/* $KAME: sctp_output.c,v 1.48 2005/06/16 18:29:24 jinmei Exp $ */

/* $NetBSD: sctp_output.c,v 1.39 2025/06/12 06:08:10 ozaki-r Exp $ */
/* $KAME: sctp_output.c,v 1.48 2005/06/16 18:29:24 jinmei Exp $ */

/*
* Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the project nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sctp_output.c,v 1.39 2025/06/12 06:08:10 ozaki-r Exp $");

#ifdef _KERNEL_OPT
#include "opt_ipsec.h"
#include "opt_inet.h"
#include "opt_sctp.h"
#endif /* _KERNEL_OPT */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/domain.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/socketvar.h>
#include <sys/proc.h>
#include <sys/kernel.h>
#include <sys/sysctl.h>
#include <sys/resourcevar.h>
#include <sys/uio.h>
#ifdef INET6
#include <sys/domain.h>
#endif

#include <machine/limits.h>
#include <machine/cpu.h>

#include <net/if.h>
#include <net/if_types.h>

#include <net/route.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/in_pcb.h>
#include <netinet/in_var.h>
#include <netinet/ip_var.h>

#ifdef INET6
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#include <netinet6/scope6_var.h>
#include <netinet6/nd6.h>

#include <netinet6/in6_pcb.h>

#include <netinet/icmp6.h>

#endif /* INET6 */

#if defined(HAVE_NRL_INPCB) || defined(__FreeBSD__)
#ifndef in6pcb
#define in6pcb inpcb
#endif
#endif

#include <netinet/sctp_pcb.h>

#ifdef IPSEC
#include <netipsec/ipsec.h>
#include <netipsec/key.h>
#endif /* IPSEC */

#include <netinet/sctp_var.h>
#include <netinet/sctp_header.h>
#include <netinet/sctputil.h>
#include <netinet/sctp_pcb.h>
#include <netinet/sctp_output.h>
#include <netinet/sctp_uio.h>
#include <netinet/sctputil.h>
#include <netinet/sctp_hashdriver.h>
#include <netinet/sctp_timer.h>
#include <netinet/sctp_asconf.h>
#include <netinet/sctp_indata.h>

#ifdef SCTP_DEBUG
extern uint32_t sctp_debug_on;
#endif

extern int sctp_peer_chunk_oh;

static int
sctp_find_cmsg(int c_type, void *data, struct mbuf *control, int cpsize)
{
struct cmsghdr cmh;
int tlen, at;

tlen = control->m_len;
at = 0;
/*
* Independent of how many mbufs, find the c_type inside the control
* structure and copy out the data.
*/
while (at < tlen) {
if ((tlen-at) < (int)CMSG_ALIGN(sizeof(cmh))) {
/* not enough room for one more we are done. */
return (0);
}
m_copydata(control, at, sizeof(cmh), (void *)&cmh);
if ((cmh.cmsg_len + at) > tlen) {
/*
* this is real messed up since there is not enough
* data here to cover the cmsg header. We are done.
*/
return (0);
}
if ((cmh.cmsg_level == IPPROTO_SCTP) &&
(c_type == cmh.cmsg_type)) {
/* found the one we want, copy it out */
at += CMSG_ALIGN(sizeof(struct cmsghdr));
if ((int)(cmh.cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr))) < cpsize) {
/*
* space of cmsg_len after header not
* big enough
*/
return (0);
}
m_copydata(control, at, cpsize, data);
return (1);
} else {
at += CMSG_ALIGN(cmh.cmsg_len);
if (cmh.cmsg_len == 0) {
break;
}
}
}
/* not found */
return (0);
}

static struct mbuf *
sctp_add_addr_to_mbuf(struct mbuf *m, struct ifaddr *ifa)
{
struct sctp_paramhdr *parmh;
struct mbuf *mret;
int len;
if (ifa->ifa_addr->sa_family == AF_INET) {
len = sizeof(struct sctp_ipv4addr_param);
} else if (ifa->ifa_addr->sa_family == AF_INET6) {
len = sizeof(struct sctp_ipv6addr_param);
} else {
/* unknown type */
return (m);
}

if (M_TRAILINGSPACE(m) >= len) {
/* easy side we just drop it on the end */
parmh = (struct sctp_paramhdr *)(m->m_data + m->m_len);
mret = m;
} else {
/* Need more space */
mret = m;
while (mret->m_next != NULL) {
mret = mret->m_next;
}
MGET(mret->m_next, M_DONTWAIT, MT_DATA);
if (mret->m_next == NULL) {
/* We are hosed, can't add more addresses */
return (m);
}
mret = mret->m_next;
parmh = mtod(mret, struct sctp_paramhdr *);
}
/* now add the parameter */
if (ifa->ifa_addr->sa_family == AF_INET) {
struct sctp_ipv4addr_param *ipv4p;
struct sockaddr_in *sin;
sin = (struct sockaddr_in *)ifa->ifa_addr;
ipv4p = (struct sctp_ipv4addr_param *)parmh;
parmh->param_type = htons(SCTP_IPV4_ADDRESS);
parmh->param_length = htons(len);
ipv4p->addr = sin->sin_addr.s_addr;
mret->m_len += len;
} else if (ifa->ifa_addr->sa_family == AF_INET6) {
struct sctp_ipv6addr_param *ipv6p;
struct sockaddr_in6 *sin6;
sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
ipv6p = (struct sctp_ipv6addr_param *)parmh;
parmh->param_type = htons(SCTP_IPV6_ADDRESS);
parmh->param_length = htons(len);
memcpy(ipv6p->addr, &sin6->sin6_addr,
sizeof(ipv6p->addr));
/* clear embedded scope in the address */
in6_clearscope((struct in6_addr *)ipv6p->addr);
mret->m_len += len;
} else {
return (m);
}
return (mret);
}

static struct mbuf *
sctp_add_cookie(struct sctp_inpcb *inp, struct mbuf *init, int init_offset,
struct mbuf *initack, int initack_offset, struct sctp_state_cookie *stc_in)
{
struct mbuf *copy_init, *copy_initack, *m_at, *sig, *mret;
struct sctp_state_cookie *stc;
struct sctp_paramhdr *ph;
uint8_t *signature;
int sig_offset;
uint16_t cookie_sz;

mret = NULL;

MGET(mret, M_DONTWAIT, MT_DATA);
if (mret == NULL) {
return (NULL);
}
copy_init = sctp_m_copym(init, init_offset, M_COPYALL, M_DONTWAIT);
if (copy_init == NULL) {
sctp_m_freem(mret);
return (NULL);
}
copy_initack = sctp_m_copym(initack, initack_offset, M_COPYALL,
M_DONTWAIT);
if (copy_initack == NULL) {
sctp_m_freem(mret);
sctp_m_freem(copy_init);
return (NULL);
}
/* easy side we just drop it on the end */
ph = mtod(mret, struct sctp_paramhdr *);
mret->m_len = sizeof(struct sctp_state_cookie) +
sizeof(struct sctp_paramhdr);
stc = (struct sctp_state_cookie *)((vaddr_t)ph +
sizeof(struct sctp_paramhdr));
ph->param_type = htons(SCTP_STATE_COOKIE);
ph->param_length = 0; /* fill in at the end */
/* Fill in the stc cookie data */
*stc = *stc_in;

/* tack the INIT and then the INIT-ACK onto the chain */
cookie_sz = 0;
m_at = mret;
for (m_at = mret; m_at; m_at = m_at->m_next) {
cookie_sz += m_at->m_len;
if (m_at->m_next == NULL) {
m_at->m_next = copy_init;
break;
}
}

for (m_at = copy_init; m_at; m_at = m_at->m_next) {
cookie_sz += m_at->m_len;
if (m_at->m_next == NULL) {
m_at->m_next = copy_initack;
break;
}
}

for (m_at = copy_initack; m_at; m_at = m_at->m_next) {
cookie_sz += m_at->m_len;
if (m_at->m_next == NULL) {
break;
}
}
MGET(sig, M_DONTWAIT, MT_DATA);
if (sig == NULL) {
/* no space */
sctp_m_freem(mret);
sctp_m_freem(copy_init);
sctp_m_freem(copy_initack);
return (NULL);
}
sig->m_len = 0;
m_at->m_next = sig;
sig_offset = 0;
signature = (uint8_t *)(mtod(sig, vaddr_t) + sig_offset);
/* Time to sign the cookie */
sctp_hash_digest_m((char *)inp->sctp_ep.secret_key[
(int)(inp->sctp_ep.current_secret_number)],
SCTP_SECRET_SIZE, mret, sizeof(struct sctp_paramhdr),
(uint8_t *)signature);
sig->m_len += SCTP_SIGNATURE_SIZE;
cookie_sz += SCTP_SIGNATURE_SIZE;

ph->param_length = htons(cookie_sz);
return (mret);
}

static struct sockaddr_in *
sctp_is_v4_ifa_addr_prefered (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
{
struct sockaddr_in *sin;
/*
* Here we determine if its a prefered address. A
* prefered address means it is the same scope or
* higher scope then the destination.
* L = loopback, P = private, G = global
* -----------------------------------------
* src | dest | result
*-----------------------------------------
* L | L | yes
*-----------------------------------------
* P | L | yes
*-----------------------------------------
* G | L | yes
*-----------------------------------------
* L | P | no
*-----------------------------------------
* P | P | yes
*-----------------------------------------
* G | P | no
*-----------------------------------------
* L | G | no
*-----------------------------------------
* P | G | no
*-----------------------------------------
* G | G | yes
*-----------------------------------------
*/

if (ifa->ifa_addr->sa_family != AF_INET) {
/* forget non-v4 */
return (NULL);
}
/* Ok the address may be ok */
sin = (struct sockaddr_in *)ifa->ifa_addr;
if (sin->sin_addr.s_addr == 0) {
return (NULL);
}
*sin_local = *sin_loop = 0;
if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
(IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
*sin_loop = 1;
*sin_local = 1;
}
if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
*sin_local = 1;
}
if (!loopscope && *sin_loop) {
/* Its a loopback address and we don't have loop scope */
return (NULL);
}
if (!ipv4_scope && *sin_local) {
/* Its a private address, and we don't have private address scope */
return (NULL);
}
if (((ipv4_scope == 0) && (loopscope == 0)) && (*sin_local)) {
/* its a global src and a private dest */
return (NULL);
}
/* its a prefered address */
return (sin);
}

static struct sockaddr_in *
sctp_is_v4_ifa_addr_acceptable (struct ifaddr *ifa, uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
{
struct sockaddr_in *sin;
/*
* Here we determine if its a acceptable address. A
* acceptable address means it is the same scope or
* higher scope but we can allow for NAT which means
* its ok to have a global dest and a private src.
*
* L = loopback, P = private, G = global
* -----------------------------------------
* src | dest | result
*-----------------------------------------
* L | L | yes
*-----------------------------------------
* P | L | yes
*-----------------------------------------
* G | L | yes
*-----------------------------------------
* L | P | no
*-----------------------------------------
* P | P | yes
*-----------------------------------------
* G | P | yes - probably this won't work.
*-----------------------------------------
* L | G | no
*-----------------------------------------
* P | G | yes
*-----------------------------------------
* G | G | yes
*-----------------------------------------
*/

if (ifa->ifa_addr->sa_family != AF_INET) {
/* forget non-v4 */
return (NULL);
}
/* Ok the address may be ok */
sin = (struct sockaddr_in *)ifa->ifa_addr;
if (sin->sin_addr.s_addr == 0) {
return (NULL);
}
*sin_local = *sin_loop = 0;
if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
(IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
*sin_loop = 1;
*sin_local = 1;
}
if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
*sin_local = 1;
}
if (!loopscope && *sin_loop) {
/* Its a loopback address and we don't have loop scope */
return (NULL);
}
/* its an acceptable address */
return (sin);
}

/*
* This treats the address list on the ep as a restricted list
* (negative list). If a the passed address is listed, then
* the address is NOT allowed on the association.
*/
int
sctp_is_addr_restricted(struct sctp_tcb *stcb, struct sockaddr *addr)
{
struct sctp_laddr *laddr;
#ifdef SCTP_DEBUG
int cnt=0;
#endif
if (stcb == NULL) {
/* There are no restrictions, no TCB :-) */
return (0);
}
#ifdef SCTP_DEBUG
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
cnt++;
}
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("There are %d addresses on the restricted list\n", cnt);
}
cnt = 0;
#endif
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
if (laddr->ifa == NULL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Help I have fallen and I can't get up!\n");
}
#endif
continue;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
cnt++;
printf("Restricted address[%d]:", cnt);
sctp_print_address(laddr->ifa->ifa_addr);
}
#endif
if (sctp_cmpaddr(addr, laddr->ifa->ifa_addr) == 1) {
/* Yes it is on the list */
return (1);
}
}
return (0);
}

static int
sctp_is_addr_in_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
{
struct sctp_laddr *laddr;

if (ifa == NULL)
return (0);
LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
if (laddr->ifa == NULL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Help I have fallen and I can't get up!\n");
}
#endif
continue;
}
if (laddr->ifa->ifa_addr == NULL)
continue;
if (laddr->ifa == ifa)
/* same pointer */
return (1);
if (laddr->ifa->ifa_addr->sa_family != ifa->ifa_addr->sa_family) {
/* skip non compatible address comparison */
continue;
}
if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
/* Yes it is restricted */
return (1);
}
}
return (0);
}

static struct in_addr
sctp_choose_v4_boundspecific_inp(struct sctp_inpcb *inp,
struct rtentry *rt,
uint8_t ipv4_scope,
uint8_t loopscope)
{
struct in_addr ans;
struct sctp_laddr *laddr;
struct sockaddr_in *sin;
struct ifnet *ifn;
struct ifaddr *ifa;
uint8_t sin_loop, sin_local;

/* first question, is the ifn we will emit on
* in our list, if so, we want that one.
*/
ifn = rt->rt_ifp;
if (ifn) {
/* is a prefered one on the interface we route out? */
IFADDR_READER_FOREACH(ifa, ifn) {
sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if (sctp_is_addr_in_ep(inp, ifa)) {
return (sin->sin_addr);
}
}
/* is an acceptable one on the interface we route out? */
IFADDR_READER_FOREACH(ifa, ifn) {
sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if (sctp_is_addr_in_ep(inp, ifa)) {
return (sin->sin_addr);
}
}
}
/* ok, what about a prefered address in the inp */
for (laddr = LIST_FIRST(&inp->sctp_addr_list);
laddr && (laddr != inp->next_addr_touse);
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
return (sin->sin_addr);

}
/* ok, what about an acceptable address in the inp */
for (laddr = LIST_FIRST(&inp->sctp_addr_list);
laddr && (laddr != inp->next_addr_touse);
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
return (sin->sin_addr);

}

/* no address bound can be a source for the destination we are in trouble */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Src address selection for EP, no acceptable src address found for address\n");
}
#endif
memset(&ans, 0, sizeof(ans));
return (ans);
}

static struct in_addr
sctp_choose_v4_boundspecific_stcb(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_nets *net,
struct rtentry *rt,
uint8_t ipv4_scope,
uint8_t loopscope,
int non_asoc_addr_ok)
{
/*
* Here we have two cases, bound all asconf
* allowed. bound all asconf not allowed.
*
*/
struct sctp_laddr *laddr, *starting_point;
struct in_addr ans;
struct ifnet *ifn;
struct ifaddr *ifa;
uint8_t sin_loop, sin_local, start_at_beginning=0;
struct sockaddr_in *sin;

/* first question, is the ifn we will emit on
* in our list, if so, we want that one.
*/
ifn = rt->rt_ifp;

if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
/*
* Here we use the list of addresses on the endpoint. Then
* the addresses listed on the "restricted" list is just that,
* address that have not been added and can't be used (unless
* the non_asoc_addr_ok is set).
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
}
#endif
/* first question, is the ifn we will emit on
* in our list, if so, we want that one.
*/
if (ifn) {
/* first try for a preferred address on the ep */
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_addr_in_ep(inp, ifa)) {
sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if ((non_asoc_addr_ok == 0) &&
(sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
/* on the no-no list */
continue;
}
return (sin->sin_addr);
}
}
/* next try for an acceptable address on the ep */
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_addr_in_ep(inp, ifa)) {
sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if ((non_asoc_addr_ok == 0) &&
(sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
/* on the no-no list */
continue;
}
return (sin->sin_addr);
}
}

}
/* if we can't find one like that then we must
* look at all addresses bound to pick one at
* first prefereable then secondly acceptable.
*/
starting_point = stcb->asoc.last_used_address;
sctpv4_from_the_top:
if (stcb->asoc.last_used_address == NULL) {
start_at_beginning=1;
stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
}
/* search beginning with the last used address */
for (laddr = stcb->asoc.last_used_address; laddr;
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if ((non_asoc_addr_ok == 0) &&
(sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
/* on the no-no list */
continue;
}
return (sin->sin_addr);

}
if (start_at_beginning == 0) {
stcb->asoc.last_used_address = NULL;
goto sctpv4_from_the_top;
}
/* now try for any higher scope than the destination */
stcb->asoc.last_used_address = starting_point;
start_at_beginning = 0;
sctpv4_from_the_top2:
if (stcb->asoc.last_used_address == NULL) {
start_at_beginning=1;
stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
}
/* search beginning with the last used address */
for (laddr = stcb->asoc.last_used_address; laddr;
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if ((non_asoc_addr_ok == 0) &&
(sctp_is_addr_restricted(stcb, (struct sockaddr *)sin))) {
/* on the no-no list */
continue;
}
return (sin->sin_addr);
}
if (start_at_beginning == 0) {
stcb->asoc.last_used_address = NULL;
goto sctpv4_from_the_top2;
}
} else {
/*
* Here we have an address list on the association, thats the
* only valid source addresses that we can use.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
}
#endif
/* First look at all addresses for one that is on
* the interface we route out
*/
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
/* first question, is laddr->ifa an address associated with the emit interface */
if (ifn) {
IFADDR_READER_FOREACH(ifa, ifn) {
if (laddr->ifa == ifa) {
sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
return (sin->sin_addr);
}
if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
return (sin->sin_addr);
}
}
}
}
/* what about an acceptable one on the interface? */
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
/* first question, is laddr->ifa an address associated with the emit interface */
if (ifn) {
IFADDR_READER_FOREACH(ifa, ifn) {
if (laddr->ifa == ifa) {
sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
return (sin->sin_addr);
}
if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
sin = (struct sockaddr_in *)laddr->ifa->ifa_addr;
return (sin->sin_addr);
}
}
}
}
/* ok, next one that is preferable in general */
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_prefered (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
return (sin->sin_addr);
}

/* last, what about one that is acceptable */
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin = sctp_is_v4_ifa_addr_acceptable (laddr->ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
return (sin->sin_addr);
}
}
memset(&ans, 0, sizeof(ans));
return (ans);
}

static struct sockaddr_in *
sctp_select_v4_nth_prefered_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
uint8_t loopscope, uint8_t ipv4_scope, int cur_addr_num)
{
struct ifaddr *ifa;
struct sockaddr_in *sin;
uint8_t sin_loop, sin_local;
int num_eligible_addr = 0;
IFADDR_READER_FOREACH(ifa, ifn) {
sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if (stcb) {
if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
/* It is restricted for some reason.. probably
* not yet added.
*/
continue;
}
}
if (cur_addr_num == num_eligible_addr) {
return (sin);
}
}
return (NULL);
}

static int
sctp_count_v4_num_prefered_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok,
uint8_t loopscope, uint8_t ipv4_scope, uint8_t *sin_loop, uint8_t *sin_local)
{
struct ifaddr *ifa;
struct sockaddr_in *sin;
int num_eligible_addr = 0;

IFADDR_READER_FOREACH(ifa, ifn) {
sin = sctp_is_v4_ifa_addr_prefered (ifa, loopscope, ipv4_scope, sin_loop, sin_local);
if (sin == NULL)
continue;
if (stcb) {
if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
/* It is restricted for some reason.. probably
* not yet added.
*/
continue;
}
}
num_eligible_addr++;
}
return (num_eligible_addr);

}

static struct in_addr
sctp_choose_v4_boundall(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_nets *net,
struct rtentry *rt,
uint8_t ipv4_scope,
uint8_t loopscope,
int non_asoc_addr_ok)
{
int cur_addr_num=0, num_prefered=0;
uint8_t sin_loop, sin_local;
struct ifnet *ifn;
struct sockaddr_in *sin;
struct in_addr ans;
struct ifaddr *ifa;
int s;
/*
* For v4 we can use (in boundall) any address in the association. If
* non_asoc_addr_ok is set we can use any address (at least in theory).
* So we look for prefered addresses first. If we find one, we use it.
* Otherwise we next try to get an address on the interface, which we
* should be able to do (unless non_asoc_addr_ok is false and we are
* routed out that way). In these cases where we can't use the address
* of the interface we go through all the ifn's looking for an address
* we can use and fill that in. Punting means we send back address
* 0, which will probably cause problems actually since then IP will
* fill in the address of the route ifn, which means we probably already
* rejected it.. i.e. here comes an abort :-<.
*/
ifn = rt->rt_ifp;
if (net) {
cur_addr_num = net->indx_of_eligible_next_to_use;
}
if (ifn == NULL) {
goto bound_all_v4_plan_c;
}
num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, ipv4_scope, &sin_loop, &sin_local);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Found %d prefered source addresses\n", num_prefered);
}
#endif
if (num_prefered == 0) {
/* no eligible addresses, we must use some other
* interface address if we can find one.
*/
goto bound_all_v4_plan_b;
}
/* Ok we have num_eligible_addr set with how many we can use,
* this may vary from call to call due to addresses being deprecated etc..
*/
if (cur_addr_num >= num_prefered) {
cur_addr_num = 0;
}
/* select the nth address from the list (where cur_addr_num is the nth) and
* 0 is the first one, 1 is the second one etc...
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("cur_addr_num:%d\n", cur_addr_num);
}
#endif
sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
ipv4_scope, cur_addr_num);

/* if sin is NULL something changed??, plan_a now */
if (sin) {
return (sin->sin_addr);
}

/*
* plan_b: Look at the interface that we emit on
* and see if we can find an acceptable address.
*/
bound_all_v4_plan_b:
IFADDR_READER_FOREACH(ifa, ifn) {
sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if (stcb) {
if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
/* It is restricted for some reason.. probably
* not yet added.
*/
continue;
}
}
return (sin->sin_addr);
}
/*
* plan_c: Look at all interfaces and find a prefered
* address. If we reache here we are in trouble I think.
*/
bound_all_v4_plan_c:
s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if (ifn == inp->next_ifn_touse)
break;
if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
/* wrong base scope */
continue;
}
if (ifn == rt->rt_ifp)
/* already looked at this guy */
continue;
num_prefered = sctp_count_v4_num_prefered_boundall (ifn, stcb, non_asoc_addr_ok,
loopscope, ipv4_scope, &sin_loop, &sin_local);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Found ifn:%p %d prefered source addresses\n", ifn, num_prefered);
}
#endif
if (num_prefered == 0) {
/*
* None on this interface.
*/
continue;
}
/* Ok we have num_eligible_addr set with how many we can use,
* this may vary from call to call due to addresses being deprecated etc..
*/
if (cur_addr_num >= num_prefered) {
cur_addr_num = 0;
}
sin = sctp_select_v4_nth_prefered_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
ipv4_scope, cur_addr_num);
if (sin == NULL)
continue;
pserialize_read_exit(s);
return (sin->sin_addr);

}
pserialize_read_exit(s);

/*
* plan_d: We are in deep trouble. No prefered address on
* any interface. And the emit interface does not
* even have an acceptable address. Take anything
* we can get! If this does not work we are
* probably going to emit a packet that will
* illicit an ABORT, falling through.
*/

s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if (ifn == inp->next_ifn_touse)
break;
if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
/* wrong base scope */
continue;
}
if (ifn == rt->rt_ifp)
/* already looked at this guy */
continue;

IFADDR_READER_FOREACH(ifa, ifn) {
sin = sctp_is_v4_ifa_addr_acceptable (ifa, loopscope, ipv4_scope, &sin_loop, &sin_local);
if (sin == NULL)
continue;
if (stcb) {
if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin)) {
/* It is restricted for some reason.. probably
* not yet added.
*/
continue;
}
}
pserialize_read_exit(s);
return (sin->sin_addr);
}
}
pserialize_read_exit(s);
/*
* Ok we can find NO address to source from that is
* not on our negative list. It is either the special
* ASCONF case where we are sourceing from a intf that
* has been ifconfig'd to a different address (i.e.
* it holds a ADD/DEL/SET-PRIM and the proper lookup
* address. OR we are hosed, and this baby is going
* to abort the association.
*/
if (non_asoc_addr_ok) {
return (((struct sockaddr_in *)(rt->rt_ifa->ifa_addr))->sin_addr);
} else {
memset(&ans, 0, sizeof(ans));
return (ans);
}
}

/* tcb may be NULL */
struct in_addr
sctp_ipv4_source_address_selection(struct sctp_inpcb *inp,
struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
int non_asoc_addr_ok)
{
struct in_addr ans;
const struct sockaddr_in *to;
struct rtentry *rt;
uint8_t ipv4_scope, loopscope;

/*
* Rules:
* - Find the route if needed, cache if I can.
* - Look at interface address in route, Is it
* in the bound list. If so we have the best source.
* - If not we must rotate amongst the addresses.
*
* Cavets and issues
*
* Do we need to pay attention to scope. We can have
* a private address or a global address we are sourcing
* or sending to. So if we draw it out
* source * dest * result
* ------------------------------------------
* a Private * Global * NAT?
* ------------------------------------------
* b Private * Private * No problem
* ------------------------------------------
* c Global * Private * Huh, How will this work?
* ------------------------------------------
* d Global * Global * No Problem
* ------------------------------------------
*
* And then we add to that what happens if there are multiple
* addresses assigned to an interface. Remember the ifa on a
* ifn is a linked list of addresses. So one interface can
* have more than one IPv4 address. What happens if we
* have both a private and a global address? Do we then
* use context of destination to sort out which one is
* best? And what about NAT's sending P->G may get you
* a NAT translation, or should you select the G thats
* on the interface in preference.
*
* Decisions:
*
* - count the number of addresses on the interface.
* - if its one, no problem except case <c>. For <a>
* we will assume a NAT out there.
* - if there are more than one, then we need to worry
* about scope P or G. We should prefer G -> G and
* P -> P if possible. Then as a secondary fall back
* to mixed types G->P being a last ditch one.
* - The above all works for bound all, but bound
* specific we need to use the same concept but instead
* only consider the bound addresses. If the bound set
* is NOT assigned to the interface then we must use
* rotation amongst them.
*
* Notes: For v4, we can always punt and let ip_output
* decide by sending back a source of 0.0.0.0
*/

/*
* Need a route to cache.
*
*/
rt = rtcache_validate(ro);
if (rt == NULL) {
/* No route to host .. punt */
memset(&ans, 0, sizeof(ans));
return (ans);
} else {
to = satocsin(rtcache_getdst(ro));
}
/* Setup our scopes */
if (stcb) {
ipv4_scope = stcb->asoc.ipv4_local_scope;
loopscope = stcb->asoc.loopback_scope;
} else {
/* Scope based on outbound address */
if ((IN4_ISPRIVATE_ADDRESS(&to->sin_addr))) {
ipv4_scope = 1;
loopscope = 0;
} else if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
ipv4_scope = 1;
loopscope = 1;
} else {
ipv4_scope = 0;
loopscope = 0;
}
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Scope setup loop:%d ipv4_scope:%d\n",
loopscope, ipv4_scope);
}
#endif
if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
/*
* When bound to all if the address list is set
* it is a negative list. Addresses being added
* by asconf.
*/
ans = sctp_choose_v4_boundall(inp, stcb, net, rt,
ipv4_scope, loopscope, non_asoc_addr_ok);
goto out;
}
/*
* Three possiblities here:
*
* a) stcb is NULL, which means we operate only from
* the list of addresses (ifa's) bound to the assoc and
* we care not about the list.
* b) stcb is NOT-NULL, which means we have an assoc structure and
* auto-asconf is on. This means that the list of addresses is
* a NOT list. We use the list from the inp, but any listed address
* in our list is NOT yet added. However if the non_asoc_addr_ok is
* set we CAN use an address NOT available (i.e. being added). Its
* a negative list.
* c) stcb is NOT-NULL, which means we have an assoc structure and
* auto-asconf is off. This means that the list of addresses is
* the ONLY addresses I can use.. its positive.
*
* Note we collapse b & c into the same function just like in
* the v6 address selection.
*/
if (stcb) {
ans = sctp_choose_v4_boundspecific_stcb(inp, stcb, net,
rt, ipv4_scope, loopscope, non_asoc_addr_ok);
goto out;
} else {
ans = sctp_choose_v4_boundspecific_inp(inp, rt,
ipv4_scope, loopscope);
goto out;
}
/* this should not be reached */
memset(&ans, 0, sizeof(ans));
out:
rtcache_unref(rt, ro);
return ans;
}

static struct sockaddr_in6 *
sctp_is_v6_ifa_addr_acceptable (struct ifaddr *ifa, int loopscope, int loc_scope, int *sin_loop, int *sin_local)
{
struct in6_ifaddr *ifa6;
struct sockaddr_in6 *sin6;

if (ifa->ifa_addr->sa_family != AF_INET6) {
/* forget non-v6 */
return (NULL);
}
ifa6 = (struct in6_ifaddr *)ifa;
/* ok to use deprecated addresses? */
if (!ip6_use_deprecated) {
if (IFA6_IS_DEPRECATED(ifa6)) {
/* can't use this type */
return (NULL);
}
}
/* are we ok, with the current state of this address? */
if (ifa6->ia6_flags &
(IN6_IFF_DETACHED | IN6_IFF_NOTREADY | IN6_IFF_ANYCAST)) {
/* Can't use these types */
return (NULL);
}
/* Ok the address may be ok */
sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
*sin_local = *sin_loop = 0;
if ((ifa->ifa_ifp->if_type == IFT_LOOP) ||
(IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
*sin_loop = 1;
}
if (!loopscope && *sin_loop) {
/* Its a loopback address and we don't have loop scope */
return (NULL);
}
if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
/* we skip unspecified addresses */
return (NULL);
}

if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
*sin_local = 1;
}
if (!loc_scope && *sin_local) {
/* Its a link local address, and we don't have link local scope */
return (NULL);
}
return (sin6);
}

static struct sockaddr_in6 *
sctp_choose_v6_boundspecific_stcb(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_nets *net,
struct rtentry *rt,
uint8_t loc_scope,
uint8_t loopscope,
int non_asoc_addr_ok)
{
/*
* Each endpoint has a list of local addresses associated
* with it. The address list is either a "negative list" i.e.
* those addresses that are NOT allowed to be used as a source OR
* a "positive list" i.e. those addresses that CAN be used.
*
* Its a negative list if asconf is allowed. What we do
* in this case is use the ep address list BUT we have
* to cross check it against the negative list.
*
* In the case where NO asconf is allowed, we have just
* a straight association level list that we must use to
* find a source address.
*/
struct sctp_laddr *laddr, *starting_point;
struct sockaddr_in6 *sin6;
int sin_loop, sin_local;
int start_at_beginning=0;
struct ifnet *ifn;
struct ifaddr *ifa;

ifn = rt->rt_ifp;
if (inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Have a STCB - asconf allowed, not bound all have a netgative list\n");
}
#endif
/* first question, is the ifn we will emit on
* in our list, if so, we want that one.
*/
if (ifn) {
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_addr_in_ep(inp, ifa)) {
sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
if ((non_asoc_addr_ok == 0) &&
(sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
/* on the no-no list */
continue;
}
return (sin6);
}
}
}
starting_point = stcb->asoc.last_used_address;
/* First try for matching scope */
sctp_from_the_top:
if (stcb->asoc.last_used_address == NULL) {
start_at_beginning=1;
stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
}
/* search beginning with the last used address */
for (laddr = stcb->asoc.last_used_address; laddr;
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
/* on the no-no list */
continue;
}
/* is it of matching scope ? */
if ((loopscope == 0) &&
(loc_scope == 0) &&
(sin_loop == 0) &&
(sin_local == 0)) {
/* all of global scope we are ok with it */
return (sin6);
}
if (loopscope && sin_loop)
/* both on the loopback, thats ok */
return (sin6);
if (loc_scope && sin_local)
/* both local scope */
return (sin6);

}
if (start_at_beginning == 0) {
stcb->asoc.last_used_address = NULL;
goto sctp_from_the_top;
}
/* now try for any higher scope than the destination */
stcb->asoc.last_used_address = starting_point;
start_at_beginning = 0;
sctp_from_the_top2:
if (stcb->asoc.last_used_address == NULL) {
start_at_beginning=1;
stcb->asoc.last_used_address = LIST_FIRST(&inp->sctp_addr_list);
}
/* search beginning with the last used address */
for (laddr = stcb->asoc.last_used_address; laddr;
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
if ((non_asoc_addr_ok == 0) && (sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6))) {
/* on the no-no list */
continue;
}
return (sin6);
}
if (start_at_beginning == 0) {
stcb->asoc.last_used_address = NULL;
goto sctp_from_the_top2;
}
} else {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Have a STCB - no asconf allowed, not bound all have a positive list\n");
}
#endif
/* First try for interface output match */
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
/* first question, is laddr->ifa an address associated with the emit interface */
if (ifn) {
IFADDR_READER_FOREACH(ifa, ifn) {
if (laddr->ifa == ifa) {
sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
return (sin6);
}
if (sctp_cmpaddr(ifa->ifa_addr, laddr->ifa->ifa_addr) == 1) {
sin6 = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
return (sin6);
}
}
}
}
/* Next try for matching scope */
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;

if ((loopscope == 0) &&
(loc_scope == 0) &&
(sin_loop == 0) &&
(sin_local == 0)) {
/* all of global scope we are ok with it */
return (sin6);
}
if (loopscope && sin_loop)
/* both on the loopback, thats ok */
return (sin6);
if (loc_scope && sin_local)
/* both local scope */
return (sin6);
}
/* ok, now try for a higher scope in the source address */
/* First try for matching scope */
LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list,
sctp_nxt_addr) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
return (sin6);
}
}
return (NULL);
}

static struct sockaddr_in6 *
sctp_choose_v6_boundspecific_inp(struct sctp_inpcb *inp,
struct rtentry *rt,
uint8_t loc_scope,
uint8_t loopscope)
{
/*
* Here we are bound specific and have only
* an inp. We must find an address that is bound
* that we can give out as a src address. We
* prefer two addresses of same scope if we can
* find them that way.
*/
struct sctp_laddr *laddr;
struct sockaddr_in6 *sin6;
struct ifnet *ifn;
struct ifaddr *ifa;
int sin_loop, sin_local;

/* first question, is the ifn we will emit on
* in our list, if so, we want that one.
*/

ifn = rt->rt_ifp;
if (ifn) {
IFADDR_READER_FOREACH(ifa, ifn) {
sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
if (sctp_is_addr_in_ep(inp, ifa)) {
return (sin6);
}
}
}
for (laddr = LIST_FIRST(&inp->sctp_addr_list);
laddr && (laddr != inp->next_addr_touse);
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;

if ((loopscope == 0) &&
(loc_scope == 0) &&
(sin_loop == 0) &&
(sin_local == 0)) {
/* all of global scope we are ok with it */
return (sin6);
}
if (loopscope && sin_loop)
/* both on the loopback, thats ok */
return (sin6);
if (loc_scope && sin_local)
/* both local scope */
return (sin6);

