stream];
14850 		if (strm->last_msg_incomplete == 0) {
14851 	do_a_copy_in:
14852 			sp = sctp_copy_it_in(stcb, asoc, srcv, uio, net, max_len, user_marks_eor, &error, non_blocking);
14853 			if ((sp == NULL) || (error)) {
14854 				goto out;
14855 			}
14856 			SCTP_TCB_SEND_LOCK(stcb);
14857 			if (sp->msg_is_complete) {
14858 				strm->last_msg_incomplete = 0;
14859 				asoc->stream_locked = 0;
14860 			} else {
14861 				/*
14862 				 * Just got locked to this guy in case of an
14863 				 * interrupt.
14864 				 */
14865 				strm->last_msg_incomplete = 1;
14866 				asoc->stream_locked = 1;
14867 				asoc->stream_locked_on = srcv->sinfo_stream;
14868 				sp->sender_all_done = 0;
14869 			}
14870 			sctp_snd_sb_alloc(stcb, sp->length);
14871 			atomic_add_int(&asoc->stream_queue_cnt, 1);
14872 			if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
14873 				sp->strseq = strm->next_sequence_sent;
14874 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_AT_SEND_2_SCTP) {
14875 					sctp_misc_ints(SCTP_STRMOUT_LOG_ASSIGN,
14876 					    (uintptr_t) stcb, sp->length,
14877 					    (uint32_t) ((srcv->sinfo_stream << 16) | sp->strseq), 0);
14878 				}
14879 				strm->next_sequence_sent++;
14880 			} else {
14881 				SCTP_STAT_INCR(sctps_sends_with_unord);
14882 			}
14883 			TAILQ_INSERT_TAIL(&strm->outqueue, sp, next);
14884 			if ((strm->next_spoke.tqe_next == NULL) &&
14885 			    (strm->next_spoke.tqe_prev == NULL)) {
14886 				/* Not on wheel, insert */
14887 				sctp_insert_on_wheel(stcb, asoc, strm, 1);
14888 			}
14889 			SCTP_TCB_SEND_UNLOCK(stcb);
14890 		} else {
14891 			SCTP_TCB_SEND_LOCK(stcb);
14892 			sp = TAILQ_LAST(&strm->outqueue, sctp_streamhead);
14893 			SCTP_TCB_SEND_UNLOCK(stcb);
14894 			if (sp == NULL) {
14895 				/* ???? Huh ??? last msg is gone */
14896 #ifdef INVARIANTS
14897 				panic("Warning: Last msg marked incomplete, yet nothing left?");
14898 #else
14899 				SCTP_PRINTF("Warning: Last msg marked incomplete, yet nothing left?\n");
14900 				strm->last_msg_incomplete = 0;
14901 #endif
14902 				goto do_a_copy_in;
14903 
14904 			}
14905 		}
14906 		while (uio->uio_resid > 0) {
14907 			/* How much room do we have? */
14908 			struct mbuf *new_tail, *mm;
14909 
14910 			if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size)
14911 				max_len = SCTP_SB_LIMIT_SND(so) - stcb->asoc.total_output_queue_size;
14912 			else
14913 				max_len = 0;
14914 
14915 			if ((max_len > SCTP_BASE_SYSCTL(sctp_add_more_threshold)) ||
14916 			    (max_len && (SCTP_SB_LIMIT_SND(so) < SCTP_BASE_SYSCTL(sctp_add_more_threshold))) ||
14917 			    (uio->uio_resid && (uio->uio_resid <= (int)max_len))) {
14918 				sndout = 0;
14919 				new_tail = NULL;
14920 				if (hold_tcblock) {
14921 					SCTP_TCB_UNLOCK(stcb);
14922 					hold_tcblock = 0;
14923 				}
14924 				mm = sctp_copy_resume(sp, uio, srcv, max_len, user_marks_eor, &error, &sndout, &new_tail);
14925 				if ((mm == NULL) || error) {
14926 					if (mm) {
14927 						sctp_m_freem(mm);
14928 					}
14929 					goto out;
14930 				}
14931 				/* Update the mbuf and count */
14932 				SCTP_TCB_SEND_LOCK(stcb);
14933 				if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
14934 					/*
14935 					 * we need to get out. Peer probably
14936 					 * aborted.
