kernel/netinet: Remove some unused variables.
[dragonfly.git] / sys / netinet / sctp_indata.c
CommitLineData
8d60bf8a 1/* $KAME: sctp_indata.c,v 1.35 2004/08/17 04:06:17 itojun Exp $ */
8d60bf8a
EN
2
3/*
4 * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#if !(defined(__OpenBSD__) || defined(__APPLE__))
33#include "opt_ipsec.h"
34#endif
8e062f96 35#if defined(__FreeBSD__) || defined(__DragonFly__)
8d60bf8a
EN
36#include "opt_inet6.h"
37#include "opt_inet.h"
38#endif
39#if defined(__NetBSD__)
40#include "opt_inet.h"
41#endif
42
43#ifdef __APPLE__
44#include <sctp.h>
45#elif !defined(__OpenBSD__)
46#include "opt_sctp.h"
47#endif
48
49#include <sys/param.h>
50#include <sys/systm.h>
51#include <sys/mbuf.h>
52#include <sys/malloc.h>
53#include <sys/socket.h>
54#include <sys/socketvar.h>
55#include <sys/sysctl.h>
56
57#include <net/if.h>
58#include <net/route.h>
59
60
61#if defined(__FreeBSD__) && __FreeBSD_version >= 500000
62#include <sys/limits.h>
63#else
64#include <machine/limits.h>
65#endif
66#include <machine/cpu.h>
67
68#include <netinet/in.h>
69#include <netinet/in_systm.h>
70#include <netinet/ip.h>
71#ifdef INET6
72#include <netinet/ip6.h>
73#endif /* INET6 */
74#include <netinet/in_pcb.h>
75#include <netinet/in_var.h>
76#include <netinet/ip_var.h>
77#ifdef INET6
78#include <netinet6/ip6_var.h>
79#endif /* INET6 */
80#include <netinet/ip_icmp.h>
81#include <netinet/icmp_var.h>
82#include <netinet/sctp_var.h>
83#include <netinet/sctp_pcb.h>
84#include <netinet/sctp_header.h>
85#include <netinet/sctputil.h>
86#include <netinet/sctp_output.h>
87#include <netinet/sctp_input.h>
88#include <netinet/sctp_hashdriver.h>
89#include <netinet/sctp_indata.h>
90#include <netinet/sctp_uio.h>
91#include <netinet/sctp_timer.h>
92#ifdef IPSEC
93#ifndef __OpenBSD__
94#include <netinet6/ipsec.h>
7f12b1a3 95#include <netproto/key/key.h>
8d60bf8a
EN
96#else
97#undef IPSEC
98#endif
99#endif /*IPSEC*/
100
101#include <net/net_osdep.h>
102
103#ifdef SCTP_DEBUG
104extern u_int32_t sctp_debug_on;
105#endif
106
107/*
108 * NOTES: On the outbound side of things I need to check the sack timer to
109 * see if I should generate a sack into the chunk queue (if I have data to
110 * send that is and will be sending it .. for bundling.
111 *
112 * The callback in sctp_usrreq.c will get called when the socket is read
113 * from. This will cause sctp_service_queues() to get called on the top
114 * entry in the list.
115 */
116
117extern int sctp_strict_sacks;
118
119void
120sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
121{
122 u_int32_t calc, calc_w_oh;
123
124#ifdef SCTP_DEBUG
125 if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
a6ec04bc 126 kprintf("cc:%lu hiwat:%lu lowat:%lu mbcnt:%lu mbmax:%lu\n",
6d49aa6f
MD
127 (u_long)stcb->sctp_socket->so_rcv.ssb_cc,
128 (u_long)stcb->sctp_socket->so_rcv.ssb_hiwat,
129 (u_long)stcb->sctp_socket->so_rcv.ssb_lowat,
130 (u_long)stcb->sctp_socket->so_rcv.ssb_mbcnt,
131 (u_long)stcb->sctp_socket->so_rcv.ssb_mbmax);
a6ec04bc 132 kprintf("Setting rwnd to: sb:%ld - (del:%d + reasm:%d str:%d)\n",
8d60bf8a
EN
133 sctp_sbspace(&stcb->sctp_socket->so_rcv),
134 asoc->size_on_delivery_queue,
135 asoc->size_on_reasm_queue,
136 asoc->size_on_all_streams);
137 }
138#endif
6d49aa6f 139 if (stcb->sctp_socket->so_rcv.ssb_cc == 0 &&
8d60bf8a
EN
140 asoc->size_on_delivery_queue == 0 &&
141 asoc->size_on_reasm_queue == 0 &&
142 asoc->size_on_all_streams == 0) {
143 /* Full rwnd granted */
6d49aa6f 144 asoc->my_rwnd = max(stcb->sctp_socket->so_rcv.ssb_hiwat,
8d60bf8a
EN
145 SCTP_MINIMAL_RWND);
146 return;
147 }
148 /* get actual space */
149 calc = (u_int32_t)sctp_sbspace(&stcb->sctp_socket->so_rcv);
150
151 /* take out what has NOT been put on socket queue and
152 * we yet hold for putting up.
153 */
154 calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_delivery_queue);
155 calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_reasm_queue);
156 calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_all_streams);
157
158 /* what is the overhead of all these rwnd's */
159 calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
160
161 asoc->my_rwnd = calc;
162 if (calc_w_oh == 0) {
163 /* If our overhead is greater than the advertised
164 * rwnd, we clamp the rwnd to 1. This lets us
165 * still accept inbound segments, but hopefully will
166 * shut the sender down when he finally gets the message.
167 */
168 asoc->my_rwnd = 1;
169 } else {
170 /* SWS threshold */
171 if (asoc->my_rwnd &&
172 (asoc->my_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
173 /* SWS engaged, tell peer none left */
174 asoc->my_rwnd = 1;
175#ifdef SCTP_DEBUG
176 if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
a6ec04bc 177 kprintf(" - SWS zeros\n");
8d60bf8a
EN
178 }
179 } else {
180 if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
a6ec04bc 181 kprintf("\n");
8d60bf8a
EN
182 }
183#endif
184 }
185 }
186}
187
188/*
189 * Take a chk structure and build it into an mbuf. Hmm should we change things
190 * so that instead we store the data side in a chunk?
191 */
192static struct mbuf *
193sctp_build_ctl_nchunk(struct sctp_tcb *stcb, uint32_t tsn, uint32_t ppid,
194 uint32_t context, uint16_t stream_no, uint16_t stream_seq, uint8_t flags)
195{
196 struct sctp_sndrcvinfo *outinfo;
197 struct cmsghdr *cmh;
198 struct mbuf *ret;
199
200 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) {
201 /* user does not want the sndrcv ctl */
202 return (NULL);
203 }
204
19267c6d 205 MGETHDR(ret, MB_DONTWAIT, MT_CONTROL);
8d60bf8a
EN
206 if (ret == NULL) {
207 /* No space */
208 return (ret);
209 }
210 /* We need a CMSG header followed by the struct */
211 cmh = mtod(ret, struct cmsghdr *);
212 outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
213 cmh->cmsg_level = IPPROTO_SCTP;
214 cmh->cmsg_type = SCTP_SNDRCV;
215 cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
216 outinfo->sinfo_stream = stream_no;
217 outinfo->sinfo_ssn = stream_seq;
218 if (flags & SCTP_DATA_UNORDERED) {
219 outinfo->sinfo_flags = MSG_UNORDERED;
220 } else {
221 outinfo->sinfo_flags = 0;
222 }
223 outinfo->sinfo_ppid = ppid;
224 outinfo->sinfo_context = context;
225 outinfo->sinfo_assoc_id = sctp_get_associd(stcb);
226 outinfo->sinfo_tsn = tsn;
227 outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
228 ret->m_len = cmh->cmsg_len;
229 ret->m_pkthdr.len = ret->m_len;
230 /*
231 * We track how many control len's have gone upon the sb
232 * and do not count these in the rwnd calculation.
233 */
234 stcb->asoc.my_rwnd_control_len +=
235 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
236
237 return (ret);
238}
239
240/*
241 * Take a chk structure and build it into an mbuf. Should we change things
242 * so that instead we store the data side in a chunk?
