svn commit: r210495 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Mon Jul 26 09:26:55 2010
New Revision: 210495
URL: http://svn.freebsd.org/changeset/base/210495

Log:
  Fix a bug where the length of a FORWARD-TSN chunk was set incorrectly in
  the chunk. This resulted in malformed frames.
  Remove a duplicate assignment.
  
  MFC after: 2 weeks

Modified:
  head/sys/netinet/sctp_output.c

Modified: head/sys/netinet/sctp_output.c
==============================================================================
--- head/sys/netinet/sctp_output.c	Mon Jul 26 09:22:52 2010	(r210494)
+++ head/sys/netinet/sctp_output.c	Mon Jul 26 09:26:55 2010	(r210495)
@@ -2271,7 +2271,6 @@ sctp_is_ifa_addr_acceptable(struct sctp_
 {
 	uint8_t dest_is_global = 0;
 
-
 	/*
 	 * Here we determine if its a acceptable address. A acceptable
 	 * address means it is the same scope or higher scope but we can
@@ -9800,7 +9799,8 @@ sctp_fill_in_rest:
 			 * peer ack point
 			 */
 			advance_peer_ack_point = last->rec.data.TSN_seq;
-			space_needed -= (cnt_of_skipped * sizeof(struct sctp_strseq));
+			space_needed = sizeof(struct sctp_forward_tsn_chunk) +
+			    cnt_of_skipped * sizeof(struct sctp_strseq);
 		}
 		chk->send_size = space_needed;
 		/* Setup the chunk */
@@ -9809,8 +9809,6 @@ sctp_fill_in_rest:
 		fwdtsn->ch.chunk_flags = 0;
 		fwdtsn->ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 		fwdtsn->new_cumulative_tsn = htonl(advance_peer_ack_point);
-		chk->send_size = (sizeof(struct sctp_forward_tsn_chunk) +
-		    (cnt_of_skipped * sizeof(struct sctp_strseq)));
 		SCTP_BUF_LEN(chk->data) = chk->send_size;
 		fwdtsn++;
 		/*-