14937 					 */
14938 					sctp_m_freem(mm);
14939 					if (stcb->asoc.state & SCTP_PCB_FLAGS_WAS_ABORTED) {
14940 						SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTP_OUTPUT, ECONNRESET);
14941 						error = ECONNRESET;
14942 					}
14943 					SCTP_TCB_SEND_UNLOCK(stcb);
14944 					goto out;
14945 				}
14946 				if (sp->tail_mbuf) {
14947 					/* tack it to the end */
14948 					SCTP_BUF_NEXT(sp->tail_mbuf) = mm;
14949 					sp->tail_mbuf = new_tail;
14950 				} else {
14951 					/* A stolen mbuf */
14952 					sp->data = mm;
14953 					sp->tail_mbuf = new_tail;
14954 				}
14955 				sctp_snd_sb_alloc(stcb, sndout);
14956 				atomic_add_int(&sp->length, sndout);
14957 				len += sndout;
14958 
14959 				/* Did we reach EOR? */
14960 				if ((uio->uio_resid == 0) &&
14961 				    ((user_marks_eor == 0) ||
14962 				    (srcv->sinfo_flags & SCTP_EOF) ||
14963 				    (user_marks_eor && (srcv->sinfo_flags & SCTP_EOR)))) {
14964 					sp->msg_is_complete = 1;
14965 				} else {
14966 					sp->msg_is_complete = 0;
14967 				}
14968 				SCTP_TCB_SEND_UNLOCK(stcb);
14969 			}
14970 			if (uio->uio_resid == 0) {
14971 				/* got it all? */
14972 				continue;
14973 			}
14974 			/* PR-SCTP? */
14975 			if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
14976 				/*
14977 				 * This is ugly but we must assure locking
14978 				 * order
14979 				 */
14980 				if (hold_tcblock == 0) {
14981 					SCTP_TCB_LOCK(stcb);
14982 					hold_tcblock = 1;
14983 				}
14984 				sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
14985 				inqueue_bytes = stcb->asoc.total_output_queue_size - (stcb->asoc.chunks_on_out_queue * sizeof(struct sctp_data_chunk));
14986 				if (SCTP_SB_LIMIT_SND(so) > stcb->asoc.total_output_queue_size)
14987 					max_len = SCTP_SB_LIMIT_SND(so) - inqueue_bytes;
14988 				else
14989 					max_len = 0;
14990 				if (max_len > 0) {
14991 					continue;
14992 				}
14993 				SCTP_TCB_UNLOCK(stcb);
14994 				hold_tcblock = 0;
14995 			}
14996 			/* wait for space now */
14997 			if (non_blocking) {
14998 				/* Non-blocking io in place out */
14999 				goto skip_out_eof;
15000 			}
15001 			if ((net->flight_size > net->cwnd) &&
15002 			    (SCTP_BASE_SYSCTL(sctp_cmt_on_off) == 0)) {
15003 				queue_only = 1;
15004 			} else if (asoc->ifp_had_enobuf) {
15005 				SCTP_STAT_INCR(sctps_ifnomemqueued);
15006 				if (net->flight_size > (net->mtu * 2)) {
15007 					queue_only = 1;
15008 				} else {
15009 					queue_only = 0;
15010 				}
15011 				asoc->ifp_had_enobuf = 0;
15012 				un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
15013 				    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
15014 			} else {
15015 				un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
15016 				    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
15017 				if (net->flight_size > (net->mtu * stcb->asoc.max_burst)) {
15018 					queue_only = 1;
15019 					SCTP_STAT_INCR(sctps_send_burst_avoid);
15020 				} else if (net->flight_size > net->cwnd) {
15021 					queue_only = 1;
15022 					SCTP_STAT_INCR(sctps_send_cwnd_avoid);
15023 				} else {
15024 					queue_only = 0;
15025 				}
15026 			}
15027 			if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) &&
15028 			    (stcb->asoc.total_flight > 0) &&
15029 			    (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) &&
15030 			    (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) {
15031 
15032 				/*-
15033 				 * Ok, Nagle is set on and we have data outstanding.
15034 				 * Don't send anything and let SACKs drive out the
15035 				 * data unless wen have a "full" segment to send.