243 */
244static
245struct mbuf *
246sctp_build_ctl(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk)
247{
248 struct sctp_sndrcvinfo *outinfo;
249 struct cmsghdr *cmh;
250 struct mbuf *ret;
251 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) {
252 /* user does not want the sndrcv ctl */
253 return (NULL);
254 }
19267c6d 255 MGET(ret, MB_DONTWAIT, MT_CONTROL);
8d60bf8a
EN
256 if (ret == NULL) {
257 /* No space */
258 return (ret);
259 }
260
261 /* We need a CMSG header followed by the struct */
262 cmh = mtod(ret, struct cmsghdr *);
263 outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
264 cmh->cmsg_level = IPPROTO_SCTP;
265 cmh->cmsg_type = SCTP_SNDRCV;
266 cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
267 outinfo->sinfo_stream = chk->rec.data.stream_number;
268 outinfo->sinfo_ssn = chk->rec.data.stream_seq;
269 if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
270 outinfo->sinfo_flags = MSG_UNORDERED;
271 } else {
272 outinfo->sinfo_flags = 0;
273 }
274 outinfo->sinfo_ppid = chk->rec.data.payloadtype;
275 outinfo->sinfo_context = chk->rec.data.context;
276 outinfo->sinfo_assoc_id = sctp_get_associd(stcb);
277 outinfo->sinfo_tsn = chk->rec.data.TSN_seq;
278 outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
279 ret->m_len = cmh->cmsg_len;
280 stcb->asoc.my_rwnd_control_len +=
281 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
282
283 return (ret);
284}
285
286int
287sctp_deliver_data(struct sctp_tcb *stcb, struct sctp_association *asoc,
288 struct sctp_tmit_chunk *chk, int hold_locks)
289{
290 struct mbuf *control, *m;
291 int free_it;
292 struct sockaddr_in6 sin6;
293 struct sockaddr *to;
294
295#ifdef SCTP_DEBUG
296 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 297 kprintf("I am now in Deliver data! (%p)\n", chk);
8d60bf8a
EN
298 }
299#endif
300 /* get a write lock on the inp if not already */
301 if (hold_locks == 0) {
302 SCTP_TCB_UNLOCK(stcb);
303 SCTP_INP_WLOCK(stcb->sctp_ep);
304 SCTP_TCB_LOCK(stcb);
305 }
306 free_it = 0;
307 /* We always add it to the queue */
308 if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
309 /* socket above is long gone */
310#ifdef SCTP_DEBUG
311 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 312 kprintf("gone is gone!\n");
8d60bf8a
EN
313 }
314#endif
315 if (chk != NULL) {
316 if (chk->data)
317 sctp_m_freem(chk->data);
318 chk->data = NULL;
319 sctp_free_remote_addr(chk->whoTo);
320 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
321 sctppcbinfo.ipi_count_chunk--;
322 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
323 panic("Chunk count is negative");
324 }
325 sctppcbinfo.ipi_gencnt_chunk++;
326 }
327 TAILQ_FOREACH(chk, &asoc->delivery_queue, sctp_next) {
328 asoc->size_on_delivery_queue -= chk->send_size;
329 asoc->cnt_on_delivery_queue--;
330 /*
331 * Lose the data pointer, since its in the socket buffer
332 */
333 if (chk->data)
334 sctp_m_freem(chk->data);
335 chk->data = NULL;
336 /* Now free the address and data */
337 sctp_free_remote_addr(chk->whoTo);
338 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
339 sctppcbinfo.ipi_count_chunk--;
340 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
341 panic("Chunk count is negative");
342 }
343 sctppcbinfo.ipi_gencnt_chunk++;
344 }
345 if (hold_locks == 0)
346 SCTP_INP_WUNLOCK(stcb->sctp_ep);
347 return (0);
348 }
349 if (chk != NULL) {
350 TAILQ_INSERT_TAIL(&asoc->delivery_queue, chk, sctp_next);
351 asoc->size_on_delivery_queue += chk->send_size;
352 asoc->cnt_on_delivery_queue++;
353 }
354 if (asoc->fragmented_delivery_inprogress) {
355 /*
356 * oh oh, fragmented delivery in progress
357 * return out of here.
358 */
359#ifdef SCTP_DEBUG
360 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 361 kprintf("Fragmented delivery in progress?\n");
8d60bf8a
EN
362 }
363#endif
364 if (hold_locks == 0)
365 SCTP_INP_WUNLOCK(stcb->sctp_ep);
366 return (0);
367 }
368 /* Now grab the first one */
369 chk = TAILQ_FIRST(&asoc->delivery_queue);
370 if (chk == NULL) {
371 /* Nothing in queue */
372#ifdef SCTP_DEBUG
373 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 374 kprintf("Nothing in queue?\n");
8d60bf8a
EN
375 }
376#endif
377 asoc->size_on_delivery_queue = 0;
378 asoc->cnt_on_delivery_queue = 0;
379 if (hold_locks == 0)
380 SCTP_INP_WUNLOCK(stcb->sctp_ep);
381 return (0);
382 }
383
6d49aa6f 384 if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) {
8d60bf8a
EN
385 /* Boy, there really is NO room */
386 if (hold_locks == 0)
387 SCTP_INP_WUNLOCK(stcb->sctp_ep);
388 return (0);
389 }
390#ifdef SCTP_DEBUG
391 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 392 kprintf("Now to the delivery with chk(%p)!\n", chk);
8d60bf8a
EN
393 }
394#endif
395 /* XXX need to append PKTHDR to the socket buffer first */
396 if ((chk->data->m_flags & M_PKTHDR) == 0) {
19267c6d 397 MGETHDR(m, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
398 if (m == NULL) {
399 /* no room! */
400 if (hold_locks == 0)
401 SCTP_INP_WUNLOCK(stcb->sctp_ep);
402 return (0);
403 }
404 m->m_pkthdr.len = chk->send_size;
405 m->m_len = 0;
406 m->m_next = chk->data;
407 chk->data = m;
408 }
409 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
410 if (chk->data->m_next == NULL) {
411 /* hopefully we hit here most of the time */
412 chk->data->m_flags |= M_EOR;
413 } else {
414 /* Add the flag to the LAST mbuf in the chain */
415 m = chk->data;
416 while (m->m_next != NULL) {
417 m = m->m_next;
418 }
419 m->m_flags |= M_EOR;
420 }
421 }
422
423 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
424 struct sockaddr_in6 lsa6;
425
426 control = sctp_build_ctl(stcb, chk);
427 to = (struct sockaddr *)&chk->whoTo->ro._l_addr;
428 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
429 to->sa_family == AF_INET) {
430 struct sockaddr_in *sin;
431
432 sin = (struct sockaddr_in *)to;
433 bzero(&sin6, sizeof(sin6));
434 sin6.sin6_family = AF_INET6;
435 sin6.sin6_len = sizeof(struct sockaddr_in6);
436 sin6.sin6_addr.s6_addr16[2] = 0xffff;
437 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
438 sizeof(sin6.sin6_addr.s6_addr16[3]));
439 sin6.sin6_port = sin->sin_port;
440 to = (struct sockaddr *)&sin6;
441 }
442 /* check and strip embedded scope junk */
443 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
444 &lsa6);
445 if (((struct sockaddr_in *)to)->sin_port == 0) {
664f5072 446 kprintf("Huh a, port is %d not net:%p %d?\n",
8d60bf8a 447 ((struct sockaddr_in *)to)->sin_port,
664f5072 448 chk->whoTo,
8d60bf8a
EN
449 (int)(ntohs(stcb->rport)));
450 ((struct sockaddr_in *)to)->sin_port = stcb->rport;
451 }
452 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < (long)chk->send_size) {
453 /* Gak not enough room */
454 if (control) {
455 sctp_m_freem(control);
456 stcb->asoc.my_rwnd_control_len -=
457 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
458 }
459 goto skip;
460 }
6cef7136 461 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
6d49aa6f 462 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
8d60bf8a
EN
463 to, chk->data, control, stcb->asoc.my_vtag,
464 stcb->sctp_ep)) {
465 /* Gak not enough room */
466 if (control) {
467 sctp_m_freem(control);
468 stcb->asoc.my_rwnd_control_len -=
469 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
470 }
471 } else {
472 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
473 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
474 stcb->asoc.my_rwnd_control_len +=
475 sizeof(struct mbuf);
476 }
477 } else {
478 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
479 }
480 free_it = 1;
481 }
6cef7136 482 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
483 } else {
484 /* append to a already started message. */
6cef7136 485 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
486 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >=
487 (long)chk->send_size) {
6d49aa6f 488 ssb_append(&stcb->sctp_socket->so_rcv, chk->data);
8d60bf8a
EN
489 free_it = 1;
490 }
6cef7136 491 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
492 }
493 skip:
494 if (hold_locks == 0)
495 SCTP_INP_WUNLOCK(stcb->sctp_ep);
496 /* free up the one we inserted */
497 if (free_it) {
498 /* Pull it off the queue */
499#ifdef SCTP_DEBUG
500 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 501 kprintf("Free_it true, doing tickle wakeup\n");
8d60bf8a
EN
502 }
503#endif
504 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
505 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next);
506 asoc->size_on_delivery_queue -= chk->send_size;
507 asoc->cnt_on_delivery_queue--;
508 /* Lose the data pointer, since its in the socket buffer */
509 chk->data = NULL;
510 /* Now free the address and data */
511 sctp_free_remote_addr(chk->whoTo);
512 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
513 sctppcbinfo.ipi_count_chunk--;
514 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
515 panic("Chunk count is negative");
516 }
517 sctppcbinfo.ipi_gencnt_chunk++;
518 }
519 return (free_it);
520}
521
522/*
523 * We are delivering currently from the reassembly queue. We must continue to
524 * deliver until we either:
525 * 1) run out of space.
526 * 2) run out of sequential TSN's
527 * 3) hit the SCTP_DATA_LAST_FRAG flag.
528 */
529static void
530sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks)
531{
532 struct sockaddr *to;
533 struct sockaddr_in6 sin6;
534 struct sctp_tmit_chunk *chk, *at;
535 struct mbuf *control, *m;
536 u_int16_t nxt_todel;
537 u_int16_t stream_no;
538 int cntDel;
539 cntDel = stream_no = 0;
540 if (hold_locks == 0) {
541 /*
542 * you always have the TCB lock, we need
543 * to have the inp write lock as well.