}
/* if we reach here, we could not find two addresses
* of the same scope to give out. Lets look for any higher level
* scope for a source address.
*/
for (laddr = LIST_FIRST(&inp->sctp_addr_list);
laddr && (laddr != inp->next_addr_touse);
laddr = LIST_NEXT(laddr, sctp_nxt_addr)) {
if (laddr->ifa == NULL) {
/* address has been removed */
continue;
}
sin6 = sctp_is_v6_ifa_addr_acceptable (laddr->ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
return (sin6);
}
/* no address bound can be a source for the destination */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Src address selection for EP, no acceptable src address found for address\n");
}
#endif
return (NULL);
}

static struct sockaddr_in6 *
sctp_select_v6_nth_addr_from_ifn_boundall (struct ifnet *ifn, struct sctp_tcb *stcb, int non_asoc_addr_ok, uint8_t loopscope,
uint8_t loc_scope, int cur_addr_num, int match_scope)
{
struct ifaddr *ifa;
struct sockaddr_in6 *sin6;
int sin_loop, sin_local;
int num_eligible_addr = 0;

IFADDR_READER_FOREACH(ifa, ifn) {
sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
if (stcb) {
if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
/* It is restricted for some reason.. probably
* not yet added.
*/
continue;
}
}
if (match_scope) {
/* Here we are asked to match scope if possible */
if (loopscope && sin_loop)
/* src and destination are loopback scope */
return (sin6);
if (loc_scope && sin_local)
/* src and destination are local scope */
return (sin6);
if ((loopscope == 0) &&
(loc_scope == 0) &&
(sin_loop == 0) &&
(sin_local == 0)) {
/* src and destination are global scope */
return (sin6);
}
continue;
}
if (num_eligible_addr == cur_addr_num) {
/* this is it */
return (sin6);
}
num_eligible_addr++;
}
return (NULL);
}

static int
sctp_count_v6_num_eligible_boundall (struct ifnet *ifn, struct sctp_tcb *stcb,
int non_asoc_addr_ok, uint8_t loopscope, uint8_t loc_scope)
{
struct ifaddr *ifa;
struct sockaddr_in6 *sin6;
int num_eligible_addr = 0;
int sin_loop, sin_local;

IFADDR_READER_FOREACH(ifa, ifn) {
sin6 = sctp_is_v6_ifa_addr_acceptable (ifa, loopscope, loc_scope, &sin_loop, &sin_local);
if (sin6 == NULL)
continue;
if (stcb) {
if ((non_asoc_addr_ok == 0) && sctp_is_addr_restricted(stcb, (struct sockaddr *)sin6)) {
/* It is restricted for some reason.. probably
* not yet added.
*/
continue;
}
}
num_eligible_addr++;
}
return (num_eligible_addr);
}

static struct sockaddr_in6 *
sctp_choose_v6_boundall(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_nets *net,
struct rtentry *rt,
uint8_t loc_scope,
uint8_t loopscope,
int non_asoc_addr_ok)
{
/* Ok, we are bound all SO any address
* is ok to use as long as it is NOT in the negative
* list.
*/
int num_eligible_addr;
int cur_addr_num=0;
int started_at_beginning=0;
int match_scope_prefered;
/* first question is, how many eligible addresses are
* there for the destination ifn that we are using that
* are within the proper scope?
*/
struct ifnet *ifn;
struct sockaddr_in6 *sin6;
int s;

ifn = rt->rt_ifp;
if (net) {
cur_addr_num = net->indx_of_eligible_next_to_use;
}
if (cur_addr_num == 0) {
match_scope_prefered = 1;
} else {
match_scope_prefered = 0;
}
num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Found %d eligible source addresses\n", num_eligible_addr);
}
#endif
if (num_eligible_addr == 0) {
/* no eligible addresses, we must use some other
* interface address if we can find one.
*/
goto bound_all_v6_plan_b;
}
/* Ok we have num_eligible_addr set with how many we can use,
* this may vary from call to call due to addresses being deprecated etc..
*/
if (cur_addr_num >= num_eligible_addr) {
cur_addr_num = 0;
}
/* select the nth address from the list (where cur_addr_num is the nth) and
* 0 is the first one, 1 is the second one etc...
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("cur_addr_num:%d match_scope_prefered:%d select it\n",
cur_addr_num, match_scope_prefered);
}
#endif
sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
loc_scope, cur_addr_num, match_scope_prefered);
if (match_scope_prefered && (sin6 == NULL)) {
/* retry without the preference for matching scope */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("retry with no match_scope_prefered\n");
}
#endif
sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope,
loc_scope, cur_addr_num, 0);
}
if (sin6) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Selected address %d ifn:%p for the route\n", cur_addr_num, ifn);
}
#endif
if (net) {
/* store so we get the next one */
if (cur_addr_num < 255)
net->indx_of_eligible_next_to_use = cur_addr_num + 1;
else
net->indx_of_eligible_next_to_use = 0;
}
return (sin6);
}
num_eligible_addr = 0;
bound_all_v6_plan_b:
/* ok, if we reach here we either fell through
* due to something changing during an interrupt (unlikely)
* or we have NO eligible source addresses for the ifn
* of the route (most likely). We must look at all the other
* interfaces EXCEPT rt->rt_ifp and do the same game.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("bound-all Plan B\n");
}
#endif
if (inp->next_ifn_touse == NULL) {
started_at_beginning=1;
inp->next_ifn_touse = IFNET_READER_FIRST();
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Start at first IFN:%p\n", inp->next_ifn_touse);
}
#endif
} else {
inp->next_ifn_touse = IFNET_READER_NEXT(inp->next_ifn_touse);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Resume at IFN:%p\n", inp->next_ifn_touse);
}
#endif
if (inp->next_ifn_touse == NULL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("IFN Resets\n");
}
#endif
started_at_beginning=1;
inp->next_ifn_touse = IFNET_READER_FIRST();
}
}

s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if (loopscope == 0 && ifn->if_type == IFT_LOOP) {
/* wrong base scope */
continue;
}
if (loc_scope && (ifn->if_index != loc_scope)) {
/* by definition the scope (from to->sin6_scopeid)
* must match that of the interface. If not then
* we could pick a wrong scope for the address.
* Usually we don't hit plan-b since the route
* handles this. However we can hit plan-b when
* we send to local-host so the route is the
* loopback interface, but the destination is a
* link local.
*/
continue;
}
if (ifn == rt->rt_ifp) {
/* already looked at this guy */
continue;
}
/* Address rotation will only work when we are not
* rotating sourced interfaces and are using the interface
* of the route. We would need to have a per interface index
* in order to do proper rotation.
*/
num_eligible_addr = sctp_count_v6_num_eligible_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("IFN:%p has %d eligible\n", ifn, num_eligible_addr);
}
#endif
if (num_eligible_addr == 0) {
/* none we can use */
continue;
}
/* Ok we have num_eligible_addr set with how many we can use,
* this may vary from call to call due to addresses being deprecated etc..
*/
inp->next_ifn_touse = ifn;

/* select the first one we can find with perference for matching scope.
*/
sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 1);
if (sin6 == NULL) {
/* can't find one with matching scope how about a source with higher
* scope
*/
sin6 = sctp_select_v6_nth_addr_from_ifn_boundall (ifn, stcb, non_asoc_addr_ok, loopscope, loc_scope, 0, 0);
if (sin6 == NULL)
/* Hmm, can't find one in the interface now */
continue;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Selected the %d'th address of ifn:%p\n",
cur_addr_num, ifn);
}
#endif
pserialize_read_exit(s);
return (sin6);
}
pserialize_read_exit(s);

if (started_at_beginning == 0) {
/* we have not been through all of them yet, force
* us to go through them all.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Force a recycle\n");
}
#endif
inp->next_ifn_touse = NULL;
goto bound_all_v6_plan_b;
}
return (NULL);

}

/* stcb and net may be NULL */
struct in6_addr
sctp_ipv6_source_address_selection(struct sctp_inpcb *inp,
struct sctp_tcb *stcb, struct route *ro, struct sctp_nets *net,
int non_asoc_addr_ok)
{
struct in6_addr ans;
struct sockaddr_in6 *rt_addr;
uint8_t loc_scope, loopscope;
struct sockaddr_in6 to;
struct rtentry *rt;

/*
* This routine is tricky standard v6 src address
* selection cannot take into account what we have
* bound etc, so we can't use it.
*
* Instead here is what we must do:
* 1) Make sure we have a route, if we
* don't have a route we can never reach the peer.
* 2) Once we have a route, determine the scope of the
* route. Link local, loopback or global.
* 3) Next we divide into three types. Either we
* are bound all.. which means we want to use
* one of the addresses of the interface we are
* going out. <or>
* 4a) We have not stcb, which means we are using the
* specific addresses bound on an inp, in this
* case we are similar to the stcb case (4b below)
* accept the list is always a positive list.<or>
* 4b) We are bound specific with a stcb, which means we have a
* list of bound addresses and we must see if the
* ifn of the route is actually one of the bound addresses.
* If not, then we must rotate addresses amongst properly
* scoped bound addresses, if so we use the address
* of the interface.
* 5) Always, no matter which path we take through the above
* we must be sure the source address we use is allowed to
* be used. I.e. IN6_IFF_DETACHED, IN6_IFF_NOTREADY, and IN6_IFF_ANYCAST
* addresses cannot be used.
* 6) Addresses that are deprecated MAY be used
* if (!ip6_use_deprecated) {
* if (IFA6_IS_DEPRECATED(ifa6)) {
* skip the address
* }
* }
*/

/*** 1> determine route, if not already done */
rt = rtcache_validate(ro);
if (rt == NULL) {
/*
* Need a route to cache.
*/
int scope_save;

memcpy(&to, rtcache_getdst(ro), sizeof(struct sockaddr));
scope_save = to.sin6_scope_id;
to.sin6_scope_id = 0;

rt = rtcache_lookup(ro, (struct sockaddr *)&to);
to.sin6_scope_id = scope_save;
}
if (rt == NULL) {
/*
* no route to host. this packet is going no-where.
* We probably should make sure we arrange to send back
* an error.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("No route to host, this packet cannot be sent!\n");
}
#endif
memset(&ans, 0, sizeof(ans));
return (ans);
}

/*** 2a> determine scope for outbound address/route */
loc_scope = loopscope = 0;
/*
* We base our scope on the outbound packet scope and route,
* NOT the TCB (if there is one). This way in local scope we will only
* use a local scope src address when we send to a local address.
*/

if (IN6_IS_ADDR_LOOPBACK(&to.sin6_addr)) {
/* If the route goes to the loopback address OR
* the address is a loopback address, we are loopback
* scope.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Loopback scope is set\n");
}
#endif
loc_scope = 0;
loopscope = 1;
if (net != NULL) {
/* mark it as local */
net->addr_is_local = 1;
}

} else if (IN6_IS_ADDR_LINKLOCAL(&to.sin6_addr)) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Link local scope is set, id:%d\n", to.sin6_scope_id);
}
#endif
if (to.sin6_scope_id)
loc_scope = to.sin6_scope_id;
else {
loc_scope = 1;
}
loopscope = 0;
} else {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Global scope is set\n");
}
#endif
}

/* now, depending on which way we are bound we call the appropriate
* routine to do steps 3-6
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Destination address:");
sctp_print_address((struct sockaddr *)&to);
}
#endif

if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Calling bound-all src addr selection for v6\n");
}
#endif
rt_addr = sctp_choose_v6_boundall(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok);
} else {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Calling bound-specific src addr selection for v6\n");
}
#endif
if (stcb)
rt_addr = sctp_choose_v6_boundspecific_stcb(inp, stcb, net, rt, loc_scope, loopscope, non_asoc_addr_ok);
else
/* we can't have a non-asoc address since we have no association */
rt_addr = sctp_choose_v6_boundspecific_inp(inp, rt, loc_scope, loopscope);
}
rtcache_unref(rt, ro);
if (rt_addr == NULL) {
/* no suitable address? */
struct in6_addr in6;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("V6 packet will reach dead-end no suitable src address\n");
}
#endif
memset(&in6, 0, sizeof(in6));
return (in6);
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Source address selected is:");
sctp_print_address((struct sockaddr *)rt_addr);
}
#endif
return (rt_addr->sin6_addr);
}

static uint8_t
sctp_get_ect(struct sctp_tcb *stcb,
struct sctp_tmit_chunk *chk)
{
uint8_t this_random;

/* Huh? */
if (sctp_ecn == 0)
return (0);

if (sctp_ecn_nonce == 0)
/* no nonce, always return ECT0 */
return (SCTP_ECT0_BIT);

if (stcb->asoc.peer_supports_ecn_nonce == 0) {
/* Peer does NOT support it, so we send a ECT0 only */
return (SCTP_ECT0_BIT);
}

if (chk == NULL)
return (SCTP_ECT0_BIT);

if (((stcb->asoc.hb_random_idx == 3) &&
(stcb->asoc.hb_ect_randombit > 7)) ||
(stcb->asoc.hb_random_idx > 3)) {
uint32_t rndval;
rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
memcpy(stcb->asoc.hb_random_values, &rndval,
sizeof(stcb->asoc.hb_random_values));
this_random = stcb->asoc.hb_random_values[0];
stcb->asoc.hb_random_idx = 0;
stcb->asoc.hb_ect_randombit = 0;
} else {
if (stcb->asoc.hb_ect_randombit > 7) {
stcb->asoc.hb_ect_randombit = 0;
stcb->asoc.hb_random_idx++;
}
this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
}
if ((this_random >> stcb->asoc.hb_ect_randombit) & 0x01) {
if (chk != NULL)
/* ECN Nonce stuff */
chk->rec.data.ect_nonce = SCTP_ECT1_BIT;
stcb->asoc.hb_ect_randombit++;
return (SCTP_ECT1_BIT);
} else {
stcb->asoc.hb_ect_randombit++;
return (SCTP_ECT0_BIT);
}
}

extern int sctp_no_csum_on_loopback;

static int
sctp_lowlevel_chunk_output(struct sctp_inpcb *inp,
struct sctp_tcb *stcb, /* may be NULL */
struct sctp_nets *net,
const struct sockaddr *to,
struct mbuf *m,
int nofragment_flag,
int ecn_ok,
struct sctp_tmit_chunk *chk,
int out_of_asoc_ok)
/* nofragment_flag to tell if IP_DF should be set (IPv4 only) */
{
/*
* Given a mbuf chain (via m_next) that holds a packet header
* WITH a SCTPHDR but no IP header, endpoint inp and sa structure.
* - calculate SCTP checksum and fill in
* - prepend a IP address header
* - if boundall use INADDR_ANY
* - if boundspecific do source address selection
* - set fragmentation option for ipV4
* - On return from IP output, check/adjust mtu size
* - of output interface and smallest_mtu size as well.
*/
struct sctphdr *sctphdr;
int o_flgs;
uint32_t csum;
int ret;
unsigned int have_mtu;
struct route *ro;
struct rtentry *rt;

if ((net) && (net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)) {
sctp_m_freem(m);
return (EFAULT);
}
if ((m->m_flags & M_PKTHDR) == 0) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Software error: sctp_lowlevel_chunk_output() called with non pkthdr!\n");
}
#endif
sctp_m_freem(m);
return (EFAULT);
}
/* Calculate the csum and fill in the length of the packet */
sctphdr = mtod(m, struct sctphdr *);
have_mtu = 0;
if (sctp_no_csum_on_loopback &&
(stcb) &&
(stcb->asoc.loopback_scope)) {
sctphdr->checksum = 0;
m->m_pkthdr.len = sctp_calculate_len(m);
} else {
sctphdr->checksum = 0;
csum = sctp_calculate_sum(m, &m->m_pkthdr.len, 0);
sctphdr->checksum = csum;
}
if (to->sa_family == AF_INET) {
struct ip *ip;
static struct route iproute;
M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
if (m == NULL) {
/* failed to prepend data, give up */
return (ENOMEM);
}
ip = mtod(m, struct ip *);
ip->ip_v = IPVERSION;
ip->ip_hl = (sizeof(struct ip) >> 2);
if (nofragment_flag) {
ip->ip_off = htons(IP_DF);
} else
ip->ip_off = 0;

ip->ip_id = htons(ip_newid());
ip->ip_ttl = inp->inp_ip_ttl;
ip->ip_len = htons(m->m_pkthdr.len);
if (stcb) {
if ((stcb->asoc.ecn_allowed) && ecn_ok) {
/* Enable ECN */
ip->ip_tos = (u_char)((in4p_ip(&inp->ip_inp.inp).ip_tos & 0x000000fc) |
sctp_get_ect(stcb, chk));
} else {
/* No ECN */
ip->ip_tos = in4p_ip(&inp->ip_inp.inp).ip_tos;
}
} else {
/* no association at all */
ip->ip_tos = inp->inp_ip_tos;
}
ip->ip_p = IPPROTO_SCTP;
ip->ip_sum = 0;
#ifdef SCTP_DEBUG
printf("chunk_output: net %p\n", net);
#endif
if (net == NULL) {
ro = &iproute;
memset(&iproute, 0, sizeof(iproute));
/* XXX */
rt = rtcache_lookup(ro, to);
rtcache_unref(rt, ro);
} else {
ro = (struct route *)&net->ro;
}
/* Now the address selection part */
ip->ip_dst.s_addr = satocsin(to)->sin_addr.s_addr;

/* call the routine to select the src address */
if (net) {
if (net->src_addr_selected == 0) {
/* Cache the source address */
((struct sockaddr_in *)&net->_s_addr)->sin_addr = sctp_ipv4_source_address_selection(inp,
stcb,
ro, net, out_of_asoc_ok);
rt = rtcache_validate(ro);
if (rt != NULL) {
net->src_addr_selected = 1;
}
rtcache_unref(rt, ro);
}
ip->ip_src = ((struct sockaddr_in *)&net->_s_addr)->sin_addr;
} else {
ip->ip_src = sctp_ipv4_source_address_selection(inp,
stcb, ro, net, out_of_asoc_ok);
}
#ifdef SCTP_DEBUG
printf("src addr %x\n", ip->ip_src.s_addr);
#endif
/*
* If source address selection fails and we find no route then
* the ip_output should fail as well with a NO_ROUTE_TO_HOST
* type error. We probably should catch that somewhere and
* abort the association right away (assuming this is an INIT
* being sent).
*/
rt = rtcache_validate(ro);
if (rt == NULL) {
/*
* src addr selection failed to find a route (or valid
* source addr), so we can't get there from here!
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("low_level_output: dropped v4 packet- no valid source addr\n");
printf("Destination was %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
}
#endif /* SCTP_DEBUG */
if (net) {
if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
stcb,
SCTP_FAILED_THRESHOLD,
(void *)net);
net->dest_state &= ~SCTP_ADDR_REACHABLE;
net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
if (stcb) {
if (net == stcb->asoc.primary_destination) {
/* need a new primary */
struct sctp_nets *alt;
alt = sctp_find_alternate_net(stcb, net);
if (alt != net) {
if (sctp_set_primary_addr(stcb,
(struct sockaddr *)NULL,
alt) == 0) {
net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
net->src_addr_selected = 0;
}
}
}
}
}
sctp_m_freem(m);
return (EHOSTUNREACH);
} else {
have_mtu = rt->rt_ifp->if_mtu;
}

o_flgs = (IP_RAWOUTPUT | (inp->sctp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)));
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Calling ipv4 output routine from low level src addr:%x\n",
(u_int)(ntohl(ip->ip_src.s_addr)));
printf("Destination is %x\n", (u_int)(ntohl(ip->ip_dst.s_addr)));
printf("RTP route is %p through\n", rt);
printf("length %d\n", ntohs(ip->ip_len));
}
#endif
if ((have_mtu) && (net) && (have_mtu > net->mtu)) {
rt->rt_ifp->if_mtu = net->mtu;
}
ret = ip_output(m, inp->ip_inp.inp.inp_options,
ro, o_flgs, inp->ip_inp.inp.inp_moptions,
&inp->ip_inp.inp);
if ((rt) && (have_mtu) && (net) && (have_mtu > net->mtu)) {
rt->rt_ifp->if_mtu = have_mtu;
}
sctp_pegs[SCTP_DATAGRAMS_SENT]++;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Ip output returns %d\n", ret);
}
#endif
if (net == NULL) {
} else {
/* PMTU check versus smallest asoc MTU goes here */
if (rt != NULL) {
if (rt->rt_rmx.rmx_mtu &&
(stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) {
sctp_mtu_size_reset(inp, &stcb->asoc,
rt->rt_rmx.rmx_mtu);
}
} else {
/* route was freed */
net->src_addr_selected = 0;
}
}
rtcache_unref(rt, ro);
return (ret);
}
#ifdef INET6
else if (to->sa_family == AF_INET6) {
struct ip6_hdr *ip6h;
static struct route ip6route;
struct ifnet *ifp;
u_char flowTop;
uint16_t flowBottom;
u_char tosBottom, tosTop;
struct sockaddr_in6 *sin6, tmp, *lsa6, lsa6_tmp;
int prev_scope=0;
u_short prev_port=0;

M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
if (m == NULL) {
/* failed to prepend data, give up */
return (ENOMEM);
}
ip6h = mtod(m, struct ip6_hdr *);

/*
* We assume here that inp_flow is in host byte order within
* the TCB!
*/
flowBottom = in6p_flowinfo(inp) & 0x0000ffff;
flowTop = ((in6p_flowinfo(inp) & 0x000f0000) >> 16);

tosTop = (((in6p_flowinfo(inp) & 0xf0) >> 4) | IPV6_VERSION);

/* protect *sin6 from overwrite */
memcpy(&tmp, to, sizeof(struct sockaddr_in6));
sin6 = &tmp;

/* KAME hack: embed scopeid */
#if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__)
if (in6_embedscope(&sin6->sin6_addr, sin6, NULL, NULL) != 0)
#else
/*
* XXX: appropriate scope zone must be provided or otherwise
* ip6_use_defzone must be 1.
*/
if (sa6_embedscope(sin6, ip6_use_defzone) != 0)
#endif
return (EINVAL);
if (net == NULL) {
memset(&ip6route, 0, sizeof(ip6route));
ro = (struct route *)&ip6route;
/* XXX */
rt = rtcache_lookup(ro, (struct sockaddr *) sin6);
rtcache_unref(rt, ro);
} else {
ro = (struct route *)&net->ro;
}
if (stcb != NULL) {
if ((stcb->asoc.ecn_allowed) && ecn_ok) {
/* Enable ECN */
tosBottom = (((in6p_flowinfo(inp) & 0x0c) | sctp_get_ect(stcb, chk)) << 4);
} else {
/* No ECN */
tosBottom = ((in6p_flowinfo(inp) & 0x0c) << 4);
}
} else {
/* we could get no asoc if it is a O-O-T-B packet */
tosBottom = ((in6p_flowinfo(inp) & 0x0c) << 4);
}
ip6h->ip6_flow = htonl(((tosTop << 24) | ((tosBottom|flowTop) << 16) | flowBottom));
ip6h->ip6_nxt = IPPROTO_SCTP;
ip6h->ip6_plen = m->m_pkthdr.len;
ip6h->ip6_dst = sin6->sin6_addr;

/*
* Add SRC address selection here:
* we can only reuse to a limited degree the kame src-addr-sel,
* since we can try their selection but it may not be bound.
*/
memset(&lsa6_tmp, 0, sizeof(lsa6_tmp));
lsa6_tmp.sin6_family = AF_INET6;
lsa6_tmp.sin6_len = sizeof(lsa6_tmp);
lsa6 = &lsa6_tmp;
rt = rtcache_validate(ro);
if (net) {
if (net->src_addr_selected == 0) {
/* Cache the source address */
((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr = sctp_ipv6_source_address_selection(inp,
stcb, ro, net, out_of_asoc_ok);

if (rt != NULL) {
net->src_addr_selected = 1;
}
}
lsa6->sin6_addr = ((struct sockaddr_in6 *)&net->_s_addr)->sin6_addr;
} else {
lsa6->sin6_addr = sctp_ipv6_source_address_selection(
inp, stcb, ro, net, out_of_asoc_ok);
}
lsa6->sin6_port = inp->sctp_lport;

if (rt == NULL) {
/*
* src addr selection failed to find a route (or valid
* source addr), so we can't get there from here!
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("low_level_output: dropped v6 pkt- no valid source addr\n");
}
#endif
sctp_m_freem(m);
if (net) {
if ((net->dest_state & SCTP_ADDR_REACHABLE) && stcb)
sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
stcb,
SCTP_FAILED_THRESHOLD,
(void *)net);
net->dest_state &= ~SCTP_ADDR_REACHABLE;
net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
if (stcb) {
if (net == stcb->asoc.primary_destination) {
/* need a new primary */
struct sctp_nets *alt;
alt = sctp_find_alternate_net(stcb, net);
if (alt != net) {
if (sctp_set_primary_addr(stcb,
(struct sockaddr *)NULL,
alt) == 0) {
net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
net->src_addr_selected = 0;
}
}
}
}
}
return (EHOSTUNREACH);
}

ip6h->ip6_src = lsa6->sin6_addr;

/*
* We set the hop limit now since there is a good chance that
* our ro pointer is now filled
*/
ip6h->ip6_hlim = in6pcb_selecthlim(&inp->ip_inp.inp,
(ro ?
(rt ? (rt->rt_ifp) : (NULL)) :
(NULL)));
o_flgs = 0;
ifp = rt->rt_ifp;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
/* Copy to be sure something bad is not happening */
sin6->sin6_addr = ip6h->ip6_dst;
lsa6->sin6_addr = ip6h->ip6_src;

printf("Calling ipv6 output routine from low level\n");
printf("src: ");
sctp_print_address((struct sockaddr *)lsa6);
printf("dst: ");
sctp_print_address((struct sockaddr *)sin6);
}
#endif /* SCTP_DEBUG */
if (net) {
sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa;
/* preserve the port and scope for link local send */
prev_scope = sin6->sin6_scope_id;
prev_port = sin6->sin6_port;
}
/* XXX NOMPSAFE need to hold ifp here */
rtcache_unref(rt, ro);
ret = ip6_output(m, ((struct in6pcb *)inp)->in6p_outputopts,
ro,
o_flgs,
((struct in6pcb *)inp)->in6p_moptions,
(struct inpcb *)inp,
&ifp);
if (net) {
/* for link local this must be done */
sin6->sin6_scope_id = prev_scope;
sin6->sin6_port = prev_port;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("return from send is %d\n", ret);
}
#endif /* SCTP_DEBUG_OUTPUT */
sctp_pegs[SCTP_DATAGRAMS_SENT]++;
if (net) {
/* PMTU check versus smallest asoc MTU goes here */
rt = rtcache_validate(ro);
if (rt == NULL) {
/* Route was freed */
net->src_addr_selected = 0;
}
if (rt != NULL) {
if (rt->rt_rmx.rmx_mtu &&
(stcb->asoc.smallest_mtu > rt->rt_rmx.rmx_mtu)) {
sctp_mtu_size_reset(inp,
&stcb->asoc,
rt->rt_rmx.rmx_mtu);
}
rtcache_unref(rt, ro);
} else if (ifp) {
if (ifp->if_mtu &&
(stcb->asoc.smallest_mtu > ifp->if_mtu)) {
sctp_mtu_size_reset(inp,
&stcb->asoc,
ifp->if_mtu);
}
}
}
return (ret);
}
#endif
else {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Unknown protocol (TSNH) type %d\n", ((const struct sockaddr *)to)->sa_family);
}
#endif
sctp_m_freem(m);
return (EFAULT);
}
}

static
int sctp_is_address_in_scope(struct ifaddr *ifa,
int ipv4_addr_legal,
int ipv6_addr_legal,
int loopback_scope,
int ipv4_local_scope,
int local_scope,
int site_scope)
{
if ((loopback_scope == 0) && (ifa->ifa_ifp->if_type == IFT_LOOP)) {
/* skip loopback if not in scope *
*/
return (0);
}
if ((ifa->ifa_addr->sa_family == AF_INET) && ipv4_addr_legal) {
struct sockaddr_in *sin;
sin = (struct sockaddr_in *)ifa->ifa_addr;
if (sin->sin_addr.s_addr == 0) {
/* not in scope , unspecified */
return (0);
}
if ((ipv4_local_scope == 0) &&
(IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
/* private address not in scope */
return (0);
}
} else if ((ifa->ifa_addr->sa_family == AF_INET6) && ipv6_addr_legal) {
struct sockaddr_in6 *sin6;
struct in6_ifaddr *ifa6;

ifa6 = (struct in6_ifaddr *)ifa;
/* ok to use deprecated addresses? */
if (!ip6_use_deprecated) {
if (ifa6->ia6_flags &
IN6_IFF_DEPRECATED) {
return (0);
}
}
if (ifa6->ia6_flags &
(IN6_IFF_DETACHED |
IN6_IFF_ANYCAST |
IN6_IFF_NOTREADY)) {
return (0);
}
sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
/* skip unspecified addresses */
return (0);
}
if (/*(local_scope == 0) && */
(IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
return (0);
}
if ((site_scope == 0) &&
(IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
return (0);
}
} else {
return (0);
}
return (1);
}

void
sctp_send_initiate(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
{
struct mbuf *m, *m_at, *m_last;
struct sctp_nets *net;
struct sctp_init_msg *initm;
struct sctp_supported_addr_param *sup_addr;
struct sctp_ecn_supported_param *ecn;
struct sctp_prsctp_supported_param *prsctp;
struct sctp_ecn_nonce_supported_param *ecn_nonce;
struct sctp_supported_chunk_types_param *pr_supported;
int cnt_inits_to=0;
int padval, ret;

/* INIT's always go to the primary (and usually ONLY address) */
m_last = NULL;
net = stcb->asoc.primary_destination;
if (net == NULL) {
net = TAILQ_FIRST(&stcb->asoc.nets);
if (net == NULL) {
/* TSNH */
return;
}
/* we confirm any address we send an INIT to */
net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
sctp_set_primary_addr(stcb, NULL, net);
} else {
/* we confirm any address we send an INIT to */
net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Sending INIT to ");
sctp_print_address (rtcache_getdst(&net->ro));
}
#endif
if (rtcache_getdst(&net->ro)->sa_family == AF_INET6) {
/* special hook, if we are sending to link local
* it will not show up in our private address count.
*/
if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&net->ro)->sa_data))
cnt_inits_to = 1;
}
if (callout_pending(&net->rxt_timer.timer)) {
/* This case should not happen */
return;
}
/* start the INIT timer */
if (sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net)) {
/* we are hosed since I can't start the INIT timer? */
return;
}
MGETHDR(m, M_DONTWAIT, MT_HEADER);
if (m == NULL) {
/* No memory, INIT timer will re-attempt. */
return;
}
/* make it into a M_EXT */
MCLGET(m, M_DONTWAIT);
if ((m->m_flags & M_EXT) != M_EXT) {
/* Failed to get cluster buffer */
sctp_m_freem(m);
return;
}
m->m_data += SCTP_MIN_OVERHEAD;
m->m_len = sizeof(struct sctp_init_msg);
/* Now lets put the SCTP header in place */
initm = mtod(m, struct sctp_init_msg *);
initm->sh.src_port = inp->sctp_lport;
initm->sh.dest_port = stcb->rport;
initm->sh.v_tag = 0;
initm->sh.checksum = 0; /* calculate later */
/* now the chunk header */
initm->msg.ch.chunk_type = SCTP_INITIATION;
initm->msg.ch.chunk_flags = 0;
/* fill in later from mbuf we build */
initm->msg.ch.chunk_length = 0;
/* place in my tag */
initm->msg.init.initiate_tag = htonl(stcb->asoc.my_vtag);
/* set up some of the credits. */
initm->msg.init.a_rwnd = htonl(uimax(inp->sctp_socket->so_rcv.sb_hiwat,
SCTP_MINIMAL_RWND));

initm->msg.init.num_outbound_streams = htons(stcb->asoc.pre_open_streams);
initm->msg.init.num_inbound_streams = htons(stcb->asoc.max_inbound_streams);
initm->msg.init.initial_tsn = htonl(stcb->asoc.init_seq_number);
/* now the address restriction */
sup_addr = (struct sctp_supported_addr_param *)((vaddr_t)initm +
sizeof(*initm));
sup_addr->ph.param_type = htons(SCTP_SUPPORTED_ADDRTYPE);
/* we support 2 types IPv6/IPv4 */
sup_addr->ph.param_length = htons(sizeof(*sup_addr) +
sizeof(uint16_t));
sup_addr->addr_type[0] = htons(SCTP_IPV4_ADDRESS);
sup_addr->addr_type[1] = htons(SCTP_IPV6_ADDRESS);
m->m_len += sizeof(*sup_addr) + sizeof(uint16_t);

/* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
if (inp->sctp_ep.adaption_layer_indicator) {
struct sctp_adaption_layer_indication *ali;
ali = (struct sctp_adaption_layer_indication *)(
(vaddr_t)sup_addr + sizeof(*sup_addr) + sizeof(uint16_t));
ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
ali->ph.param_length = htons(sizeof(*ali));
ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
m->m_len += sizeof(*ali);
ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali +
sizeof(*ali));
} else {
ecn = (struct sctp_ecn_supported_param *)((vaddr_t)sup_addr +
sizeof(*sup_addr) + sizeof(uint16_t));
}

/* now any cookie time extensions */
if (stcb->asoc.cookie_preserve_req) {
struct sctp_cookie_perserve_param *cookie_preserve;
cookie_preserve = (struct sctp_cookie_perserve_param *)(ecn);
cookie_preserve->ph.param_type = htons(SCTP_COOKIE_PRESERVE);
cookie_preserve->ph.param_length = htons(
sizeof(*cookie_preserve));
cookie_preserve->time = htonl(stcb->asoc.cookie_preserve_req);
m->m_len += sizeof(*cookie_preserve);
ecn = (struct sctp_ecn_supported_param *)(
(vaddr_t)cookie_preserve + sizeof(*cookie_preserve));
stcb->asoc.cookie_preserve_req = 0;
}

/* ECN parameter */
if (sctp_ecn == 1) {
ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
ecn->ph.param_length = htons(sizeof(*ecn));
m->m_len += sizeof(*ecn);
prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn +
sizeof(*ecn));
} else {
prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn);
}
/* And now tell the peer we do pr-sctp */
prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
prsctp->ph.param_length = htons(sizeof(*prsctp));
m->m_len += sizeof(*prsctp);