15036 				 */
15037 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) {
15038 					sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED);
15039 				}
15040 				SCTP_STAT_INCR(sctps_naglequeued);
15041 				nagle_applies = 1;
15042 			} else {
15043 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) {
15044 					if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY))
15045 						sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED);
15046 				}
15047 				SCTP_STAT_INCR(sctps_naglesent);
15048 				nagle_applies = 0;
15049 			}
15050 			/* What about the INIT, send it maybe */
15051 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
15052 
15053 				sctp_misc_ints(SCTP_CWNDLOG_PRESEND, queue_only_for_init, queue_only,
15054 				    nagle_applies, un_sent);
15055 				sctp_misc_ints(SCTP_CWNDLOG_PRESEND, stcb->asoc.total_output_queue_size,
15056 				    stcb->asoc.total_flight,
15057 				    stcb->asoc.chunks_on_out_queue, stcb->asoc.total_flight_count);
15058 			}
15059 			if (queue_only_for_init) {
15060 				if (hold_tcblock == 0) {
15061 					SCTP_TCB_LOCK(stcb);
15062 					hold_tcblock = 1;
15063 				}
15064 				if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
15065 					/* a collision took us forward? */
15066 					queue_only_for_init = 0;
15067 					queue_only = 0;
15068 				} else {
15069 					sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED);
15070 					SCTP_SET_STATE(asoc, SCTP_STATE_COOKIE_WAIT);
15071 					queue_only_for_init = 0;
15072 					queue_only = 1;
15073 				}
15074 			}
15075 			if ((queue_only == 0) && (nagle_applies == 0)) {
15076 				/*-
15077 				 * need to start chunk output
15078 				 * before blocking.. note that if
15079 				 * a lock is already applied, then
15080 				 * the input via the net is happening
15081 				 * and I don't need to start output :-D
15082 				 */
15083 				if (hold_tcblock == 0) {
15084 					if (SCTP_TCB_TRYLOCK(stcb)) {
15085 						hold_tcblock = 1;
15086 						sctp_chunk_output(inp,
15087 						    stcb,
15088 						    SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
15089 					}
15090 				} else {
15091 					sctp_chunk_output(inp,
15092 					    stcb,
15093 					    SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
15094 				}
15095 				if (hold_tcblock == 1) {
15096 					SCTP_TCB_UNLOCK(stcb);
15097 					hold_tcblock = 0;
15098 				}
15099 			}
15100 			SOCKBUF_LOCK(&so->so_snd);
15101 			/*-
15102 			 * This is a bit strange, but I think it will
15103 			 * work. The total_output_queue_size is locked and
15104 			 * protected by the TCB_LOCK, which we just released.
15105 			 * There is a race that can occur between releasing it
15106 			 * above, and me getting the socket lock, where sacks
15107 			 * come in but we have not put the SB_WAIT on the
15108 			 * so_snd buffer to get the wakeup. After the LOCK
15109 			 * is applied the sack_processing will also need to
15110 			 * LOCK the so->so_snd to do the actual sowwakeup(). So
15111 			 * once we have the socket buffer lock if we recheck the
15112 			 * size we KNOW we will get to sleep safely with the
15113 			 * wakeup flag in place.
15114 			 */
15115 			if (SCTP_SB_LIMIT_SND(so) <= (stcb->asoc.total_output_queue_size +
15116 			    min(SCTP_BASE_SYSCTL(sctp_add_more_threshold), SCTP_SB_LIMIT_SND(so)))) {
15117 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
15118 					sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
15119 					    so, asoc, uio->uio_resid);
15120 				}
15121 				be.error = 0;
15122 				stcb->block_entry = &be;
15123 				error = sbwait(&so->so_snd);
15124 				stcb->block_entry = NULL;
15125 
15126 				if (error || so->so_error || be.error) {
15127 					if (error == 0) {
15128 						if (so->so_error)
15129 							error = so->so_error;
15130 						if (be.error) {
15131 							error = be.error;
15132 						}
15133 					}
15134 					SOCKBUF_UNLOCK(&so->so_snd);
15135 					goto out_unlocked;
15136 				}
15137 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
15138 					sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
15139 					    so, asoc, stcb->asoc.total_output_queue_size);
15140 				}
15141 			}
15142 			SOCKBUF_UNLOCK(&so->so_snd);
15143 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
15144 				goto out_unlocked;
15145 			}
15146 		}
15147 		SCTP_TCB_SEND_LOCK(stcb);
15148 		if (sp) {
15149 			if (sp->msg_is_complete == 0) {
15150 				strm->last_msg_incomplete = 1;
15151 				asoc->stream_locked = 1;
15152 				asoc->stream_locked_on = srcv->sinfo_stream;
15153 			} else {
15154 				sp->sender_all_done = 1;
15155 				strm->last_msg_incomplete = 0;
15156 				asoc->stream_locked = 0;
15157 			}
15158 		} else {
15159 			SCTP_PRINTF("Huh no sp TSNH?\n");
15160 			strm->last_msg_incomplete = 0;
15161 			asoc->stream_locked = 0;
15162 		}
15163 		SCTP_TCB_SEND_UNLOCK(stcb);
15164 		if (uio->uio_resid == 0) {
15165 			got_all_of_the_send = 1;
15166 		}
15167 	} else if (top) {
15168 		/* We send in a 0, since we do NOT have any locks */
15169 		error = sctp_msg_append(stcb, net, top, srcv, 0);
15170 		top = NULL;
15171 		if (srcv->sinfo_flags & SCTP_EOF) {
15172 			/*
15173 			 * This should only happen for Panda for the mbuf
15174 			 * send case, which does NOT yet support EEOR mode.