544 */
545 SCTP_TCB_UNLOCK(stcb);
546 SCTP_INP_WLOCK(stcb->sctp_ep);
547 SCTP_TCB_LOCK(stcb);
548 }
549 if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
550 /* socket above is long gone */
551 asoc->fragmented_delivery_inprogress = 0;
552 TAILQ_FOREACH(chk, &asoc->reasmqueue, sctp_next) {
553 asoc->size_on_delivery_queue -= chk->send_size;
554 asoc->cnt_on_delivery_queue--;
555 /*
556 * Lose the data pointer, since its in the socket buffer
557 */
558 if (chk->data)
559 sctp_m_freem(chk->data);
560 chk->data = NULL;
561 /* Now free the address and data */
562 sctp_free_remote_addr(chk->whoTo);
563 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
564 sctppcbinfo.ipi_count_chunk--;
565 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
566 panic("Chunk count is negative");
567 }
568 sctppcbinfo.ipi_gencnt_chunk++;
569 }
570 if (hold_locks == 0)
571 SCTP_INP_WUNLOCK(stcb->sctp_ep);
572 return;
573 }
574 do {
6d49aa6f
MD
575 if (stcb->sctp_socket->so_rcv.ssb_cc >=
576 stcb->sctp_socket->so_rcv.ssb_hiwat) {
8d60bf8a
EN
577 if (cntDel) {
578 sctp_sorwakeup(stcb->sctp_ep,
579 stcb->sctp_socket);
580 }
581 if (hold_locks == 0)
582 SCTP_INP_WUNLOCK(stcb->sctp_ep);
583 return;
584 }
585 chk = TAILQ_FIRST(&asoc->reasmqueue);
586 if (chk == NULL) {
587 if (cntDel) {
588 sctp_sorwakeup(stcb->sctp_ep,
589 stcb->sctp_socket);
590 }
591 if (hold_locks == 0)
592 SCTP_INP_WUNLOCK(stcb->sctp_ep);
593 return;
594 }
595 if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) {
596 /* Can't deliver more :< */
597 if (cntDel) {
598 sctp_sorwakeup(stcb->sctp_ep,
599 stcb->sctp_socket);
600 }
601 if (hold_locks == 0)
602 SCTP_INP_WUNLOCK(stcb->sctp_ep);
603 return;
604 }
605 stream_no = chk->rec.data.stream_number;
606 nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1;
607 if (nxt_todel != chk->rec.data.stream_seq &&
608 (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
609 /*
610 * Not the next sequence to deliver in its stream OR
611 * unordered
612 */
613 if (cntDel) {
614 sctp_sorwakeup(stcb->sctp_ep,
615 stcb->sctp_socket);
616 }
617 if (hold_locks == 0)
618 SCTP_INP_WUNLOCK(stcb->sctp_ep);
619 return;
620 }
621
622 if ((chk->data->m_flags & M_PKTHDR) == 0) {
19267c6d 623 MGETHDR(m, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
624 if (m == NULL) {
625 /* no room! */
626 if (hold_locks == 0)
627 SCTP_INP_WUNLOCK(stcb->sctp_ep);
628 return;
629 }
630 m->m_pkthdr.len = chk->send_size;
631 m->m_len = 0;
632 m->m_next = chk->data;
633 chk->data = m;
634 }
635 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
636 if (chk->data->m_next == NULL) {
637 /* hopefully we hit here most of the time */
638 chk->data->m_flags |= M_EOR;
639 } else {
640 /* Add the flag to the LAST mbuf in the chain */
641 m = chk->data;
642 while (m->m_next != NULL) {
643 m = m->m_next;
644 }
645 m->m_flags |= M_EOR;
646 }
647 }
648 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
649 struct sockaddr_in6 lsa6;
650
651 control = sctp_build_ctl(stcb, chk);
652 to = (struct sockaddr *)&chk->whoTo->ro._l_addr;
653 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
654 to->sa_family == AF_INET) {
655 struct sockaddr_in *sin;
656 sin = (struct sockaddr_in *)to;
657 bzero(&sin6, sizeof(sin6));
658 sin6.sin6_family = AF_INET6;
659 sin6.sin6_len = sizeof(struct sockaddr_in6);
660 sin6.sin6_addr.s6_addr16[2] = 0xffff;
661 bcopy(&sin->sin_addr,
662 &sin6.sin6_addr.s6_addr16[3],
663 sizeof(sin6.sin6_addr.s6_addr16[3]));
664 sin6.sin6_port = sin->sin_port;
665 to = (struct sockaddr *)&sin6;
666 }
667 /* check and strip embedded scope junk */
668 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
669 &lsa6);
670 if (((struct sockaddr_in *)to)->sin_port == 0) {
664f5072 671 kprintf("Huh b, port is %d not net:%p %d?\n",
8d60bf8a 672 ((struct sockaddr_in *)to)->sin_port,
664f5072 673 chk->whoTo,
8d60bf8a
EN
674 (int)(ntohs(stcb->rport)));
675 ((struct sockaddr_in *)to)->sin_port = stcb->rport;
676 }
677 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) <
678 (long)chk->send_size) {
679 if (control) {
680 sctp_m_freem(control);
681 stcb->asoc.my_rwnd_control_len -=
682 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
683 }
684 sctp_sorwakeup(stcb->sctp_ep,
685 stcb->sctp_socket);
686 if (hold_locks == 0)
687 SCTP_INP_WUNLOCK(stcb->sctp_ep);
688 return;
689 }
6cef7136 690 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
6d49aa6f 691 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
8d60bf8a
EN
692 to, chk->data, control, stcb->asoc.my_vtag,
693 stcb->sctp_ep)) {
694 /* Gak not enough room */
695 if (control) {
696 sctp_m_freem(control);
697 stcb->asoc.my_rwnd_control_len -=
698 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
699 }
700 sctp_sorwakeup(stcb->sctp_ep,
701 stcb->sctp_socket);
702 if (hold_locks == 0)
703 SCTP_INP_WUNLOCK(stcb->sctp_ep);
6cef7136 704 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
705 return;
706 }
6cef7136 707 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
708 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
709 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
710 stcb->asoc.my_rwnd_control_len +=
711 sizeof(struct mbuf);
712 }
713 } else {
714 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
715 }
716 cntDel++;
717 } else {
718 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >=
719 (long)chk->send_size) {
6cef7136 720 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
6d49aa6f 721 ssb_append(&stcb->sctp_socket->so_rcv, chk->data);
6cef7136 722 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
723 cntDel++;
724 } else {
725 /* out of space in the sb */
726 sctp_sorwakeup(stcb->sctp_ep,
727 stcb->sctp_socket);
728 if (hold_locks == 0)
729 SCTP_INP_WUNLOCK(stcb->sctp_ep);
730 return;
731 }
732 }
733 /* pull it we did it */
734 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
735 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
736 asoc->fragmented_delivery_inprogress = 0;
737 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
738 asoc->strmin[stream_no].last_sequence_delivered++;
739 }
740 }
741 asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
742 asoc->size_on_reasm_queue -= chk->send_size;
743 asoc->cnt_on_reasm_queue--;
744 /* free up the chk */
745 sctp_free_remote_addr(chk->whoTo);
746 chk->data = NULL;
747 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
748 sctppcbinfo.ipi_count_chunk--;
749 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
750 panic("Chunk count is negative");
751 }
752 sctppcbinfo.ipi_gencnt_chunk++;
753 if (asoc->fragmented_delivery_inprogress == 0) {
754 /*
755 * Now lets see if we can deliver the next one on the
756 * stream
757 */
758 u_int16_t nxt_todel;
759 struct sctp_stream_in *strm;
760
761 strm = &asoc->strmin[stream_no];
762 nxt_todel = strm->last_sequence_delivered + 1;
763 chk = TAILQ_FIRST(&strm->inqueue);
764 if (chk && (nxt_todel == chk->rec.data.stream_seq)) {
765 while (chk != NULL) {
766 /* all delivered */
767 if (nxt_todel ==
768 chk->rec.data.stream_seq) {
769 at = TAILQ_NEXT(chk, sctp_next);
770 TAILQ_REMOVE(&strm->inqueue,
771 chk, sctp_next);
772 asoc->size_on_all_streams -=
773 chk->send_size;
774 asoc->cnt_on_all_streams--;
775 strm->last_sequence_delivered++;
776 /*
777 * We ignore the return of
778 * deliver_data here since we
779 * always can hold the chunk on
780 * the d-queue. And we have a
781 * finite number that can be
782 * delivered from the strq.
783 */
784 sctp_deliver_data(stcb, asoc, chk, 1);
785 chk = at;
786 } else {
787 break;
788 }
789 nxt_todel =
790 strm->last_sequence_delivered + 1;
791 }
792 }
793 if (!TAILQ_EMPTY(&asoc->delivery_queue)) {
794 /* Here if deliver_data fails, we must break */
795 if (sctp_deliver_data(stcb, asoc, NULL, 1) == 0)
796 break;
797 }
798 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
799 if (hold_locks == 0)
800 SCTP_INP_WUNLOCK(stcb->sctp_ep);
801 return;
802 }
803 chk = TAILQ_FIRST(&asoc->reasmqueue);
804 } while (chk);
805 if (cntDel) {
806 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
807 }
808 if (hold_locks == 0)
809 SCTP_INP_WUNLOCK(stcb->sctp_ep);
810}
811
812/*
813 * Queue the chunk either right into the socket buffer if it is the next one
814 * to go OR put it in the correct place in the delivery queue. If we do
815 * append to the so_buf, keep doing so until we are out of order.
816 * One big question still remains, what to do when the socket buffer is FULL??
817 */
818static void
819sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc,
820 struct sctp_tmit_chunk *chk, int *abort_flag)
821{
822 struct sctp_stream_in *strm;
823 struct sctp_tmit_chunk *at;
824 int queue_needed;
825 u_int16_t nxt_todel;
826 struct mbuf *oper;
827
828/*** FIX FIX FIX ???
829 * Need to add code to deal with 16 bit seq wrap
830 * without a TSN wrap for ordered delivery (maybe).
831 * FIX FIX FIX ???