/* And now tell the peer we do all the extensions */
pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp +
sizeof(*prsctp));

pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
pr_supported->chunk_types[0] = SCTP_ASCONF;
pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
pr_supported->chunk_types[5] = 0; /* pad */
pr_supported->chunk_types[6] = 0; /* pad */
pr_supported->chunk_types[7] = 0; /* pad */

m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
/* ECN nonce: And now tell the peer we support ECN nonce */

if (sctp_ecn_nonce) {
ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported +
sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
m->m_len += sizeof(*ecn_nonce);
}

m_at = m;
/* now the addresses */
if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
struct ifnet *ifn;
struct ifaddr *ifa;
int cnt;
int s;

cnt = cnt_inits_to;
s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if ((stcb->asoc.loopback_scope == 0) &&
(ifn->if_type == IFT_LOOP)) {
/*
* Skip loopback devices if loopback_scope
* not set
*/
continue;
}
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_address_in_scope(ifa,
stcb->asoc.ipv4_addr_legal,
stcb->asoc.ipv6_addr_legal,
stcb->asoc.loopback_scope,
stcb->asoc.ipv4_local_scope,
stcb->asoc.local_scope,
stcb->asoc.site_scope) == 0) {
continue;
}
cnt++;
}
}
pserialize_read_exit(s);

if (cnt > 1) {
s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if ((stcb->asoc.loopback_scope == 0) &&
(ifn->if_type == IFT_LOOP)) {
/*
* Skip loopback devices if loopback_scope
* not set
*/
continue;
}
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_address_in_scope(ifa,
stcb->asoc.ipv4_addr_legal,
stcb->asoc.ipv6_addr_legal,
stcb->asoc.loopback_scope,
stcb->asoc.ipv4_local_scope,
stcb->asoc.local_scope,
stcb->asoc.site_scope) == 0) {
continue;
}
m_at = sctp_add_addr_to_mbuf(m_at, ifa);
}
}
pserialize_read_exit(s);
}
} else {
struct sctp_laddr *laddr;
int cnt;
cnt = cnt_inits_to;
/* First, how many ? */
LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
if (laddr->ifa == NULL) {
continue;
}
if (laddr->ifa->ifa_addr == NULL)
continue;
if (sctp_is_address_in_scope(laddr->ifa,
stcb->asoc.ipv4_addr_legal,
stcb->asoc.ipv6_addr_legal,
stcb->asoc.loopback_scope,
stcb->asoc.ipv4_local_scope,
stcb->asoc.local_scope,
stcb->asoc.site_scope) == 0) {
continue;
}
cnt++;
}
/* To get through a NAT we only list addresses if
* we have more than one. That way if you just
* bind a single address we let the source of the init
* dictate our address.
*/
if (cnt > 1) {
LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
if (laddr->ifa == NULL) {
continue;
}
if (laddr->ifa->ifa_addr == NULL) {
continue;
}

if (sctp_is_address_in_scope(laddr->ifa,
stcb->asoc.ipv4_addr_legal,
stcb->asoc.ipv6_addr_legal,
stcb->asoc.loopback_scope,
stcb->asoc.ipv4_local_scope,
stcb->asoc.local_scope,
stcb->asoc.site_scope) == 0) {
continue;
}
m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
}
}
}
/* calulate the size and update pkt header and chunk header */
m->m_pkthdr.len = 0;
for (m_at = m; m_at; m_at = m_at->m_next) {
if (m_at->m_next == NULL)
m_last = m_at;
m->m_pkthdr.len += m_at->m_len;
}
initm->msg.ch.chunk_length = htons((m->m_pkthdr.len -
sizeof(struct sctphdr)));
#ifdef SCTP_DEBUG
printf("chunk_length %d\n", ntohs(initm->msg.ch.chunk_length));
#endif
/* We pass 0 here to NOT set IP_DF if its IPv4, we
* ignore the return here since the timer will drive
* a retranmission.
*/

/* I don't expect this to execute but we will be safe here */
padval = m->m_pkthdr.len % 4;
if ((padval) && (m_last)) {
/* The compiler worries that m_last may not be
* set even though I think it is impossible :->
* however we add m_last here just in case.
*/
ret = sctp_add_pad_tombuf(m_last, (4-padval));
if (ret) {
/* Houston we have a problem, no space */
sctp_m_freem(m);
return;
}
m->m_pkthdr.len += padval;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Calling lowlevel output stcb:%p net:%p\n",
stcb, net);
}
#endif
ret = sctp_lowlevel_chunk_output(inp, stcb, net,
rtcache_getdst(&net->ro), m, 0, 0, NULL, 0);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Low level output returns %d\n", ret);
}
#endif
sctp_timer_start(SCTP_TIMER_TYPE_INIT, inp, stcb, net);
SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
}

struct mbuf *
sctp_arethere_unrecognized_parameters(struct mbuf *in_initpkt,
int param_offset, int *abort_processing, struct sctp_chunkhdr *cp)
{
/* Given a mbuf containing an INIT or INIT-ACK
* with the param_offset being equal to the
* beginning of the params i.e. (iphlen + sizeof(struct sctp_init_msg)
* parse through the parameters to the end of the mbuf verifying
* that all parameters are known.
*
* For unknown parameters build and return a mbuf with
* UNRECOGNIZED_PARAMETER errors. If the flags indicate
* to stop processing this chunk stop, and set *abort_processing
* to 1.
*
* By having param_offset be pre-set to where parameters begin
* it is hoped that this routine may be reused in the future
* by new features.
*/
struct sctp_paramhdr *phdr, params;

struct mbuf *mat, *op_err;
char tempbuf[2048];
int at, limit, pad_needed;
uint16_t ptype, plen;
int err_at;

*abort_processing = 0;
mat = in_initpkt;
err_at = 0;
limit = ntohs(cp->chunk_length) - sizeof(struct sctp_init_chunk);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Limit is %d bytes\n", limit);
}
#endif
at = param_offset;
op_err = NULL;

phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
while ((phdr != NULL) && ((size_t)limit >= sizeof(struct sctp_paramhdr))) {
ptype = ntohs(phdr->param_type);
plen = ntohs(phdr->param_length);
limit -= SCTP_SIZE32(plen);
if (plen < sizeof(struct sctp_paramhdr)) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("sctp_output.c:Impossible length in parameter < %d\n", plen);
}
#endif
*abort_processing = 1;
break;
}
/* All parameters for all chunks that we
* know/understand are listed here. We process
* them other places and make appropriate
* stop actions per the upper bits. However
* this is the generic routine processor's can
* call to get back an operr.. to either incorporate (init-ack)
* or send.
*/
if ((ptype == SCTP_HEARTBEAT_INFO) ||
(ptype == SCTP_IPV4_ADDRESS) ||
(ptype == SCTP_IPV6_ADDRESS) ||
(ptype == SCTP_STATE_COOKIE) ||
(ptype == SCTP_UNRECOG_PARAM) ||
(ptype == SCTP_COOKIE_PRESERVE) ||
(ptype == SCTP_SUPPORTED_ADDRTYPE) ||
(ptype == SCTP_PRSCTP_SUPPORTED) ||
(ptype == SCTP_ADD_IP_ADDRESS) ||
(ptype == SCTP_DEL_IP_ADDRESS) ||
(ptype == SCTP_ECN_CAPABLE) ||
(ptype == SCTP_ULP_ADAPTION) ||
(ptype == SCTP_ERROR_CAUSE_IND) ||
(ptype == SCTP_SET_PRIM_ADDR) ||
(ptype == SCTP_SUCCESS_REPORT) ||
(ptype == SCTP_ULP_ADAPTION) ||
(ptype == SCTP_SUPPORTED_CHUNK_EXT) ||
(ptype == SCTP_ECN_NONCE_SUPPORTED)
) {
/* no skip it */
at += SCTP_SIZE32(plen);
} else if (ptype == SCTP_HOSTNAME_ADDRESS) {
/* We can NOT handle HOST NAME addresses!! */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Can't handle hostname addresses.. abort processing\n");
}
#endif
*abort_processing = 1;
if (op_err == NULL) {
/* Ok need to try to get a mbuf */
MGETHDR(op_err, M_DONTWAIT, MT_DATA);
if (op_err) {
op_err->m_len = 0;
op_err->m_pkthdr.len = 0;
/* pre-reserve space for ip and sctp header and chunk hdr*/
op_err->m_data += sizeof(struct ip6_hdr);
op_err->m_data += sizeof(struct sctphdr);
op_err->m_data += sizeof(struct sctp_chunkhdr);
}
}
if (op_err) {
/* If we have space */
struct sctp_paramhdr s;
if (err_at % 4) {
u_int32_t cpthis=0;
pad_needed = 4 - (err_at % 4);
m_copyback(op_err, err_at, pad_needed, (void *)&cpthis);
err_at += pad_needed;
}
s.param_type = htons(SCTP_CAUSE_UNRESOLV_ADDR);
s.param_length = htons(sizeof(s) + plen);
m_copyback(op_err, err_at, sizeof(s), (void *)&s);
err_at += sizeof(s);
phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
if (phdr == NULL) {
sctp_m_freem(op_err);
/* we are out of memory but we
* still need to have a look at what to
* do (the system is in trouble though).
*/
return (NULL);
}
m_copyback(op_err, err_at, plen, (void *)phdr);
err_at += plen;
}
return (op_err);
} else {
/* we do not recognize the parameter
* figure out what we do.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Got parameter type %x - unknown\n",
(u_int)ptype);
}
#endif
if ((ptype & 0x4000) == 0x4000) {
/* Report bit is set?? */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Report bit is set\n");
}
#endif
if (op_err == NULL) {
/* Ok need to try to get an mbuf */
MGETHDR(op_err, M_DONTWAIT, MT_DATA);
if (op_err) {
op_err->m_len = 0;
op_err->m_pkthdr.len = 0;
op_err->m_data += sizeof(struct ip6_hdr);
op_err->m_data += sizeof(struct sctphdr);
op_err->m_data += sizeof(struct sctp_chunkhdr);
}
}
if (op_err) {
/* If we have space */
struct sctp_paramhdr s;
if (err_at % 4) {
u_int32_t cpthis=0;
pad_needed = 4 - (err_at % 4);
m_copyback(op_err, err_at, pad_needed, (void *)&cpthis);
err_at += pad_needed;
}
s.param_type = htons(SCTP_UNRECOG_PARAM);
s.param_length = htons(sizeof(s) + plen);
m_copyback(op_err, err_at, sizeof(s), (void *)&s);
err_at += sizeof(s);
if (plen > sizeof(tempbuf)) {
plen = sizeof(tempbuf);
}
phdr = sctp_get_next_param(mat, at, (struct sctp_paramhdr *)tempbuf, plen);
if (phdr == NULL) {
sctp_m_freem(op_err);
/* we are out of memory but we
* still need to have a look at what to
* do (the system is in trouble though).
*/
goto more_processing;
}
m_copyback(op_err, err_at, plen, (void *)phdr);
err_at += plen;
}
}
more_processing:
if ((ptype & 0x8000) == 0x0000) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Abort bit is now setting1\n");
}
#endif
return (op_err);
} else {
/* skip this chunk and continue processing */
at += SCTP_SIZE32(plen);
}

}
phdr = sctp_get_next_param(mat, at, &params, sizeof(params));
}
return (op_err);
}

static int
sctp_are_there_new_addresses(struct sctp_association *asoc,
struct mbuf *in_initpkt, int iphlen, int offset)
{
/*
* Given a INIT packet, look through the packet to verify that
* there are NO new addresses. As we go through the parameters
* add reports of any un-understood parameters that require an
* error. Also we must return (1) to drop the packet if we see
* a un-understood parameter that tells us to drop the chunk.
*/
struct sockaddr_in sin4, *sa4;
struct sockaddr_in6 sin6, *sa6;
struct sockaddr *sa_touse;
struct sockaddr *sa;
struct sctp_paramhdr *phdr, params;
struct ip *iph;
struct mbuf *mat;
uint16_t ptype, plen;
uint8_t fnd;
struct sctp_nets *net;

memset(&sin4, 0, sizeof(sin4));
memset(&sin6, 0, sizeof(sin6));
sin4.sin_family = AF_INET;
sin4.sin_len = sizeof(sin4);
sin6.sin6_family = AF_INET6;
sin6.sin6_len = sizeof(sin6);

sa_touse = NULL;
/* First what about the src address of the pkt ? */
iph = mtod(in_initpkt, struct ip *);
if (iph->ip_v == IPVERSION) {
/* source addr is IPv4 */
sin4.sin_addr = iph->ip_src;
sa_touse = (struct sockaddr *)&sin4;
} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
/* source addr is IPv6 */
struct ip6_hdr *ip6h;
ip6h = mtod(in_initpkt, struct ip6_hdr *);
sin6.sin6_addr = ip6h->ip6_src;
sa_touse = (struct sockaddr *)&sin6;
} else {
return (1);
}

fnd = 0;
TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
sa = (struct sockaddr *)&net->ro.ro_sa;
if (sa->sa_family == sa_touse->sa_family) {
if (sa->sa_family == AF_INET) {
sa4 = (struct sockaddr_in *)sa;
if (sa4->sin_addr.s_addr ==
sin4.sin_addr.s_addr) {
fnd = 1;
break;
}
} else if (sa->sa_family == AF_INET6) {
sa6 = (struct sockaddr_in6 *)sa;
if (SCTP6_ARE_ADDR_EQUAL(&sa6->sin6_addr,
&sin6.sin6_addr)) {
fnd = 1;
break;
}
}
}
}
if (fnd == 0) {
/* New address added! no need to look further. */
return (1);
}
/* Ok so far lets munge through the rest of the packet */
mat = in_initpkt;
sa_touse = NULL;
offset += sizeof(struct sctp_init_chunk);
phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
while (phdr) {
ptype = ntohs(phdr->param_type);
plen = ntohs(phdr->param_length);
if (ptype == SCTP_IPV4_ADDRESS) {
struct sctp_ipv4addr_param *p4, p4_buf;

phdr = sctp_get_next_param(mat, offset,
(struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
if (plen != sizeof(struct sctp_ipv4addr_param) ||
phdr == NULL) {
return (1);
}
p4 = (struct sctp_ipv4addr_param *)phdr;
sin4.sin_addr.s_addr = p4->addr;
sa_touse = (struct sockaddr *)&sin4;
} else if (ptype == SCTP_IPV6_ADDRESS) {
struct sctp_ipv6addr_param *p6, p6_buf;

phdr = sctp_get_next_param(mat, offset,
(struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
if (plen != sizeof(struct sctp_ipv6addr_param) ||
phdr == NULL) {
return (1);
}
p6 = (struct sctp_ipv6addr_param *)phdr;
memcpy((void *)&sin6.sin6_addr, p6->addr,
sizeof(p6->addr));
sa_touse = (struct sockaddr *)&sin4;
}

if (sa_touse) {
/* ok, sa_touse points to one to check */
fnd = 0;
TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
sa = (struct sockaddr *)&net->ro.ro_sa;
if (sa->sa_family != sa_touse->sa_family) {
continue;
}
if (sa->sa_family == AF_INET) {
sa4 = (struct sockaddr_in *)sa;
if (sa4->sin_addr.s_addr ==
sin4.sin_addr.s_addr) {
fnd = 1;
break;
}
} else if (sa->sa_family == AF_INET6) {
sa6 = (struct sockaddr_in6 *)sa;
if (SCTP6_ARE_ADDR_EQUAL(
&sa6->sin6_addr, &sin6.sin6_addr)) {
fnd = 1;
break;
}
}
}
if (!fnd) {
/* New addr added! no need to look further */
return (1);
}
}
offset += SCTP_SIZE32(plen);
phdr = sctp_get_next_param(mat, offset, &params, sizeof(params));
}
return (0);
}

/*
* Given a MBUF chain that was sent into us containing an
* INIT. Build a INIT-ACK with COOKIE and send back.
* We assume that the in_initpkt has done a pullup to
* include IPv6/4header, SCTP header and initial part of
* INIT message (i.e. the struct sctp_init_msg).
*/
void
sctp_send_initiate_ack(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
struct mbuf *init_pkt, int iphlen, int offset, struct sctphdr *sh,
struct sctp_init_chunk *init_chk)
{
struct sctp_association *asoc;
struct mbuf *m, *m_at, *m_tmp, *m_cookie, *op_err, *m_last;
struct sctp_init_msg *initackm_out;
struct sctp_ecn_supported_param *ecn;
struct sctp_prsctp_supported_param *prsctp;
struct sctp_ecn_nonce_supported_param *ecn_nonce;
struct sctp_supported_chunk_types_param *pr_supported;
struct sockaddr_storage store;
struct sockaddr_in *sin;
struct sockaddr_in6 *sin6;
struct route *ro;
struct ip *iph;
struct ip6_hdr *ip6;
const struct sockaddr *to;
struct sctp_state_cookie stc;
struct sctp_nets *net=NULL;
int cnt_inits_to=0;
uint16_t his_limit, i_want;
int abort_flag, padval, sz_of;
struct rtentry *rt;

if (stcb) {
asoc = &stcb->asoc;
} else {
asoc = NULL;
}
m_last = NULL;
if ((asoc != NULL) &&
(SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
(sctp_are_there_new_addresses(asoc, init_pkt, iphlen, offset))) {
/* new addresses, out of here in non-cookie-wait states */
/*
* Send a ABORT, we don't add the new address error clause though
* we even set the T bit and copy in the 0 tag.. this looks no
* different than if no listner was present.
*/
sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
return;
}
abort_flag = 0;
op_err = sctp_arethere_unrecognized_parameters(init_pkt,
(offset+sizeof(struct sctp_init_chunk)),
&abort_flag, (struct sctp_chunkhdr *)init_chk);
if (abort_flag) {
sctp_send_abort(init_pkt, iphlen, sh, init_chk->init.initiate_tag, op_err);
return;
}
MGETHDR(m, M_DONTWAIT, MT_HEADER);
if (m == NULL) {
/* No memory, INIT timer will re-attempt. */
sctp_m_freem(op_err);
return;
}
MCLGET(m, M_DONTWAIT);
if ((m->m_flags & M_EXT) != M_EXT) {
/* Failed to get cluster buffer */
sctp_m_freem(op_err);
sctp_m_freem(m);
return;
}
m->m_data += SCTP_MIN_OVERHEAD;
m_reset_rcvif(m);
m->m_len = sizeof(struct sctp_init_msg);

/* the time I built cookie */
SCTP_GETTIME_TIMEVAL(&stc.time_entered);

/* populate any tie tags */
if (asoc != NULL) {
/* unlock before tag selections */
SCTP_TCB_UNLOCK(stcb);
if (asoc->my_vtag_nonce == 0)
asoc->my_vtag_nonce = sctp_select_a_tag(inp);
stc.tie_tag_my_vtag = asoc->my_vtag_nonce;

if (asoc->peer_vtag_nonce == 0)
asoc->peer_vtag_nonce = sctp_select_a_tag(inp);
stc.tie_tag_peer_vtag = asoc->peer_vtag_nonce;

stc.cookie_life = asoc->cookie_life;
net = asoc->primary_destination;
/* now we must relock */
SCTP_INP_RLOCK(inp);
/* we may be in trouble here if the inp got freed
* most likely this set of tests will protect
* us but there is a chance not.
*/
if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
sctp_m_freem(op_err);
sctp_m_freem(m);
sctp_send_abort(init_pkt, iphlen, sh, 0, NULL);
return;
}
SCTP_TCB_LOCK(stcb);
SCTP_INP_RUNLOCK(stcb->sctp_ep);
} else {
stc.tie_tag_my_vtag = 0;
stc.tie_tag_peer_vtag = 0;
/* life I will award this cookie */
stc.cookie_life = inp->sctp_ep.def_cookie_life;
}

/* copy in the ports for later check */
stc.myport = sh->dest_port;
stc.peerport = sh->src_port;

/*
* If we wanted to honor cookie life extensions, we would add
* to stc.cookie_life. For now we should NOT honor any extension
*/
stc.site_scope = stc.local_scope = stc.loopback_scope = 0;
if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
struct inpcb *in_inp;
/* Its a V6 socket */
in_inp = (struct inpcb *)inp;
stc.ipv6_addr_legal = 1;
/* Now look at the binding flag to see if V4 will be legal */
if (
#if defined(__FreeBSD__) || defined(__APPLE__)
(in_inp->inp_flags & IN6P_IPV6_V6ONLY)
#elif defined(__OpenBSD__)
(0) /* For openbsd we do dual bind only */
#else
(((struct in6pcb *)in_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
#endif
== 0) {
stc.ipv4_addr_legal = 1;
} else {
/* V4 addresses are NOT legal on the association */
stc.ipv4_addr_legal = 0;
}
} else {
/* Its a V4 socket, no - V6 */
stc.ipv4_addr_legal = 1;
stc.ipv6_addr_legal = 0;
}

#ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
stc.ipv4_scope = 1;
#else
stc.ipv4_scope = 0;
#endif
/* now for scope setup */
memset((void *)&store, 0, sizeof(store));
sin = (struct sockaddr_in *)&store;
sin6 = (struct sockaddr_in6 *)&store;
if (net == NULL) {
to = (struct sockaddr *)&store;
iph = mtod(init_pkt, struct ip *);
if (iph->ip_v == IPVERSION) {
struct in_addr addr;
static struct route iproute;

sin->sin_family = AF_INET;
sin->sin_len = sizeof(struct sockaddr_in);
sin->sin_port = sh->src_port;
sin->sin_addr = iph->ip_src;
/* lookup address */
stc.address[0] = sin->sin_addr.s_addr;
stc.address[1] = 0;
stc.address[2] = 0;
stc.address[3] = 0;
stc.addr_type = SCTP_IPV4_ADDRESS;
/* local from address */
memset(&iproute, 0, sizeof(iproute));
ro = &iproute;

/* XXX */
rt = rtcache_lookup(ro, (struct sockaddr *) sin);
rtcache_unref(rt, ro);
addr = sctp_ipv4_source_address_selection(inp, NULL,
ro, NULL, 0);
stc.laddress[0] = addr.s_addr;
stc.laddress[1] = 0;
stc.laddress[2] = 0;
stc.laddress[3] = 0;
stc.laddr_type = SCTP_IPV4_ADDRESS;
/* scope_id is only for v6 */
stc.scope_id = 0;
#ifndef SCTP_DONT_DO_PRIVADDR_SCOPE
if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
stc.ipv4_scope = 1;
}
#else
stc.ipv4_scope = 1;
#endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
/* Must use the address in this case */
if (sctp_is_address_on_local_host((struct sockaddr *)sin)) {
stc.loopback_scope = 1;
stc.ipv4_scope = 1;
stc.site_scope = 1;
stc.local_scope = 1;
}
} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
struct in6_addr addr;
static struct route iproute6;
ip6 = mtod(init_pkt, struct ip6_hdr *);
sin6->sin6_family = AF_INET6;
sin6->sin6_len = sizeof(struct sockaddr_in6);
sin6->sin6_port = sh->src_port;
sin6->sin6_addr = ip6->ip6_src;
/* lookup address */
memcpy(&stc.address, &sin6->sin6_addr,
sizeof(struct in6_addr));
sin6->sin6_scope_id = 0;
stc.addr_type = SCTP_IPV6_ADDRESS;
stc.scope_id = 0;
if (sctp_is_address_on_local_host((struct sockaddr *)sin6)) {
stc.loopback_scope = 1;
stc.local_scope = 1;
stc.site_scope = 1;
stc.ipv4_scope = 1;
} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
/*
* If the new destination is a LINK_LOCAL
* we must have common both site and local
* scope. Don't set local scope though since
* we must depend on the source to be added
* implicitly. We cannot assure just because
* we share one link that all links are common.
*
* XXX: never treat link-local case explicitly.
* Use general routines defined in scope6.c.
* (jinmei@kame)
*/
stc.local_scope = 0;
stc.site_scope = 1;
stc.ipv4_scope = 1;
/* we start counting for the private
* address stuff at 1. since the link
* local we source from won't show
* up in our scoped count.
*/
cnt_inits_to=1;
/* pull out the scope_id from incoming pkt */
#if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__)
(void)in6_recoverscope(sin6, &in6_src,
m_get_rcvif_NOMPSAFE(init_pkt));
in6_embedscope(&sin6->sin6_addr, sin6, NULL,
NULL);
#else
(void)sa6_recoverscope(sin6);
#endif
stc.scope_id = sin6->sin6_scope_id;

} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
/*
* If the new destination is SITE_LOCAL
* then we must have site scope in common.
*/
stc.site_scope = 1;
}
/* local from address */
memset(&iproute6, 0, sizeof(iproute6));
ro = (struct route *)&iproute6;
/* XXX */
rt = rtcache_lookup(ro, (struct sockaddr *) sin6);
rtcache_unref(rt, ro);
addr = sctp_ipv6_source_address_selection(inp, NULL,
ro, NULL, 0);
memcpy(&stc.laddress, &addr, sizeof(struct in6_addr));
stc.laddr_type = SCTP_IPV6_ADDRESS;
}
} else {
/* set the scope per the existing tcb */
struct sctp_nets *lnet;

stc.loopback_scope = asoc->loopback_scope;
stc.ipv4_scope = asoc->ipv4_local_scope;
stc.site_scope = asoc->site_scope;
stc.local_scope = asoc->local_scope;
TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
if (rtcache_getdst(&lnet->ro)->sa_family == AF_INET6) {
if (IN6_IS_ADDR_LINKLOCAL((const struct in6_addr *) rtcache_getdst(&lnet->ro)->sa_data)) {
/* if we have a LL address, start counting
* at 1.
*/
cnt_inits_to = 1;
}
}
}

/* use the net pointer */
to = rtcache_getdst(&net->ro);
if (to->sa_family == AF_INET) {
memcpy(&stc.address[0], to, sizeof(struct in_addr));
stc.address[1] = 0;
stc.address[2] = 0;
stc.address[3] = 0;
stc.addr_type = SCTP_IPV4_ADDRESS;
if (net->src_addr_selected == 0) {
/* strange case here, the INIT
* should have did the selection.
*/
net->_s_addr.sin.sin_addr =
sctp_ipv4_source_address_selection(inp,
stcb, &net->ro, net, 0);
net->src_addr_selected = 1;

}

stc.laddress[0] = net->_s_addr.sin.sin_addr.s_addr;
stc.laddress[1] = 0;
stc.laddress[2] = 0;
stc.laddress[3] = 0;
stc.laddr_type = SCTP_IPV4_ADDRESS;
} else if (to->sa_family == AF_INET6) {
memcpy(&stc.address, &to->sa_data,
sizeof(struct in6_addr));
stc.addr_type = SCTP_IPV6_ADDRESS;
if (net->src_addr_selected == 0) {
/* strange case here, the INIT
* should have did the selection.
*/
net->_s_addr.sin6.sin6_addr =
sctp_ipv6_source_address_selection(inp,
stcb, &net->ro, net, 0);
net->src_addr_selected = 1;
}
memcpy(&stc.laddress, &net->_s_addr.sin6.sin6_addr,
sizeof(struct in6_addr));
stc.laddr_type = SCTP_IPV6_ADDRESS;
}
}
/* Now lets put the SCTP header in place */
initackm_out = mtod(m, struct sctp_init_msg *);
initackm_out->sh.src_port = inp->sctp_lport;
initackm_out->sh.dest_port = sh->src_port;
initackm_out->sh.v_tag = init_chk->init.initiate_tag;
/* Save it off for quick ref */
stc.peers_vtag = init_chk->init.initiate_tag;
initackm_out->sh.checksum = 0; /* calculate later */
/* who are we */
strncpy(stc.identification, SCTP_VERSION_STRING,
uimin(strlen(SCTP_VERSION_STRING), sizeof(stc.identification)));
/* now the chunk header */
initackm_out->msg.ch.chunk_type = SCTP_INITIATION_ACK;
initackm_out->msg.ch.chunk_flags = 0;
/* fill in later from mbuf we build */
initackm_out->msg.ch.chunk_length = 0;
/* place in my tag */
if ((asoc != NULL) &&
((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED))) {
/* re-use the v-tags and init-seq here */
initackm_out->msg.init.initiate_tag = htonl(asoc->my_vtag);
initackm_out->msg.init.initial_tsn = htonl(asoc->init_seq_number);
} else {
initackm_out->msg.init.initiate_tag = htonl(sctp_select_a_tag(inp));
/* get a TSN to use too */
initackm_out->msg.init.initial_tsn = htonl(sctp_select_initial_TSN(&inp->sctp_ep));
}
/* save away my tag to */
stc.my_vtag = initackm_out->msg.init.initiate_tag;

/* set up some of the credits. */
initackm_out->msg.init.a_rwnd = htonl(uimax(inp->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND));
/* set what I want */
his_limit = ntohs(init_chk->init.num_inbound_streams);
/* choose what I want */
if (asoc != NULL) {
if (asoc->streamoutcnt > inp->sctp_ep.pre_open_stream_count) {
i_want = asoc->streamoutcnt;
} else {
i_want = inp->sctp_ep.pre_open_stream_count;
}
} else {
i_want = inp->sctp_ep.pre_open_stream_count;
}
if (his_limit < i_want) {
/* I Want more :< */
initackm_out->msg.init.num_outbound_streams = init_chk->init.num_inbound_streams;
} else {
/* I can have what I want :> */
initackm_out->msg.init.num_outbound_streams = htons(i_want);
}
/* tell him his limt. */
initackm_out->msg.init.num_inbound_streams =
htons(inp->sctp_ep.max_open_streams_intome);
/* setup the ECN pointer */

/* if (inp->sctp_flags & SCTP_PCB_FLAGS_ADAPTIONEVNT) {*/
if (inp->sctp_ep.adaption_layer_indicator) {
struct sctp_adaption_layer_indication *ali;
ali = (struct sctp_adaption_layer_indication *)(
(vaddr_t)initackm_out + sizeof(*initackm_out));
ali->ph.param_type = htons(SCTP_ULP_ADAPTION);
ali->ph.param_length = htons(sizeof(*ali));
ali->indication = ntohl(inp->sctp_ep.adaption_layer_indicator);
m->m_len += sizeof(*ali);
ecn = (struct sctp_ecn_supported_param *)((vaddr_t)ali +
sizeof(*ali));
} else {
ecn = (struct sctp_ecn_supported_param*)(
(vaddr_t)initackm_out + sizeof(*initackm_out));
}

/* ECN parameter */
if (sctp_ecn == 1) {
ecn->ph.param_type = htons(SCTP_ECN_CAPABLE);
ecn->ph.param_length = htons(sizeof(*ecn));
m->m_len += sizeof(*ecn);

prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn +
sizeof(*ecn));
} else {
prsctp = (struct sctp_prsctp_supported_param *)((vaddr_t)ecn);
}
/* And now tell the peer we do pr-sctp */
prsctp->ph.param_type = htons(SCTP_PRSCTP_SUPPORTED);
prsctp->ph.param_length = htons(sizeof(*prsctp));
m->m_len += sizeof(*prsctp);

/* And now tell the peer we do all the extensions */
pr_supported = (struct sctp_supported_chunk_types_param *)((vaddr_t)prsctp +
sizeof(*prsctp));

pr_supported->ph.param_type = htons(SCTP_SUPPORTED_CHUNK_EXT);
pr_supported->ph.param_length = htons(sizeof(*pr_supported) + SCTP_EXT_COUNT);
pr_supported->chunk_types[0] = SCTP_ASCONF;
pr_supported->chunk_types[1] = SCTP_ASCONF_ACK;
pr_supported->chunk_types[2] = SCTP_FORWARD_CUM_TSN;
pr_supported->chunk_types[3] = SCTP_PACKET_DROPPED;
pr_supported->chunk_types[4] = SCTP_STREAM_RESET;
pr_supported->chunk_types[5] = 0; /* pad */
pr_supported->chunk_types[6] = 0; /* pad */
pr_supported->chunk_types[7] = 0; /* pad */

m->m_len += (sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
if (sctp_ecn_nonce) {
/* ECN nonce: And now tell the peer we support ECN nonce */
ecn_nonce = (struct sctp_ecn_nonce_supported_param *)((vaddr_t)pr_supported +
sizeof(*pr_supported) + SCTP_EXT_COUNT + SCTP_PAD_EXT_COUNT);
ecn_nonce->ph.param_type = htons(SCTP_ECN_NONCE_SUPPORTED);
ecn_nonce->ph.param_length = htons(sizeof(*ecn_nonce));
m->m_len += sizeof(*ecn_nonce);
}

m_at = m;
/* now the addresses */
if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
struct ifnet *ifn;
struct ifaddr *ifa;
int cnt = cnt_inits_to;
int s;

s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if ((stc.loopback_scope == 0) &&
(ifn->if_type == IFT_LOOP)) {
/*
* Skip loopback devices if loopback_scope
* not set
*/
continue;
}
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_address_in_scope(ifa,
stc.ipv4_addr_legal, stc.ipv6_addr_legal,
stc.loopback_scope, stc.ipv4_scope,
stc.local_scope, stc.site_scope) == 0) {
continue;
}
cnt++;
}
}
pserialize_read_exit(s);

if (cnt > 1) {
s = pserialize_read_enter();
IFNET_READER_FOREACH(ifn) {
if ((stc.loopback_scope == 0) &&
(ifn->if_type == IFT_LOOP)) {
/*
* Skip loopback devices if
* loopback_scope not set
*/
continue;
}
IFADDR_READER_FOREACH(ifa, ifn) {
if (sctp_is_address_in_scope(ifa,
stc.ipv4_addr_legal,
stc.ipv6_addr_legal,
stc.loopback_scope, stc.ipv4_scope,
stc.local_scope, stc.site_scope) == 0) {
continue;
}
m_at = sctp_add_addr_to_mbuf(m_at, ifa);
}
}
pserialize_read_exit(s);
}
} else {
struct sctp_laddr *laddr;
int cnt;
cnt = cnt_inits_to;
/* First, how many ? */
LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
if (laddr->ifa == NULL) {
continue;
}
if (laddr->ifa->ifa_addr == NULL)
continue;
if (sctp_is_address_in_scope(laddr->ifa,
stc.ipv4_addr_legal, stc.ipv6_addr_legal,
stc.loopback_scope, stc.ipv4_scope,
stc.local_scope, stc.site_scope) == 0) {
continue;
}
cnt++;
}
/* If we bind a single address only we won't list
* any. This way you can get through a NAT
*/
if (cnt > 1) {
LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
if (laddr->ifa == NULL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Help I have fallen and I can't get up!\n");
}
#endif
continue;
}
if (laddr->ifa->ifa_addr == NULL)
continue;
if (sctp_is_address_in_scope(laddr->ifa,
stc.ipv4_addr_legal, stc.ipv6_addr_legal,
stc.loopback_scope, stc.ipv4_scope,
stc.local_scope, stc.site_scope) == 0) {
continue;
}
m_at = sctp_add_addr_to_mbuf(m_at, laddr->ifa);
}
}
}

/* tack on the operational error if present */
if (op_err) {
if (op_err->m_pkthdr.len % 4) {
/* must add a pad to the param */
u_int32_t cpthis=0;
int padlen;
padlen = 4 - (op_err->m_pkthdr.len % 4);
m_copyback(op_err, op_err->m_pkthdr.len, padlen, (void *)&cpthis);
}
while (m_at->m_next != NULL) {
m_at = m_at->m_next;
}
m_at->m_next = op_err;
while (m_at->m_next != NULL) {
m_at = m_at->m_next;
}
}
/* Get total size of init packet */
sz_of = SCTP_SIZE32(ntohs(init_chk->ch.chunk_length));
/* pre-calulate the size and update pkt header and chunk header */
m->m_pkthdr.len = 0;
for (m_tmp = m; m_tmp; m_tmp = m_tmp->m_next) {
m->m_pkthdr.len += m_tmp->m_len;
if (m_tmp->m_next == NULL) {
/* m_tmp should now point to last one */
break;
}
}
/*
* Figure now the size of the cookie. We know the size of the
* INIT-ACK. The Cookie is going to be the size of INIT, INIT-ACK,
* COOKIE-STRUCTURE and SIGNATURE.
*/

/*
* take our earlier INIT calc and add in the sz we just calculated
* minus the size of the sctphdr (its not included in chunk size
*/

/* add once for the INIT-ACK */
sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));

/* add a second time for the INIT-ACK in the cookie */
sz_of += (m->m_pkthdr.len - sizeof(struct sctphdr));