15175 			 * Thus, we can just set this flag to do the proper
15176 			 * EOF handling.
15177 			 */
15178 			got_all_of_the_send = 1;
15179 		}
15180 	}
15181 	if (error) {
15182 		goto out;
15183 	}
15184 dataless_eof:
15185 	/* EOF thing ? */
15186 	if ((srcv->sinfo_flags & SCTP_EOF) &&
15187 	    (got_all_of_the_send == 1) &&
15188 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
15189 		int cnt;
15190 
15191 		SCTP_STAT_INCR(sctps_sends_with_eof);
15192 		error = 0;
15193 		if (hold_tcblock == 0) {
15194 			SCTP_TCB_LOCK(stcb);
15195 			hold_tcblock = 1;
15196 		}
15197 		cnt = sctp_is_there_unsent_data(stcb);
15198 		if (TAILQ_EMPTY(&asoc->send_queue) &&
15199 		    TAILQ_EMPTY(&asoc->sent_queue) &&
15200 		    (cnt == 0)) {
15201 			if (asoc->locked_on_sending) {
15202 				goto abort_anyway;
15203 			}
15204 			/* there is nothing queued to send, so I'm done... */
15205 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
15206 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
15207 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
15208 				/* only send SHUTDOWN the first time through */
15209 				sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
15210 				if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
15211 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
15212 				}
15213 				SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
15214 				SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
15215 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
15216 				    asoc->primary_destination);
15217 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
15218 				    asoc->primary_destination);
15219 			}
15220 		} else {
15221 			/*-
15222 			 * we still got (or just got) data to send, so set
15223 			 * SHUTDOWN_PENDING
15224 			 */
15225 			/*-
15226 			 * XXX sockets draft says that SCTP_EOF should be
15227 			 * sent with no data.  currently, we will allow user
15228 			 * data to be sent first and move to
15229 			 * SHUTDOWN-PENDING
15230 			 */
15231 			if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
15232 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
15233 			    (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
15234 				if (hold_tcblock == 0) {
15235 					SCTP_TCB_LOCK(stcb);
15236 					hold_tcblock = 1;
15237 				}
15238 				if (asoc->locked_on_sending) {
15239 					/* Locked to send out the data */
15240 					struct sctp_stream_queue_pending *sp;
15241 
15242 					sp = TAILQ_LAST(&asoc->locked_on_sending->outqueue, sctp_streamhead);
15243 					if (sp) {
15244 						if ((sp->length == 0) && (sp->msg_is_complete == 0))
15245 							asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
15246 					}
15247 				}
15248 				asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
15249 				if (TAILQ_EMPTY(&asoc->send_queue) &&
15250 				    TAILQ_EMPTY(&asoc->sent_queue) &&
15251 				    (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
15252 			abort_anyway:
15253 					if (free_cnt_applied) {
15254 						atomic_add_int(&stcb->asoc.refcnt, -1);
15255 						free_cnt_applied = 0;
15256 					}
15257 					sctp_abort_an_association(stcb->sctp_ep, stcb,
15258 					    SCTP_RESPONSE_TO_USER_REQ,
15259 					    NULL, SCTP_SO_LOCKED);
15260 					/*
15261 					 * now relock the stcb so everything
15262 					 * is sane
15263 					 */
15264 					hold_tcblock = 0;
15265 					stcb = NULL;
15266 					goto out;
15267 				}
15268 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
15269 				    asoc->primary_destination);
15270 				sctp_feature_off(inp, SCTP_PCB_FLAGS_NODELAY);