832 */
833 queue_needed = 1;
834 asoc->size_on_all_streams += chk->send_size;
835 asoc->cnt_on_all_streams++;
836 strm = &asoc->strmin[chk->rec.data.stream_number];
837 nxt_todel = strm->last_sequence_delivered + 1;
838#ifdef SCTP_STR_LOGGING
839 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
840#endif
841#ifdef SCTP_DEBUG
842 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 843 kprintf("queue to stream called for ssn:%u lastdel:%u nxt:%u\n",
8d60bf8a
EN
844 (u_int)chk->rec.data.stream_seq,
845 (u_int)strm->last_sequence_delivered, (u_int)nxt_todel);
846 }
847#endif
848 if (compare_with_wrap(strm->last_sequence_delivered,
849 chk->rec.data.stream_seq, MAX_SEQ) ||
850 (strm->last_sequence_delivered == chk->rec.data.stream_seq)) {
851 /* The incoming sseq is behind where we last delivered? */
852#ifdef SCTP_DEBUG
853 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 854 kprintf("Duplicate S-SEQ:%d delivered:%d from peer, Abort association\n",
8d60bf8a
EN
855 chk->rec.data.stream_seq,
856 strm->last_sequence_delivered);
857 }
858#endif
859 /*
860 * throw it in the stream so it gets cleaned up in
861 * association destruction
862 */
863 TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next);
19267c6d 864 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
865 if (oper) {
866 struct sctp_paramhdr *ph;
867 u_int32_t *ippp;
868
869 oper->m_len = sizeof(struct sctp_paramhdr) +
870 sizeof(*ippp);
871 ph = mtod(oper, struct sctp_paramhdr *);
872 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
873 ph->param_length = htons(oper->m_len);
874 ippp = (u_int32_t *)(ph + 1);
875 *ippp = htonl(0x00000001);
876 }
877 sctp_abort_an_association(stcb->sctp_ep, stcb,
878 SCTP_PEER_FAULTY, oper);
879
880 *abort_flag = 1;
881 return;
882
883 }
884 if (nxt_todel == chk->rec.data.stream_seq) {
885 /* can be delivered right away */
886#ifdef SCTP_DEBUG
887 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 888 kprintf("It's NEXT!\n");
8d60bf8a
EN
889 }
890#endif
891#ifdef SCTP_STR_LOGGING
892 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
893#endif
894 queue_needed = 0;
895 asoc->size_on_all_streams -= chk->send_size;
896 asoc->cnt_on_all_streams--;
897 strm->last_sequence_delivered++;
898 sctp_deliver_data(stcb, asoc, chk, 0);
899 chk = TAILQ_FIRST(&strm->inqueue);
900 while (chk != NULL) {
901 /* all delivered */
902 nxt_todel = strm->last_sequence_delivered + 1;
903 if (nxt_todel == chk->rec.data.stream_seq) {
904 at = TAILQ_NEXT(chk, sctp_next);
905 TAILQ_REMOVE(&strm->inqueue, chk, sctp_next);
906 asoc->size_on_all_streams -= chk->send_size;
907 asoc->cnt_on_all_streams--;
908 strm->last_sequence_delivered++;
909 /*
910 * We ignore the return of deliver_data here
911 * since we always can hold the chunk on the
912 * d-queue. And we have a finite number that
913 * can be delivered from the strq.
914 */
915#ifdef SCTP_STR_LOGGING
916 sctp_log_strm_del(chk, NULL,
917 SCTP_STR_LOG_FROM_IMMED_DEL);
918#endif
919 sctp_deliver_data(stcb, asoc, chk, 0);
920 chk = at;
921 continue;
922 }
923 break;
924 }
925 }
926 if (queue_needed) {
927 /*
928 * Ok, we did not deliver this guy, find
929 * the correct place to put it on the queue.
930 */
931#ifdef SCTP_DEBUG
932 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 933 kprintf("Queue Needed!\n");
8d60bf8a
EN
934 }
935#endif
936 if (TAILQ_EMPTY(&strm->inqueue)) {
937 /* Empty queue */
938#ifdef SCTP_STR_LOGGING
939 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INSERT_HD);
940#endif
941 TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next);
942 } else {
943 TAILQ_FOREACH(at, &strm->inqueue, sctp_next) {
944 if (compare_with_wrap(at->rec.data.stream_seq,
945 chk->rec.data.stream_seq, MAX_SEQ)) {
946 /*
947 * one in queue is bigger than the new
948 * one, insert before this one
949 */
950#ifdef SCTP_STR_LOGGING
951 sctp_log_strm_del(chk, at,
952 SCTP_STR_LOG_FROM_INSERT_MD);
953#endif
954 TAILQ_INSERT_BEFORE(at, chk, sctp_next);
955 break;
956 } else if (at->rec.data.stream_seq ==
957 chk->rec.data.stream_seq) {
958 /*
959 * Gak, He sent me a duplicate str seq
960 * number
961 */
962 /*
963 * foo bar, I guess I will just free
964 * this new guy, should we abort too?
965 * FIX ME MAYBE? Or it COULD be that
966 * the SSN's have wrapped. Maybe I
967 * should compare to TSN somehow...
968 * sigh for now just blow away the
969 * chunk!
970 */
971
972 if (chk->data)
973 sctp_m_freem(chk->data);
974 chk->data = NULL;
975 asoc->size_on_all_streams -= chk->send_size;
976 asoc->cnt_on_all_streams--;
977 sctp_pegs[SCTP_DUP_SSN_RCVD]++;
978 sctp_free_remote_addr(chk->whoTo);
979 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
980 sctppcbinfo.ipi_count_chunk--;
981 if ((int)sctppcbinfo.ipi_count_chunk <
982 0) {
983 panic("Chunk count is negative");
984 }
985 sctppcbinfo.ipi_gencnt_chunk++;
986 return;
987 } else {
988 if (TAILQ_NEXT(at, sctp_next) == NULL) {
989 /*
990 * We are at the end, insert it
991 * after this one
992 */
993#ifdef SCTP_STR_LOGGING
994 sctp_log_strm_del(chk, at,
995 SCTP_STR_LOG_FROM_INSERT_TL);
996#endif
997 TAILQ_INSERT_AFTER(&strm->inqueue,
998 at, chk, sctp_next);
999 break;
1000 }
1001 }
1002 }
1003 }
1004 } else {
1005 /* We delivered some chunks, wake them up */
1006
1007#ifdef SCTP_DEBUG
1008 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1009 kprintf("Doing WAKEUP!\n");
8d60bf8a
EN
1010 }
1011#endif
1012 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1013 }
1014}
1015
1016/*
1017 * Returns two things: You get the total size of the deliverable parts of the
1018 * first fragmented message on the reassembly queue. And you get a 1 back if
1019 * all of the message is ready or a 0 back if the message is still incomplete
1020 */
1021static int
1022sctp_is_all_msg_on_reasm(struct sctp_association *asoc, int *t_size)
1023{
1024 struct sctp_tmit_chunk *chk;
1025 u_int32_t tsn;
1026
1027 *t_size = 0;
1028 chk = TAILQ_FIRST(&asoc->reasmqueue);
1029 if (chk == NULL) {
1030 /* nothing on the queue */
1031 return (0);
1032 }
1033 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
1034 /* Not a first on the queue */
1035 return (0);
1036 }
1037 tsn = chk->rec.data.TSN_seq;
1038 while (chk) {
1039 if (tsn != chk->rec.data.TSN_seq) {
1040 return (0);
1041 }
1042 *t_size += chk->send_size;
1043 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1044 return (1);
1045 }
1046 tsn++;
1047 chk = TAILQ_NEXT(chk, sctp_next);
1048 }
1049 return (0);
1050}
1051
1052/*
1053 * Dump onto the re-assembly queue, in its proper place. After dumping on
1054 * the queue, see if anthing can be delivered. If so pull it off (or as much
1055 * as we can. If we run out of space then we must dump what we can and set
1056 * the appropriate flag to say we queued what we could.
1057 */
1058static void
1059sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
1060 struct sctp_tmit_chunk *chk, int *abort_flag)
1061{
1062 struct mbuf *oper;
1063 u_int16_t nxt_todel;
633abfbf 1064 u_int32_t cum_ackp1, prev_tsn, post_tsn;
8d60bf8a 1065 int tsize;
8d60bf8a
EN
1066 struct sctp_tmit_chunk *at, *prev, *next;
1067
1068 prev = next = NULL;
1069 cum_ackp1 = asoc->tsn_last_delivered + 1;
1070
1071 if (TAILQ_EMPTY(&asoc->reasmqueue)) {
1072 /* This is the first one on the queue */
1073 TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next);
1074 /*
1075 * we do not check for delivery of anything when
1076 * only one fragment is here
1077 */
1078 asoc->size_on_reasm_queue = chk->send_size;
1079 asoc->cnt_on_reasm_queue++;
1080 if (chk->rec.data.TSN_seq == cum_ackp1) {
1081 if (asoc->fragmented_delivery_inprogress == 0 &&
1082 (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) !=
1083 SCTP_DATA_FIRST_FRAG) {
1084 /*
1085 * An empty queue, no delivery inprogress, we
1086 * hit the next one and it does NOT have a
1087 * FIRST fragment mark.