/* Now add the cookie header and cookie message struct */
sz_of += sizeof(struct sctp_state_cookie_param);
/* ...and add the size of our signature */
sz_of += SCTP_SIGNATURE_SIZE;
initackm_out->msg.ch.chunk_length = htons(sz_of);

/* Now we must build a cookie */
m_cookie = sctp_add_cookie(inp, init_pkt, offset, m,
sizeof(struct sctphdr), &stc);
if (m_cookie == NULL) {
/* memory problem */
sctp_m_freem(m);
return;
}
/* Now append the cookie to the end and update the space/size */
m_tmp->m_next = m_cookie;

/*
* We pass 0 here to NOT set IP_DF if its IPv4, we ignore the
* return here since the timer will drive a retranmission.
*/
padval = m->m_pkthdr.len % 4;
if ((padval) && (m_last)) {
/* see my previous comments on m_last */
int ret;
ret = sctp_add_pad_tombuf(m_last, (4-padval));
if (ret) {
/* Houston we have a problem, no space */
sctp_m_freem(m);
return;
}
m->m_pkthdr.len += padval;
}
sctp_lowlevel_chunk_output(inp, NULL, NULL, to, m, 0, 0, NULL, 0);
}

static void
sctp_insert_on_wheel(struct sctp_association *asoc,
struct sctp_stream_out *strq)
{
struct sctp_stream_out *stre, *strn;
stre = TAILQ_FIRST(&asoc->out_wheel);
if (stre == NULL) {
/* only one on wheel */
TAILQ_INSERT_HEAD(&asoc->out_wheel, strq, next_spoke);
return;
}
for (; stre; stre = strn) {
strn = TAILQ_NEXT(stre, next_spoke);
if (stre->stream_no > strq->stream_no) {
TAILQ_INSERT_BEFORE(stre, strq, next_spoke);
return;
} else if (stre->stream_no == strq->stream_no) {
/* huh, should not happen */
return;
} else if (strn == NULL) {
/* next one is null */
TAILQ_INSERT_AFTER(&asoc->out_wheel, stre, strq,
next_spoke);
}
}
}

static void
sctp_remove_from_wheel(struct sctp_association *asoc,
struct sctp_stream_out *strq)
{
/* take off and then setup so we know it is not on the wheel */
TAILQ_REMOVE(&asoc->out_wheel, strq, next_spoke);
strq->next_spoke.tqe_next = NULL;
strq->next_spoke.tqe_prev = NULL;
}

static void
sctp_prune_prsctp(struct sctp_tcb *stcb,
struct sctp_association *asoc,
struct sctp_sndrcvinfo *srcv,
int dataout
)
{
int freed_spc=0;
struct sctp_tmit_chunk *chk, *nchk;
if ((asoc->peer_supports_prsctp) && (asoc->sent_queue_cnt_removeable > 0)) {
TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
/*
* Look for chunks marked with the PR_SCTP
* flag AND the buffer space flag. If the one
* being sent is equal or greater priority then
* purge the old one and free some space.
*/
if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
SCTP_PR_SCTP_BUFFER)) ==
(SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
/*
* This one is PR-SCTP AND buffer space
* limited type
*/
if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
/* Lower numbers equates to
* higher priority so if the
* one we are looking at has a
* larger or equal priority we
* want to drop the data and
* NOT retransmit it.
*/
if (chk->data) {
/* We release the
* book_size if the
* mbuf is here
*/
int ret_spc;
int cause;
if (chk->sent > SCTP_DATAGRAM_UNSENT)
cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT;
else
cause = SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT;
ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
cause,
&asoc->sent_queue);
freed_spc += ret_spc;
if (freed_spc >= dataout) {
return;
}
} /* if chunk was present */
} /* if of sufficient priority */
} /* if chunk has enabled */
} /* tailqforeach */

chk = TAILQ_FIRST(&asoc->send_queue);
while (chk) {
nchk = TAILQ_NEXT(chk, sctp_next);
/* Here we must move to the sent queue and mark */
if ((chk->flags & (SCTP_PR_SCTP_ENABLED |
SCTP_PR_SCTP_BUFFER)) ==
(SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) {
if (chk->rec.data.timetodrop.tv_sec >= (long)srcv->sinfo_timetolive) {
if (chk->data) {
/* We release the
* book_size if the
* mbuf is here
*/
int ret_spc;
ret_spc = sctp_release_pr_sctp_chunk(stcb, chk,
SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_UNSENT,
&asoc->send_queue);

freed_spc += ret_spc;
if (freed_spc >= dataout) {
return;
}
} /* end if chk->data */
} /* end if right class */
} /* end if chk pr-sctp */
chk = nchk;
} /* end while (chk) */
} /* if enabled in asoc */
}

static void
sctp_prepare_chunk(struct sctp_tmit_chunk *template,
struct sctp_tcb *stcb,
struct sctp_sndrcvinfo *srcv,
struct sctp_stream_out *strq,
struct sctp_nets *net)
{
memset(template, 0, sizeof(struct sctp_tmit_chunk));
template->sent = SCTP_DATAGRAM_UNSENT;
if ((stcb->asoc.peer_supports_prsctp) &&
(srcv->sinfo_flags & (SCTP_PR_SCTP_TTL|SCTP_PR_SCTP_BUF)) &&
(srcv->sinfo_timetolive > 0)
) {
/* If:
* Peer supports PR-SCTP
* The flags is set against this send for PR-SCTP
* And timetolive is a positive value, zero is reserved
* to mean a reliable send for both buffer/time
* related one.
*/
if (srcv->sinfo_flags & SCTP_PR_SCTP_BUF) {
/*
* Time to live is a priority stored in tv_sec
* when doing the buffer drop thing.
*/
template->rec.data.timetodrop.tv_sec = srcv->sinfo_timetolive;
} else {
struct timeval tv;

SCTP_GETTIME_TIMEVAL(&template->rec.data.timetodrop);
tv.tv_sec = srcv->sinfo_timetolive / 1000;
tv.tv_usec = (srcv->sinfo_timetolive * 1000) % 1000000;
#ifndef __FreeBSD__
timeradd(&template->rec.data.timetodrop, &tv,
&template->rec.data.timetodrop);
#else
timevaladd(&template->rec.data.timetodrop, &tv);
#endif
}
}
if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
template->rec.data.stream_seq = strq->next_sequence_sent;
} else {
template->rec.data.stream_seq = 0;
}
template->rec.data.TSN_seq = 0; /* not yet assigned */

template->rec.data.stream_number = srcv->sinfo_stream;
template->rec.data.payloadtype = srcv->sinfo_ppid;
template->rec.data.context = srcv->sinfo_context;
template->rec.data.doing_fast_retransmit = 0;
template->rec.data.ect_nonce = 0; /* ECN Nonce */

if (srcv->sinfo_flags & SCTP_ADDR_OVER) {
template->whoTo = net;
} else {
if (stcb->asoc.primary_destination)
template->whoTo = stcb->asoc.primary_destination;
else {
/* TSNH */
template->whoTo = net;
}
}
/* the actual chunk flags */
if (srcv->sinfo_flags & SCTP_UNORDERED) {
template->rec.data.rcv_flags = SCTP_DATA_UNORDERED;
} else {
template->rec.data.rcv_flags = 0;
}
/* no flags yet, FRAGMENT_OK goes here */
template->flags = 0;
/* PR sctp flags */
if (stcb->asoc.peer_supports_prsctp) {
if (srcv->sinfo_timetolive > 0) {
/*
* We only set the flag if timetolive (or
* priority) was set to a positive number.
* Zero is reserved specifically to be
* EXCLUDED and sent reliable.
*/
if (srcv->sinfo_flags & SCTP_PR_SCTP_TTL) {
template->flags |= SCTP_PR_SCTP_ENABLED;
}
if (srcv->sinfo_flags & SCTP_PR_SCTP_BUF) {
template->flags |= SCTP_PR_SCTP_BUFFER;
}
}
}
template->asoc = &stcb->asoc;
}

int
sctp_get_frag_point(struct sctp_tcb *stcb,
struct sctp_association *asoc)
{
int siz, ovh;

/* For endpoints that have both 6 and 4 addresses
* we must reserver room for the 6 ip header, for
* those that are only dealing with V4 we use
* a larger frag point.
*/
if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
ovh = SCTP_MED_OVERHEAD;
} else {
ovh = SCTP_MED_V4_OVERHEAD;
}

if (stcb->sctp_ep->sctp_frag_point > asoc->smallest_mtu)
siz = asoc->smallest_mtu - ovh;
else
siz = (stcb->sctp_ep->sctp_frag_point - ovh);
/*
if (siz > (MCLBYTES-sizeof(struct sctp_data_chunk))) { */
/* A data chunk MUST fit in a cluster */
/* siz = (MCLBYTES - sizeof(struct sctp_data_chunk));*/
/* }*/

if (siz % 4) {
/* make it an even word boundary please */
siz -= (siz % 4);
}
return (siz);
}
extern unsigned int sctp_max_chunks_on_queue;

#define SBLOCKWAIT(f) (((f)&MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)

static int
sctp_msg_append(struct sctp_tcb *stcb,
struct sctp_nets *net,
struct mbuf *m,
struct sctp_sndrcvinfo *srcv,
int flags)
{
struct socket *so;
struct sctp_association *asoc;
struct sctp_stream_out *strq;
struct sctp_tmit_chunk *chk;
struct sctpchunk_listhead tmp;
struct sctp_tmit_chunk template;
struct mbuf *n, *mnext;
struct mbuf *mm;
unsigned int dataout, siz;
int mbcnt = 0;
int mbcnt_e = 0;
int error = 0;

if ((stcb == NULL) || (net == NULL) || (m == NULL) || (srcv == NULL)) {
/* Software fault, you blew it on the call */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("software error in sctp_msg_append:1\n");
printf("stcb:%p net:%p m:%p srcv:%p\n",
stcb, net, m, srcv);
}
#endif
sctp_m_freem(m);
return (EFAULT);
}
so = stcb->sctp_socket;
asoc = &stcb->asoc;
if (srcv->sinfo_flags & SCTP_ABORT) {
if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
(SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
/* It has to be up before we abort */
/* how big is the user initiated abort? */
if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
dataout = m->m_pkthdr.len;
} else {
/* we must count */
dataout = 0;
for (n = m; n; n = n->m_next) {
dataout += n->m_len;
}
}
M_PREPEND(m, sizeof(struct sctp_paramhdr), M_DONTWAIT);
if (m) {
struct sctp_paramhdr *ph;
m->m_len = sizeof(struct sctp_paramhdr) + dataout;
ph = mtod(m, struct sctp_paramhdr *);
ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
ph->param_length = htons(m->m_len);
}
sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, m);
m = NULL;
} else {
/* Only free if we don't send an abort */
;
}
goto out;
}
if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
(asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
/* got data while shutting down */
error = ECONNRESET;
goto out;
}

if (srcv->sinfo_stream >= asoc->streamoutcnt) {
/* Invalid stream number */
error = EINVAL;
goto out;
}
if (asoc->strmout == NULL) {
/* huh? software error */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("software error in sctp_msg_append:2\n");
}
#endif
error = EFAULT;
goto out;
}
strq = &asoc->strmout[srcv->sinfo_stream];
/* how big is it ? */
if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.len)) {
dataout = m->m_pkthdr.len;
} else {
/* we must count */
dataout = 0;
for (n = m; n; n = n->m_next) {
dataout += n->m_len;
}
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Attempt to send out %d bytes\n",
dataout);
}
#endif

/* lock the socket buf */
error = sblock(&so->so_snd, SBLOCKWAIT(flags));
if (error)
goto out_locked;

if (dataout > so->so_snd.sb_hiwat) {
/* It will NEVER fit */
error = EMSGSIZE;
goto release;
}
if ((srcv->sinfo_flags & SCTP_EOF) &&
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
(dataout == 0)
) {
goto zap_by_it_all;
}
if ((so->so_snd.sb_hiwat <
(dataout + asoc->total_output_queue_size)) ||
(asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
(asoc->total_output_mbuf_queue_size >
so->so_snd.sb_mbmax)
) {
/* XXX Buffer space hunt for data to skip */
if (asoc->peer_supports_prsctp) {
sctp_prune_prsctp(stcb, asoc, srcv, dataout);
}
while ((so->so_snd.sb_hiwat <
(dataout + asoc->total_output_queue_size)) ||
(asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
(asoc->total_output_mbuf_queue_size >
so->so_snd.sb_mbmax)) {
struct sctp_inpcb *inp;
/* Now did we free up enough room? */
if (so->so_state & SS_NBIO) {
/* Non-blocking io in place */
error = EWOULDBLOCK;
goto release;
}
/*
* We store off a pointer to the endpoint.
* Since on return from this we must check to
* see if an so_error is set. If so we may have
* been reset and our stcb destroyed. Returning
* an error will cause the correct error return
* through and fix this all.
*/
inp = stcb->sctp_ep;
/*
* Not sure how else to do this since
* the level we suspended at is not
* known deep down where we are. I will
* drop to spl0() so that others can
* get in.
*/

inp->sctp_tcb_at_block = (void *)stcb;
inp->error_on_block = 0;
sbunlock(&so->so_snd);
error = sbwait(&so->so_snd);
/*
* XXX: This is ugly but I have
* recreated most of what goes on to
* block in the sb. UGHH
* May want to add the bit about being
* no longer connected.. but this then
* further dooms the UDP model NOT to
* allow this.
*/
inp->sctp_tcb_at_block = 0;
if (inp->error_on_block)
error = inp->error_on_block;
if (so->so_error)
error = so->so_error;
if (error) {
goto out_locked;
}
error = sblock(&so->so_snd, M_WAITOK);
if (error)
goto out_locked;
/* Otherwise we cycle back and recheck
* the space
*/
#if defined(__FreeBSD__) && __FreeBSD_version >= 502115
if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
#else
if (so->so_state & SS_CANTSENDMORE) {
#endif
error = EPIPE;
goto release;
}
if (so->so_error) {
error = so->so_error;
goto release;
}
}
}
/* If we have a packet header fix it if it was broke */
if (m->m_flags & M_PKTHDR) {
m->m_pkthdr.len = dataout;
}
/* use the smallest one, user set value or
* smallest mtu of the asoc
*/
siz = sctp_get_frag_point(stcb, asoc);
if ((dataout) && (dataout <= siz)) {
/* Fast path */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
error = ENOMEM;
goto release;
}
sctp_prepare_chunk(chk, stcb, srcv, strq, net);
chk->whoTo->ref_count++;
chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;

/* no flags yet, FRAGMENT_OK goes here */
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
asoc->chunks_on_out_queue++;
chk->data = m;
m = NULL;
/* Total in the MSIZE */
for (mm = chk->data; mm; mm = mm->m_next) {
mbcnt += MSIZE;
if (mm->m_flags & M_EXT) {
mbcnt += chk->data->m_ext.ext_size;
}
}
/* fix up the send_size if it is not present */
chk->send_size = dataout;
chk->book_size = chk->send_size;
chk->mbcnt = mbcnt;
/* ok, we are committed */
if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
/* bump the ssn if we are unordered. */
strq->next_sequence_sent++;
}
chk->data->m_nextpkt = 0;
asoc->stream_queue_cnt++;
TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
/* now check if this stream is on the wheel */
if ((strq->next_spoke.tqe_next == NULL) &&
(strq->next_spoke.tqe_prev == NULL)) {
/* Insert it on the wheel since it is not
* on it currently
*/
sctp_insert_on_wheel(asoc, strq);
}
} else if ((dataout) && (dataout > siz)) {
/* Slow path */
if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NO_FRAGMENT) &&
(dataout > siz)) {
error = EMSGSIZE;
goto release;
}
/* setup the template */
sctp_prepare_chunk(&template, stcb, srcv, strq, net);

n = m;
while (dataout > siz) {
/*
* We can wait since this is called from the user
* send side
*/
n->m_nextpkt = m_split(n, siz, M_WAIT);
if (n->m_nextpkt == NULL) {
error = EFAULT;
goto release;
}
dataout -= siz;
n = n->m_nextpkt;
}
/*
* ok, now we have a chain on m where m->m_nextpkt points to
* the next chunk and m/m->m_next chain is the piece to send.
* We must go through the chains and thread them on to
* sctp_tmit_chunk chains and place them all on the stream
* queue, breaking the m->m_nextpkt pointers as we go.
*/
n = m;
TAILQ_INIT(&tmp);
while (n) {
/*
* first go through and allocate a sctp_tmit chunk
* for each chunk piece
*/
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/*
* ok we must spin through and dump anything
* we have allocated and then jump to the
* no_membad
*/
chk = TAILQ_FIRST(&tmp);
while (chk) {
TAILQ_REMOVE(&tmp, chk, sctp_next);
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
asoc->chunks_on_out_queue--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
chk = TAILQ_FIRST(&tmp);
}
error = ENOMEM;
goto release;
}
sctppcbinfo.ipi_count_chunk++;
asoc->chunks_on_out_queue++;

sctppcbinfo.ipi_gencnt_chunk++;
*chk = template;
chk->whoTo->ref_count++;
chk->data = n;
/* Total in the MSIZE */
mbcnt_e = 0;
for (mm = chk->data; mm; mm = mm->m_next) {
mbcnt_e += MSIZE;
if (mm->m_flags & M_EXT) {
mbcnt_e += chk->data->m_ext.ext_size;
}
}
/* now fix the chk->send_size */
if (chk->data->m_flags & M_PKTHDR) {
chk->send_size = chk->data->m_pkthdr.len;
} else {
struct mbuf *nn;
chk->send_size = 0;
for (nn = chk->data; nn; nn = nn->m_next) {
chk->send_size += nn->m_len;
}
}
chk->book_size = chk->send_size;
chk->mbcnt = mbcnt_e;
mbcnt += mbcnt_e;
if (chk->flags & SCTP_PR_SCTP_BUFFER) {
asoc->sent_queue_cnt_removeable++;
}
n = n->m_nextpkt;
TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
}
m = NULL;
/* now that we have enough space for all de-couple the
* chain of mbufs by going through our temp array
* and breaking the pointers.
*/
/* ok, we are committed */
if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
/* bump the ssn if we are unordered. */
strq->next_sequence_sent++;
}
/* Mark the first/last flags. This will
* result int a 3 for a single item on the list
*/
chk = TAILQ_FIRST(&tmp);
chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
/* now break any chains on the queue and
* move it to the streams actual queue.
*/
chk = TAILQ_FIRST(&tmp);
while (chk) {
chk->data->m_nextpkt = 0;
TAILQ_REMOVE(&tmp, chk, sctp_next);
asoc->stream_queue_cnt++;
TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
chk = TAILQ_FIRST(&tmp);
}
/* now check if this stream is on the wheel */
if ((strq->next_spoke.tqe_next == NULL) &&
(strq->next_spoke.tqe_prev == NULL)) {
/* Insert it on the wheel since it is not
* on it currently
*/
sctp_insert_on_wheel(asoc, strq);
}
}
/* has a SHUTDOWN been (also) requested by the user on this asoc? */
zap_by_it_all:

if ((srcv->sinfo_flags & SCTP_EOF) &&
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {

int some_on_streamwheel = 0;

if (!TAILQ_EMPTY(&asoc->out_wheel)) {
/* Check to see if some data queued */
struct sctp_stream_out *outs;
TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
if (!TAILQ_EMPTY(&outs->outqueue)) {
some_on_streamwheel = 1;
break;
}
}
}

if (TAILQ_EMPTY(&asoc->send_queue) &&
TAILQ_EMPTY(&asoc->sent_queue) &&
(some_on_streamwheel == 0)) {
/* there is nothing queued to send, so I'm done... */
if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
(SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
/* only send SHUTDOWN the first time through */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("%s:%d sends a shutdown\n",
__FILE__,
__LINE__
);
}
#endif
sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
asoc->state = SCTP_STATE_SHUTDOWN_SENT;
sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
asoc->primary_destination);
sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
asoc->primary_destination);
}
} else {
/*
* we still got (or just got) data to send, so set
* SHUTDOWN_PENDING
*/
asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
}
}
#ifdef SCTP_MBCNT_LOGGING
sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
asoc->total_output_queue_size,
dataout,
asoc->total_output_mbuf_queue_size,
mbcnt);
#endif
asoc->total_output_queue_size += dataout;
asoc->total_output_mbuf_queue_size += mbcnt;
if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
so->so_snd.sb_cc += dataout;
so->so_snd.sb_mbcnt += mbcnt;
}

#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("++total out:%d total_mbuf_out:%d\n",
(int)asoc->total_output_queue_size,
(int)asoc->total_output_mbuf_queue_size);
}
#endif

release:
sbunlock(&so->so_snd);
out_locked:

out:
if (m && m->m_nextpkt) {
n = m;
while (n) {
mnext = n->m_nextpkt;
n->m_nextpkt = NULL;
sctp_m_freem(n);
n = mnext;
}
} else {
sctp_m_freem(m);
}

return (error);
}

static struct mbuf *
sctp_copy_mbufchain(struct mbuf *clonechain,
struct mbuf *outchain)
{
struct mbuf *appendchain;
#if defined(__FreeBSD__) || defined(__NetBSD__)
/* Supposedly m_copypacket is an optimization, use it if we can */
if (clonechain->m_flags & M_PKTHDR) {
appendchain = m_copypacket(clonechain, M_DONTWAIT);
sctp_pegs[SCTP_CACHED_SRC]++;
} else
appendchain = m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT);
#elif defined(__APPLE__)
appendchain = sctp_m_copym(clonechain, 0, M_COPYALL, M_DONTWAIT);
#else
appendchain = m_copy(clonechain, 0, M_COPYALL);
#endif

if (appendchain == NULL) {
/* error */
sctp_m_freem(outchain);
return (NULL);
}
if (outchain) {
/* tack on to the end */
struct mbuf *m;
m = outchain;
while (m) {
if (m->m_next == NULL) {
m->m_next = appendchain;
break;
}
m = m->m_next;
}
if (outchain->m_flags & M_PKTHDR) {
int append_tot;
struct mbuf *t;
t = appendchain;
append_tot = 0;
while (t) {
append_tot += t->m_len;
t = t->m_next;
}
outchain->m_pkthdr.len += append_tot;
}
return (outchain);
} else {
return (appendchain);
}
}

static void
sctp_sendall_iterator(struct sctp_inpcb *inp, struct sctp_tcb *stcb, void *ptr, u_int32_t val)
{
struct sctp_copy_all *ca;
struct mbuf *m;
int turned_on_nonblock=0, ret;

ca = (struct sctp_copy_all *)ptr;
if (ca->m == NULL) {
return;
}
if (ca->inp != inp) {
/* TSNH */
return;
}
m = sctp_copy_mbufchain(ca->m, NULL);
if (m == NULL) {
/* can't copy so we are done */
ca->cnt_failed++;
return;
}
if ((stcb->sctp_socket->so_state & SS_NBIO) == 0) {
/* we have to do this non-blocking */
turned_on_nonblock = 1;
stcb->sctp_socket->so_state |= SS_NBIO;
}
ret = sctp_msg_append(stcb, stcb->asoc.primary_destination, m, &ca->sndrcv, 0);
if (turned_on_nonblock) {
/* we turned on non-blocking so turn it off */
stcb->sctp_socket->so_state &= ~SS_NBIO;
}
if (ret) {
ca->cnt_failed++;
} else {
ca->cnt_sent++;
}
}

static void
sctp_sendall_completes(void *ptr, u_int32_t val)
{
struct sctp_copy_all *ca;
ca = (struct sctp_copy_all *)ptr;
/* Do a notify here?
* Kacheong suggests that the notify
* be done at the send time.. so you would
* push up a notification if any send failed.
* Don't know if this is feasible since the
* only failures we have is "memory" related and
* if you cannot get an mbuf to send the data
* you surely can't get an mbuf to send up
* to notify the user you can't send the data :->
*/

/* now free everything */
m_freem(ca->m);
free(ca, M_PCB);
}

#define MC_ALIGN(m, len) do { \
(m)->m_data += (MCLBYTES - (len)) & ~(sizeof(long) - 1); \
} while (0)

static struct mbuf *
sctp_copy_out_all(struct uio *uio, int len)
{
struct mbuf *ret, *at;
int left, willcpy, cancpy, error;

MGETHDR(ret, M_WAIT, MT_HEADER);
if (ret == NULL) {
/* TSNH */
return (NULL);
}
left = len;
ret->m_len = 0;
ret->m_pkthdr.len = len;
MCLGET(ret, M_WAIT);
if (ret == NULL) {
return (NULL);
}
if ((ret->m_flags & M_EXT) == 0) {
m_freem (ret);
return (NULL);
}
cancpy = M_TRAILINGSPACE(ret);
willcpy = uimin(cancpy, left);
at = ret;
while (left > 0) {
/* Align data to the end */
MC_ALIGN(at, willcpy);
error = uiomove(mtod(at, void *), willcpy, uio);
if (error) {
err_out_now:
m_freem(ret);
return (NULL);
}
at->m_len = willcpy;
at->m_nextpkt = at->m_next = 0;
left -= willcpy;
if (left > 0) {
MGET(at->m_next, M_WAIT, MT_DATA);
if (at->m_next == NULL) {
goto err_out_now;
}
at = at->m_next;
at->m_len = 0;
MCLGET(at, M_WAIT);
if (at == NULL) {
goto err_out_now;
}
if ((at->m_flags & M_EXT) == 0) {
goto err_out_now;
}
cancpy = M_TRAILINGSPACE(at);
willcpy = uimin(cancpy, left);
}
}
return (ret);
}

static int
sctp_sendall (struct sctp_inpcb *inp, struct uio *uio, struct mbuf *m, struct sctp_sndrcvinfo *srcv)
{
int ret;
struct sctp_copy_all *ca;
ca = malloc(sizeof(struct sctp_copy_all), M_PCB, M_WAIT);
if (ca == NULL) {
m_freem(m);
return (ENOMEM);
}
memset (ca, 0, sizeof(struct sctp_copy_all));

ca->inp = inp;
ca->sndrcv = *srcv;
/* take off the sendall flag, it would
* be bad if we failed to do this :-0
*/
ca->sndrcv.sinfo_flags &= ~SCTP_SENDALL;

/* get length and mbuf chain */
if (uio) {
ca->sndlen = uio->uio_resid;
ca->m = sctp_copy_out_all(uio, ca->sndlen);
if (ca->m == NULL) {
free(ca, M_PCB);
return (ENOMEM);
}
} else {
if ((m->m_flags & M_PKTHDR) == 0) {
ca->sndlen = 0;
while(m) {
ca->sndlen += m->m_len;
m = m->m_next;
}
} else {
ca->sndlen = m->m_pkthdr.len;
}
ca->m = m;
}

ret = sctp_initiate_iterator(sctp_sendall_iterator, SCTP_PCB_ANY_FLAGS, SCTP_ASOC_ANY_STATE,
(void *)ca, 0, sctp_sendall_completes, inp);
if (ret) {
#ifdef SCTP_DEBUG
printf("Failed to initiate iterator to takeover associations\n");
#endif
free(ca, M_PCB);
return (EFAULT);

}
return (0);
}

void
sctp_toss_old_cookies(struct sctp_association *asoc)
{
struct sctp_tmit_chunk *chk, *nchk;
chk = TAILQ_FIRST(&asoc->control_send_queue);
while (chk) {
nchk = TAILQ_NEXT(chk, sctp_next);
if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
sctp_m_freem(chk->data);
chk->data = NULL;
asoc->ctrl_queue_cnt--;
if (chk->whoTo)
sctp_free_remote_addr(chk->whoTo);
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
}
chk = nchk;
}
}

void
sctp_toss_old_asconf(struct sctp_tcb *stcb)
{
struct sctp_association *asoc;
struct sctp_tmit_chunk *chk, *chk_tmp;

asoc = &stcb->asoc;
for (chk = TAILQ_FIRST(&asoc->control_send_queue); chk != NULL;
chk = chk_tmp) {
/* get next chk */
chk_tmp = TAILQ_NEXT(chk, sctp_next);
/* find SCTP_ASCONF chunk in queue (only one ever in queue) */
if (chk->rec.chunk_id == SCTP_ASCONF) {
TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
sctp_m_freem(chk->data);
chk->data = NULL;
asoc->ctrl_queue_cnt--;
if (chk->whoTo)
sctp_free_remote_addr(chk->whoTo);
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
}
}
}

static void
sctp_clean_up_datalist(struct sctp_tcb *stcb,
struct sctp_association *asoc,
struct sctp_tmit_chunk **data_list,
int bundle_at,
struct sctp_nets *net)
{
int i;
for (i = 0; i < bundle_at; i++) {
/* off of the send queue */
if (i) {
/* Any chunk NOT 0 you zap the time
* chunk 0 gets zapped or set based on
* if a RTO measurement is needed.
*/
data_list[i]->do_rtt = 0;
}
/* record time */
data_list[i]->sent_rcv_time = net->last_sent_time;
TAILQ_REMOVE(&asoc->send_queue,
data_list[i],
sctp_next);
/* on to the sent queue */
TAILQ_INSERT_TAIL(&asoc->sent_queue,
data_list[i],
sctp_next);
/* This does not lower until the cum-ack passes it */
asoc->sent_queue_cnt++;
asoc->send_queue_cnt--;
if ((asoc->peers_rwnd <= 0) &&
(asoc->total_flight == 0) &&
(bundle_at == 1)) {
/* Mark the chunk as being a window probe */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("WINDOW PROBE SET\n");
}
#endif
sctp_pegs[SCTP_WINDOW_PROBES]++;
data_list[i]->rec.data.state_flags |= SCTP_WINDOW_PROBE;
} else {
data_list[i]->rec.data.state_flags &= ~SCTP_WINDOW_PROBE;
}
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC2, 3);
#endif
data_list[i]->sent = SCTP_DATAGRAM_SENT;
data_list[i]->snd_count = 1;
net->flight_size += data_list[i]->book_size;
asoc->total_flight += data_list[i]->book_size;
asoc->total_flight_count++;
#ifdef SCTP_LOG_RWND
sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
#endif
asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
(u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
/* SWS sender side engages */
asoc->peers_rwnd = 0;
}
}
}

static void
sctp_clean_up_ctl(struct sctp_association *asoc)
{
struct sctp_tmit_chunk *chk, *nchk;
for (chk = TAILQ_FIRST(&asoc->control_send_queue);
chk; chk = nchk) {
nchk = TAILQ_NEXT(chk, sctp_next);
if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
(chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
(chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
(chk->rec.chunk_id == SCTP_SHUTDOWN) ||
(chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
(chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
(chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
(chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
(chk->rec.chunk_id == SCTP_ECN_CWR) ||
(chk->rec.chunk_id == SCTP_ASCONF_ACK)) {
/* Stray chunks must be cleaned up */
clean_up_anyway:
TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
sctp_m_freem(chk->data);
chk->data = NULL;
asoc->ctrl_queue_cnt--;
sctp_free_remote_addr(chk->whoTo);
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
} else if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
struct sctp_stream_reset_req *strreq;
/* special handling, we must look into the param */
strreq = mtod(chk->data, struct sctp_stream_reset_req *);
if (strreq->sr_req.ph.param_type == ntohs(SCTP_STR_RESET_RESPONSE)) {
goto clean_up_anyway;
}
}
}
}

static int
sctp_move_to_outqueue(struct sctp_tcb *stcb,
struct sctp_stream_out *strq)
{
/* Move from the stream to the send_queue keeping track of the total */
struct sctp_association *asoc;
int tot_moved = 0;
int failed = 0;
int padval;
struct sctp_tmit_chunk *chk, *nchk;
struct sctp_data_chunk *dchkh;
struct sctpchunk_listhead tmp;
struct mbuf *orig;

asoc = &stcb->asoc;
TAILQ_INIT(&tmp);
chk = TAILQ_FIRST(&strq->outqueue);
while (chk) {
nchk = TAILQ_NEXT(chk, sctp_next);
/* now put in the chunk header */
orig = chk->data;
M_PREPEND(chk->data, sizeof(struct sctp_data_chunk), M_DONTWAIT);
if (chk->data == NULL) {
/* HELP */
failed++;
break;
}
if (orig != chk->data) {
/* A new mbuf was added, account for it */
if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
stcb->sctp_socket->so_snd.sb_mbcnt += MSIZE;
}
#ifdef SCTP_MBCNT_LOGGING
sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
asoc->total_output_queue_size,
0,
asoc->total_output_mbuf_queue_size,
MSIZE);
#endif
stcb->asoc.total_output_mbuf_queue_size += MSIZE;
chk->mbcnt += MSIZE;
}
chk->send_size += sizeof(struct sctp_data_chunk);
/* This should NOT have to do anything, but
* I would rather be cautious
*/
if (!failed && ((size_t)chk->data->m_len < sizeof(struct sctp_data_chunk))) {
m_pullup(chk->data, sizeof(struct sctp_data_chunk));
if (chk->data == NULL) {
failed++;
break;
}
}
dchkh = mtod(chk->data, struct sctp_data_chunk *);
dchkh->ch.chunk_length = htons(chk->send_size);
/* Chunks must be padded to even word boundary */
padval = chk->send_size % 4;
if (padval) {
/* For fragmented messages this should not
* run except possibly on the last chunk
*/
if (sctp_pad_lastmbuf(chk->data, (4 - padval))) {
/* we are in big big trouble no mbufs :< */
failed++;
break;
}
chk->send_size += (4 - padval);
}
/* pull from stream queue */
TAILQ_REMOVE(&strq->outqueue, chk, sctp_next);
asoc->stream_queue_cnt--;
TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
/* add it in to the size of moved chunks */
if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
/* we pull only one message */
break;
}
chk = nchk;
}
if (failed) {
/* Gak, we just lost the user message */
chk = TAILQ_FIRST(&tmp);
while (chk) {
nchk = TAILQ_NEXT(chk, sctp_next);
TAILQ_REMOVE(&tmp, chk, sctp_next);

sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
(SCTP_NOTIFY_DATAGRAM_UNSENT|SCTP_INTERNAL_ERROR),
chk);

sctp_m_freem(chk->data);
chk->data = NULL;
if (chk->whoTo) {
sctp_free_remote_addr(chk->whoTo);
chk->whoTo = NULL;
}
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
chk = nchk;
}
return (0);
}
/* now pull them off of temp wheel */
chk = TAILQ_FIRST(&tmp);
while (chk) {
nchk = TAILQ_NEXT(chk, sctp_next);
/* insert on send_queue */
TAILQ_REMOVE(&tmp, chk, sctp_next);
TAILQ_INSERT_TAIL(&asoc->send_queue, chk, sctp_next);
asoc->send_queue_cnt++;
/* assign TSN */
chk->rec.data.TSN_seq = asoc->sending_seq++;

dchkh = mtod(chk->data, struct sctp_data_chunk *);
/* Put the rest of the things in place now. Size
* was done earlier in previous loop prior to
* padding.
*/
dchkh->ch.chunk_type = SCTP_DATA;
dchkh->ch.chunk_flags = chk->rec.data.rcv_flags;
dchkh->dp.tsn = htonl(chk->rec.data.TSN_seq);
dchkh->dp.stream_id = htons(strq->stream_no);
dchkh->dp.stream_sequence = htons(chk->rec.data.stream_seq);
dchkh->dp.protocol_id = chk->rec.data.payloadtype;
/* total count moved */
tot_moved += chk->send_size;
chk = nchk;
}
return (tot_moved);
}

static void
sctp_fill_outqueue(struct sctp_tcb *stcb,
struct sctp_nets *net)
{
struct sctp_association *asoc;
struct sctp_tmit_chunk *chk;
struct sctp_stream_out *strq, *strqn;
int mtu_fromwheel, goal_mtu;
unsigned int moved, seenend, cnt_mvd=0;

asoc = &stcb->asoc;
/* Attempt to move at least 1 MTU's worth
* onto the wheel for each destination address
*/
goal_mtu = net->cwnd - net->flight_size;
if ((unsigned int)goal_mtu < net->mtu) {
goal_mtu = net->mtu;
}
if (sctp_pegs[SCTP_MOVED_MTU] < (unsigned int)goal_mtu) {
sctp_pegs[SCTP_MOVED_MTU] = goal_mtu;
}
seenend = moved = mtu_fromwheel = 0;
if (asoc->last_out_stream == NULL) {
strq = asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
if (asoc->last_out_stream == NULL) {
/* huh nothing on the wheel, TSNH */
return;
}
goto done_it;
}
strq = TAILQ_NEXT(asoc->last_out_stream, next_spoke);
done_it:
if (strq == NULL) {
asoc->last_out_stream = TAILQ_FIRST(&asoc->out_wheel);
}
while (mtu_fromwheel < goal_mtu) {
if (strq == NULL) {
if (seenend == 0) {
seenend = 1;
strq = TAILQ_FIRST(&asoc->out_wheel);
} else if ((moved == 0) && (seenend)) {
/* none left on the wheel */
sctp_pegs[SCTP_MOVED_NLEF]++;
return;
} else if (moved) {
/*
* clear the flags and rotate back through
* again
*/
moved = 0;
seenend = 0;
strq = TAILQ_FIRST(&asoc->out_wheel);
}
if (strq == NULL)
break;
continue;
}
strqn = TAILQ_NEXT(strq, next_spoke);
if ((chk = TAILQ_FIRST(&strq->outqueue)) == NULL) {
/* none left on this queue, prune a spoke? */
sctp_remove_from_wheel(asoc, strq);
if (strq == asoc->last_out_stream) {
/* the last one we used went off the wheel */
asoc->last_out_stream = NULL;
}
strq = strqn;
continue;
}
if (chk->whoTo != net) {
/* Skip this stream, first one on stream
* does not head to our current destination.
*/
strq = strqn;
continue;
}
mtu_fromwheel += sctp_move_to_outqueue(stcb, strq);
cnt_mvd++;
moved++;
asoc->last_out_stream = strq;
strq = strqn;
}
sctp_pegs[SCTP_MOVED_MAX]++;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Ok we moved %d chunks to send queue\n",
moved);
}
#endif
if (sctp_pegs[SCTP_MOVED_QMAX] < cnt_mvd) {
sctp_pegs[SCTP_MOVED_QMAX] = cnt_mvd;
}
}

void
sctp_fix_ecn_echo(struct sctp_association *asoc)
{
struct sctp_tmit_chunk *chk;
TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
chk->sent = SCTP_DATAGRAM_UNSENT;
}
}
}

static void
sctp_move_to_an_alt(struct sctp_tcb *stcb,
struct sctp_association *asoc,
struct sctp_nets *net)
{
struct sctp_tmit_chunk *chk;
struct sctp_nets *a_net;
a_net = sctp_find_alternate_net(stcb, net);
if ((a_net != net) &&
((a_net->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE)) {
/*
* We only proceed if a valid alternate is found that is
* not this one and is reachable. Here we must move all
* chunks queued in the send queue off of the destination
* address to our alternate.
*/
TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
if (chk->whoTo == net) {
/* Move the chunk to our alternate */
sctp_free_remote_addr(chk->whoTo);
chk->whoTo = a_net;
a_net->ref_count++;
}
}
}
}

static int sctp_from_user_send=0;

static int
sctp_med_chunk_output(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_association *asoc,
int *num_out,
int *reason_code,
int control_only, int *cwnd_full, int from_where,
struct timeval *now, int *now_filled)
{
/*
* Ok this is the generic chunk service queue.
* we must do the following:
* - Service the stream queue that is next, moving any message
* (note I must get a complete message i.e. FIRST/MIDDLE and
* LAST to the out queue in one pass) and assigning TSN's
* - Check to see if the cwnd/rwnd allows any output, if so we
* go ahead and fomulate and send the low level chunks. Making
* sure to combine any control in the control chunk queue also.
*/
struct sctp_nets *net;
struct mbuf *outchain;
struct sctp_tmit_chunk *chk, *nchk;
struct sctphdr *shdr;
/* temp arrays for unlinking */
struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
int no_fragmentflg, error;
int one_chunk, hbflag;
int asconf, cookie, no_out_cnt;
int bundle_at, ctl_cnt, no_data_chunks, cwnd_full_ind;
unsigned int mtu, r_mtu, omtu;
*num_out = 0;
cwnd_full_ind = 0;
ctl_cnt = no_out_cnt = asconf = cookie = 0;
/*
* First lets prime the pump. For each destination, if there
* is room in the flight size, attempt to pull an MTU's worth
* out of the stream queues into the general send_queue
*/
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC2, 2);
#endif
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("***********************\n");
}
#endif
hbflag = 0;
if (control_only)
no_data_chunks = 1;
else
no_data_chunks = 0;