15271 			}
15272 		}
15273 	}
15274 skip_out_eof:
15275 	if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
15276 		some_on_control = 1;
15277 	}
15278 	if ((net->flight_size > net->cwnd) &&
15279 	    (SCTP_BASE_SYSCTL(sctp_cmt_on_off) == 0)) {
15280 		queue_only = 1;
15281 	} else if (asoc->ifp_had_enobuf) {
15282 		SCTP_STAT_INCR(sctps_ifnomemqueued);
15283 		if (net->flight_size > (net->mtu * 2)) {
15284 			queue_only = 1;
15285 		} else {
15286 			queue_only = 0;
15287 		}
15288 		asoc->ifp_had_enobuf = 0;
15289 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
15290 		    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
15291 	} else {
15292 		un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
15293 		    (stcb->asoc.stream_queue_cnt * sizeof(struct sctp_data_chunk)));
15294 		if (net->flight_size > (net->mtu * stcb->asoc.max_burst)) {
15295 			queue_only = 1;
15296 			SCTP_STAT_INCR(sctps_send_burst_avoid);
15297 		} else if (net->flight_size > net->cwnd) {
15298 			queue_only = 1;
15299 			SCTP_STAT_INCR(sctps_send_cwnd_avoid);
15300 		} else {
15301 			queue_only = 0;
15302 		}
15303 	}
15304 	if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY)) &&
15305 	    (stcb->asoc.total_flight > 0) &&
15306 	    (stcb->asoc.stream_queue_cnt < SCTP_MAX_DATA_BUNDLING) &&
15307 	    (un_sent < (int)(stcb->asoc.smallest_mtu - SCTP_MIN_OVERHEAD))) {
15308 		/*-
15309 		 * Ok, Nagle is set on and we have data outstanding.
15310 		 * Don't send anything and let SACKs drive out the
15311 		 * data unless wen have a "full" segment to send.
15312 		 */
15313 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) {
15314 			sctp_log_nagle_event(stcb, SCTP_NAGLE_APPLIED);
15315 		}
15316 		SCTP_STAT_INCR(sctps_naglequeued);
15317 		nagle_applies = 1;
15318 	} else {
15319 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_NAGLE_LOGGING_ENABLE) {
15320 			if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_NODELAY))
15321 				sctp_log_nagle_event(stcb, SCTP_NAGLE_SKIPPED);
15322 		}
15323 		SCTP_STAT_INCR(sctps_naglesent);
15324 		nagle_applies = 0;
15325 	}
15326 	if (queue_only_for_init) {
15327 		if (hold_tcblock == 0) {
15328 			SCTP_TCB_LOCK(stcb);
15329 			hold_tcblock = 1;
15330 		}
15331 		if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
15332 			/* a collision took us forward? */
15333 			queue_only_for_init = 0;
15334 			queue_only = 0;
15335 		} else {
15336 			sctp_send_initiate(inp, stcb, SCTP_SO_LOCKED);
15337 			SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_WAIT);
15338 			queue_only_for_init = 0;
15339 			queue_only = 1;
15340 		}
15341 	}
15342 	if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) {
15343 		/* we can attempt to send too. */
15344 		if (hold_tcblock == 0) {
15345 			/*
15346 			 * If there is activity recv'ing sacks no need to
15347 			 * send
15348 			 */
15349 			if (SCTP_TCB_TRYLOCK(stcb)) {
15350 				sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
15351 				hold_tcblock = 1;
15352 			}
15353 		} else {
15354 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
15355 		}
15356 	} else if ((queue_only == 0) &&
15357 		    (stcb->asoc.peers_rwnd == 0) &&
15358 	    (stcb->asoc.total_flight == 0)) {
15359 		/* We get to have a probe outstanding */
15360 		if (hold_tcblock == 0) {
15361 			hold_tcblock = 1;
15362 			SCTP_TCB_LOCK(stcb);
15363 		}
15364 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND, SCTP_SO_LOCKED);
15365 	} else if (some_on_control) {
15366 		int num_out, reason, cwnd_full, frag_point;
15367 