1088 */
1089#ifdef SCTP_DEBUG
1090 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1091 kprintf("Gak, Evil plot, its not first, no fragmented delivery in progress\n");
8d60bf8a
EN
1092 }
1093#endif
19267c6d 1094 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1095 if (oper) {
1096 struct sctp_paramhdr *ph;
1097 u_int32_t *ippp;
1098
1099 oper->m_len =
1100 sizeof(struct sctp_paramhdr) +
1101 sizeof(*ippp);
1102 ph = mtod(oper, struct sctp_paramhdr *);
1103 ph->param_type =
1104 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1105 ph->param_length = htons(oper->m_len);
1106 ippp = (u_int32_t *)(ph + 1);
1107 *ippp = htonl(0x10000001);
1108 }
1109 sctp_abort_an_association(stcb->sctp_ep, stcb,
1110 SCTP_PEER_FAULTY, oper);
1111 *abort_flag = 1;
1112 } else if (asoc->fragmented_delivery_inprogress &&
1113 (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
1114 /*
1115 * We are doing a partial delivery and the NEXT
1116 * chunk MUST be either the LAST or MIDDLE
1117 * fragment NOT a FIRST
1118 */
1119#ifdef SCTP_DEBUG
1120 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1121 kprintf("Gak, Evil plot, it IS a first and fragmented delivery in progress\n");
8d60bf8a
EN
1122 }
1123#endif
19267c6d 1124 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1125 if (oper) {
1126 struct sctp_paramhdr *ph;
1127 u_int32_t *ippp;
1128
1129 oper->m_len =
1130 sizeof(struct sctp_paramhdr) +
1131 sizeof(*ippp);
1132 ph = mtod(oper, struct sctp_paramhdr *);
1133 ph->param_type =
1134 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1135 ph->param_length = htons(oper->m_len);
1136 ippp = (u_int32_t *)(ph + 1);
1137 *ippp = htonl(0x10000002);
1138 }
1139 sctp_abort_an_association(stcb->sctp_ep, stcb,
1140 SCTP_PEER_FAULTY, oper);
1141 *abort_flag = 1;
1142 } else if (asoc->fragmented_delivery_inprogress) {
1143 /* Here we are ok with a MIDDLE or LAST piece */
1144 if (chk->rec.data.stream_number !=
1145 asoc->str_of_pdapi) {
1146 /* Got to be the right STR No */
1147#ifdef SCTP_DEBUG
1148 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1149 kprintf("Gak, Evil plot, it IS not same stream number %d vs %d\n",
8d60bf8a
EN
1150 chk->rec.data.stream_number,
1151 asoc->str_of_pdapi);
1152 }
1153#endif
19267c6d 1154 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1155 if (oper) {
1156 struct sctp_paramhdr *ph;
1157 u_int32_t *ippp;
1158 oper->m_len =
1159 sizeof(struct sctp_paramhdr) +
1160 sizeof(*ippp);
1161 ph = mtod(oper,
1162 struct sctp_paramhdr *);
1163 ph->param_type =
1164 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1165 ph->param_length =
1166 htons(oper->m_len);
1167 ippp = (u_int32_t *)(ph + 1);
1168 *ippp = htonl(0x10000003);
1169 }
1170 sctp_abort_an_association(stcb->sctp_ep,
1171 stcb, SCTP_PEER_FAULTY, oper);
1172 *abort_flag = 1;
1173 } else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) !=
1174 SCTP_DATA_UNORDERED &&
1175 chk->rec.data.stream_seq !=
1176 asoc->ssn_of_pdapi) {
1177 /* Got to be the right STR Seq */
1178#ifdef SCTP_DEBUG
1179 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1180 kprintf("Gak, Evil plot, it IS not same stream seq %d vs %d\n",
8d60bf8a
EN
1181 chk->rec.data.stream_seq,
1182 asoc->ssn_of_pdapi);
1183 }
1184#endif
19267c6d 1185 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1186 if (oper) {
1187 struct sctp_paramhdr *ph;
1188 u_int32_t *ippp;
1189 oper->m_len =
1190 sizeof(struct sctp_paramhdr) +
1191 sizeof(*ippp);
1192 ph = mtod(oper,
1193 struct sctp_paramhdr *);
1194 ph->param_type =
1195 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1196 ph->param_length =
1197 htons(oper->m_len);
1198 ippp = (u_int32_t *)(ph + 1);
1199 *ippp = htonl(0x10000004);
1200 }
1201 sctp_abort_an_association(stcb->sctp_ep,
1202 stcb, SCTP_PEER_FAULTY, oper);
1203 *abort_flag = 1;
1204 }
1205 }
1206 }
1207 return;
1208 }
1209 /* Find its place */
1210 at = TAILQ_FIRST(&asoc->reasmqueue);
1211
1212 /* Grab the top flags */
1213 TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1214 if (compare_with_wrap(at->rec.data.TSN_seq,
1215 chk->rec.data.TSN_seq, MAX_TSN)) {
1216 /*
1217 * one in queue is bigger than the new one, insert
1218 * before this one
1219 */
1220 /* A check */
1221 asoc->size_on_reasm_queue += chk->send_size;
1222 asoc->cnt_on_reasm_queue++;
1223 next = at;
1224 TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1225 break;
1226 } else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) {
1227 /* Gak, He sent me a duplicate str seq number */
1228 /*
1229 * foo bar, I guess I will just free this new guy,
1230 * should we abort too? FIX ME MAYBE? Or it COULD be
1231 * that the SSN's have wrapped. Maybe I should compare
1232 * to TSN somehow... sigh for now just blow away the
1233 * chunk!
1234 */
1235 if (chk->data)
1236 sctp_m_freem(chk->data);
1237 chk->data = NULL;
1238 sctp_free_remote_addr(chk->whoTo);
1239 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
1240 sctppcbinfo.ipi_count_chunk--;
1241 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
1242 panic("Chunk count is negative");
1243 }
1244 sctppcbinfo.ipi_gencnt_chunk++;
1245 return;
1246 } else {
8d60bf8a
EN
1247 prev = at;
1248 if (TAILQ_NEXT(at, sctp_next) == NULL) {
1249 /*
1250 * We are at the end, insert it after this one
1251 */
1252 /* check it first */
1253 asoc->size_on_reasm_queue += chk->send_size;
1254 asoc->cnt_on_reasm_queue++;
1255 TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next);
1256 break;
1257 }
1258 }
1259 }
1260 /* Now the audits */
1261 if (prev) {
1262 prev_tsn = chk->rec.data.TSN_seq - 1;
1263 if (prev_tsn == prev->rec.data.TSN_seq) {
1264 /*
1265 * Ok the one I am dropping onto the end
1266 * is the NEXT. A bit of valdiation here.
1267 */
1268 if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1269 SCTP_DATA_FIRST_FRAG ||
1270 (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1271 SCTP_DATA_MIDDLE_FRAG) {
1272 /*
1273 * Insert chk MUST be a MIDDLE or LAST fragment
1274 */
1275 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1276 SCTP_DATA_FIRST_FRAG) {
1277#ifdef SCTP_DEBUG
1278 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc
SW
1279 kprintf("Prev check - It can be a midlle or last but not a first\n");
1280 kprintf("Gak, Evil plot, it's a FIRST!\n");
8d60bf8a
EN
1281 }
1282#endif
19267c6d 1283 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1284 if (oper) {
1285 struct sctp_paramhdr *ph;
1286 u_int32_t *ippp;
1287
1288 oper->m_len =
1289 sizeof(struct sctp_paramhdr) +
1290 sizeof(*ippp);
1291 ph = mtod(oper,
1292 struct sctp_paramhdr *);
1293 ph->param_type =
1294 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1295 ph->param_length =
1296 htons(oper->m_len);
1297
1298 ippp = (u_int32_t *)(ph + 1);
1299 *ippp = htonl(0x10000005);
1300 }
1301 sctp_abort_an_association(stcb->sctp_ep,
1302 stcb, SCTP_PEER_FAULTY, oper);
1303 *abort_flag = 1;
1304 return;
1305 }
1306 if (chk->rec.data.stream_number !=
1307 prev->rec.data.stream_number) {
1308 /*
1309 * Huh, need the correct STR here, they
1310 * must be the same.
1311 */
1312#ifdef SCTP_DEBUG
1313 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1314 kprintf("Prev check - Gak, Evil plot, ssn:%d not the same as at:%d\n",
8d60bf8a
EN
1315 chk->rec.data.stream_number,
1316 prev->rec.data.stream_number);
1317 }
1318#endif
19267c6d 1319 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1320 if (oper) {
1321 struct sctp_paramhdr *ph;
1322 u_int32_t *ippp;
1323
1324 oper->m_len =
1325 sizeof(struct sctp_paramhdr) +
1326 sizeof(*ippp);
1327 ph = mtod(oper,
1328 struct sctp_paramhdr *);
1329 ph->param_type =
1330 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1331 ph->param_length =
1332 htons(oper->m_len);
1333 ippp = (u_int32_t *)(ph + 1);
1334 *ippp = htonl(0x10000006);
1335 }
1336
1337 sctp_abort_an_association(stcb->sctp_ep,
1338 stcb, SCTP_PEER_FAULTY, oper);
1339
1340 *abort_flag = 1;
1341 return;
1342 }
1343 if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1344 chk->rec.data.stream_seq !=
1345 prev->rec.data.stream_seq) {
1346 /*
1347 * Huh, need the correct STR here, they
1348 * must be the same.