/* Nothing to possible to send? */
if (TAILQ_EMPTY(&asoc->control_send_queue) &&
TAILQ_EMPTY(&asoc->send_queue) &&
TAILQ_EMPTY(&asoc->out_wheel)) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("All wheels empty\n");
}
#endif
return (0);
}
if (asoc->peers_rwnd <= 0) {
/* No room in peers rwnd */
*cwnd_full = 1;
*reason_code = 1;
if (asoc->total_flight > 0) {
/* we are allowed one chunk in flight */
no_data_chunks = 1;
sctp_pegs[SCTP_RWND_BLOCKED]++;
}
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Ok we have done the fillup no_data_chunk=%d tf=%d prw:%d\n",
(int)no_data_chunks,
(int)asoc->total_flight, (int)asoc->peers_rwnd);
}
#endif
TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("net:%p fs:%d cwnd:%d\n",
net, net->flight_size, net->cwnd);
}
#endif
if (net->flight_size >= net->cwnd) {
/* skip this network, no room */
cwnd_full_ind++;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Ok skip fillup->fs:%d > cwnd:%d\n",
net->flight_size,
net->cwnd);
}
#endif
sctp_pegs[SCTP_CWND_NOFILL]++;
continue;
}
/*
* spin through the stream queues moving one message and
* assign TSN's as appropriate.
*/
sctp_fill_outqueue(stcb, net);
}
*cwnd_full = cwnd_full_ind;
/* now service each destination and send out what we can for it */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
int chk_cnt = 0;
TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
chk_cnt++;
}
printf("We have %d chunks on the send_queue\n", chk_cnt);
chk_cnt = 0;
TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
chk_cnt++;
}
printf("We have %d chunks on the sent_queue\n", chk_cnt);
TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
chk_cnt++;
}
printf("We have %d chunks on the control_queue\n", chk_cnt);
}
#endif
/* If we have data to send, and DSACK is running, stop it
* and build a SACK to dump on to bundle with output. This
* actually MAY make it so the bundling does not occur if
* the SACK is big but I think this is ok because basic SACK
* space is pre-reserved in our fragmentation size choice.
*/
if ((TAILQ_FIRST(&asoc->send_queue) != NULL) &&
(no_data_chunks == 0)) {
/* We will be sending something */
if (callout_pending(&stcb->asoc.dack_timer.timer)) {
/* Yep a callout is pending */
sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep,
stcb, NULL);
sctp_send_sack(stcb);
}
}
/* Nothing to send? */
if ((TAILQ_FIRST(&asoc->control_send_queue) == NULL) &&
(TAILQ_FIRST(&asoc->send_queue) == NULL)) {
return (0);
}
TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
struct rtentry *rt;
/* how much can we send? */
if (net->ref_count < 2) {
/* Ref-count of 1 so we cannot have data or control
* queued to this address. Skip it.
*/
continue;
}
ctl_cnt = bundle_at = 0;
outchain = NULL;
no_fragmentflg = 1;
one_chunk = 0;

rt = rtcache_validate(&net->ro);
if (rt != NULL) {
/* if we have a route and an ifp
* check to see if we have room to
* send to this guy
*/
struct ifnet *ifp;
ifp = net->ro._ro_rt->rt_ifp;
if ((ifp->if_snd.ifq_len + 2) >= ifp->if_snd.ifq_maxlen) {
sctp_pegs[SCTP_IFP_QUEUE_FULL]++;
#ifdef SCTP_LOG_MAXBURST
sctp_log_maxburst(net, ifp->if_snd.ifq_len, ifp->if_snd.ifq_maxlen, SCTP_MAX_IFP_APPLIED);
#endif
rtcache_unref(rt, &net->ro);
continue;
}
rtcache_unref(rt, &net->ro);
}
if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) {
mtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
} else {
mtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
}
if (mtu > asoc->peers_rwnd) {
if (asoc->total_flight > 0) {
/* We have a packet in flight somewhere */
r_mtu = asoc->peers_rwnd;
} else {
/* We are always allowed to send one MTU out */
one_chunk = 1;
r_mtu = mtu;
}
} else {
r_mtu = mtu;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Ok r_mtu is %d mtu is %d for this net:%p one_chunk:%d\n",
r_mtu, mtu, net, one_chunk);
}
#endif
/************************/
/* Control transmission */
/************************/
/* Now first lets go through the control queue */
for (chk = TAILQ_FIRST(&asoc->control_send_queue);
chk; chk = nchk) {
nchk = TAILQ_NEXT(chk, sctp_next);
if (chk->whoTo != net) {
/*
* No, not sent to the network we are
* looking at
*/
continue;
}
if (chk->data == NULL) {
continue;
}
if ((chk->data->m_flags & M_PKTHDR) == 0) {
/*
* NOTE: the chk queue MUST have the PKTHDR
* flag set on it with a total in the
* m_pkthdr.len field!! else the chunk will
* ALWAYS be skipped
*/
continue;
}
if (chk->sent != SCTP_DATAGRAM_UNSENT) {
/*
* It must be unsent. Cookies and ASCONF's
* hang around but there timers will force
* when marked for resend.
*/
continue;
}
/* Here we do NOT factor the r_mtu */
if ((chk->data->m_pkthdr.len < (int)mtu) ||
(chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
/*
* We probably should glom the mbuf chain from
* the chk->data for control but the problem
* is it becomes yet one more level of
* tracking to do if for some reason output
* fails. Then I have got to reconstruct the
* merged control chain.. el yucko.. for now
* we take the easy way and do the copy
*/
outchain = sctp_copy_mbufchain(chk->data,
outchain);
if (outchain == NULL) {
return (ENOMEM);
}
/* update our MTU size */
if (mtu > chk->data->m_pkthdr.len)
mtu -= chk->data->m_pkthdr.len;
else
mtu = 0;
/* Do clear IP_DF ? */
if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
no_fragmentflg = 0;
}
/* Mark things to be removed, if needed */
if ((chk->rec.chunk_id == SCTP_SELECTIVE_ACK) ||
(chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST) ||
(chk->rec.chunk_id == SCTP_HEARTBEAT_ACK) ||
(chk->rec.chunk_id == SCTP_SHUTDOWN) ||
(chk->rec.chunk_id == SCTP_SHUTDOWN_ACK) ||
(chk->rec.chunk_id == SCTP_OPERATION_ERROR) ||
(chk->rec.chunk_id == SCTP_COOKIE_ACK) ||
(chk->rec.chunk_id == SCTP_ECN_CWR) ||
(chk->rec.chunk_id == SCTP_PACKET_DROPPED) ||
(chk->rec.chunk_id == SCTP_ASCONF_ACK)) {

if (chk->rec.chunk_id == SCTP_HEARTBEAT_REQUEST)
hbflag = 1;
/* remove these chunks at the end */
if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
/* turn off the timer */
if (callout_pending(&stcb->asoc.dack_timer.timer)) {
sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
inp, stcb, net);
}
}
ctl_cnt++;
} else {
/*
* Other chunks, since they have
* timers running (i.e. COOKIE or
* ASCONF) we just "trust" that it
* gets sent or retransmitted.
*/
ctl_cnt++;
if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
cookie = 1;
no_out_cnt = 1;
} else if (chk->rec.chunk_id == SCTP_ASCONF) {
/*
* set hb flag since we can use
* these for RTO
*/
hbflag = 1;
asconf = 1;
}
chk->sent = SCTP_DATAGRAM_SENT;
chk->snd_count++;
}
if (mtu == 0) {
/*
* Ok we are out of room but we can
* output without effecting the flight
* size since this little guy is a
* control only packet.
*/
if (asconf) {
sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
asconf = 0;
}
if (cookie) {
sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
cookie = 0;
}
if (outchain->m_len == 0) {
/*
* Special case for when you
* get a 0 len mbuf at the
* head due to the lack of a
* MHDR at the beginning.
*/
outchain->m_len = sizeof(struct sctphdr);
} else {
M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
if (outchain == NULL) {
/* no memory */
error = ENOBUFS;
goto error_out_again;
}
}
shdr = mtod(outchain, struct sctphdr *);
shdr->src_port = inp->sctp_lport;
shdr->dest_port = stcb->rport;
shdr->v_tag = htonl(stcb->asoc.peer_vtag);
shdr->checksum = 0;

if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
rtcache_getdst(&net->ro),
outchain,
no_fragmentflg, 0, NULL, asconf))) {
if (error == ENOBUFS) {
asoc->ifp_had_enobuf = 1;
}
sctp_pegs[SCTP_DATA_OUT_ERR]++;
if (from_where == 0) {
sctp_pegs[SCTP_ERROUT_FRM_USR]++;
}
error_out_again:
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("Gak got ctrl error %d\n", error);
}
#endif
/* error, could not output */
if (hbflag) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Update HB anyway\n");
}
#endif
if (*now_filled == 0) {
SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
*now_filled = 1;
*now = net->last_sent_time;
} else {
net->last_sent_time = *now;
}
hbflag = 0;
}
if (error == EHOSTUNREACH ||
error == EHOSTDOWN) {
/*
* Destination went
* unreachable during
* this send
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Moving data to an alterante\n");
}
#endif
sctp_move_to_an_alt(stcb, asoc, net);
}
sctp_clean_up_ctl (asoc);
return (error);
} else
asoc->ifp_had_enobuf = 0;
/* Only HB or ASCONF advances time */
if (hbflag) {
if (*now_filled == 0) {
SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
*now_filled = 1;
*now = net->last_sent_time;
} else {
net->last_sent_time = *now;
}
hbflag = 0;
}
/*
* increase the number we sent, if a
* cookie is sent we don't tell them
* any was sent out.
*/
if (!no_out_cnt)
*num_out += ctl_cnt;
/* recalc a clean slate and setup */
if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
mtu = (net->mtu - SCTP_MIN_OVERHEAD);
} else {
mtu = (net->mtu - SCTP_MIN_V4_OVERHEAD);
}
no_fragmentflg = 1;
}
}
}
/*********************/
/* Data transmission */
/*********************/
/* now lets add any data within the MTU constraints */
if (((struct sockaddr *)&net->ro.ro_sa)->sa_family == AF_INET) {
omtu = net->mtu - (sizeof(struct ip) + sizeof(struct sctphdr));
} else {
omtu = net->mtu - (sizeof(struct ip6_hdr) + sizeof(struct sctphdr));
}

#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Now to data transmission\n");
}
#endif

if (((asoc->state & SCTP_STATE_OPEN) == SCTP_STATE_OPEN) ||
(cookie)) {
for (chk = TAILQ_FIRST(&asoc->send_queue); chk; chk = nchk) {
if (no_data_chunks) {
/* let only control go out */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Either nothing to send or we are full\n");
}
#endif
break;
}
if (net->flight_size >= net->cwnd) {
/* skip this net, no room for data */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("fs:%d > cwnd:%d\n",
net->flight_size, net->cwnd);
}
#endif
sctp_pegs[SCTP_CWND_BLOCKED]++;
*reason_code = 2;
break;
}
nchk = TAILQ_NEXT(chk, sctp_next);
if (chk->whoTo != net) {
/* No, not sent to this net */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("chk->whoTo:%p not %p\n",
chk->whoTo, net);

}
#endif
continue;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Can we pick up a chunk?\n");
}
#endif
if ((chk->send_size > omtu) && ((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) == 0)) {
/* strange, we have a chunk that is to bit
* for its destination and yet no fragment ok flag.
* Something went wrong when the PMTU changed...we did
* not mark this chunk for some reason?? I will
* fix it here by letting IP fragment it for now and
* printing a warning. This really should not happen ...
*/
/*#ifdef SCTP_DEBUG*/
printf("Warning chunk of %d bytes > mtu:%d and yet PMTU disc missed\n",
chk->send_size, mtu);
/*#endif*/
chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
}

if (((chk->send_size <= mtu) && (chk->send_size <= r_mtu)) ||
((chk->flags & CHUNK_FLAGS_FRAGMENT_OK) && (chk->send_size <= asoc->peers_rwnd))) {
/* ok we will add this one */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Picking up the chunk\n");
}
#endif
outchain = sctp_copy_mbufchain(chk->data, outchain);
if (outchain == NULL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Gakk no memory\n");
}
#endif
if (!callout_pending(&net->rxt_timer.timer)) {
sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
}
return (ENOMEM);
}
/* update our MTU size */
/* Do clear IP_DF ? */
if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
no_fragmentflg = 0;
}
mtu -= chk->send_size;
r_mtu -= chk->send_size;
data_list[bundle_at++] = chk;
if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
mtu = 0;
break;
}
if (mtu <= 0) {
mtu = 0;
break;
}
if ((r_mtu <= 0) || one_chunk) {
r_mtu = 0;
break;
}
} else {
/*
* Must be sent in order of the TSN's
* (on a network)
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("ok no more chk:%d > mtu:%d || < r_mtu:%d\n",
chk->send_size, mtu, r_mtu);
}
#endif

break;
}
}/* for () */
} /* if asoc.state OPEN */
/* Is there something to send for this destination? */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("ok now is chain assembled? %p\n",
outchain);
}
#endif

if (outchain) {
/* We may need to start a control timer or two */
if (asconf) {
sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, net);
asconf = 0;
}
if (cookie) {
sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net);
cookie = 0;
}
/* must start a send timer if data is being sent */
if (bundle_at && (!callout_pending(&net->rxt_timer.timer))) {
/* no timer running on this destination
* restart it.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("ok lets start a send timer .. we will transmit %p\n",
outchain);
}
#endif
sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
}
/* Now send it, if there is anything to send :> */
if ((outchain->m_flags & M_PKTHDR) == 0) {
struct mbuf *t;

MGETHDR(t, M_DONTWAIT, MT_HEADER);
if (t == NULL) {
sctp_m_freem(outchain);
return (ENOMEM);
}
t->m_next = outchain;
t->m_pkthdr.len = 0;
m_reset_rcvif(t);
t->m_len = 0;

outchain = t;
while (t) {
outchain->m_pkthdr.len += t->m_len;
t = t->m_next;
}
}
if (outchain->m_len == 0) {
/* Special case for when you get a 0 len
* mbuf at the head due to the lack
* of a MHDR at the beginning.
*/
m_align(outchain, sizeof(struct sctphdr));
outchain->m_len = sizeof(struct sctphdr);
} else {
M_PREPEND(outchain, sizeof(struct sctphdr), M_DONTWAIT);
if (outchain == NULL) {
/* out of mbufs */
error = ENOBUFS;
goto errored_send;
}
}
shdr = mtod(outchain, struct sctphdr *);
shdr->src_port = inp->sctp_lport;
shdr->dest_port = stcb->rport;
shdr->v_tag = htonl(stcb->asoc.peer_vtag);
shdr->checksum = 0;
if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
rtcache_getdst(&net->ro),
outchain,
no_fragmentflg, bundle_at, data_list[0], asconf))) {
/* error, we could not output */
if (error == ENOBUFS) {
asoc->ifp_had_enobuf = 1;
}
sctp_pegs[SCTP_DATA_OUT_ERR]++;
if (from_where == 0) {
sctp_pegs[SCTP_ERROUT_FRM_USR]++;
}

errored_send:
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Gak send error %d\n", error);
}
#endif
if (hbflag) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Update HB time anyway\n");
}
#endif
if (*now_filled == 0) {
SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
*now_filled = 1;
*now = net->last_sent_time;
} else {
net->last_sent_time = *now;
}
hbflag = 0;
}
if (error == EHOSTUNREACH ||
error == EHOSTDOWN) {
/*
* Destination went unreachable during
* this send
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Calling the movement routine\n");
}
#endif
sctp_move_to_an_alt(stcb, asoc, net);
}
sctp_clean_up_ctl (asoc);
return (error);
} else {
asoc->ifp_had_enobuf = 0;
}
if (bundle_at || hbflag) {
/* For data/asconf and hb set time */
if (*now_filled == 0) {
SCTP_GETTIME_TIMEVAL(&net->last_sent_time);
*now_filled = 1;
*now = net->last_sent_time;
} else {
net->last_sent_time = *now;
}
}

if (!no_out_cnt) {
*num_out += (ctl_cnt + bundle_at);
}
if (bundle_at) {
if (!net->rto_pending) {
/* setup for a RTO measurement */
net->rto_pending = 1;
data_list[0]->do_rtt = 1;
} else {
data_list[0]->do_rtt = 0;
}
sctp_pegs[SCTP_PEG_TSNS_SENT] += bundle_at;
sctp_clean_up_datalist(stcb, asoc, data_list, bundle_at, net);
}
if (one_chunk) {
break;
}
}
}
/* At the end there should be no NON timed
* chunks hanging on this queue.
*/
if ((*num_out == 0) && (*reason_code == 0)) {
*reason_code = 3;
}
sctp_clean_up_ctl (asoc);
return (0);
}

void
sctp_queue_op_err(struct sctp_tcb *stcb, struct mbuf *op_err)
{
/* Prepend a OPERATIONAL_ERROR chunk header
* and put on the end of the control chunk queue.
*/
/* Sender had better have gotten a MGETHDR or else
* the control chunk will be forever skipped
*/
struct sctp_chunkhdr *hdr;
struct sctp_tmit_chunk *chk;
struct mbuf *mat;

chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(op_err);
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
M_PREPEND(op_err, sizeof(struct sctp_chunkhdr), M_DONTWAIT);
if (op_err == NULL) {
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
chk->send_size = 0;
mat = op_err;
while (mat != NULL) {
chk->send_size += mat->m_len;
mat = mat->m_next;
}
chk->rec.chunk_id = SCTP_OPERATION_ERROR;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->data = op_err;
chk->whoTo = chk->asoc->primary_destination;
chk->whoTo->ref_count++;
hdr = mtod(op_err, struct sctp_chunkhdr *);
hdr->chunk_type = SCTP_OPERATION_ERROR;
hdr->chunk_flags = 0;
hdr->chunk_length = htons(chk->send_size);
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue,
chk,
sctp_next);
chk->asoc->ctrl_queue_cnt++;
}

int
sctp_send_cookie_echo(struct mbuf *m,
int offset,
struct sctp_tcb *stcb,
struct sctp_nets *net)
{
/*
* pull out the cookie and put it at the front of the control
* chunk queue.
*/
int at;
struct mbuf *cookie, *mat;
struct sctp_paramhdr parm, *phdr;
struct sctp_chunkhdr *hdr;
struct sctp_tmit_chunk *chk;
uint16_t ptype, plen;
/* First find the cookie in the param area */
cookie = NULL;
at = offset + sizeof(struct sctp_init_chunk);

do {
phdr = sctp_get_next_param(m, at, &parm, sizeof(parm));
if (phdr == NULL) {
return (-3);
}
ptype = ntohs(phdr->param_type);
plen = ntohs(phdr->param_length);
if (ptype == SCTP_STATE_COOKIE) {
int pad;
/* found the cookie */
if ((pad = (plen % 4))) {
plen += 4 - pad;
}
cookie = sctp_m_copym(m, at, plen, M_DONTWAIT);
if (cookie == NULL) {
/* No memory */
return (-2);
}
break;
}
at += SCTP_SIZE32(plen);
} while (phdr);
if (cookie == NULL) {
/* Did not find the cookie */
return (-3);
}
/* ok, we got the cookie lets change it into a cookie echo chunk */

/* first the change from param to cookie */
hdr = mtod(cookie, struct sctp_chunkhdr *);
hdr->chunk_type = SCTP_COOKIE_ECHO;
hdr->chunk_flags = 0;
/* now we MUST have a PKTHDR on it */
if ((cookie->m_flags & M_PKTHDR) != M_PKTHDR) {
/* we hope this happens rarely */
MGETHDR(mat, M_DONTWAIT, MT_HEADER);
if (mat == NULL) {
sctp_m_freem(cookie);
return (-4);
}
mat->m_len = 0;
m_reset_rcvif(mat);
mat->m_next = cookie;
cookie = mat;
}
cookie->m_pkthdr.len = plen;
/* get the chunk stuff now and place it in the FRONT of the queue */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(cookie);
return (-5);
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
chk->send_size = cookie->m_pkthdr.len;
chk->rec.chunk_id = SCTP_COOKIE_ECHO;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->data = cookie;
chk->whoTo = chk->asoc->primary_destination;
chk->whoTo->ref_count++;
TAILQ_INSERT_HEAD(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;
return (0);
}

void
sctp_send_heartbeat_ack(struct sctp_tcb *stcb,
struct mbuf *m,
int offset,
int chk_length,
struct sctp_nets *net)
{
/* take a HB request and make it into a
* HB ack and send it.
*/
struct mbuf *outchain;
struct sctp_chunkhdr *chdr;
struct sctp_tmit_chunk *chk;

if (net == NULL)
/* must have a net pointer */
return;

outchain = sctp_m_copym(m, offset, chk_length, M_DONTWAIT);
if (outchain == NULL) {
/* gak out of memory */
return;
}
chdr = mtod(outchain, struct sctp_chunkhdr *);
chdr->chunk_type = SCTP_HEARTBEAT_ACK;
chdr->chunk_flags = 0;
if ((outchain->m_flags & M_PKTHDR) != M_PKTHDR) {
/* should not happen but we are cautious. */
struct mbuf *tmp;
MGETHDR(tmp, M_DONTWAIT, MT_HEADER);
if (tmp == NULL) {
return;
}
tmp->m_len = 0;
m_reset_rcvif(tmp);
tmp->m_next = outchain;
outchain = tmp;
}
outchain->m_pkthdr.len = chk_length;
if (chk_length % 4) {
/* need pad */
u_int32_t cpthis=0;
int padlen;
padlen = 4 - (outchain->m_pkthdr.len % 4);
m_copyback(outchain, outchain->m_pkthdr.len, padlen, (void *)&cpthis);
}
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(outchain);
return ;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

chk->send_size = chk_length;
chk->rec.chunk_id = SCTP_HEARTBEAT_ACK;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->data = outchain;
chk->whoTo = net;
chk->whoTo->ref_count++;
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;
}

int
sctp_send_cookie_ack(struct sctp_tcb *stcb) {
/* formulate and queue a cookie-ack back to sender */
struct mbuf *cookie_ack;
struct sctp_chunkhdr *hdr;
struct sctp_tmit_chunk *chk;

cookie_ack = NULL;
MGETHDR(cookie_ack, M_DONTWAIT, MT_HEADER);
if (cookie_ack == NULL) {
/* no mbuf's */
return (-1);
}
cookie_ack->m_data += SCTP_MIN_OVERHEAD;
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(cookie_ack);
return (-1);
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

chk->send_size = sizeof(struct sctp_chunkhdr);
chk->rec.chunk_id = SCTP_COOKIE_ACK;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->data = cookie_ack;
if (chk->asoc->last_control_chunk_from != NULL) {
chk->whoTo = chk->asoc->last_control_chunk_from;
} else {
chk->whoTo = chk->asoc->primary_destination;
}
chk->whoTo->ref_count++;
hdr = mtod(cookie_ack, struct sctp_chunkhdr *);
hdr->chunk_type = SCTP_COOKIE_ACK;
hdr->chunk_flags = 0;
hdr->chunk_length = htons(chk->send_size);
cookie_ack->m_pkthdr.len = cookie_ack->m_len = chk->send_size;
m_reset_rcvif(cookie_ack);
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;
return (0);
}

int
sctp_send_shutdown_ack(struct sctp_tcb *stcb, struct sctp_nets *net)
{
/* formulate and queue a SHUTDOWN-ACK back to the sender */
struct mbuf *m_shutdown_ack;
struct sctp_shutdown_ack_chunk *ack_cp;
struct sctp_tmit_chunk *chk;

m_shutdown_ack = NULL;
MGETHDR(m_shutdown_ack, M_DONTWAIT, MT_HEADER);
if (m_shutdown_ack == NULL) {
/* no mbuf's */
return (-1);
}
m_shutdown_ack->m_data += SCTP_MIN_OVERHEAD;
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(m_shutdown_ack);
return (-1);
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

chk->send_size = sizeof(struct sctp_chunkhdr);
chk->rec.chunk_id = SCTP_SHUTDOWN_ACK;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->data = m_shutdown_ack;
chk->whoTo = net;
net->ref_count++;

ack_cp = mtod(m_shutdown_ack, struct sctp_shutdown_ack_chunk *);
ack_cp->ch.chunk_type = SCTP_SHUTDOWN_ACK;
ack_cp->ch.chunk_flags = 0;
ack_cp->ch.chunk_length = htons(chk->send_size);
m_shutdown_ack->m_pkthdr.len = m_shutdown_ack->m_len = chk->send_size;
m_reset_rcvif(m_shutdown_ack);
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;
return (0);
}

int
sctp_send_shutdown(struct sctp_tcb *stcb, struct sctp_nets *net)
{
/* formulate and queue a SHUTDOWN to the sender */
struct mbuf *m_shutdown;
struct sctp_shutdown_chunk *shutdown_cp;
struct sctp_tmit_chunk *chk;

m_shutdown = NULL;
MGETHDR(m_shutdown, M_DONTWAIT, MT_HEADER);
if (m_shutdown == NULL) {
/* no mbuf's */
return (-1);
}
m_shutdown->m_data += SCTP_MIN_OVERHEAD;
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(m_shutdown);
return (-1);
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

chk->send_size = sizeof(struct sctp_shutdown_chunk);
chk->rec.chunk_id = SCTP_SHUTDOWN;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->data = m_shutdown;
chk->whoTo = net;
net->ref_count++;

shutdown_cp = mtod(m_shutdown, struct sctp_shutdown_chunk *);
shutdown_cp->ch.chunk_type = SCTP_SHUTDOWN;
shutdown_cp->ch.chunk_flags = 0;
shutdown_cp->ch.chunk_length = htons(chk->send_size);
shutdown_cp->cumulative_tsn_ack = htonl(stcb->asoc.cumulative_tsn);
m_shutdown->m_pkthdr.len = m_shutdown->m_len = chk->send_size;
m_reset_rcvif(m_shutdown);
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;

if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
soisdisconnecting(stcb->sctp_ep->sctp_socket);
}
return (0);
}

int
sctp_send_asconf(struct sctp_tcb *stcb, struct sctp_nets *net)
{
/*
* formulate and queue an ASCONF to the peer
* ASCONF parameters should be queued on the assoc queue
*/
struct sctp_tmit_chunk *chk;
struct mbuf *m_asconf;

/* compose an ASCONF chunk, maximum length is PMTU */
m_asconf = sctp_compose_asconf(stcb);
if (m_asconf == NULL) {
return (-1);
}
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(m_asconf);
return (-1);
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

chk->data = m_asconf;
chk->send_size = m_asconf->m_pkthdr.len;
chk->rec.chunk_id = SCTP_ASCONF;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->whoTo = chk->asoc->primary_destination;
chk->whoTo->ref_count++;
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;
return (0);
}

int
sctp_send_asconf_ack(struct sctp_tcb *stcb, uint32_t retrans)
{
/*
* formulate and queue a asconf-ack back to sender
* the asconf-ack must be stored in the tcb
*/
struct sctp_tmit_chunk *chk;
struct mbuf *m_ack;

/* is there a asconf-ack mbuf chain to send? */
if (stcb->asoc.last_asconf_ack_sent == NULL) {
return (-1);
}

/* copy the asconf_ack */
#if defined(__FreeBSD__) || defined(__NetBSD__)
/* Supposedly the m_copypacket is a optimzation,
* use it if we can.
*/
if (stcb->asoc.last_asconf_ack_sent->m_flags & M_PKTHDR) {
m_ack = m_copypacket(stcb->asoc.last_asconf_ack_sent, M_DONTWAIT);
sctp_pegs[SCTP_CACHED_SRC]++;
} else
m_ack = m_copym(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL, M_DONTWAIT);
#else
m_ack = m_copy(stcb->asoc.last_asconf_ack_sent, 0, M_COPYALL);
#endif
if (m_ack == NULL) {
/* couldn't copy it */

return (-1);
}
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/* no memory */
sctp_m_freem(m_ack);
return (-1);
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