15368 		/* Here we do control only */
15369 		if (hold_tcblock == 0) {
15370 			hold_tcblock = 1;
15371 			SCTP_TCB_LOCK(stcb);
15372 		}
15373 		frag_point = sctp_get_frag_point(stcb, &stcb->asoc);
15374 		(void)sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
15375 		    &reason, 1, &cwnd_full, 1, &now, &now_filled, frag_point, SCTP_SO_LOCKED);
15376 	}
15377 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d err:%d\n",
15378 	    queue_only, stcb->asoc.peers_rwnd, un_sent,
15379 	    stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
15380 	    stcb->asoc.total_output_queue_size, error);
15381 
15382 out:
15383 out_unlocked:
15384 
15385 	if (local_soresv && stcb) {
15386 		atomic_subtract_int(&stcb->asoc.sb_send_resv, sndlen);
15387 		local_soresv = 0;
15388 	}
15389 	if (create_lock_applied) {
15390 		SCTP_ASOC_CREATE_UNLOCK(inp);
15391 		create_lock_applied = 0;
15392 	}
15393 	if ((stcb) && hold_tcblock) {
15394 		SCTP_TCB_UNLOCK(stcb);
15395 	}
15396 	if (stcb && free_cnt_applied) {
15397 		atomic_add_int(&stcb->asoc.refcnt, -1);
15398 	}
15399 #ifdef INVARIANTS
15400 	if (stcb) {
15401 		if (mtx_owned(&stcb->tcb_mtx)) {
15402 			panic("Leaving with tcb mtx owned?");
15403 		}
15404 		if (mtx_owned(&stcb->tcb_send_mtx)) {
15405 			panic("Leaving with tcb send mtx owned?");
15406 		}
15407 	}
15408 #endif
15409 	if (top) {
15410 		sctp_m_freem(top);
15411 	}
15412 	if (control) {
15413 		sctp_m_freem(control);
15414 	}
15415 	return (error);
15416 }
15417 
15418 
15419 /*
15420  * generate an AUTHentication chunk, if required
15421  */
15422 struct mbuf *
15423 sctp_add_auth_chunk(struct mbuf *m, struct mbuf **m_end,
15424     struct sctp_auth_chunk **auth_ret, uint32_t * offset,
15425     struct sctp_tcb *stcb, uint8_t chunk)
15426 {
15427 	struct mbuf *m_auth;
15428 	struct sctp_auth_chunk *auth;
15429 	int chunk_len;
15430 
15431 	if ((m_end == NULL) || (auth_ret == NULL) || (offset == NULL) ||
15432 	    (stcb == NULL))
15433 		return (m);
15434 
15435 	/* sysctl disabled auth? */
15436 	if (SCTP_BASE_SYSCTL(sctp_auth_disable))
15437 		return (m);
15438 
15439 	/* peer doesn't do auth... */
15440 	if (!stcb->asoc.peer_supports_auth) {
15441 		return (m);
15442 	}
15443 	/* does the requested chunk require auth? */
15444 	if (!sctp_auth_is_required_chunk(chunk, stcb->asoc.peer_auth_chunks)) {
15445 		return (m);
15446 	}
15447 	m_auth = sctp_get_mbuf_for_msg(sizeof(*auth), 0, M_DONTWAIT, 1, MT_HEADER);
15448 	if (m_auth == NULL) {
15449 		/* no mbuf's */
15450 		return (m);
15451 	}
15452 	/* reserve some space if this will be the first mbuf */
15453 	if (m == NULL)
15454 		SCTP_BUF_RESV_UF(m_auth, SCTP_MIN_OVERHEAD);
15455 	/* fill in the AUTH chunk details */
15456 	auth = mtod(m_auth, struct sctp_auth_chunk *);
15457 	bzero(auth, sizeof(*auth));
15458 	auth->ch.chunk_type = SCTP_AUTHENTICATION;
15459 	auth->ch.chunk_flags = 0;
15460 	chunk_len = sizeof(*auth) +
15461 	    sctp_get_hmac_digest_len(stcb->asoc.peer_hmac_id);
15462 	auth->ch.chunk_length = htons(chunk_len);
15463 	auth->hmac_id = htons(stcb->asoc.peer_hmac_id);
15464 	/* key id and hmac digest will be computed and filled in upon send */
15465 
15466 	/* save the offset where the auth was inserted into the chain */
15467 	if (m != NULL) {
15468 		struct mbuf *cn;
15469 
15470 		*offset = 0;
15471 		cn = m;
15472 		while (cn) {
15473 			*offset += SCTP_BUF_LEN(cn);
15474 			cn = SCTP_BUF_NEXT(cn);
15475 		}
15476 	} else
15477 		*offset = 0;
15478 
15479 	/* update length and return pointer to the auth chunk */
15480 	SCTP_BUF_LEN(m_auth) = chunk_len;