1349 */
1350#ifdef SCTP_DEBUG
1351 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1352 kprintf("Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n",
8d60bf8a
EN
1353 chk->rec.data.stream_seq,
1354 prev->rec.data.stream_seq);
1355 }
1356#endif
19267c6d 1357 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1358 if (oper) {
1359 struct sctp_paramhdr *ph;
1360 u_int32_t *ippp;
1361
1362 oper->m_len =
1363 sizeof(struct sctp_paramhdr) +
1364 sizeof(*ippp);
1365 ph = mtod(oper,
1366 struct sctp_paramhdr *);
1367 ph->param_type =
1368 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1369 ph->param_length =
1370 htons(oper->m_len);
1371 ippp = (u_int32_t *)(ph + 1);
1372 *ippp = htonl(0x10000007);
1373 }
1374
1375 sctp_abort_an_association(stcb->sctp_ep,
1376 stcb, SCTP_PEER_FAULTY, oper);
1377
1378 *abort_flag = 1;
1379 return;
1380 }
1381 } else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1382 SCTP_DATA_LAST_FRAG) {
1383 /* Insert chk MUST be a FIRST */
1384 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1385 SCTP_DATA_FIRST_FRAG) {
1386#ifdef SCTP_DEBUG
1387 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1388 kprintf("Prev check - Gak, evil plot, its not FIRST and it must be!\n");
8d60bf8a
EN
1389 }
1390#endif
19267c6d 1391 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1392 if (oper) {
1393 struct sctp_paramhdr *ph;
1394 u_int32_t *ippp;
1395
1396 oper->m_len =
1397 sizeof(struct sctp_paramhdr) +
1398 sizeof(*ippp);
1399 ph = mtod(oper,
1400 struct sctp_paramhdr *);
1401 ph->param_type =
1402 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1403 ph->param_length =
1404 htons(oper->m_len);
1405 ippp = (u_int32_t *)(ph + 1);
1406 *ippp = htonl(0x10000008);
1407 }
1408
1409 sctp_abort_an_association(stcb->sctp_ep,
1410 stcb, SCTP_PEER_FAULTY, oper);
1411
1412 *abort_flag = 1;
1413 return;
1414 }
1415 }
1416 }
1417 }
1418
1419 if (next) {
1420 post_tsn = chk->rec.data.TSN_seq + 1;
1421 if (post_tsn == next->rec.data.TSN_seq) {
1422 /*
1423 * Ok the one I am inserting ahead of
1424 * is my NEXT one. A bit of valdiation here.
1425 */
1426 if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1427 /* Insert chk MUST be a last fragment */
1428 if ((chk->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK)
1429 != SCTP_DATA_LAST_FRAG) {
1430#ifdef SCTP_DEBUG
1431 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc
SW
1432 kprintf("Next chk - Next is FIRST, we must be LAST\n");
1433 kprintf("Gak, Evil plot, its not a last!\n");
8d60bf8a
EN
1434 }
1435#endif
19267c6d 1436 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1437 if (oper) {
1438 struct sctp_paramhdr *ph;
1439 u_int32_t *ippp;
1440
1441 oper->m_len =
1442 sizeof(struct sctp_paramhdr) +
1443 sizeof(*ippp);
1444 ph = mtod(oper,
1445 struct sctp_paramhdr *);
1446 ph->param_type =
1447 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1448 ph->param_length =
1449 htons(oper->m_len);
1450 ippp = (u_int32_t *)(ph + 1);
1451 *ippp = htonl(0x10000009);
1452 }
1453
1454 sctp_abort_an_association(stcb->sctp_ep,
1455 stcb, SCTP_PEER_FAULTY, oper);
1456
1457 *abort_flag = 1;
1458 return;
1459 }
1460 } else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1461 SCTP_DATA_MIDDLE_FRAG ||
1462 (next->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK) ==
1463 SCTP_DATA_LAST_FRAG) {
1464 /* Insert chk CAN be MIDDLE or FIRST NOT LAST */
1465 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1466 SCTP_DATA_LAST_FRAG) {
1467#ifdef SCTP_DEBUG
1468 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc
SW
1469 kprintf("Next chk - Next is a MIDDLE/LAST\n");
1470 kprintf("Gak, Evil plot, new prev chunk is a LAST\n");
8d60bf8a
EN
1471 }
1472#endif
19267c6d 1473 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1474 if (oper) {
1475 struct sctp_paramhdr *ph;
1476 u_int32_t *ippp;
1477
1478 oper->m_len =
1479 sizeof(struct sctp_paramhdr) +
1480 sizeof(*ippp);
1481 ph = mtod(oper,
1482 struct sctp_paramhdr *);
1483 ph->param_type =
1484 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1485 ph->param_length =
1486 htons(oper->m_len);
1487 ippp = (u_int32_t *)(ph + 1);
1488 *ippp = htonl(0x1000000a);
1489 }
1490 sctp_abort_an_association(stcb->sctp_ep,
1491 stcb, SCTP_PEER_FAULTY, oper);
1492
1493 *abort_flag = 1;
1494 return;
1495 }
1496 if (chk->rec.data.stream_number !=
1497 next->rec.data.stream_number) {
1498 /*
1499 * Huh, need the correct STR here, they
1500 * must be the same.
1501 */
1502#ifdef SCTP_DEBUG
1503 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1504 kprintf("Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n",
8d60bf8a
EN
1505 chk->rec.data.stream_number,
1506 next->rec.data.stream_number);
1507 }
1508#endif
19267c6d 1509 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1510 if (oper) {
1511 struct sctp_paramhdr *ph;
1512 u_int32_t *ippp;
1513
1514 oper->m_len =
1515 sizeof(struct sctp_paramhdr) +
1516 sizeof(*ippp);
1517 ph = mtod(oper,
1518 struct sctp_paramhdr *);
1519 ph->param_type =
1520 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1521 ph->param_length =
1522 htons(oper->m_len);
1523 ippp = (u_int32_t *)(ph + 1);
1524 *ippp = htonl(0x1000000b);
1525 }
1526
1527 sctp_abort_an_association(stcb->sctp_ep,
1528 stcb, SCTP_PEER_FAULTY, oper);
1529
1530 *abort_flag = 1;
1531 return;
1532 }
1533 if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1534 chk->rec.data.stream_seq !=
1535 next->rec.data.stream_seq) {
1536 /*
1537 * Huh, need the correct STR here, they
1538 * must be the same.
1539 */
1540#ifdef SCTP_DEBUG
1541 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1542 kprintf("Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n",
8d60bf8a
EN
1543 chk->rec.data.stream_seq,
1544 next->rec.data.stream_seq);
1545 }
1546#endif
19267c6d 1547 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1548 if (oper) {
1549 struct sctp_paramhdr *ph;
1550 u_int32_t *ippp;
1551
1552 oper->m_len =
1553 sizeof(struct sctp_paramhdr) +
1554 sizeof(*ippp);
1555 ph = mtod(oper,
1556 struct sctp_paramhdr *);
1557 ph->param_type =
1558 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1559 ph->param_length =
1560 htons(oper->m_len);
1561 ippp = (u_int32_t *)(ph + 1);
1562 *ippp = htonl(0x1000000c);
1563 }
1564
1565 sctp_abort_an_association(stcb->sctp_ep,
1566 stcb, SCTP_PEER_FAULTY, oper);
1567
1568 *abort_flag = 1;
1569 return;
1570
1571 }
1572 }
1573 }
1574 }
1575 /*
1576 * now that we have all in there place we must check a number of
1577 * things to see if we can send data to the ULP.
1578 */
1579 /* we need to do some delivery, if we can */
1580 chk = TAILQ_FIRST(&asoc->reasmqueue);
1581 if (chk == NULL) {
1582 /* Huh? */
1583 asoc->size_on_reasm_queue = 0;
1584 asoc->cnt_on_reasm_queue = 0;
1585 return;
1586 }
1587 if (asoc->fragmented_delivery_inprogress == 0) {
1588 nxt_todel =
1589 asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
1590 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
1591 (nxt_todel == chk->rec.data.stream_seq ||
1592 (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
1593 /*
1594 * Yep the first one is here and its
1595 * ok to deliver but should we?
1596 */
1597 if (TAILQ_EMPTY(&asoc->delivery_queue) &&
1598 (sctp_is_all_msg_on_reasm(asoc, &tsize) ||
1599 (asoc->size_on_reasm_queue >=
6d49aa6f 1600 (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) &&
8d60bf8a
EN
1601 tsize))) {
1602 /*
1603 * Yes, we setup to
1604 * start reception, by backing down the TSN
1605 * just in case we can't deliver. If we
1606 */
1607 asoc->fragmented_delivery_inprogress = 1;
1608 asoc->tsn_last_delivered =
1609 chk->rec.data.TSN_seq - 1;
1610 asoc->str_of_pdapi =
1611 chk->rec.data.stream_number;
1612 asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
1613 asoc->fragment_flags = chk->rec.data.rcv_flags;
1614 sctp_service_reassembly(stcb, asoc, 0);
1615 }
1616 }
1617 } else {
1618 sctp_service_reassembly(stcb, asoc, 0);
1619 }
1620}
1621
1622/*
1623 * This is an unfortunate routine. It checks to make sure a evil guy is not
1624 * stuffing us full of bad packet fragments. A broken peer could also do this
1625 * but this is doubtful. It is to bad I must worry about evil crackers sigh
1626 * :< more cycles.
1627 */
1628static int
1629sctp_does_chk_belong_to_reasm(struct sctp_association *asoc,
1630 struct sctp_tmit_chunk *chk)
1631{
1632 struct sctp_tmit_chunk *at;
1633 u_int32_t tsn_est;
1634
1635 TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1636 if (compare_with_wrap(chk->rec.data.TSN_seq,
1637 at->rec.data.TSN_seq, MAX_TSN)) {
1638 /* is it one bigger? */
1639 tsn_est = at->rec.data.TSN_seq + 1;
1640 if (tsn_est == chk->rec.data.TSN_seq) {
1641 /* yep. It better be a last then*/
1642 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1643 SCTP_DATA_LAST_FRAG) {
1644 /*
1645 * Ok this guy belongs next to a guy
1646 * that is NOT last, it should be a
1647 * middle/last, not a complete chunk.
1648 */
1649 return (1);
1650 } else {
1651 /*
1652 * This guy is ok since its a LAST and
1653 * the new chunk is a fully self-
1654 * contained one.