/* figure out where it goes to */
if (retrans) {
/* we're doing a retransmission */
if (stcb->asoc.used_alt_asconfack > 2) {
/* tried alternate nets already, go back */
chk->whoTo = NULL;
} else {
/* need to try and alternate net */
chk->whoTo = sctp_find_alternate_net(stcb, stcb->asoc.last_control_chunk_from);
stcb->asoc.used_alt_asconfack++;
}
if (chk->whoTo == NULL) {
/* no alternate */
if (stcb->asoc.last_control_chunk_from == NULL)
chk->whoTo = stcb->asoc.primary_destination;
else
chk->whoTo = stcb->asoc.last_control_chunk_from;
stcb->asoc.used_alt_asconfack = 0;
}
} else {
/* normal case */
if (stcb->asoc.last_control_chunk_from == NULL)
chk->whoTo = stcb->asoc.primary_destination;
else
chk->whoTo = stcb->asoc.last_control_chunk_from;
stcb->asoc.used_alt_asconfack = 0;
}
chk->data = m_ack;
chk->send_size = m_ack->m_pkthdr.len;
chk->rec.chunk_id = SCTP_ASCONF_ACK;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->flags = 0;
chk->asoc = &stcb->asoc;
chk->whoTo->ref_count++;
TAILQ_INSERT_TAIL(&chk->asoc->control_send_queue, chk, sctp_next);
chk->asoc->ctrl_queue_cnt++;
return (0);
}

static int
sctp_chunk_retransmission(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_association *asoc,
int *cnt_out, struct timeval *now, int *now_filled)
{
/*
* send out one MTU of retransmission.
* If fast_retransmit is happening we ignore the cwnd.
* Otherwise we obey the cwnd and rwnd.
* For a Cookie or Asconf in the control chunk queue we retransmit
* them by themselves.
*
* For data chunks we will pick out the lowest TSN's in the
* sent_queue marked for resend and bundle them all together
* (up to a MTU of destination). The address to send to should
* have been selected/changed where the retransmission was
* marked (i.e. in FR or t3-timeout routines).
*/
struct sctp_tmit_chunk *data_list[SCTP_MAX_DATA_BUNDLING];
struct sctp_tmit_chunk *chk, *fwd;
struct mbuf *m;
struct sctphdr *shdr;
int asconf;
struct sctp_nets *net;
int no_fragmentflg, bundle_at, cnt_thru;
unsigned int mtu;
int error, i, one_chunk, fwd_tsn, ctl_cnt, tmr_started;

tmr_started = ctl_cnt = bundle_at = error = 0;
no_fragmentflg = 1;
asconf = 0;
fwd_tsn = 0;
*cnt_out = 0;
fwd = NULL;
m = NULL;
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC3, 1);
#endif
if (TAILQ_EMPTY(&asoc->sent_queue)) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("SCTP hits empty queue with cnt set to %d?\n",
asoc->sent_queue_retran_cnt);
}
#endif
asoc->sent_queue_cnt = 0;
asoc->sent_queue_cnt_removeable = 0;
}
TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
if (chk->sent != SCTP_DATAGRAM_RESEND) {
/* we only worry about things marked for resend */
continue;
}
if ((chk->rec.chunk_id == SCTP_COOKIE_ECHO) ||
(chk->rec.chunk_id == SCTP_ASCONF) ||
(chk->rec.chunk_id == SCTP_STREAM_RESET) ||
(chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN)) {
if (chk->rec.chunk_id == SCTP_STREAM_RESET) {
/* For stream reset we only retran the request
* not the response.
*/
struct sctp_stream_reset_req *strreq;
strreq = mtod(chk->data, struct sctp_stream_reset_req *);
if (strreq->sr_req.ph.param_type != ntohs(SCTP_STR_RESET_REQUEST)) {
continue;
}
}
ctl_cnt++;
if (chk->rec.chunk_id == SCTP_ASCONF) {
no_fragmentflg = 1;
asconf = 1;
}
if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
fwd_tsn = 1;
fwd = chk;
}
m = sctp_copy_mbufchain(chk->data, m);
break;
}
}
one_chunk = 0;
cnt_thru = 0;
/* do we have control chunks to retransmit? */
if (m != NULL) {
/* Start a timer no matter if we suceed or fail */
if (chk->rec.chunk_id == SCTP_COOKIE_ECHO) {
sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, inp, stcb, chk->whoTo);
} else if (chk->rec.chunk_id == SCTP_ASCONF)
sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp, stcb, chk->whoTo);

if (m->m_len == 0) {
/* Special case for when you get a 0 len
* mbuf at the head due to the lack
* of a MHDR at the beginning.
*/
m->m_len = sizeof(struct sctphdr);
} else {
M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
if (m == NULL) {
return (ENOBUFS);
}
}
shdr = mtod(m, struct sctphdr *);
shdr->src_port = inp->sctp_lport;
shdr->dest_port = stcb->rport;
shdr->v_tag = htonl(stcb->asoc.peer_vtag);
shdr->checksum = 0;
chk->snd_count++; /* update our count */

if ((error = sctp_lowlevel_chunk_output(inp, stcb, chk->whoTo,
rtcache_getdst(&chk->whoTo->ro), m,
no_fragmentflg, 0, NULL, asconf))) {
sctp_pegs[SCTP_DATA_OUT_ERR]++;
return (error);
}
/*
*We don't want to mark the net->sent time here since this
* we use this for HB and retrans cannot measure RTT
*/
/* SCTP_GETTIME_TIMEVAL(&chk->whoTo->last_sent_time);*/
*cnt_out += 1;
chk->sent = SCTP_DATAGRAM_SENT;
sctp_ucount_decr(asoc->sent_queue_retran_cnt);
if (fwd_tsn == 0) {
return (0);
} else {
/* Clean up the fwd-tsn list */
sctp_clean_up_ctl (asoc);
return (0);
}
}
/* Ok, it is just data retransmission we need to do or
* that and a fwd-tsn with it all.
*/
if (TAILQ_EMPTY(&asoc->sent_queue)) {
return (-1);
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Normal chunk retransmission cnt:%d\n",
asoc->sent_queue_retran_cnt);
}
#endif
if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT)) {
/* not yet open, resend the cookie and that is it */
return (1);
}

#ifdef SCTP_AUDITING_ENABLED
sctp_auditing(20, inp, stcb, NULL);
#endif
TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
if (chk->sent != SCTP_DATAGRAM_RESEND) {
/* No, not sent to this net or not ready for rtx */
continue;

}
/* pick up the net */
net = chk->whoTo;
if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
mtu = (net->mtu - SCTP_MIN_OVERHEAD);
} else {
mtu = net->mtu- SCTP_MIN_V4_OVERHEAD;
}

if ((asoc->peers_rwnd < mtu) && (asoc->total_flight > 0)) {
/* No room in peers rwnd */
uint32_t tsn;
tsn = asoc->last_acked_seq + 1;
if (tsn == chk->rec.data.TSN_seq) {
/* we make a special exception for this case.
* The peer has no rwnd but is missing the
* lowest chunk.. which is probably what is
* holding up the rwnd.
*/
goto one_chunk_around;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("blocked-peers_rwnd:%d tf:%d\n",
(int)asoc->peers_rwnd,
(int)asoc->total_flight);
}
#endif
sctp_pegs[SCTP_RWND_BLOCKED]++;
return (1);
}
one_chunk_around:
if (asoc->peers_rwnd < mtu) {
one_chunk = 1;
}
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC3, 2);
#endif
bundle_at = 0;
m = NULL;
net->fast_retran_ip = 0;
if (chk->rec.data.doing_fast_retransmit == 0) {
/* if no FR in progress skip destination that
* have flight_size > cwnd.
*/
if (net->flight_size >= net->cwnd) {
sctp_pegs[SCTP_CWND_BLOCKED]++;
continue;
}
} else {
/* Mark the destination net to have FR recovery
* limits put on it.
*/
net->fast_retran_ip = 1;
}

if ((chk->send_size <= mtu) || (chk->flags & CHUNK_FLAGS_FRAGMENT_OK)) {
/* ok we will add this one */
m = sctp_copy_mbufchain(chk->data, m);
if (m == NULL) {
return (ENOMEM);
}
/* update our MTU size */
/* Do clear IP_DF ? */
if (chk->flags & CHUNK_FLAGS_FRAGMENT_OK) {
no_fragmentflg = 0;
}
mtu -= chk->send_size;
data_list[bundle_at++] = chk;
if (one_chunk && (asoc->total_flight <= 0)) {
sctp_pegs[SCTP_WINDOW_PROBES]++;
chk->rec.data.state_flags |= SCTP_WINDOW_PROBE;
}
}
if (one_chunk == 0) {
/* now are there anymore forward from chk to pick up?*/
fwd = TAILQ_NEXT(chk, sctp_next);
while (fwd) {
if (fwd->sent != SCTP_DATAGRAM_RESEND) {
/* Nope, not for retran */
fwd = TAILQ_NEXT(fwd, sctp_next);
continue;
}
if (fwd->whoTo != net) {
/* Nope, not the net in question */
fwd = TAILQ_NEXT(fwd, sctp_next);
continue;
}
if (fwd->send_size <= mtu) {
m = sctp_copy_mbufchain(fwd->data, m);
if (m == NULL) {
return (ENOMEM);
}
/* update our MTU size */
/* Do clear IP_DF ? */
if (fwd->flags & CHUNK_FLAGS_FRAGMENT_OK) {
no_fragmentflg = 0;
}
mtu -= fwd->send_size;
data_list[bundle_at++] = fwd;
if (bundle_at >= SCTP_MAX_DATA_BUNDLING) {
break;
}
fwd = TAILQ_NEXT(fwd, sctp_next);
} else {
/* can't fit so we are done */
break;
}
}
}
/* Is there something to send for this destination? */
if (m) {
/* No matter if we fail/or suceed we should
* start a timer. A failure is like a lost
* IP packet :-)
*/
if (!callout_pending(&net->rxt_timer.timer)) {
/* no timer running on this destination
* restart it.
*/
sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
tmr_started = 1;
}
if (m->m_len == 0) {
/* Special case for when you get a 0 len
* mbuf at the head due to the lack
* of a MHDR at the beginning.
*/
m->m_len = sizeof(struct sctphdr);
} else {
M_PREPEND(m, sizeof(struct sctphdr), M_DONTWAIT);
if (m == NULL) {
return (ENOBUFS);
}
}
shdr = mtod(m, struct sctphdr *);
shdr->src_port = inp->sctp_lport;
shdr->dest_port = stcb->rport;
shdr->v_tag = htonl(stcb->asoc.peer_vtag);
shdr->checksum = 0;

/* Now lets send it, if there is anything to send :> */
if ((error = sctp_lowlevel_chunk_output(inp, stcb, net,
rtcache_getdst(&net->ro),
m,
no_fragmentflg, 0, NULL, asconf))) {
/* error, we could not output */
sctp_pegs[SCTP_DATA_OUT_ERR]++;
return (error);
}
/* For HB's */
/*
* We don't want to mark the net->sent time here since
* this we use this for HB and retrans cannot measure
* RTT
*/
/* SCTP_GETTIME_TIMEVAL(&net->last_sent_time);*/

/* For auto-close */
cnt_thru++;
if (*now_filled == 0) {
SCTP_GETTIME_TIMEVAL(&asoc->time_last_sent);
*now = asoc->time_last_sent;
*now_filled = 1;
} else {
asoc->time_last_sent = *now;
}
*cnt_out += bundle_at;
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC4, bundle_at);
#endif
for (i = 0; i < bundle_at; i++) {
sctp_pegs[SCTP_RETRANTSN_SENT]++;
data_list[i]->sent = SCTP_DATAGRAM_SENT;
data_list[i]->snd_count++;
sctp_ucount_decr(asoc->sent_queue_retran_cnt);
/* record the time */
data_list[i]->sent_rcv_time = asoc->time_last_sent;
net->flight_size += data_list[i]->book_size;
asoc->total_flight += data_list[i]->book_size;
asoc->total_flight_count++;

#ifdef SCTP_LOG_RWND
sctp_log_rwnd(SCTP_DECREASE_PEER_RWND,
asoc->peers_rwnd , data_list[i]->send_size, sctp_peer_chunk_oh);
#endif
asoc->peers_rwnd = sctp_sbspace_sub(asoc->peers_rwnd,
(u_int32_t)(data_list[i]->send_size + sctp_peer_chunk_oh));
if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
/* SWS sender side engages */
asoc->peers_rwnd = 0;
}

if ((i == 0) &&
(data_list[i]->rec.data.doing_fast_retransmit)) {
sctp_pegs[SCTP_FAST_RETRAN]++;
if ((data_list[i] == TAILQ_FIRST(&asoc->sent_queue)) &&
(tmr_started == 0)) {
/*
* ok we just fast-retrans'd
* the lowest TSN, i.e the
* first on the list. In this
* case we want to give some
* more time to get a SACK
* back without a t3-expiring.
*/
sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
}
}
}
#ifdef SCTP_AUDITING_ENABLED
sctp_auditing(21, inp, stcb, NULL);
#endif
} else {
/* None will fit */
return (1);
}
if (asoc->sent_queue_retran_cnt <= 0) {
/* all done we have no more to retran */
asoc->sent_queue_retran_cnt = 0;
break;
}
if (one_chunk) {
/* No more room in rwnd */
return (1);
}
/* stop the for loop here. we sent out a packet */
break;
}
return (0);
}

static int
sctp_timer_validation(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_association *asoc,
int ret)
{
struct sctp_nets *net;
/* Validate that a timer is running somewhere */
TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
if (callout_pending(&net->rxt_timer.timer)) {
/* Here is a timer */
return (ret);
}
}
/* Gak, we did not have a timer somewhere */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Deadlock avoided starting timer on a dest at retran\n");
}
#endif
sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, asoc->primary_destination);
return (ret);
}

int
sctp_chunk_output(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
int from_where)
{
/* Ok this is the generic chunk service queue.
* we must do the following:
* - See if there are retransmits pending, if so we
* must do these first and return.
* - Service the stream queue that is next,
* moving any message (note I must get a complete
* message i.e. FIRST/MIDDLE and LAST to the out
* queue in one pass) and assigning TSN's
* - Check to see if the cwnd/rwnd allows any output, if
* so we go ahead and fomulate and send the low level
* chunks. Making sure to combine any control in the
* control chunk queue also.
*/
struct sctp_association *asoc;
struct sctp_nets *net;
int error, num_out, tot_out, ret, reason_code, burst_cnt, burst_limit;
struct timeval now;
int now_filled=0;
int cwnd_full=0;
asoc = &stcb->asoc;
tot_out = 0;
num_out = 0;
reason_code = 0;
sctp_pegs[SCTP_CALLS_TO_CO]++;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("in co - retran count:%d\n", asoc->sent_queue_retran_cnt);
}
#endif
while (asoc->sent_queue_retran_cnt) {
/* Ok, it is retransmission time only, we send out only ONE
* packet with a single call off to the retran code.
*/
ret = sctp_chunk_retransmission(inp, stcb, asoc, &num_out, &now, &now_filled);
if (ret > 0) {
/* Can't send anymore */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("retransmission ret:%d -- full\n", ret);
}
#endif
/*
* now lets push out control by calling med-level
* output once. this assures that we WILL send HB's
* if queued too.
*/
(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1,
&cwnd_full, from_where,
&now, &now_filled);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Control send outputs:%d@full\n", num_out);
}
#endif
#ifdef SCTP_AUDITING_ENABLED
sctp_auditing(8, inp, stcb, NULL);
#endif
return (sctp_timer_validation(inp, stcb, asoc, ret));
}
if (ret < 0) {
/*
* The count was off.. retran is not happening so do
* the normal retransmission.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Done with retrans, none left fill up window\n");
}
#endif
#ifdef SCTP_AUDITING_ENABLED
sctp_auditing(9, inp, stcb, NULL);
#endif
break;
}
if (from_where == 1) {
/* Only one transmission allowed out of a timeout */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Only one packet allowed out\n");
}
#endif
#ifdef SCTP_AUDITING_ENABLED
sctp_auditing(10, inp, stcb, NULL);
#endif
/* Push out any control */
(void)sctp_med_chunk_output(inp, stcb, asoc, &num_out, &reason_code, 1, &cwnd_full, from_where,
&now, &now_filled);
return (ret);
}
if ((num_out == 0) && (ret == 0)) {
/* No more retrans to send */
break;
}
}
#ifdef SCTP_AUDITING_ENABLED
sctp_auditing(12, inp, stcb, NULL);
#endif
/* Check for bad destinations, if they exist move chunks around. */
burst_limit = asoc->max_burst;
TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
SCTP_ADDR_NOT_REACHABLE) {
/*
* if possible move things off of this address
* we still may send below due to the dormant state
* but we try to find an alternate address to send
* to and if we have one we move all queued data on
* the out wheel to this alternate address.
*/
sctp_move_to_an_alt(stcb, asoc, net);
} else {
/*
if ((asoc->sat_network) || (net->addr_is_local)) {
burst_limit = asoc->max_burst * SCTP_SAT_NETWORK_BURST_INCR;
}
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("examined net:%p burst limit:%d\n", net, asoc->max_burst);
}
#endif

#ifdef SCTP_USE_ALLMAN_BURST
if ((net->flight_size+(burst_limit*net->mtu)) < net->cwnd) {
if (net->ssthresh < net->cwnd)
net->ssthresh = net->cwnd;
net->cwnd = (net->flight_size+(burst_limit*net->mtu));
#ifdef SCTP_LOG_MAXBURST
sctp_log_maxburst(net, 0, burst_limit, SCTP_MAX_BURST_APPLIED);
#endif
sctp_pegs[SCTP_MAX_BURST_APL]++;
}
net->fast_retran_ip = 0;
#endif
}

}
/* Fill up what we can to the destination */
burst_cnt = 0;
cwnd_full = 0;
do {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("Burst count:%d - call m-c-o\n", burst_cnt);
}
#endif
error = sctp_med_chunk_output(inp, stcb, asoc, &num_out,
&reason_code, 0, &cwnd_full, from_where,
&now, &now_filled);
if (error) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Error %d was returned from med-c-op\n", error);
}
#endif
#ifdef SCTP_LOG_MAXBURST
sctp_log_maxburst(asoc->primary_destination, error , burst_cnt, SCTP_MAX_BURST_ERROR_STOP);
#endif
break;
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT3) {
printf("m-c-o put out %d\n", num_out);
}
#endif
tot_out += num_out;
burst_cnt++;
} while (num_out
#ifndef SCTP_USE_ALLMAN_BURST
&& (burst_cnt < burst_limit)
#endif
);
#ifndef SCTP_USE_ALLMAN_BURST
if (burst_cnt >= burst_limit) {
sctp_pegs[SCTP_MAX_BURST_APL]++;
asoc->burst_limit_applied = 1;
#ifdef SCTP_LOG_MAXBURST
sctp_log_maxburst(asoc->primary_destination, 0 , burst_cnt, SCTP_MAX_BURST_APPLIED);
#endif
} else {
asoc->burst_limit_applied = 0;
}
#endif

#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Ok, we have put out %d chunks\n", tot_out);
}
#endif
if (tot_out == 0) {
sctp_pegs[SCTP_CO_NODATASNT]++;
if (asoc->stream_queue_cnt > 0) {
sctp_pegs[SCTP_SOS_NOSNT]++;
} else {
sctp_pegs[SCTP_NOS_NOSNT]++;
}
if (asoc->send_queue_cnt > 0) {
sctp_pegs[SCTP_SOSE_NOSNT]++;
} else {
sctp_pegs[SCTP_NOSE_NOSNT]++;
}
}
/* Now we need to clean up the control chunk chain if
* a ECNE is on it. It must be marked as UNSENT again
* so next call will continue to send it until
* such time that we get a CWR, to remove it.
*/
sctp_fix_ecn_echo(asoc);
return (error);
}

int
sctp_output(struct sctp_inpcb *inp, struct mbuf *m,
struct sockaddr *addr, struct mbuf *control, struct lwp *l, int flags)
{
struct sctp_inpcb *t_inp;
struct sctp_tcb *stcb;
struct sctp_nets *net;
struct sctp_association *asoc;
int create_lock_applied = 0;
int queue_only, error = 0;
struct sctp_sndrcvinfo srcv;
int un_sent = 0;
int use_rcvinfo = 0;
t_inp = inp;
/* struct route ro;*/

queue_only = 0;
stcb = NULL;
asoc = NULL;
net = NULL;

#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("USR Send BEGINS\n");
}
#endif

if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
(inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
/* The listner can NOT send */
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
sctp_m_freem(m);
return (EFAULT);
}
/* Can't allow a V6 address on a non-v6 socket */
if (addr) {
SCTP_ASOC_CREATE_LOCK(inp);
if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
(inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
/* Should I really unlock ? */
SCTP_ASOC_CREATE_UNLOCK(inp);
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
sctp_m_freem(m);
return (EFAULT);
}
create_lock_applied = 1;
if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
(addr->sa_family == AF_INET6)) {
SCTP_ASOC_CREATE_UNLOCK(inp);
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
sctp_m_freem(m);
return (EINVAL);
}
}
if (control) {
sctppcbinfo.mbuf_track++;
if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
sizeof(srcv))) {
if (srcv.sinfo_flags & SCTP_SENDALL) {
/* its a sendall */
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
return (sctp_sendall(inp, NULL, m, &srcv));
}
if (srcv.sinfo_assoc_id) {
if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
SCTP_INP_RLOCK(inp);
stcb = LIST_FIRST(&inp->sctp_asoc_list);
if (stcb) {
SCTP_TCB_LOCK(stcb);
}
SCTP_INP_RUNLOCK(inp);

if (stcb == NULL) {
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
sctp_m_freem(m);
return (ENOTCONN);
}
net = stcb->asoc.primary_destination;
} else {
stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
}
/*
* Question: Should I error here if the

* assoc_id is no longer valid?
* i.e. I can't find it?
*/
if ((stcb) &&
(addr != NULL)) {
/* Must locate the net structure */
if (addr)
net = sctp_findnet(stcb, addr);
}
if (net == NULL)
net = stcb->asoc.primary_destination;
}
use_rcvinfo = 1;
}
}
if (stcb == NULL) {
if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
SCTP_INP_RLOCK(inp);
stcb = LIST_FIRST(&inp->sctp_asoc_list);
if (stcb) {
SCTP_TCB_LOCK(stcb);
}
SCTP_INP_RUNLOCK(inp);
if (stcb == NULL) {
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
sctp_m_freem(m);
return (ENOTCONN);
}
if (addr == NULL) {
net = stcb->asoc.primary_destination;
} else {
net = sctp_findnet(stcb, addr);
if (net == NULL) {
net = stcb->asoc.primary_destination;
}
}
} else {
if (addr != NULL) {
SCTP_INP_WLOCK(inp);
SCTP_INP_INCR_REF(inp);
SCTP_INP_WUNLOCK(inp);
stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
if (stcb == NULL) {
SCTP_INP_WLOCK(inp);
SCTP_INP_DECR_REF(inp);
SCTP_INP_WUNLOCK(inp);
}
}
}
}
if ((stcb == NULL) &&
(inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
sctp_m_freem(m);
return (ENOTCONN);
} else if ((stcb == NULL) &&
(addr == NULL)) {
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
sctp_m_freem(m);
return (ENOENT);
} else if (stcb == NULL) {
/* UDP mode, we must go ahead and start the INIT process */
if ((use_rcvinfo) && (srcv.sinfo_flags & SCTP_ABORT)) {
/* Strange user to do this */
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
sctp_m_freem(m);
return (ENOENT);
}
stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
if (stcb == NULL) {
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
sctp_m_freem(m);
return (error);
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
} else {
printf("Huh-1, create lock should have been applied!\n");
}
queue_only = 1;
asoc = &stcb->asoc;
asoc->state = SCTP_STATE_COOKIE_WAIT;
SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
if (control) {
/* see if a init structure exists in cmsg headers */
struct sctp_initmsg initm;
int i;
if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control,
sizeof(initm))) {
/* we have an INIT override of the default */
if (initm.sinit_max_attempts)
asoc->max_init_times = initm.sinit_max_attempts;
if (initm.sinit_num_ostreams)
asoc->pre_open_streams = initm.sinit_num_ostreams;
if (initm.sinit_max_instreams)
asoc->max_inbound_streams = initm.sinit_max_instreams;
if (initm.sinit_max_init_timeo)
asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
}
if (asoc->streamoutcnt < asoc->pre_open_streams) {
/* Default is NOT correct */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Ok, defout:%d pre_open:%d\n",
asoc->streamoutcnt, asoc->pre_open_streams);
}
#endif
free(asoc->strmout, M_PCB);
asoc->strmout = NULL;
asoc->streamoutcnt = asoc->pre_open_streams;
asoc->strmout = malloc(asoc->streamoutcnt *
sizeof(struct sctp_stream_out), M_PCB,
M_WAIT);
for (i = 0; i < asoc->streamoutcnt; i++) {
/*
* inbound side must be set to 0xffff,
* also NOTE when we get the INIT-ACK
* back (for INIT sender) we MUST
* reduce the count (streamoutcnt) but
* first check if we sent to any of the
* upper streams that were dropped (if
* some were). Those that were dropped
* must be notified to the upper layer
* as failed to send.
*/
asoc->strmout[i].next_sequence_sent = 0x0;
TAILQ_INIT(&asoc->strmout[i].outqueue);
asoc->strmout[i].stream_no = i;
asoc->strmout[i].next_spoke.tqe_next = 0;
asoc->strmout[i].next_spoke.tqe_prev = 0;
}
}
}
sctp_send_initiate(inp, stcb);
/*
* we may want to dig in after this call and adjust the MTU
* value. It defaulted to 1500 (constant) but the ro structure
* may now have an update and thus we may need to change it
* BEFORE we append the message.
*/
net = stcb->asoc.primary_destination;
} else {
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
asoc = &stcb->asoc;
if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
queue_only = 1;
}
if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
(asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
if ((use_rcvinfo) &&
(srcv.sinfo_flags & SCTP_ABORT)) {
sctp_msg_append(stcb, net, m, &srcv, flags);
error = 0;
} else {
sctp_m_freem(m);
error = ECONNRESET;
}
SCTP_TCB_UNLOCK(stcb);
return (error);
}
}
if (create_lock_applied) {
/* we should never hit here with the create lock applied
*
*/
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}

if (use_rcvinfo == 0) {
srcv = stcb->asoc.def_send;
}
#ifdef SCTP_DEBUG
else {
if (sctp_debug_on & SCTP_DEBUG_OUTPUT5) {
printf("stream:%d\n", srcv.sinfo_stream);
printf("flags:%x\n", (u_int)srcv.sinfo_flags);
printf("ppid:%d\n", srcv.sinfo_ppid);
printf("context:%d\n", srcv.sinfo_context);
}
}
#endif
if (control) {
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);
control = NULL;
}
if (net && ((srcv.sinfo_flags & SCTP_ADDR_OVER))) {
/* we take the override or the unconfirmed */
;
} else {
net = stcb->asoc.primary_destination;
}
if ((error = sctp_msg_append(stcb, net, m, &srcv, flags))) {
SCTP_TCB_UNLOCK(stcb);
return (error);
}
if (net->flight_size > net->cwnd) {
sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
queue_only = 1;
} else if (asoc->ifp_had_enobuf) {
sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
queue_only = 1;
} else {
un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
SCTP_MED_OVERHEAD);

if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
(stcb->asoc.total_flight > 0) &&
(un_sent < (int)stcb->asoc.smallest_mtu)
) {

/* Ok, Nagle is set on and we have
* data outstanding. Don't send anything
* and let the SACK drive out the data.
*/
sctp_pegs[SCTP_NAGLE_NOQ]++;
queue_only = 1;
} else {
sctp_pegs[SCTP_NAGLE_OFF]++;
}
}
if ((queue_only == 0) && stcb->asoc.peers_rwnd) {
/* we can attempt to send too.*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("USR Send calls sctp_chunk_output\n");
}
#endif
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC0, 1);
sctp_auditing(6, inp, stcb, net);
#endif
sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
sctp_chunk_output(inp, stcb, 0);
#ifdef SCTP_AUDITING_ENABLED
sctp_audit_log(0xC0, 2);
sctp_auditing(7, inp, stcb, net);
#endif

}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("USR Send complete qo:%d prw:%d\n", queue_only, stcb->asoc.peers_rwnd);
}
#endif
SCTP_TCB_UNLOCK(stcb);
return (0);
}

void
send_forward_tsn(struct sctp_tcb *stcb,
struct sctp_association *asoc)
{
struct sctp_tmit_chunk *chk;
struct sctp_forward_tsn_chunk *fwdtsn;

TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
if (chk->rec.chunk_id == SCTP_FORWARD_CUM_TSN) {
/* mark it to unsent */
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
/* Do we correct its output location? */
if (chk->whoTo != asoc->primary_destination) {
sctp_free_remote_addr(chk->whoTo);
chk->whoTo = asoc->primary_destination;
chk->whoTo->ref_count++;
}
goto sctp_fill_in_rest;
}
}
/* Ok if we reach here we must build one */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
chk->rec.chunk_id = SCTP_FORWARD_CUM_TSN;
chk->asoc = asoc;
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
chk->whoTo->ref_count--;
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->whoTo = asoc->primary_destination;
chk->whoTo->ref_count++;
TAILQ_INSERT_TAIL(&asoc->control_send_queue, chk, sctp_next);
asoc->ctrl_queue_cnt++;
sctp_fill_in_rest:
/* Here we go through and fill out the part that
* deals with stream/seq of the ones we skip.
*/
chk->data->m_pkthdr.len = chk->data->m_len = 0;
{
struct sctp_tmit_chunk *at, *tp1, *last;
struct sctp_strseq *strseq;
unsigned int cnt_of_space, i, ovh;
unsigned int space_needed;
unsigned int cnt_of_skipped = 0;
TAILQ_FOREACH(at, &asoc->sent_queue, sctp_next) {
if (at->sent != SCTP_FORWARD_TSN_SKIP) {
/* no more to look at */
break;
}
if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
/* We don't report these */
continue;
}
cnt_of_skipped++;
}
space_needed = (sizeof(struct sctp_forward_tsn_chunk) +
(cnt_of_skipped * sizeof(struct sctp_strseq)));
if ((M_TRAILINGSPACE(chk->data) < (int)space_needed) &&
((chk->data->m_flags & M_EXT) == 0)) {
/* Need a M_EXT, get one and move
* fwdtsn to data area.
*/
MCLGET(chk->data, M_DONTWAIT);
}
cnt_of_space = M_TRAILINGSPACE(chk->data);

if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
ovh = SCTP_MIN_OVERHEAD;
} else {
ovh = SCTP_MIN_V4_OVERHEAD;
}
if (cnt_of_space > (asoc->smallest_mtu-ovh)) {
/* trim to a mtu size */
cnt_of_space = asoc->smallest_mtu - ovh;
}
if (cnt_of_space < space_needed) {
/* ok we must trim down the chunk by lowering
* the advance peer ack point.
*/
cnt_of_skipped = (cnt_of_space-
((sizeof(struct sctp_forward_tsn_chunk))/
sizeof(struct sctp_strseq)));
/* Go through and find the TSN that
* will be the one we report.
*/
at = TAILQ_FIRST(&asoc->sent_queue);
for (i = 0; i < cnt_of_skipped; i++) {
tp1 = TAILQ_NEXT(at, sctp_next);
at = tp1;
}
last = at;
/* last now points to last one I can report, update peer ack point */
asoc->advanced_peer_ack_point = last->rec.data.TSN_seq;
space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
}
chk->send_size = space_needed;
/* Setup the chunk */
fwdtsn = mtod(chk->data, struct sctp_forward_tsn_chunk *);
fwdtsn->ch.chunk_length = htons(chk->send_size);
fwdtsn->ch.chunk_flags = 0;
fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
fwdtsn->new_cumulative_tsn = htonl(asoc->advanced_peer_ack_point);
chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
(cnt_of_skipped * sizeof(struct sctp_strseq)));
chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
fwdtsn++;
/* Move pointer to after the fwdtsn and transfer to
* the strseq pointer.
*/
strseq = (struct sctp_strseq *)fwdtsn;
/*
* Now populate the strseq list. This is done blindly
* without pulling out duplicate stream info. This is
* inefficent but won't harm the process since the peer
* will look at these in sequence and will thus release
* anything. It could mean we exceed the PMTU and chop
* off some that we could have included.. but this is
* unlikely (aka 1432/4 would mean 300+ stream seq's would
* have to be reported in one FWD-TSN. With a bit of work
* we can later FIX this to optimize and pull out duplicates..
* but it does add more overhead. So for now... not!
*/
at = TAILQ_FIRST(&asoc->sent_queue);
for (i = 0; i < cnt_of_skipped; i++) {
tp1 = TAILQ_NEXT(at, sctp_next);
if (at->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
/* We don't report these */
i--;
at = tp1;
continue;
}
strseq->stream = ntohs(at->rec.data.stream_number);
strseq->sequence = ntohs(at->rec.data.stream_seq);
strseq++;
at = tp1;
}
}
return;

}

void
sctp_send_sack(struct sctp_tcb *stcb)
{
/*
* Queue up a SACK in the control queue. We must first check to
* see if a SACK is somehow on the control queue. If so, we will
* take and remove the old one.
*/
struct sctp_association *asoc;
struct sctp_tmit_chunk *chk, *a_chk;
struct sctp_sack_chunk *sack;
struct sctp_gap_ack_block *gap_descriptor;
uint32_t *dup;
int start;
unsigned int i, maxi, seeing_ones, m_size;
unsigned int num_gap_blocks, space;

start = maxi = 0;
seeing_ones = 1;
a_chk = NULL;
asoc = &stcb->asoc;
if (asoc->last_data_chunk_from == NULL) {
/* Hmm we never received anything */
return;
}
sctp_set_rwnd(stcb, asoc);
TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
if (chk->rec.chunk_id == SCTP_SELECTIVE_ACK) {
/* Hmm, found a sack already on queue, remove it */
TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
asoc->ctrl_queue_cnt++;
a_chk = chk;
sctp_m_freem(a_chk->data);
a_chk->data = NULL;
sctp_free_remote_addr(a_chk->whoTo);
a_chk->whoTo = NULL;
break;
}
}
if (a_chk == NULL) {
a_chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (a_chk == NULL) {
/* No memory so we drop the idea, and set a timer */
sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep, stcb, NULL);
sctp_timer_start(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep, stcb, NULL);
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
a_chk->rec.chunk_id = SCTP_SELECTIVE_ACK;
}
a_chk->asoc = asoc;
a_chk->snd_count = 0;
a_chk->send_size = 0; /* fill in later */
a_chk->sent = SCTP_DATAGRAM_UNSENT;
m_size = (asoc->mapping_array_size << 3);

if ((asoc->numduptsns) ||
(asoc->last_data_chunk_from->dest_state & SCTP_ADDR_NOT_REACHABLE)
) {
/* Ok, we have some duplicates or the destination for the
* sack is unreachable, lets see if we can select an alternate
* than asoc->last_data_chunk_from
*/
if ((!(asoc->last_data_chunk_from->dest_state &
SCTP_ADDR_NOT_REACHABLE)) &&
(asoc->used_alt_onsack > 2)) {
/* We used an alt last time, don't this time */
a_chk->whoTo = NULL;
} else {
asoc->used_alt_onsack++;
a_chk->whoTo = sctp_find_alternate_net(stcb, asoc->last_data_chunk_from);
}
if (a_chk->whoTo == NULL) {
/* Nope, no alternate */
a_chk->whoTo = asoc->last_data_chunk_from;
asoc->used_alt_onsack = 0;
}
} else {
/* No duplicates so we use the last
* place we received data from.
*/
#ifdef SCTP_DEBUG
if (asoc->last_data_chunk_from == NULL) {
printf("Huh, last_data_chunk_from is null when we want to sack??\n");
}
#endif
asoc->used_alt_onsack = 0;
a_chk->whoTo = asoc->last_data_chunk_from;
}
if (a_chk->whoTo)
a_chk->whoTo->ref_count++;

/* Ok now lets formulate a MBUF with our sack */
MGETHDR(a_chk->data, M_DONTWAIT, MT_DATA);
if ((a_chk->data == NULL) ||
(a_chk->whoTo == NULL)) {
/* rats, no mbuf memory */
if (a_chk->data) {
/* was a problem with the destination */
sctp_m_freem(a_chk->data);
a_chk->data = NULL;
}
a_chk->whoTo->ref_count--;
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep, stcb, NULL);
sctp_timer_start(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep, stcb, NULL);
return;
}
/* First count the number of gap ack blocks we need */
if (asoc->highest_tsn_inside_map == asoc->cumulative_tsn) {
/* We know if there are none above the cum-ack we
* have everything with NO gaps
*/
num_gap_blocks = 0;
} else {
/* Ok we must count how many gaps we
* have.
*/
num_gap_blocks = 0;
if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
maxi = (asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn);
} else {
maxi = (asoc->highest_tsn_inside_map + (MAX_TSN - asoc->mapping_array_base_tsn) + 1);
}
if (maxi > m_size) {
/* impossible but who knows, someone is playing with us :> */
#ifdef SCTP_DEBUG
printf("GAK maxi:%d > m_size:%d came out higher than allowed htsn:%u base:%u cumack:%u\n",
maxi,
m_size,
asoc->highest_tsn_inside_map,
asoc->mapping_array_base_tsn,
asoc->cumulative_tsn
);
#endif
num_gap_blocks = 0;
goto no_gaps_now;
}
if (asoc->cumulative_tsn >= asoc->mapping_array_base_tsn) {
start = (asoc->cumulative_tsn - asoc->mapping_array_base_tsn);
} else {
/* Set it so we start at 0 */
start = -1;
}
/* Ok move start up one to look at the NEXT past the cum-ack */
start++;
for (i = start; i <= maxi; i++) {
if (seeing_ones) {
/* while seeing ones I must
* transition back to 0 before
* finding the next gap and
* counting the segment.
*/
if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
seeing_ones = 0;
}
} else {
if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
seeing_ones = 1;
num_gap_blocks++;
}
}
}
no_gaps_now:
if (num_gap_blocks == 0) {
/*
* Traveled all of the bits and NO one,
* must have reneged
*/
if (compare_with_wrap(asoc->cumulative_tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
#ifdef SCTP_MAP_LOGGING
sctp_log_map(0, 4, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
#endif
}
}
}