15481 	m = sctp_copy_mbufchain(m_auth, m, m_end, 1, chunk_len, 0);
15482 	if (auth_ret != NULL)
15483 		*auth_ret = auth;
15484 
15485 	return (m);
15486 }
15487 
15488 #ifdef INET6
15489 int
15490 sctp_v6src_match_nexthop(struct sockaddr_in6 *src6, sctp_route_t * ro)
15491 {
15492 	struct nd_prefix *pfx = NULL;
15493 	struct nd_pfxrouter *pfxrtr = NULL;
15494 	struct sockaddr_in6 gw6;
15495 
15496 	if (ro == NULL || ro->ro_rt == NULL || src6->sin6_family != AF_INET6)
15497 		return (0);
15498 
15499 	/* get prefix entry of address */
15500 	LIST_FOREACH(pfx, &MODULE_GLOBAL(MOD_INET6, nd_prefix), ndpr_entry) {
15501 		if (pfx->ndpr_stateflags & NDPRF_DETACHED)
15502 			continue;
15503 		if (IN6_ARE_MASKED_ADDR_EQUAL(&pfx->ndpr_prefix.sin6_addr,
15504 		    &src6->sin6_addr, &pfx->ndpr_mask))
15505 			break;
15506 	}
15507 	/* no prefix entry in the prefix list */
15508 	if (pfx == NULL) {
15509 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "No prefix entry for ");
15510 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6);
15511 		return (0);
15512 	}
15513 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "v6src_match_nexthop(), Prefix entry is ");
15514 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)src6);
15515 
15516 	/* search installed gateway from prefix entry */
15517 	for (pfxrtr = pfx->ndpr_advrtrs.lh_first; pfxrtr; pfxrtr =
15518 	    pfxrtr->pfr_next) {
15519 		memset(&gw6, 0, sizeof(struct sockaddr_in6));
15520 		gw6.sin6_family = AF_INET6;
15521 		gw6.sin6_len = sizeof(struct sockaddr_in6);
15522 		memcpy(&gw6.sin6_addr, &pfxrtr->router->rtaddr,
15523 		    sizeof(struct in6_addr));
15524 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "prefix router is ");
15525 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, (struct sockaddr *)&gw6);
15526 		SCTPDBG(SCTP_DEBUG_OUTPUT2, "installed router is ");
15527 		SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway);
15528 		if (sctp_cmpaddr((struct sockaddr *)&gw6,
15529 		    ro->ro_rt->rt_gateway)) {
15530 			SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is installed\n");
15531 			return (1);
15532 		}
15533 	}
15534 	SCTPDBG(SCTP_DEBUG_OUTPUT2, "pfxrouter is not installed\n");
15535 	return (0);
15536 }
15537 
15538 #endif
15539 
15540 int
15541 sctp_v4src_match_nexthop(struct sctp_ifa *sifa, sctp_route_t * ro)
15542 {
15543 	struct sockaddr_in *sin, *mask;
15544 	struct ifaddr *ifa;
15545 	struct in_addr srcnetaddr, gwnetaddr;
15546 
15547 	if (ro == NULL || ro->ro_rt == NULL ||
15548 	    sifa->address.sa.sa_family != AF_INET) {
15549 		return (0);
15550 	}
15551 	ifa = (struct ifaddr *)sifa->ifa;
15552 	mask = (struct sockaddr_in *)(ifa->ifa_netmask);
15553 	sin = (struct sockaddr_in *)&sifa->address.sin;
15554 	srcnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr);
15555 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: src address is ");
15556 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, &sifa->address.sa);
15557 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", srcnetaddr.s_addr);
15558 
15559 	sin = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
15560 	gwnetaddr.s_addr = (sin->sin_addr.s_addr & mask->sin_addr.s_addr);
15561 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "match_nexthop4: nexthop is ");
15562 	SCTPDBG_ADDR(SCTP_DEBUG_OUTPUT2, ro->ro_rt->rt_gateway);
15563 	SCTPDBG(SCTP_DEBUG_OUTPUT1, "network address is %x\n", gwnetaddr.s_addr);
15564 	if (srcnetaddr.s_addr == gwnetaddr.s_addr) {
15565 		return (1);
15566 	}
15567 	return (0);
15568 }
15569