1655 */
1656 return (0);
1657 }
1658 }
1659 } else if (chk->rec.data.TSN_seq == at->rec.data.TSN_seq) {
1660 /* Software error since I have a dup? */
1661 return (1);
1662 } else {
1663 /*
1664 * Ok, 'at' is larger than new chunk but does it
1665 * need to be right before it.
1666 */
1667 tsn_est = chk->rec.data.TSN_seq + 1;
1668 if (tsn_est == at->rec.data.TSN_seq) {
1669 /* Yep, It better be a first */
1670 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1671 SCTP_DATA_FIRST_FRAG) {
1672 return (1);
1673 } else {
1674 return (0);
1675 }
1676 }
1677 }
1678 }
1679 return (0);
1680}
1681
1682extern unsigned int sctp_max_chunks_on_queue;
1683static int
1684sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1685 struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length,
1686 struct sctp_nets *net, u_int32_t *high_tsn, int *abort_flag,
1687 int *break_flag, int last_chunk)
1688{
1689 /* Process a data chunk */
1690 /* struct sctp_tmit_chunk *chk;*/
1691 struct sctp_tmit_chunk *chk;
1692 u_int32_t tsn, gap;
1693 struct mbuf *dmbuf;
633abfbf 1694 int the_len;
8d60bf8a
EN
1695 u_int16_t strmno, strmseq;
1696 struct mbuf *oper;
1697
1698 chk = NULL;
1699 tsn = ntohl(ch->dp.tsn);
1700#ifdef SCTP_MAP_LOGGING
1701 sctp_log_map(0, tsn, asoc->cumulative_tsn, SCTP_MAP_PREPARE_SLIDE);
1702#endif
1703 if (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN) ||
1704 asoc->cumulative_tsn == tsn) {
1705 /* It is a duplicate */
1706 sctp_pegs[SCTP_DUPTSN_RECVD]++;
1707 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1708 /* Record a dup for the next outbound sack */
1709 asoc->dup_tsns[asoc->numduptsns] = tsn;
1710 asoc->numduptsns++;
1711 }
1712 return (0);
1713 }
1714 /* Calculate the number of TSN's between the base and this TSN */
1715 if (tsn >= asoc->mapping_array_base_tsn) {
1716 gap = tsn - asoc->mapping_array_base_tsn;
1717 } else {
1718 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + tsn + 1;
1719 }
1720 if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1721 /* Can't hold the bit in the mapping at max array, toss it */
1722 return (0);
1723 }
1724 if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) {
1725 if (sctp_expand_mapping_array(asoc)) {
1726 /* Can't expand, drop it */
1727 return (0);
1728 }
1729 }
1730 if (compare_with_wrap(tsn, *high_tsn, MAX_TSN)) {
1731 *high_tsn = tsn;
1732 }
1733 /* See if we have received this one already */
1734 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
1735 sctp_pegs[SCTP_DUPTSN_RECVD]++;
1736 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1737 /* Record a dup for the next outbound sack */
1738 asoc->dup_tsns[asoc->numduptsns] = tsn;
1739 asoc->numduptsns++;
1740 }
1741 if (!callout_pending(&asoc->dack_timer.timer)) {
1742 /*
1743 * By starting the timer we assure that we
1744 * WILL sack at the end of the packet
1745 * when sctp_sack_check gets called.
1746 */
1747 sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep,
1748 stcb, NULL);
1749 }
1750 return (0);
1751 }
1752 /*
1753 * Check to see about the GONE flag, duplicates would cause
1754 * a sack to be sent up above
1755 */
1756 if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
1757 /*
1758 * wait a minute, this guy is gone, there is no
1759 * longer a receiver. Send peer an ABORT!
1760 */
1761 struct mbuf *op_err;
1762 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1763 sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
1764 *abort_flag = 1;
1765 return (0);
1766 }
1767 /*
1768 * Now before going further we see if there is room. If NOT then
1769 * we MAY let one through only IF this TSN is the one we are
1770 * waiting for on a partial delivery API.
1771 */
1772
1773 /* now do the tests */
1774 if (((asoc->cnt_on_all_streams +
1775 asoc->cnt_on_delivery_queue +
1776 asoc->cnt_on_reasm_queue +
1777 asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) ||
1778 (((int)asoc->my_rwnd) <= 0)) {
1779 /*
1780 * When we have NO room in the rwnd we check
1781 * to make sure the reader is doing its job...
1782 */
6d49aa6f 1783 if (stcb->sctp_socket->so_rcv.ssb_cc) {
8d60bf8a
EN
1784 /* some to read, wake-up */
1785 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1786 }
1787 /* now is it in the mapping array of what we have accepted? */
1788 if (compare_with_wrap(tsn,
1789 asoc->highest_tsn_inside_map, MAX_TSN)) {
1790
1791 /* Nope not in the valid range dump it */
1792#ifdef SCTP_DEBUG
1793 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1794 kprintf("My rwnd overrun1:tsn:%lx rwnd %lu sbspace:%ld delq:%d!\n",
8d60bf8a
EN
1795 (u_long)tsn, (u_long)asoc->my_rwnd,
1796 sctp_sbspace(&stcb->sctp_socket->so_rcv),
1797 stcb->asoc.cnt_on_delivery_queue);
1798 }
1799#endif
1800 sctp_set_rwnd(stcb, asoc);
1801 if ((asoc->cnt_on_all_streams +
1802 asoc->cnt_on_delivery_queue +
1803 asoc->cnt_on_reasm_queue +
1804 asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) {
1805 sctp_pegs[SCTP_MSGC_DROP]++;
1806 } else {
1807 sctp_pegs[SCTP_RWND_DROPS]++;
1808 }
8d60bf8a
EN
1809 *break_flag = 1;
1810 return (0);
1811 }
1812 }
1813 strmno = ntohs(ch->dp.stream_id);
1814 if (strmno >= asoc->streamincnt) {
1815 struct sctp_paramhdr *phdr;
1816 struct mbuf *mb;
1817
19267c6d 1818 MGETHDR(mb, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1819 if (mb != NULL) {
1820 /* add some space up front so prepend will work well */
1821 mb->m_data += sizeof(struct sctp_chunkhdr);
1822 phdr = mtod(mb, struct sctp_paramhdr *);
1823 /*
1824 * Error causes are just param's and this one has
1825 * two back to back phdr, one with the error type
1826 * and size, the other with the streamid and a rsvd
1827 */
1828 mb->m_pkthdr.len = mb->m_len =
1829 (sizeof(struct sctp_paramhdr) * 2);
1830 phdr->param_type = htons(SCTP_CAUSE_INV_STRM);
1831 phdr->param_length =
1832 htons(sizeof(struct sctp_paramhdr) * 2);
1833 phdr++;
1834 /* We insert the stream in the type field */
1835 phdr->param_type = ch->dp.stream_id;
1836 /* And set the length to 0 for the rsvd field */
1837 phdr->param_length = 0;
1838 sctp_queue_op_err(stcb, mb);
1839 }
1840 sctp_pegs[SCTP_BAD_STRMNO]++;
1841 return (0);
1842 }
1843 /*
1844 * Before we continue lets validate that we are not
1845 * being fooled by an evil attacker. We can only
1846 * have 4k chunks based on our TSN spread allowed
1847 * by the mapping array 512 * 8 bits, so there is
1848 * no way our stream sequence numbers could have wrapped.
1849 * We of course only validate the FIRST fragment so the
1850 * bit must be set.
1851 */
1852 strmseq = ntohs(ch->dp.stream_sequence);
1853 if ((ch->ch.chunk_flags & SCTP_DATA_FIRST_FRAG) &&
1854 (ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0 &&
1855 (compare_with_wrap(asoc->strmin[strmno].last_sequence_delivered,
1856 strmseq, MAX_SEQ) ||
1857 asoc->strmin[strmno].last_sequence_delivered == strmseq)) {
1858 /* The incoming sseq is behind where we last delivered? */
1859#ifdef SCTP_DEBUG
1860 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 1861 kprintf("EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n",
8d60bf8a
EN
1862 strmseq,
1863 asoc->strmin[strmno].last_sequence_delivered);
1864 }
1865#endif
1866 /*
1867 * throw it in the stream so it gets cleaned up in
1868 * association destruction
1869 */
19267c6d 1870 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1871 if (oper) {
1872 struct sctp_paramhdr *ph;
1873 u_int32_t *ippp;
1874
1875 oper->m_len = sizeof(struct sctp_paramhdr) +
1876 sizeof(*ippp);
1877 ph = mtod(oper, struct sctp_paramhdr *);
1878 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1879 ph->param_length = htons(oper->m_len);
1880 ippp = (u_int32_t *)(ph + 1);
1881 *ippp = htonl(0x20000001);
1882 }
1883 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY,
1884 oper);
1885 sctp_pegs[SCTP_BAD_SSN_WRAP]++;
1886 *abort_flag = 1;
1887 return (0);
1888 }
1889
1890 the_len = (chk_length-sizeof(struct sctp_data_chunk));
1891 if (last_chunk == 0) {
1892 dmbuf = sctp_m_copym(*m,
1893 (offset + sizeof(struct sctp_data_chunk)),
19267c6d 1894 the_len, MB_DONTWAIT);
8d60bf8a
EN
1895 } else {
1896 /* We can steal the last chunk */
1897 dmbuf = *m;
1898 /* lop off the top part */
1899 m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
1900 if (dmbuf->m_pkthdr.len > the_len) {
1901 /* Trim the end round bytes off too */
1902 m_adj(dmbuf, -(dmbuf->m_pkthdr.len-the_len));
1903 }
1904 sctp_pegs[SCTP_NO_COPY_IN]++;
1905 }
1906 if (dmbuf == NULL) {
1907 sctp_pegs[SCTP_DROP_NOMEMORY]++;
1908 return (0);
1909 }
1910 if ((ch->ch.chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
1911 asoc->fragmented_delivery_inprogress == 0 &&
1912 TAILQ_EMPTY(&asoc->delivery_queue) &&
1913 ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) ||
1914 ((asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq &&
1915 TAILQ_EMPTY(&asoc->strmin[strmno].inqueue))) &&
6d49aa6f
MD
1916 ((long)(stcb->sctp_socket->so_rcv.ssb_hiwat -
1917 stcb->sctp_socket->so_rcv.ssb_cc) >= (long)the_len)) {
8d60bf8a
EN
1918 /* Candidate for express delivery */
1919 /*
1920 * Its not fragmented,
1921 * No PD-API is up,
1922 * Nothing in the delivery queue,
1923 * Its un-ordered OR ordered and the next to deliver AND
1924 * nothing else is stuck on the stream queue,
1925 * And there is room for it in the socket buffer.