/* Now calculate the space needed */
space = (sizeof(struct sctp_sack_chunk) +
(num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
(asoc->numduptsns * sizeof(int32_t))
);
if (space > (asoc->smallest_mtu-SCTP_MAX_OVERHEAD)) {
/* Reduce the size of the sack to fit */
int calc, fit;
calc = (asoc->smallest_mtu - SCTP_MAX_OVERHEAD);
calc -= sizeof(struct sctp_gap_ack_block);
fit = calc/sizeof(struct sctp_gap_ack_block);
if (fit > (int)num_gap_blocks) {
/* discard some dups */
asoc->numduptsns = (fit - num_gap_blocks);
} else {
/* discard all dups and some gaps */
num_gap_blocks = fit;
asoc->numduptsns = 0;
}
/* recalc space */
space = (sizeof(struct sctp_sack_chunk) +
(num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
(asoc->numduptsns * sizeof(int32_t))
);

}

if ((space+SCTP_MIN_OVERHEAD) > MHLEN) {
/* We need a cluster */
MCLGET(a_chk->data, M_DONTWAIT);
if ((a_chk->data->m_flags & M_EXT) != M_EXT) {
/* can't get a cluster
* give up and try later.
*/
sctp_m_freem(a_chk->data);
a_chk->data = NULL;
a_chk->whoTo->ref_count--;
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, a_chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep, stcb, NULL);
sctp_timer_start(SCTP_TIMER_TYPE_RECV,
stcb->sctp_ep, stcb, NULL);
return;
}
}

/* ok, lets go through and fill it in */
a_chk->data->m_data += SCTP_MIN_OVERHEAD;
sack = mtod(a_chk->data, struct sctp_sack_chunk *);
sack->ch.chunk_type = SCTP_SELECTIVE_ACK;
sack->ch.chunk_flags = asoc->receiver_nonce_sum & SCTP_SACK_NONCE_SUM;
sack->sack.cum_tsn_ack = htonl(asoc->cumulative_tsn);
sack->sack.a_rwnd = htonl(asoc->my_rwnd);
asoc->my_last_reported_rwnd = asoc->my_rwnd;
sack->sack.num_gap_ack_blks = htons(num_gap_blocks);
sack->sack.num_dup_tsns = htons(asoc->numduptsns);

a_chk->send_size = (sizeof(struct sctp_sack_chunk) +
(num_gap_blocks * sizeof(struct sctp_gap_ack_block)) +
(asoc->numduptsns * sizeof(int32_t)));
a_chk->data->m_pkthdr.len = a_chk->data->m_len = a_chk->send_size;
sack->ch.chunk_length = htons(a_chk->send_size);

gap_descriptor = (struct sctp_gap_ack_block *)((vaddr_t)sack + sizeof(struct sctp_sack_chunk));
seeing_ones = 0;
for (i = start; i <= maxi; i++) {
if (num_gap_blocks == 0) {
break;
}
if (seeing_ones) {
/* while seeing Ones I must
* transition back to 0 before
* finding the next gap
*/
if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) == 0) {
gap_descriptor->end = htons(((uint16_t)(i-start)));
gap_descriptor++;
seeing_ones = 0;
num_gap_blocks--;
}
} else {
if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
gap_descriptor->start = htons(((uint16_t)(i+1-start)));
/* advance struct to next pointer */
seeing_ones = 1;
}
}
}
if (num_gap_blocks) {
/* special case where the array is all 1's
* to the end of the array.
*/
gap_descriptor->end = htons(((uint16_t)((i-start))));
gap_descriptor++;
}
/* now we must add any dups we are going to report. */
if (asoc->numduptsns) {
dup = (uint32_t *)gap_descriptor;
for (i = 0; i < asoc->numduptsns; i++) {
*dup = htonl(asoc->dup_tsns[i]);
dup++;
}
asoc->numduptsns = 0;
}
/* now that the chunk is prepared queue it to the control
* chunk queue.
*/
TAILQ_INSERT_TAIL(&asoc->control_send_queue, a_chk, sctp_next);
asoc->ctrl_queue_cnt++;
sctp_pegs[SCTP_PEG_SACKS_SENT]++;
return;
}

void
sctp_send_abort_tcb(struct sctp_tcb *stcb, struct mbuf *operr)
{
struct mbuf *m_abort;
struct sctp_abort_msg *abort_m;
int sz;
abort_m = NULL;
MGETHDR(m_abort, M_DONTWAIT, MT_HEADER);
if (m_abort == NULL) {
/* no mbuf's */
return;
}
m_abort->m_data += SCTP_MIN_OVERHEAD;
abort_m = mtod(m_abort, struct sctp_abort_msg *);
m_abort->m_len = sizeof(struct sctp_abort_msg);
m_abort->m_next = operr;
sz = 0;
if (operr) {
struct mbuf *n;
n = operr;
while (n) {
sz += n->m_len;
n = n->m_next;
}
}
abort_m->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;
abort_m->msg.ch.chunk_flags = 0;
abort_m->msg.ch.chunk_length = htons(sizeof(struct sctp_abort_chunk) +
sz);
abort_m->sh.src_port = stcb->sctp_ep->sctp_lport;
abort_m->sh.dest_port = stcb->rport;
abort_m->sh.v_tag = htonl(stcb->asoc.peer_vtag);
abort_m->sh.checksum = 0;
m_abort->m_pkthdr.len = m_abort->m_len + sz;
m_reset_rcvif(m_abort);
sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb,
stcb->asoc.primary_destination,
rtcache_getdst(&stcb->asoc.primary_destination->ro),
m_abort, 1, 0, NULL, 0);
}

int
sctp_send_shutdown_complete(struct sctp_tcb *stcb,
struct sctp_nets *net)

{
/* formulate and SEND a SHUTDOWN-COMPLETE */
struct mbuf *m_shutdown_comp;
struct sctp_shutdown_complete_msg *comp_cp;

m_shutdown_comp = NULL;
MGETHDR(m_shutdown_comp, M_DONTWAIT, MT_HEADER);
if (m_shutdown_comp == NULL) {
/* no mbuf's */
return (-1);
}
m_shutdown_comp->m_data += sizeof(struct ip6_hdr);
comp_cp = mtod(m_shutdown_comp, struct sctp_shutdown_complete_msg *);
comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
comp_cp->shut_cmp.ch.chunk_flags = 0;
comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));
comp_cp->sh.src_port = stcb->sctp_ep->sctp_lport;
comp_cp->sh.dest_port = stcb->rport;
comp_cp->sh.v_tag = htonl(stcb->asoc.peer_vtag);
comp_cp->sh.checksum = 0;

m_shutdown_comp->m_pkthdr.len = m_shutdown_comp->m_len = sizeof(struct sctp_shutdown_complete_msg);
m_reset_rcvif(m_shutdown_comp);
sctp_lowlevel_chunk_output(stcb->sctp_ep, stcb, net,
rtcache_getdst(&net->ro), m_shutdown_comp,
1, 0, NULL, 0);
if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
stcb->sctp_ep->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
soisdisconnected(stcb->sctp_ep->sctp_socket);
}
return (0);
}

int
sctp_send_shutdown_complete2(struct mbuf *m, int iphlen, struct sctphdr *sh)
{
/* formulate and SEND a SHUTDOWN-COMPLETE */
struct mbuf *mout;
struct ip *iph, *iph_out;
struct ip6_hdr *ip6, *ip6_out;
int offset_out;
struct sctp_shutdown_complete_msg *comp_cp;

MGETHDR(mout, M_DONTWAIT, MT_HEADER);
if (mout == NULL) {
/* no mbuf's */
return (-1);
}
iph = mtod(m, struct ip *);
iph_out = NULL;
ip6_out = NULL;
offset_out = 0;
if (iph->ip_v == IPVERSION) {
mout->m_len = sizeof(struct ip) +
sizeof(struct sctp_shutdown_complete_msg);
mout->m_next = NULL;
iph_out = mtod(mout, struct ip *);

/* Fill in the IP header for the ABORT */
iph_out->ip_v = IPVERSION;
iph_out->ip_hl = (sizeof(struct ip)/4);
iph_out->ip_tos = (u_char)0;
iph_out->ip_id = 0;
iph_out->ip_off = 0;
iph_out->ip_ttl = MAXTTL;
iph_out->ip_p = IPPROTO_SCTP;
iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
iph_out->ip_dst.s_addr = iph->ip_src.s_addr;

/* let IP layer calculate this */
iph_out->ip_sum = 0;
offset_out += sizeof(*iph_out);
comp_cp = (struct sctp_shutdown_complete_msg *)(
(vaddr_t)iph_out + offset_out);
} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
ip6 = (struct ip6_hdr *)iph;
mout->m_len = sizeof(struct ip6_hdr) +
sizeof(struct sctp_shutdown_complete_msg);
mout->m_next = NULL;
ip6_out = mtod(mout, struct ip6_hdr *);

/* Fill in the IPv6 header for the ABORT */
ip6_out->ip6_flow = ip6->ip6_flow;
ip6_out->ip6_hlim = ip6_defhlim;
ip6_out->ip6_nxt = IPPROTO_SCTP;
ip6_out->ip6_src = ip6->ip6_dst;
ip6_out->ip6_dst = ip6->ip6_src;
ip6_out->ip6_plen = mout->m_len;
offset_out += sizeof(*ip6_out);
comp_cp = (struct sctp_shutdown_complete_msg *)(
(vaddr_t)ip6_out + offset_out);
} else {
/* Currently not supported. */
return (-1);
}

/* Now copy in and fill in the ABORT tags etc. */
comp_cp->sh.src_port = sh->dest_port;
comp_cp->sh.dest_port = sh->src_port;
comp_cp->sh.checksum = 0;
comp_cp->sh.v_tag = sh->v_tag;
comp_cp->shut_cmp.ch.chunk_flags = SCTP_HAD_NO_TCB;
comp_cp->shut_cmp.ch.chunk_type = SCTP_SHUTDOWN_COMPLETE;
comp_cp->shut_cmp.ch.chunk_length = htons(sizeof(struct sctp_shutdown_complete_chunk));

mout->m_pkthdr.len = mout->m_len;
/* add checksum */
if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
comp_cp->sh.checksum = 0;
} else {
comp_cp->sh.checksum = sctp_calculate_sum(mout, NULL, offset_out);
}

/* zap the rcvif, it should be null */
m_reset_rcvif(mout);
/* zap the stack pointer to the route */
if (iph_out != NULL) {
struct route ro;

memset(&ro, 0, sizeof ro);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("sctp_shutdown_complete2 calling ip_output:\n");
sctp_print_address_pkt(iph_out, &comp_cp->sh);
}
#endif
/* set IPv4 length */
iph_out->ip_len = htons(mout->m_pkthdr.len);
/* out it goes */
ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
} else if (ip6_out != NULL) {
struct route ro;

memset(&ro, 0, sizeof(ro));
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("sctp_shutdown_complete2 calling ip6_output:\n");
sctp_print_address_pkt((struct ip *)ip6_out,
&comp_cp->sh);
}
#endif
ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL);
}
sctp_pegs[SCTP_DATAGRAMS_SENT]++;
return (0);
}

static struct sctp_nets *
sctp_select_hb_destination(struct sctp_tcb *stcb, struct timeval *now)
{
struct sctp_nets *net, *hnet;
int ms_goneby, highest_ms, state_override=0;

SCTP_GETTIME_TIMEVAL(now);
highest_ms = 0;
hnet = NULL;
TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
if (
((net->dest_state & SCTP_ADDR_NOHB) && ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) ||
(net->dest_state & SCTP_ADDR_OUT_OF_SCOPE)
) {
/* Skip this guy from consideration if HB is off AND its confirmed*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Skipping net:%p state:%d nohb/out-of-scope\n",
net, net->dest_state);
}
#endif
continue;
}
if (sctp_destination_is_reachable(stcb, (struct sockaddr *)&net->ro.ro_sa) == 0) {
/* skip this dest net from consideration */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Skipping net:%p reachable NOT\n",
net);
}
#endif
continue;
}
if (net->last_sent_time.tv_sec) {
/* Sent to so we subtract */
ms_goneby = (now->tv_sec - net->last_sent_time.tv_sec) * 1000;
} else
/* Never been sent to */
ms_goneby = 0x7fffffff;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("net:%p ms_goneby:%d\n",
net, ms_goneby);
}
#endif
/* When the address state is unconfirmed but still considered reachable, we
* HB at a higher rate. Once it goes confirmed OR reaches the "unreachable"
* state, then we cut it back to HB at a more normal pace.
*/
if ((net->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED) {
state_override = 1;
} else {
state_override = 0;
}

if ((((unsigned int)ms_goneby >= net->RTO) || (state_override)) &&
(ms_goneby > highest_ms)) {
highest_ms = ms_goneby;
hnet = net;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("net:%p is the new high\n",
net);
}
#endif
}
}
if (hnet &&
((hnet->dest_state & (SCTP_ADDR_UNCONFIRMED|SCTP_ADDR_NOT_REACHABLE)) == SCTP_ADDR_UNCONFIRMED)) {
state_override = 1;
} else {
state_override = 0;
}

if (highest_ms && (((unsigned int)highest_ms >= hnet->RTO) || state_override)) {
/* Found the one with longest delay bounds
* OR it is unconfirmed and still not marked
* unreachable.
*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("net:%p is the hb winner -",
hnet);
if (hnet)
sctp_print_address((struct sockaddr *)&hnet->ro.ro_sa);
else
printf(" none\n");
}
#endif
/* update the timer now */
hnet->last_sent_time = *now;
return (hnet);
}
/* Nothing to HB */
return (NULL);
}

int
sctp_send_hb(struct sctp_tcb *stcb, int user_req, struct sctp_nets *u_net)
{
struct sctp_tmit_chunk *chk;
struct sctp_nets *net;
struct sctp_heartbeat_chunk *hb;
struct timeval now;
struct sockaddr_in *sin;
struct sockaddr_in6 *sin6;

if (user_req == 0) {
net = sctp_select_hb_destination(stcb, &now);
if (net == NULL) {
/* All our busy none to send to, just
* start the timer again.
*/
if (stcb->asoc.state == 0) {
return (0);
}
sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
stcb->sctp_ep,
stcb,
net);
return (0);
}
#ifndef SCTP_USE_ALLMAN_BURST
else {
/* found one idle.. decay cwnd on this one
* by 1/2 if none outstanding.
*/

if (net->flight_size == 0) {
net->cwnd /= 2;
if (net->addr_is_local) {
if (net->cwnd < (net->mtu *4)) {
net->cwnd = net->mtu * 4;
}
} else {
if (net->cwnd < (net->mtu * 2)) {
net->cwnd = net->mtu * 2;
}
}

}

}
#endif
} else {
net = u_net;
if (net == NULL) {
return (0);
}
SCTP_GETTIME_TIMEVAL(&now);
}
sin = (struct sockaddr_in *)&net->ro.ro_sa;
if (sin->sin_family != AF_INET) {
if (sin->sin_family != AF_INET6) {
/* huh */
return (0);
}
}
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Gak, can't get a chunk for hb\n");
}
#endif
return (0);
}
sctppcbinfo.ipi_gencnt_chunk++;
sctppcbinfo.ipi_count_chunk++;
chk->rec.chunk_id = SCTP_HEARTBEAT_REQUEST;
chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_heartbeat_chunk);
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return (0);
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->whoTo = net;
chk->whoTo->ref_count++;
/* Now we have a mbuf that we can fill in with the details */
hb = mtod(chk->data, struct sctp_heartbeat_chunk *);

/* fill out chunk header */
hb->ch.chunk_type = SCTP_HEARTBEAT_REQUEST;
hb->ch.chunk_flags = 0;
hb->ch.chunk_length = htons(chk->send_size);
/* Fill out hb parameter */
hb->heartbeat.hb_info.ph.param_type = htons(SCTP_HEARTBEAT_INFO);
hb->heartbeat.hb_info.ph.param_length = htons(sizeof(struct sctp_heartbeat_info_param));
hb->heartbeat.hb_info.time_value_1 = now.tv_sec;
hb->heartbeat.hb_info.time_value_2 = now.tv_usec;
/* Did our user request this one, put it in */
hb->heartbeat.hb_info.user_req = user_req;
hb->heartbeat.hb_info.addr_family = sin->sin_family;
hb->heartbeat.hb_info.addr_len = sin->sin_len;
if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
/* we only take from the entropy pool if the address is
* not confirmed.
*/
net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
} else {
net->heartbeat_random1 = hb->heartbeat.hb_info.random_value1 = 0;
net->heartbeat_random2 = hb->heartbeat.hb_info.random_value2 = 0;
}
if (sin->sin_family == AF_INET) {
memcpy(hb->heartbeat.hb_info.address, &sin->sin_addr, sizeof(sin->sin_addr));
} else if (sin->sin_family == AF_INET6) {
/* We leave the scope the way it is in our lookup table. */
sin6 = (struct sockaddr_in6 *)&net->ro.ro_sa;
memcpy(hb->heartbeat.hb_info.address, &sin6->sin6_addr, sizeof(sin6->sin6_addr));
} else {
/* huh compiler bug */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Compiler bug bleeds a mbuf and a chunk\n");
}
#endif
return (0);
}
/* ok we have a destination that needs a beat */
/* lets do the theshold management Qiaobing style */
if (user_req == 0) {
if (sctp_threshold_management(stcb->sctp_ep, stcb, net,
stcb->asoc.max_send_times)) {
/* we have lost the association, in a way this
* is quite bad since we really are one less time
* since we really did not send yet. This is the
* down side to the Q's style as defined in the RFC
* and not my alternate style defined in the RFC.
*/
sctp_m_freem(chk->data);
chk->data = NULL;
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return (-1);
}
}
net->hb_responded = 0;
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("Inserting chunk for HB\n");
}
#endif
TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
stcb->asoc.ctrl_queue_cnt++;
sctp_pegs[SCTP_HB_SENT]++;
/*
* Call directly med level routine to put out the chunk. It will
* always tumble out control chunks aka HB but it may even tumble
* out data too.
*/
if (user_req == 0) {
/* Ok now lets start the HB timer if it is NOT a user req */
sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
stcb, net);
}
return (1);
}

void
sctp_send_ecn_echo(struct sctp_tcb *stcb, struct sctp_nets *net,
uint32_t high_tsn)
{
struct sctp_association *asoc;
struct sctp_ecne_chunk *ecne;
struct sctp_tmit_chunk *chk;
asoc = &stcb->asoc;
TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
if (chk->rec.chunk_id == SCTP_ECN_ECHO) {
/* found a previous ECN_ECHO update it if needed */
ecne = mtod(chk->data, struct sctp_ecne_chunk *);
ecne->tsn = htonl(high_tsn);
return;
}
}
/* nope could not find one to update so we must build one */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
return;
}
sctp_pegs[SCTP_ECNE_SENT]++;
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
chk->rec.chunk_id = SCTP_ECN_ECHO;
chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_ecne_chunk);
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->whoTo = net;
chk->whoTo->ref_count++;
ecne = mtod(chk->data, struct sctp_ecne_chunk *);
ecne->ch.chunk_type = SCTP_ECN_ECHO;
ecne->ch.chunk_flags = 0;
ecne->ch.chunk_length = htons(sizeof(struct sctp_ecne_chunk));
ecne->tsn = htonl(high_tsn);
TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
asoc->ctrl_queue_cnt++;
}

void
sctp_send_packet_dropped(struct sctp_tcb *stcb, struct sctp_nets *net,
struct mbuf *m, int iphlen, int bad_crc)
{
struct sctp_association *asoc;
struct sctp_pktdrop_chunk *drp;
struct sctp_tmit_chunk *chk;
uint8_t *datap;
int len;
unsigned int small_one;
struct ip *iph;

long spc;
asoc = &stcb->asoc;
if (asoc->peer_supports_pktdrop == 0) {
/* peer must declare support before I
* send one.
*/
return;
}
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;

iph = mtod(m, struct ip *);
if (iph == NULL) {
return;
}
if (iph->ip_v == IPVERSION) {
/* IPv4 */
#if defined(__FreeBSD__)
len = chk->send_size = iph->ip_len;
#else
len = chk->send_size = (iph->ip_len - iphlen);
#endif
} else {
struct ip6_hdr *ip6h;
/* IPv6 */
ip6h = mtod(m, struct ip6_hdr *);
len = chk->send_size = htons(ip6h->ip6_plen);
}
if ((len+iphlen) > m->m_pkthdr.len) {
/* huh */
chk->send_size = len = m->m_pkthdr.len - iphlen;
}
chk->asoc = &stcb->asoc;
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
jump_out:
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
if ((chk->send_size+sizeof(struct sctp_pktdrop_chunk)+SCTP_MIN_OVERHEAD) > MHLEN) {
MCLGET(chk->data, M_DONTWAIT);
if ((chk->data->m_flags & M_EXT) == 0) {
/* Give up */
sctp_m_freem(chk->data);
chk->data = NULL;
goto jump_out;
}
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
drp = mtod(chk->data, struct sctp_pktdrop_chunk *);
if (drp == NULL) {
sctp_m_freem(chk->data);
chk->data = NULL;
goto jump_out;
}
small_one = asoc->smallest_mtu;
if (small_one > MCLBYTES) {
/* Only one cluster worth of data MAX */
small_one = MCLBYTES;
}
chk->book_size = (chk->send_size + sizeof(struct sctp_pktdrop_chunk) +
sizeof(struct sctphdr) + SCTP_MED_OVERHEAD);
if (chk->book_size > small_one) {
drp->ch.chunk_flags = SCTP_PACKET_TRUNCATED;
drp->trunc_len = htons(chk->send_size);
chk->send_size = small_one - (SCTP_MED_OVERHEAD +
sizeof(struct sctp_pktdrop_chunk) +
sizeof(struct sctphdr));
len = chk->send_size;
} else {
/* no truncation needed */
drp->ch.chunk_flags = 0;
drp->trunc_len = htons(0);
}
if (bad_crc) {
drp->ch.chunk_flags |= SCTP_BADCRC;
}
chk->send_size += sizeof(struct sctp_pktdrop_chunk);
chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
if (net) {
/* we should hit here */
chk->whoTo = net;
} else {
chk->whoTo = asoc->primary_destination;
}
chk->whoTo->ref_count++;
chk->rec.chunk_id = SCTP_PACKET_DROPPED;
drp->ch.chunk_type = SCTP_PACKET_DROPPED;
drp->ch.chunk_length = htons(chk->send_size);
spc = stcb->sctp_socket->so_rcv.sb_hiwat;
if (spc < 0) {
spc = 0;
}
drp->bottle_bw = htonl(spc);
drp->current_onq = htonl(asoc->size_on_delivery_queue +
asoc->size_on_reasm_queue +
asoc->size_on_all_streams +
asoc->my_rwnd_control_len +
stcb->sctp_socket->so_rcv.sb_cc);
drp->reserved = 0;
datap = drp->data;
m_copydata(m, iphlen, len, datap);
TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
asoc->ctrl_queue_cnt++;
}

void
sctp_send_cwr(struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t high_tsn)
{
struct sctp_association *asoc;
struct sctp_cwr_chunk *cwr;
struct sctp_tmit_chunk *chk;

asoc = &stcb->asoc;
TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
if (chk->rec.chunk_id == SCTP_ECN_CWR) {
/* found a previous ECN_CWR update it if needed */
cwr = mtod(chk->data, struct sctp_cwr_chunk *);
if (compare_with_wrap(high_tsn, ntohl(cwr->tsn),
MAX_TSN)) {
cwr->tsn = htonl(high_tsn);
}
return;
}
}
/* nope could not find one to update so we must build one */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
chk->rec.chunk_id = SCTP_ECN_CWR;
chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_cwr_chunk);
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
chk->data->m_pkthdr.len = chk->data->m_len = chk->send_size;
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->whoTo = net;
chk->whoTo->ref_count++;
cwr = mtod(chk->data, struct sctp_cwr_chunk *);
cwr->ch.chunk_type = SCTP_ECN_CWR;
cwr->ch.chunk_flags = 0;
cwr->ch.chunk_length = htons(sizeof(struct sctp_cwr_chunk));
cwr->tsn = htonl(high_tsn);
TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue, chk, sctp_next);
asoc->ctrl_queue_cnt++;
}
static void
sctp_reset_the_streams(struct sctp_tcb *stcb,
struct sctp_stream_reset_request *req, int number_entries, uint16_t *list)
{
int i;

if (req->reset_flags & SCTP_RESET_ALL) {
for (i=0; i<stcb->asoc.streamoutcnt; i++) {
stcb->asoc.strmout[i].next_sequence_sent = 0;
}
} else if (number_entries) {
for (i=0; i<number_entries; i++) {
if (list[i] >= stcb->asoc.streamoutcnt) {
/* no such stream */
continue;
}
stcb->asoc.strmout[(list[i])].next_sequence_sent = 0;
}
}
sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list);
}

void
sctp_send_str_reset_ack(struct sctp_tcb *stcb,
struct sctp_stream_reset_request *req)
{
struct sctp_association *asoc;
struct sctp_stream_reset_resp *strack;
struct sctp_tmit_chunk *chk;
uint32_t seq;
int number_entries, i;
uint8_t two_way=0, not_peer=0;
uint16_t *list=NULL;

asoc = &stcb->asoc;
if (req->reset_flags & SCTP_RESET_ALL)
number_entries = 0;
else
number_entries = (ntohs(req->ph.param_length) - sizeof(struct sctp_stream_reset_request)) / sizeof(uint16_t);

chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
chk->rec.chunk_id = SCTP_STREAM_RESET;
chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_stream_reset_resp) + (number_entries * sizeof(uint16_t));
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
strresp_jump_out:
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
MCLGET(chk->data, M_DONTWAIT);
if ((chk->data->m_flags & M_EXT) == 0) {
/* Give up */
sctp_m_freem(chk->data);
chk->data = NULL;
goto strresp_jump_out;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
}
if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
/* can't do it, no room */
/* Give up */
sctp_m_freem(chk->data);
chk->data = NULL;
goto strresp_jump_out;

}
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->whoTo = asoc->primary_destination;
chk->whoTo->ref_count++;
strack = mtod(chk->data, struct sctp_stream_reset_resp *);

strack->ch.chunk_type = SCTP_STREAM_RESET;
strack->ch.chunk_flags = 0;
strack->ch.chunk_length = htons(chk->send_size);

memset(strack->sr_resp.reset_pad, 0, sizeof(strack->sr_resp.reset_pad));

strack->sr_resp.ph.param_type = ntohs(SCTP_STR_RESET_RESPONSE);
strack->sr_resp.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));

if (chk->send_size % 4) {
/* need a padding for the end */
int pad;
uint8_t *end;
end = (uint8_t *)((vaddr_t)strack + chk->send_size);
pad = chk->send_size % 4;
for (i = 0; i < pad; i++) {
end[i] = 0;
}
chk->send_size += pad;
}

/* actual response */
if (req->reset_flags & SCTP_RESET_YOUR) {
strack->sr_resp.reset_flags = SCTP_RESET_PERFORMED;
} else {
strack->sr_resp.reset_flags = 0;
}

/* copied from reset request */
strack->sr_resp.reset_req_seq_resp = req->reset_req_seq;
seq = ntohl(req->reset_req_seq);

list = req->list_of_streams;
/* copy the un-converted network byte order streams */
for (i=0; i<number_entries; i++) {
strack->sr_resp.list_of_streams[i] = list[i];
}
if (asoc->str_reset_seq_in == seq) {
/* is it the next expected? */
asoc->str_reset_seq_in++;
strack->sr_resp.reset_at_tsn = htonl(asoc->sending_seq);
asoc->str_reset_sending_seq = asoc->sending_seq;
if (number_entries) {
uint16_t temp;
/* convert them to host byte order */
for (i=0 ; i<number_entries; i++) {
temp = ntohs(list[i]);
list[i] = temp;
}
}
if (req->reset_flags & SCTP_RESET_YOUR) {
/* reset my outbound streams */
sctp_reset_the_streams(stcb, req , number_entries, list);
}
if (req->reset_flags & SCTP_RECIPRICAL) {
/* reset peer too */
sctp_send_str_reset_req(stcb, number_entries, list, two_way, not_peer);
}

} else {
/* no its a retran so I must just ack and do nothing */
strack->sr_resp.reset_at_tsn = htonl(asoc->str_reset_sending_seq);
}
strack->sr_resp.cumulative_tsn = htonl(asoc->cumulative_tsn);
TAILQ_INSERT_TAIL(&asoc->control_send_queue,
chk,
sctp_next);
asoc->ctrl_queue_cnt++;
}

void
sctp_send_str_reset_req(struct sctp_tcb *stcb,
int number_entrys, uint16_t *list, uint8_t two_way, uint8_t not_peer)
{
/* Send a stream reset request. The number_entrys may be 0 and list NULL
* if the request is to reset all streams. If two_way is true then we
* not only request a RESET of the received streams but we also
* request the peer to send a reset req to us too.
* Flag combinations in table:
*
* two_way | not_peer | = | Flags
* ------------------------------
* 0 | 0 | = | SCTP_RESET_YOUR (just the peer)
* 1 | 0 | = | SCTP_RESET_YOUR | SCTP_RECIPRICAL (both sides)
* 0 | 1 | = | Not a Valid Request (not anyone)
* 1 | 1 | = | SCTP_RESET_RECIPRICAL (Just local host)
*/
struct sctp_association *asoc;
struct sctp_stream_reset_req *strreq;
struct sctp_tmit_chunk *chk;

asoc = &stcb->asoc;
if (asoc->stream_reset_outstanding) {
/* Already one pending, must get ACK back
* to clear the flag.
*/
return;
}

if ((two_way == 0) && (not_peer == 1)) {
/* not a valid request */
return;
}

chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
return;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
chk->rec.chunk_id = SCTP_STREAM_RESET;
chk->asoc = &stcb->asoc;
chk->send_size = sizeof(struct sctp_stream_reset_req) + (number_entrys * sizeof(uint16_t));
MGETHDR(chk->data, M_DONTWAIT, MT_DATA);
if (chk->data == NULL) {
strreq_jump_out:
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
return;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
chk->data->m_pkthdr.len = chk->data->m_len = SCTP_SIZE32(chk->send_size);
if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
MCLGET(chk->data, M_DONTWAIT);
if ((chk->data->m_flags & M_EXT) == 0) {
/* Give up */
sctp_m_freem(chk->data);
chk->data = NULL;
goto strreq_jump_out;
}
chk->data->m_data += SCTP_MIN_OVERHEAD;
}
if (M_TRAILINGSPACE(chk->data) < (int)SCTP_SIZE32(chk->send_size)) {
/* can't do it, no room */
/* Give up */
sctp_m_freem(chk->data);
chk->data = NULL;
goto strreq_jump_out;
}
chk->sent = SCTP_DATAGRAM_UNSENT;
chk->snd_count = 0;
chk->whoTo = asoc->primary_destination;
chk->whoTo->ref_count++;

strreq = mtod(chk->data, struct sctp_stream_reset_req *);
strreq->ch.chunk_type = SCTP_STREAM_RESET;
strreq->ch.chunk_flags = 0;
strreq->ch.chunk_length = htons(chk->send_size);

strreq->sr_req.ph.param_type = ntohs(SCTP_STR_RESET_REQUEST);
strreq->sr_req.ph.param_length = htons((chk->send_size - sizeof(struct sctp_chunkhdr)));

if (chk->send_size % 4) {
/* need a padding for the end */
int pad, i;
uint8_t *end;
end = (uint8_t *)((vaddr_t)strreq + chk->send_size);
pad = chk->send_size % 4;
for (i=0; i<pad; i++) {
end[i] = 0;
}
chk->send_size += pad;
}

strreq->sr_req.reset_flags = 0;
if (number_entrys == 0) {
strreq->sr_req.reset_flags |= SCTP_RESET_ALL;
}
if (two_way == 0) {
strreq->sr_req.reset_flags |= SCTP_RESET_YOUR;
} else {
if (not_peer == 0) {
strreq->sr_req.reset_flags |= SCTP_RECIPRICAL | SCTP_RESET_YOUR;
} else {
strreq->sr_req.reset_flags |= SCTP_RECIPRICAL;
}
}
memset(strreq->sr_req.reset_pad, 0, sizeof(strreq->sr_req.reset_pad));
strreq->sr_req.reset_req_seq = htonl(asoc->str_reset_seq_out);
if (number_entrys) {
/* populate the specific entry's */
int i;
for (i=0; i < number_entrys; i++) {
strreq->sr_req.list_of_streams[i] = htons(list[i]);
}
}
TAILQ_INSERT_TAIL(&asoc->control_send_queue,
chk,
sctp_next);
asoc->ctrl_queue_cnt++;
sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
asoc->stream_reset_outstanding = 1;
}

void
sctp_send_abort(struct mbuf *m, int iphlen, struct sctphdr *sh, uint32_t vtag,
struct mbuf *err_cause)
{
/*
* Formulate the abort message, and send it back down.
*/
struct mbuf *mout;
struct sctp_abort_msg *abm;
struct ip *iph, *iph_out;
struct ip6_hdr *ip6, *ip6_out;
int iphlen_out;

/* don't respond to ABORT with ABORT */
if (sctp_is_there_an_abort_here(m, iphlen, &vtag)) {
sctp_m_freem(err_cause);
return;
}
MGETHDR(mout, M_DONTWAIT, MT_HEADER);
if (mout == NULL) {
sctp_m_freem(err_cause);
return;
}
iph = mtod(m, struct ip *);
iph_out = NULL;
ip6_out = NULL;
if (iph->ip_v == IPVERSION) {
iph_out = mtod(mout, struct ip *);
mout->m_len = sizeof(*iph_out) + sizeof(*abm);
mout->m_next = err_cause;

/* Fill in the IP header for the ABORT */
iph_out->ip_v = IPVERSION;
iph_out->ip_hl = (sizeof(struct ip) / 4);
iph_out->ip_tos = (u_char)0;
iph_out->ip_id = 0;
iph_out->ip_off = 0;
iph_out->ip_ttl = MAXTTL;
iph_out->ip_p = IPPROTO_SCTP;
iph_out->ip_src.s_addr = iph->ip_dst.s_addr;
iph_out->ip_dst.s_addr = iph->ip_src.s_addr;
/* let IP layer calculate this */
iph_out->ip_sum = 0;

iphlen_out = sizeof(*iph_out);
abm = (struct sctp_abort_msg *)((vaddr_t)iph_out + iphlen_out);
} else if (iph->ip_v == (IPV6_VERSION >> 4)) {
ip6 = (struct ip6_hdr *)iph;
ip6_out = mtod(mout, struct ip6_hdr *);
mout->m_len = sizeof(*ip6_out) + sizeof(*abm);
mout->m_next = err_cause;

/* Fill in the IP6 header for the ABORT */
ip6_out->ip6_flow = ip6->ip6_flow;
ip6_out->ip6_hlim = ip6_defhlim;
ip6_out->ip6_nxt = IPPROTO_SCTP;
ip6_out->ip6_src = ip6->ip6_dst;
ip6_out->ip6_dst = ip6->ip6_src;

iphlen_out = sizeof(*ip6_out);
abm = (struct sctp_abort_msg *)((vaddr_t)ip6_out + iphlen_out);
} else {
/* Currently not supported */
return;
}

abm->sh.src_port = sh->dest_port;
abm->sh.dest_port = sh->src_port;
abm->sh.checksum = 0;
if (vtag == 0) {
abm->sh.v_tag = sh->v_tag;
abm->msg.ch.chunk_flags = SCTP_HAD_NO_TCB;
} else {
abm->sh.v_tag = htonl(vtag);
abm->msg.ch.chunk_flags = 0;
}
abm->msg.ch.chunk_type = SCTP_ABORT_ASSOCIATION;

if (err_cause) {
struct mbuf *m_tmp = err_cause;
int err_len = 0;
/* get length of the err_cause chain */
while (m_tmp != NULL) {
err_len += m_tmp->m_len;
m_tmp = m_tmp->m_next;
}
mout->m_pkthdr.len = mout->m_len + err_len;
if (err_len % 4) {
/* need pad at end of chunk */
u_int32_t cpthis=0;
int padlen;
padlen = 4 - (mout->m_pkthdr.len % 4);
m_copyback(mout, mout->m_pkthdr.len, padlen, (void *)&cpthis);
}
abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch) + err_len);
} else {
mout->m_pkthdr.len = mout->m_len;
abm->msg.ch.chunk_length = htons(sizeof(abm->msg.ch));
}

/* add checksum */
if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
abm->sh.checksum = 0;
} else {
abm->sh.checksum = sctp_calculate_sum(mout, NULL, iphlen_out);
}

/* zap the rcvif, it should be null */
m_reset_rcvif(mout);
if (iph_out != NULL) {
struct route ro;

/* zap the stack pointer to the route */
memset(&ro, 0, sizeof ro);
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("sctp_send_abort calling ip_output:\n");
sctp_print_address_pkt(iph_out, &abm->sh);
}
#endif
/* set IPv4 length */
iph_out->ip_len = htons(mout->m_pkthdr.len);
/* out it goes */
(void)ip_output(mout, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
} else if (ip6_out != NULL) {
struct route ro;

/* zap the stack pointer to the route */
memset(&ro, 0, sizeof(ro));
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("sctp_send_abort calling ip6_output:\n");
sctp_print_address_pkt((struct ip *)ip6_out, &abm->sh);
}
#endif
ip6_output(mout, NULL, &ro, 0, NULL, NULL, NULL);
}
sctp_pegs[SCTP_DATAGRAMS_SENT]++;
}

void
sctp_send_operr_to(struct mbuf *m, int iphlen,
struct mbuf *scm,
uint32_t vtag)
{
struct sctphdr *ihdr;
struct sctphdr *ohdr;
struct sctp_chunkhdr *ophdr;

struct ip *iph;
#ifdef SCTP_DEBUG
struct sockaddr_in6 lsa6, fsa6;
#endif
uint32_t val;
iph = mtod(m, struct ip *);
ihdr = (struct sctphdr *)((vaddr_t)iph + iphlen);
if (!(scm->m_flags & M_PKTHDR)) {
/* must be a pkthdr */
printf("Huh, not a packet header in send_operr\n");
m_freem(scm);
return;
}
M_PREPEND(scm, (sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)), M_DONTWAIT);
if (scm == NULL) {
/* can't send because we can't add a mbuf */
return;
}
ohdr = mtod(scm, struct sctphdr *);
ohdr->src_port = ihdr->dest_port;
ohdr->dest_port = ihdr->src_port;
ohdr->v_tag = vtag;
ohdr->checksum = 0;
ophdr = (struct sctp_chunkhdr *)(ohdr + 1);
ophdr->chunk_type = SCTP_OPERATION_ERROR;
ophdr->chunk_flags = 0;
ophdr->chunk_length = htons(scm->m_pkthdr.len - sizeof(struct sctphdr));
if (scm->m_pkthdr.len % 4) {
/* need padding */
u_int32_t cpthis=0;
int padlen;
padlen = 4 - (scm->m_pkthdr.len % 4);
m_copyback(scm, scm->m_pkthdr.len, padlen, (void *)&cpthis);
}
if ((sctp_no_csum_on_loopback) && m_get_rcvif_NOMPSAFE(m) != NULL &&
m_get_rcvif_NOMPSAFE(m)->if_type == IFT_LOOP) {
val = 0;
} else {
val = sctp_calculate_sum(scm, NULL, 0);
}
ohdr->checksum = val;
if (iph->ip_v == IPVERSION) {
/* V4 */
struct ip *out;
struct route ro;
M_PREPEND(scm, sizeof(struct ip), M_DONTWAIT);
if (scm == NULL)
return;
memset(&ro, 0, sizeof ro);
out = mtod(scm, struct ip *);
out->ip_v = iph->ip_v;
out->ip_hl = (sizeof(struct ip)/4);
out->ip_tos = iph->ip_tos;
out->ip_id = iph->ip_id;
out->ip_off = 0;
out->ip_ttl = MAXTTL;
out->ip_p = IPPROTO_SCTP;
out->ip_sum = 0;
out->ip_src = iph->ip_dst;
out->ip_dst = iph->ip_src;
out->ip_len = htons(scm->m_pkthdr.len);
ip_output(scm, 0, &ro, IP_RAWOUTPUT, NULL, NULL);
sctp_pegs[SCTP_DATAGRAMS_SENT]++;
} else {
/* V6 */
struct route ro;
struct ip6_hdr *out6, *in6;

M_PREPEND(scm, sizeof(struct ip6_hdr), M_DONTWAIT);
if (scm == NULL)
return;
memset(&ro, 0, sizeof ro);
in6 = mtod(m, struct ip6_hdr *);
out6 = mtod(scm, struct ip6_hdr *);
out6->ip6_flow = in6->ip6_flow;
out6->ip6_hlim = ip6_defhlim;
out6->ip6_nxt = IPPROTO_SCTP;
out6->ip6_src = in6->ip6_dst;
out6->ip6_dst = in6->ip6_src;

#ifdef SCTP_DEBUG
memset(&lsa6, 0, sizeof(lsa6));
lsa6.sin6_len = sizeof(lsa6);
lsa6.sin6_family = AF_INET6;
lsa6.sin6_addr = out6->ip6_src;
memset(&fsa6, 0, sizeof(fsa6));
fsa6.sin6_len = sizeof(fsa6);
fsa6.sin6_family = AF_INET6;
fsa6.sin6_addr = out6->ip6_dst;
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("sctp_operr_to calling ipv6 output:\n");
printf("src: ");
sctp_print_address((struct sockaddr *)&lsa6);
printf("dst ");
sctp_print_address((struct sockaddr *)&fsa6);
}
#endif /* SCTP_DEBUG */
ip6_output(scm, NULL, &ro, 0, NULL, NULL, NULL);
sctp_pegs[SCTP_DATAGRAMS_SENT]++;
}
}

static int
sctp_copy_one(struct mbuf *m, struct uio *uio, int cpsz, int resv_upfront, int *mbcnt)
{
int left, cancpy, willcpy, error;
left = cpsz;

if (m == NULL) {
/* TSNH */
*mbcnt = 0;
return (ENOMEM);
}
m->m_len = 0;
if ((left+resv_upfront) > (int)MHLEN) {
MCLGET(m, M_WAIT);
if (m == NULL) {
*mbcnt = 0;
return (ENOMEM);
}
if ((m->m_flags & M_EXT) == 0) {
*mbcnt = 0;
return (ENOMEM);
}
*mbcnt += m->m_ext.ext_size;
}
*mbcnt += MSIZE;
cancpy = M_TRAILINGSPACE(m);
willcpy = uimin(cancpy, left);
if ((willcpy + resv_upfront) > cancpy) {
willcpy -= resv_upfront;
}
while (left > 0) {
/* Align data to the end */
if ((m->m_flags & M_EXT) == 0) {
m_align(m, willcpy);
} else {
MC_ALIGN(m, willcpy);
}
error = uiomove(mtod(m, void *), willcpy, uio);
if (error) {
return (error);
}
m->m_len = willcpy;
m->m_nextpkt = 0;
left -= willcpy;
if (left > 0) {
MGET(m->m_next, M_WAIT, MT_DATA);
if (m->m_next == NULL) {
*mbcnt = 0;
return (ENOMEM);
}
m = m->m_next;
m->m_len = 0;
*mbcnt += MSIZE;
if (left > (int)MHLEN) {
MCLGET(m, M_WAIT);
if (m == NULL) {
*mbcnt = 0;
return (ENOMEM);
}
if ((m->m_flags & M_EXT) == 0) {
*mbcnt = 0;
return (ENOMEM);
}
*mbcnt += m->m_ext.ext_size;
}
cancpy = M_TRAILINGSPACE(m);
willcpy = uimin(cancpy, left);
}
}
return (0);
}

static int
sctp_copy_it_in(struct sctp_inpcb *inp,
struct sctp_tcb *stcb,
struct sctp_association *asoc,
struct sctp_nets *net,
struct sctp_sndrcvinfo *srcv,
struct uio *uio,
int flags)
{
/* This routine must be very careful in
* its work. Protocol processing is
* up and running so care must be taken to
* spl...() when you need to do something
* that may effect the stcb/asoc. The sb is
* locked however. When data is copied the
* protocol processing should be enabled since
* this is a slower operation...
*/
struct socket *so;
int error = 0;
int frag_size, mbcnt = 0, mbcnt_e = 0;
unsigned int sndlen;
unsigned int tot_demand;
int tot_out, dataout;
struct sctp_tmit_chunk *chk;
struct mbuf *mm;
struct sctp_stream_out *strq;
uint32_t my_vtag;
int resv_in_first;

so = stcb->sctp_socket;
solock(so);
chk = NULL;
mm = NULL;

sndlen = uio->uio_resid;
/* lock the socket buf */
error = sblock(&so->so_snd, SBLOCKWAIT(flags));
if (error)
goto out_locked;

#ifdef SCTP_DEBUG
printf("sctp_copy_it_in: %d\n", sndlen);
#endif
/* will it ever fit ? */
if (sndlen > so->so_snd.sb_hiwat) {
/* It will NEVER fit */
error = EMSGSIZE;
goto release;
}
/* Do I need to block? */
if ((so->so_snd.sb_hiwat <
(sndlen + asoc->total_output_queue_size)) ||
(asoc->chunks_on_out_queue > sctp_max_chunks_on_queue) ||
(asoc->total_output_mbuf_queue_size >
so->so_snd.sb_mbmax)
) {
/* prune any prsctp bufs out */
if (asoc->peer_supports_prsctp) {
sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
}
/*
* We store off a pointer to the endpoint.
* Since on return from this we must check to
* see if an so_error is set. If so we may have
* been reset and our stcb destroyed. Returning
* an error will flow back to the user...
*/
while ((so->so_snd.sb_hiwat <
(sndlen + asoc->total_output_queue_size)) ||
(asoc->chunks_on_out_queue >
sctp_max_chunks_on_queue) ||
(asoc->total_output_mbuf_queue_size >
so->so_snd.sb_mbmax)
) {
if ((so->so_state & SS_NBIO)
#if defined(__FreeBSD__) && __FreeBSD_version >= 500000
|| (flags & MSG_NBIO)
#endif
) {
/* Non-blocking io in place */
error = EWOULDBLOCK;
goto release;
}
inp->sctp_tcb_at_block = (void *)stcb;
inp->error_on_block = 0;
#ifdef SCTP_BLK_LOGGING
sctp_log_block(SCTP_BLOCK_LOG_INTO_BLK,
so, asoc);
#endif
sbunlock(&so->so_snd);
SCTP_TCB_UNLOCK(stcb);
error = sbwait(&so->so_snd);
SCTP_INP_RLOCK(inp);
if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
(inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
/* Should I really unlock ? */
SCTP_INP_RUNLOCK(inp);
error = EFAULT;
goto out_locked;
}
SCTP_TCB_LOCK(stcb);
SCTP_INP_RUNLOCK(inp);

inp->sctp_tcb_at_block = 0;
#ifdef SCTP_BLK_LOGGING
sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
so, asoc);
#endif
if (inp->error_on_block) {
/*
* if our asoc was killed, the free code
* (in sctp_pcb.c) will save a error in
* here for us
*/
error = inp->error_on_block;
goto out_locked;
}
if (error) {
goto out_locked;
}
/* did we encounter a socket error? */
if (so->so_error) {
error = so->so_error;
goto out_locked;
}
error = sblock(&so->so_snd, M_WAITOK);
if (error) {
/* Can't acquire the lock */
goto out_locked;
}
#if defined(__FreeBSD__) && __FreeBSD_version >= 502115
if (so->so_rcv.sb_state & SBS_CANTSENDMORE) {
#else
if (so->so_state & SS_CANTSENDMORE) {
#endif
/* The socket is now set not to sendmore.. its gone */
error = EPIPE;
goto release;
}
if (so->so_error) {
error = so->so_error;
goto release;
}
if (asoc->peer_supports_prsctp) {
sctp_prune_prsctp(stcb, asoc, srcv, sndlen);
}
}
}
dataout = tot_out = uio->uio_resid;
if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
resv_in_first = SCTP_MED_OVERHEAD;
} else {
resv_in_first = SCTP_MED_V4_OVERHEAD;
}

/* Are we aborting? */
if (srcv->sinfo_flags & SCTP_ABORT) {
if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) &&
(SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
/* It has to be up before we abort */
/* how big is the user initiated abort? */

/* I wonder about doing a MGET without a splnet set.
* it is done that way in the sosend code so I guess
* it is ok :-0
*/
MGETHDR(mm, M_WAIT, MT_DATA);
if (mm) {
struct sctp_paramhdr *ph;

tot_demand = (tot_out + sizeof(struct sctp_paramhdr));
if (tot_demand > MHLEN) {
if (tot_demand > MCLBYTES) {
/* truncate user data */
tot_demand = MCLBYTES;
tot_out = tot_demand - sizeof(struct sctp_paramhdr);
}
MCLGET(mm, M_WAIT);
if ((mm->m_flags & M_EXT) == 0) {
/* truncate further */
tot_demand = MHLEN;
tot_out = tot_demand - sizeof(struct sctp_paramhdr);
}
}
/* now move forward the data pointer */
ph = mtod(mm, struct sctp_paramhdr *);
ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
ph->param_length = htons((sizeof(struct sctp_paramhdr) + tot_out));
ph++;
mm->m_pkthdr.len = tot_out + sizeof(struct sctp_paramhdr);
mm->m_len = mm->m_pkthdr.len;
error = uiomove((void *)ph, (int)tot_out, uio);
if (error) {
/*
* Here if we can't get his data we
* still abort we just don't get to
* send the users note :-0
*/
sctp_m_freem(mm);
mm = NULL;
}
}
sbunlock(&so->so_snd);
sctp_abort_an_association(stcb->sctp_ep, stcb,
SCTP_RESPONSE_TO_USER_REQ,
mm);
mm = NULL;
goto out_locked;
}
goto release;
}

/* Now can we send this? */
if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
(asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
/* got data while shutting down */
error = ECONNRESET;
goto release;
}
/* Is the stream no. valid? */
if (srcv->sinfo_stream >= asoc->streamoutcnt) {
/* Invalid stream number */
error = EINVAL;
goto release;
}
if (asoc->strmout == NULL) {
/* huh? software error */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("software error in sctp_copy_it_in\n");
}
#endif
error = EFAULT;
goto release;
}
if ((srcv->sinfo_flags & SCTP_EOF) &&
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) &&
(tot_out == 0)) {
sounlock(so);
goto zap_by_it_now;
}
if (tot_out == 0) {
/* not allowed */
error = EMSGSIZE;
goto release;
}
/* save off the tag */
my_vtag = asoc->my_vtag;
strq = &asoc->strmout[srcv->sinfo_stream];
/* First lets figure out the "chunking" point */
frag_size = sctp_get_frag_point(stcb, asoc);

/* two choices here, it all fits in one chunk or
* we need multiple chunks.
*/
sounlock(so);
if (tot_out <= frag_size) {
/* no need to setup a template */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
error = ENOMEM;
goto release;
}
sctppcbinfo.ipi_count_chunk++;
sctppcbinfo.ipi_gencnt_chunk++;
asoc->chunks_on_out_queue++;
MGETHDR(mm, M_WAIT, MT_DATA);
if (mm == NULL) {
error = ENOMEM;
goto clean_up;
}
error = sctp_copy_one(mm, uio, tot_out, resv_in_first, &mbcnt_e);
if (error)
goto clean_up;
sctp_prepare_chunk(chk, stcb, srcv, strq, net);
chk->mbcnt = mbcnt_e;
mbcnt += mbcnt_e;
mbcnt_e = 0;
mm->m_pkthdr.len = tot_out;
chk->data = mm;
mm = NULL;

/* the actual chunk flags */
chk->rec.data.rcv_flags |= SCTP_DATA_NOT_FRAG;
chk->whoTo->ref_count++;

/* fix up the send_size if it is not present */
chk->send_size = tot_out;
chk->book_size = chk->send_size;
/* ok, we are committed */
if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
/* bump the ssn if we are unordered. */
strq->next_sequence_sent++;
}
if (chk->flags & SCTP_PR_SCTP_BUFFER) {
asoc->sent_queue_cnt_removeable++;
}
solock(so);
if ((asoc->state == 0) ||
(my_vtag != asoc->my_vtag) ||
(so != inp->sctp_socket) ||
(inp->sctp_socket == 0)) {
/* connection was aborted */
sounlock(so);
error = ECONNRESET;
goto clean_up;
}
asoc->stream_queue_cnt++;
TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
/* now check if this stream is on the wheel */
if ((strq->next_spoke.tqe_next == NULL) &&
(strq->next_spoke.tqe_prev == NULL)) {
/* Insert it on the wheel since it is not
* on it currently
*/
sctp_insert_on_wheel(asoc, strq);
}
sounlock(so);
clean_up:
if (error) {
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
goto release;
}
} else {
/* we need to setup a template */
struct sctp_tmit_chunk template;
struct sctpchunk_listhead tmp;

/* setup the template */
sctp_prepare_chunk(&template, stcb, srcv, strq, net);

/* Prepare the temp list */
TAILQ_INIT(&tmp);

/* Template is complete, now time for the work */
while (tot_out > 0) {
/* Get a chunk */
chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
if (chk == NULL) {
/*
* ok we must spin through and dump anything
* we have allocated and then jump to the
* no_membad
*/
error = ENOMEM;
}
sctppcbinfo.ipi_count_chunk++;
asoc->chunks_on_out_queue++;

sctppcbinfo.ipi_gencnt_chunk++;
*chk = template;
chk->whoTo->ref_count++;
MGETHDR(chk->data, M_WAIT, MT_DATA);
if (chk->data == NULL) {
error = ENOMEM;
goto temp_clean_up;
}
tot_demand = uimin(tot_out, frag_size);
error = sctp_copy_one(chk->data, uio, tot_demand , resv_in_first, &mbcnt_e);
if (error)
goto temp_clean_up;
/* now fix the chk->send_size */
chk->mbcnt = mbcnt_e;
mbcnt += mbcnt_e;
mbcnt_e = 0;
chk->send_size = tot_demand;
chk->data->m_pkthdr.len = tot_demand;
chk->book_size = chk->send_size;
if (chk->flags & SCTP_PR_SCTP_BUFFER) {
asoc->sent_queue_cnt_removeable++;
}
TAILQ_INSERT_TAIL(&tmp, chk, sctp_next);
tot_out -= tot_demand;
}
/* Now the tmp list holds all chunks and data */
if ((srcv->sinfo_flags & SCTP_UNORDERED) == 0) {
/* bump the ssn if we are unordered. */
strq->next_sequence_sent++;
}
/* Mark the first/last flags. This will
* result int a 3 for a single item on the list
*/
chk = TAILQ_FIRST(&tmp);
chk->rec.data.rcv_flags |= SCTP_DATA_FIRST_FRAG;
chk = TAILQ_LAST(&tmp, sctpchunk_listhead);
chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;

/* now move it to the streams actual queue */
/* first stop protocol processing */
mutex_enter(softnet_lock);
if ((asoc->state == 0) ||
(my_vtag != asoc->my_vtag) ||
(so != inp->sctp_socket) ||
(inp->sctp_socket == 0)) {
/* connection was aborted */
mutex_exit(softnet_lock);
error = ECONNRESET;
goto temp_clean_up;
}
chk = TAILQ_FIRST(&tmp);
while (chk) {
chk->data->m_nextpkt = 0;
TAILQ_REMOVE(&tmp, chk, sctp_next);
asoc->stream_queue_cnt++;
TAILQ_INSERT_TAIL(&strq->outqueue, chk, sctp_next);
chk = TAILQ_FIRST(&tmp);
}
/* now check if this stream is on the wheel */
if ((strq->next_spoke.tqe_next == NULL) &&
(strq->next_spoke.tqe_prev == NULL)) {
/* Insert it on the wheel since it is not
* on it currently
*/
sctp_insert_on_wheel(asoc, strq);
}
/* Ok now we can allow pping */
mutex_exit(softnet_lock);
temp_clean_up:
if (error) {
chk = TAILQ_FIRST(&tmp);
while (chk) {
sctp_m_freem(chk->data);
chk->data = NULL;
TAILQ_REMOVE(&tmp, chk, sctp_next);
SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
sctppcbinfo.ipi_count_chunk--;
asoc->chunks_on_out_queue--;
if ((int)sctppcbinfo.ipi_count_chunk < 0) {
panic("Chunk count is negative");
}
sctppcbinfo.ipi_gencnt_chunk++;
chk = TAILQ_FIRST(&tmp);
}
goto release;
}
}
zap_by_it_now:
#ifdef SCTP_MBCNT_LOGGING
sctp_log_mbcnt(SCTP_LOG_MBCNT_INCREASE,
asoc->total_output_queue_size,
dataout,
asoc->total_output_mbuf_queue_size,
mbcnt);
#endif
solock(so);
asoc->total_output_queue_size += dataout;
asoc->total_output_mbuf_queue_size += mbcnt;
if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
so->so_snd.sb_cc += dataout;
so->so_snd.sb_mbcnt += mbcnt;
}
if ((srcv->sinfo_flags & SCTP_EOF) &&
(stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)
) {
int some_on_streamwheel = 0;
error = 0;
if (!TAILQ_EMPTY(&asoc->out_wheel)) {
/* Check to see if some data queued */
struct sctp_stream_out *outs;
TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
if (!TAILQ_EMPTY(&outs->outqueue)) {
some_on_streamwheel = 1;
break;
}
}
}
if (TAILQ_EMPTY(&asoc->send_queue) &&
TAILQ_EMPTY(&asoc->sent_queue) &&
(some_on_streamwheel == 0)) {
/* there is nothing queued to send, so I'm done... */
if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
(SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
/* only send SHUTDOWN the first time through */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
printf("%s:%d sends a shutdown\n",
__FILE__,
__LINE__
);
}
#endif
sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
asoc->state = SCTP_STATE_SHUTDOWN_SENT;
sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
asoc->primary_destination);
sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb,
asoc->primary_destination);
}
} else {
/*
* we still got (or just got) data to send, so set
* SHUTDOWN_PENDING
*/
/*
* XXX sockets draft says that SCTP_EOF should be sent
* with no data. currently, we will allow user data
* to be sent first and move to SHUTDOWN-PENDING
*/
asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
}
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
printf("++total out:%d total_mbuf_out:%d\n",
(int)asoc->total_output_queue_size,
(int)asoc->total_output_mbuf_queue_size);
}
#endif

release:
sbunlock(&so->so_snd);
out_locked:
sounlock(so);

sctp_m_freem(mm);
return (error);
}

int
sctp_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio,
struct mbuf *top, struct mbuf *control, int flags, struct lwp *p)
{
int error, use_rcvinfo;
int queue_only = 0, queue_only_for_init=0;
int un_sent = 0;
int now_filled=0;
struct sctp_inpcb *inp;
struct sctp_tcb *stcb=NULL;
struct sctp_sndrcvinfo srcv;
struct timeval now;
struct sctp_nets *net;
struct sctp_association *asoc;
struct sctp_inpcb *t_inp;
int create_lock_applied = 0;

error = use_rcvinfo = 0;
net = NULL;
stcb = NULL;
asoc = NULL;
t_inp = inp = (struct sctp_inpcb *)so->so_pcb;

solock(so);
if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
(inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING)) {
/* The listner can NOT send */
error = EFAULT;
sounlock(so);
goto out;
}
if (addr) {
SCTP_ASOC_CREATE_LOCK(inp);
if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
(inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
/* Should I really unlock ? */
error = EFAULT;
sounlock(so);
goto out;

}
create_lock_applied = 1;
if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
(addr->sa_family == AF_INET6)) {
error = EINVAL;
sounlock(so);
goto out;
}
}
/* now we must find the assoc */
if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
SCTP_INP_RLOCK(inp);
stcb = LIST_FIRST(&inp->sctp_asoc_list);
if (stcb == NULL) {
SCTP_INP_RUNLOCK(inp);
error = ENOTCONN;
sounlock(so);
goto out;
}
SCTP_TCB_LOCK(stcb);
SCTP_INP_RUNLOCK(inp);
net = stcb->asoc.primary_destination;
}
#ifdef SCTP_DEBUG
printf("sctp_sosend: get control\n");
#endif
/* get control */
if (control) {
/* process cmsg snd/rcv info (maybe a assoc-id) */
if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
sizeof(srcv))) {
/* got one */
if (srcv.sinfo_flags & SCTP_SENDALL) {
/* its a sendall */
sctppcbinfo.mbuf_track--;
sctp_m_freem(control);

if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
return (sctp_sendall(inp, uio, top, &srcv));
}
use_rcvinfo = 1;
}
}
#ifdef SCTP_DEBUG
printf("sctp_sosend: doing lookup\n");
#endif
if (stcb == NULL) {
/* Need to do a lookup */
if (use_rcvinfo && srcv.sinfo_assoc_id) {
stcb = sctp_findassociation_ep_asocid(inp, srcv.sinfo_assoc_id);
/*
* Question: Should I error here if the assoc_id is
* no longer valid? i.e. I can't find it?
*/
if ((stcb) &&
(addr != NULL)) {
/* Must locate the net structure */
net = sctp_findnet(stcb, addr);
}
}
if (stcb == NULL) {
if (addr != NULL) {
/* Since we did not use findep we must
* increment it, and if we don't find a
* tcb decrement it.
*/
SCTP_INP_WLOCK(inp);
SCTP_INP_INCR_REF(inp);
SCTP_INP_WUNLOCK(inp);
stcb = sctp_findassociation_ep_addr(&t_inp, addr, &net, NULL, NULL);
if (stcb == NULL) {
SCTP_INP_WLOCK(inp);
SCTP_INP_DECR_REF(inp);
SCTP_INP_WUNLOCK(inp);
}
}
}
}
if ((stcb == NULL) &&
(inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
error = ENOTCONN;
sounlock(so);
goto out;
} else if ((stcb == NULL) && (addr == NULL)) {
error = ENOENT;
sounlock(so);
goto out;
} else if (stcb == NULL) {
/* UDP style, we must go ahead and start the INIT process */
if ((use_rcvinfo) &&
(srcv.sinfo_flags & SCTP_ABORT)) {
/* User asks to abort a non-existent asoc */
error = ENOENT;
sounlock(so);
goto out;
}
/* get an asoc/stcb struct */
stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
if (stcb == NULL) {
/* Error is setup for us in the call */
sounlock(so);
goto out;
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
} else {
printf("Huh-3? create lock should have been on??\n");
}
/* Turn on queue only flag to prevent data from being sent */
queue_only = 1;
asoc = &stcb->asoc;
asoc->state = SCTP_STATE_COOKIE_WAIT;
SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
if (control) {
/* see if a init structure exists in cmsg headers */
struct sctp_initmsg initm;
int i;
if (sctp_find_cmsg(SCTP_INIT, (void *)&initm, control, sizeof(initm))) {
/* we have an INIT override of the default */
if (initm.sinit_max_attempts)
asoc->max_init_times = initm.sinit_max_attempts;
if (initm.sinit_num_ostreams)
asoc->pre_open_streams = initm.sinit_num_ostreams;
if (initm.sinit_max_instreams)
asoc->max_inbound_streams = initm.sinit_max_instreams;
if (initm.sinit_max_init_timeo)
asoc->initial_init_rto_max = initm.sinit_max_init_timeo;
if (asoc->streamoutcnt < asoc->pre_open_streams) {
/* Default is NOT correct */
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("Ok, defout:%d pre_open:%d\n",
asoc->streamoutcnt, asoc->pre_open_streams);
}
#endif
free(asoc->strmout, M_PCB);
asoc->strmout = NULL;
asoc->streamoutcnt = asoc->pre_open_streams;

/* What happesn if this fails? .. we panic ...*/
asoc->strmout = malloc(
asoc->streamoutcnt *
sizeof(struct sctp_stream_out),
M_PCB, M_WAIT);
for (i = 0; i < asoc->streamoutcnt; i++) {
/*
* inbound side must be set to 0xffff,
* also NOTE when we get the INIT-ACK
* back (for INIT sender) we MUST
* reduce the count (streamoutcnt) but
* first check if we sent to any of the
* upper streams that were dropped (if
* some were). Those that were dropped
* must be notified to the upper layer
* as failed to send.
*/
asoc->strmout[i].next_sequence_sent = 0x0;
TAILQ_INIT(&asoc->strmout[i].outqueue);
asoc->strmout[i].stream_no = i;
asoc->strmout[i].next_spoke.tqe_next = 0;
asoc->strmout[i].next_spoke.tqe_prev = 0;
}
}
}

}
/* out with the INIT */
queue_only_for_init = 1;
sctp_send_initiate(inp, stcb);
/*
* we may want to dig in after this call and adjust the MTU
* value. It defaulted to 1500 (constant) but the ro structure
* may now have an update and thus we may need to change it
* BEFORE we append the message.
*/
net = stcb->asoc.primary_destination;
asoc = &stcb->asoc;
} else {
asoc = &stcb->asoc;
}
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
queue_only = 1;
}
if (use_rcvinfo == 0) {
/* Grab the default stuff from the asoc */
srcv = stcb->asoc.def_send;
}
/* we are now done with all control */
sctp_m_freem(control);
control = NULL;

if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) ||
(SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
(asoc->state & SCTP_STATE_SHUTDOWN_PENDING)) {
if ((use_rcvinfo) &&
(srcv.sinfo_flags & SCTP_ABORT)) {
;
} else {
error = ECONNRESET;
sounlock(so);
goto out;
}
}
/* Ok, we will attempt a msgsnd :> */
#if 0 /* XXX */
if (p)
p->p_stats->p_ru.ru_msgsnd++;
#endif

if (stcb) {
if (net && ((srcv.sinfo_flags & SCTP_ADDR_OVER))) {
/* we take the override or the unconfirmed */
;
} else {
net = stcb->asoc.primary_destination;
}
}

#ifdef SCTP_DEBUG
printf("sctp_sosend: before copying in %p\n", top);
#endif
if (top == NULL) {
/* Must copy it all in from user land. The
* socket buf is locked but we don't suspend
* protocol processing until we are ready to
* send/queue it.
*/
sounlock(so);
#ifdef SCTP_DEBUG
printf("sctp_sosend: before cii\n");
#endif
error = sctp_copy_it_in(inp, stcb, asoc, net, &srcv, uio, flags);
#ifdef SCTP_DEBUG
printf("sctp_sosend: after cii\n");
#endif
if (error)
goto out;
} else {
/* Here we must either pull in the user data to chunk
* buffers, or use top to do a msg_append.
*/
error = sctp_msg_append(stcb, net, top, &srcv, flags);
sounlock(so);
if (error)
goto out;
/* zap the top since it is now being used */
top = 0;
}
#ifdef SCTP_DEBUG
printf("sctp_sosend: after copying in\n");
#endif
if (net->flight_size > net->cwnd) {
sctp_pegs[SCTP_SENDTO_FULL_CWND]++;
queue_only = 1;

} else if (asoc->ifp_had_enobuf) {
sctp_pegs[SCTP_QUEONLY_BURSTLMT]++;
queue_only = 1;
} else {
un_sent = ((stcb->asoc.total_output_queue_size - stcb->asoc.total_flight) +
((stcb->asoc.chunks_on_out_queue - stcb->asoc.total_flight_count) * sizeof(struct sctp_data_chunk)) +
SCTP_MED_OVERHEAD);

if (((inp->sctp_flags & SCTP_PCB_FLAGS_NODELAY) == 0) &&
(stcb->asoc.total_flight > 0) &&
(un_sent < (int)stcb->asoc.smallest_mtu)) {

/* Ok, Nagle is set on and we have data outstanding. Don't
* send anything and let SACKs drive out the data unless we
* have a "full" segment to send.
*/
sctp_pegs[SCTP_NAGLE_NOQ]++;
queue_only = 1;
} else {
sctp_pegs[SCTP_NAGLE_OFF]++;
}
}
if (queue_only_for_init) {
/* It is possible to have a turn around of the
* INIT/INIT-ACK/COOKIE before I have a chance to
* copy in the data. In such a case I DO want to
* send it out by reversing the queue only flag.
*/
if ((SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_WAIT) ||
(SCTP_GET_STATE(asoc) != SCTP_STATE_COOKIE_ECHOED)) {
/* yep, reverse it */
queue_only = 0;
}
}

#ifdef SCTP_DEBUG
printf("sctp_sosend: before sending chunk\n");
#endif
if ((queue_only == 0) && (stcb->asoc.peers_rwnd && un_sent)) {
/* we can attempt to send too.*/
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("USR Send calls sctp_chunk_output\n");
}
#endif
solock(so);
sctp_pegs[SCTP_OUTPUT_FRM_SND]++;
sctp_chunk_output(inp, stcb, 0);
sounlock(so);
} else if ((queue_only == 0) &&
(stcb->asoc.peers_rwnd == 0) &&
(stcb->asoc.total_flight == 0)) {
/* We get to have a probe outstanding */
solock(so);
sctp_from_user_send = 1;
sctp_chunk_output(inp, stcb, 0);
sctp_from_user_send = 0;
sounlock(so);

} else if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
int num_out, reason, cwnd_full;
/* Here we do control only */
solock(so);
sctp_med_chunk_output(inp, stcb, &stcb->asoc, &num_out,
&reason, 1, &cwnd_full, 1, &now, &now_filled);
sounlock(so);
}
#ifdef SCTP_DEBUG
if (sctp_debug_on & SCTP_DEBUG_OUTPUT1) {
printf("USR Send complete qo:%d prw:%d unsent:%d tf:%d cooq:%d toqs:%d \n",
queue_only, stcb->asoc.peers_rwnd, un_sent,
stcb->asoc.total_flight, stcb->asoc.chunks_on_out_queue,
stcb->asoc.total_output_queue_size);
}
#endif
out:
if (create_lock_applied) {
SCTP_ASOC_CREATE_UNLOCK(inp);
create_lock_applied = 0;
}
if (stcb) {
SCTP_TCB_UNLOCK(stcb);
}
sctp_m_freem(top);
sctp_m_freem(control);
return (error);
}