1926 * Lets just stuff it up the buffer....
1927 */
1928
1929 struct mbuf *control, *mmm;
1930 struct sockaddr_in6 sin6;
1931 struct sockaddr_in6 lsa6;
1932 struct sockaddr *to;
1933
1934 /* It would be nice to avoid this copy if we could :< */
1935 control = sctp_build_ctl_nchunk(stcb, tsn,
1936 ch->dp.protocol_id, 0, strmno, strmseq,
1937 ch->ch.chunk_flags);
1938 /* XXX need to append PKTHDR to the socket buffer first */
1939
1940 if ((dmbuf->m_flags & M_PKTHDR) == 0) {
1941 struct mbuf *tmp;
19267c6d 1942 MGETHDR(tmp, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
1943 if (tmp == NULL) {
1944
1945 /* no room! */
1946 if (control) {
1947 sctp_m_freem(control);
1948 stcb->asoc.my_rwnd_control_len -=
1949 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
1950 }
1951
1952 goto failed_express_del;
1953 }
1954 tmp->m_pkthdr.len = the_len;
1955 tmp->m_len = 0;
1956 tmp->m_next = dmbuf;
1957 dmbuf = tmp;
1958 }
1959 to = (struct sockaddr *)&net->ro._l_addr;
1960 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
1961 to->sa_family == AF_INET) {
1962 struct sockaddr_in *sin;
1963
1964 sin = (struct sockaddr_in *)to;
1965 bzero(&sin6, sizeof(sin6));
1966 sin6.sin6_family = AF_INET6;
1967 sin6.sin6_len = sizeof(struct sockaddr_in6);
1968 sin6.sin6_addr.s6_addr16[2] = 0xffff;
1969 bcopy(&sin->sin_addr,
1970 &sin6.sin6_addr.s6_addr16[3],
1971 sizeof(sin6.sin6_addr.s6_addr16[3]));
1972 sin6.sin6_port = sin->sin_port;
1973 to = (struct sockaddr *)&sin6;
1974 }
1975
1976 /* check and strip embedded scope junk */
1977 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
1978 &lsa6);
1979 if (((struct sockaddr_in *)to)->sin_port == 0) {
664f5072 1980 kprintf("Huh c, port is %d not net:%p %d?\n",
8d60bf8a 1981 ((struct sockaddr_in *)to)->sin_port,
664f5072 1982 net,
8d60bf8a
EN
1983 (int)(ntohs(stcb->rport)));
1984 ((struct sockaddr_in *)to)->sin_port = stcb->rport;
1985 }
1986
1987 mmm = dmbuf;
1988 /* Mark the EOR */
1989 while (mmm->m_next != NULL) {
1990 mmm = mmm->m_next;
1991 }
1992 mmm->m_flags |= M_EOR;
1993 if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
1994 /* we have a new high score */
1995 asoc->highest_tsn_inside_map = tsn;
1996#ifdef SCTP_MAP_LOGGING
1997 sctp_log_map(0, 1, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
1998#endif
1999 }
2000 SCTP_TCB_UNLOCK(stcb);
2001 SCTP_INP_WLOCK(stcb->sctp_ep);
2002 SCTP_TCB_LOCK(stcb);
6cef7136 2003 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
6d49aa6f 2004 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to, dmbuf,
8d60bf8a
EN
2005 control, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2006 if (control) {
2007 sctp_m_freem(control);
2008 stcb->asoc.my_rwnd_control_len -=
2009 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
2010 }
2011 sctp_m_freem(dmbuf);
6cef7136 2012 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
2013 goto failed_express_del;
2014 }
6cef7136 2015 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
8d60bf8a
EN
2016 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
2017 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2018 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2019 }
2020 } else {
2021 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2022 }
2023 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2024 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2025 if ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0) {
2026
2027 /* for ordered, bump what we delivered */
2028 asoc->strmin[strmno].last_sequence_delivered++;
2029 }
2030 sctp_pegs[SCTP_EXPRESS_ROUTE]++;
2031#ifdef SCTP_STR_LOGGING
2032 sctp_log_strm_del_alt(tsn, strmseq,
2033 SCTP_STR_LOG_FROM_EXPRS_DEL);
2034#endif
2035#ifdef SCTP_DEBUG
2036 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 2037 kprintf("Express Delivery succeeds\n");
8d60bf8a
EN
2038 }
2039#endif
2040 goto finish_express_del;
2041 }
2042
2043 failed_express_del:
2044 /* If we reach here this is a new chunk */
2045 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
2046 if (chk == NULL) {
2047 /* No memory so we drop the chunk */
2048 sctp_pegs[SCTP_DROP_NOMEMORY]++;
2049 if (last_chunk == 0) {
2050 /* we copied it, free the copy */
2051 sctp_m_freem(dmbuf);
2052 }
2053 return (0);
2054 }
2055 sctppcbinfo.ipi_count_chunk++;
2056 sctppcbinfo.ipi_gencnt_chunk++;
2057 chk->rec.data.TSN_seq = tsn;
2058 chk->rec.data.stream_seq = strmseq;
2059 chk->rec.data.stream_number = strmno;
2060 chk->rec.data.payloadtype = ch->dp.protocol_id;
2061 chk->rec.data.context = 0;
2062 chk->rec.data.doing_fast_retransmit = 0;
2063 chk->rec.data.rcv_flags = ch->ch.chunk_flags;
2064 chk->asoc = asoc;
2065 chk->send_size = the_len;
2066 chk->whoTo = net;
2067 net->ref_count++;
2068 chk->data = dmbuf;
2069
2070
2071 /* Mark it as received */
2072 /* Now queue it where it belongs */
2073 if ((chk->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
2074 SCTP_DATA_NOT_FRAG) {
2075 /* First a sanity check */
2076 if (asoc->fragmented_delivery_inprogress) {
2077 /*
2078 * Ok, we have a fragmented delivery in progress
2079 * if this chunk is next to deliver OR belongs in
2080 * our view to the reassembly, the peer is evil
2081 * or broken.
2082 */
2083 u_int32_t estimate_tsn;
2084 estimate_tsn = asoc->tsn_last_delivered + 1;
2085 if (TAILQ_EMPTY(&asoc->reasmqueue) &&
2086 (estimate_tsn == chk->rec.data.TSN_seq)) {
2087 /* Evil/Broke peer */
19267c6d 2088 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
2089 if (oper) {
2090 struct sctp_paramhdr *ph;
2091 u_int32_t *ippp;
2092
2093 oper->m_len =
2094 sizeof(struct sctp_paramhdr) +
2095 sizeof(*ippp);
2096 ph = mtod(oper, struct sctp_paramhdr *);
2097 ph->param_type =
2098 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2099 ph->param_length = htons(oper->m_len);
2100 ippp = (u_int32_t *)(ph + 1);
2101 *ippp = htonl(0x20000002);
2102 }
2103 sctp_abort_an_association(stcb->sctp_ep, stcb,
2104 SCTP_PEER_FAULTY, oper);
2105
2106 *abort_flag = 1;
2107 sctp_pegs[SCTP_DROP_FRAG]++;
2108 return (0);
2109 } else {
2110 if (sctp_does_chk_belong_to_reasm(asoc, chk)) {
19267c6d 2111 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
2112 if (oper) {
2113 struct sctp_paramhdr *ph;
2114 u_int32_t *ippp;
2115
2116 oper->m_len =
2117 sizeof(struct sctp_paramhdr) +
2118 sizeof(*ippp);
2119 ph = mtod(oper,
2120 struct sctp_paramhdr *);
2121 ph->param_type =
2122 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2123 ph->param_length =
2124 htons(oper->m_len);
2125 ippp = (u_int32_t *)(ph + 1);
2126 *ippp = htonl(0x20000003);
2127 }
2128 sctp_abort_an_association(stcb->sctp_ep,
2129 stcb, SCTP_PEER_FAULTY, oper);
2130
2131 *abort_flag = 1;
2132 sctp_pegs[SCTP_DROP_FRAG]++;
2133 return (0);
2134 }
2135 }
2136 } else {
2137 if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
2138 /*
2139 * Reassembly queue is NOT empty
2140 * validate that this chk does not need to
2141 * be in reasembly queue. If it does then
2142 * our peer is broken or evil.
2143 */
2144 if (sctp_does_chk_belong_to_reasm(asoc, chk)) {
19267c6d 2145 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
2146 if (oper) {
2147 struct sctp_paramhdr *ph;
2148 u_int32_t *ippp;
2149
2150 oper->m_len =
2151 sizeof(struct sctp_paramhdr) +
2152 sizeof(*ippp);
2153 ph = mtod(oper,
2154 struct sctp_paramhdr *);
2155 ph->param_type =
2156 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2157 ph->param_length =
2158 htons(oper->m_len);
2159 ippp = (u_int32_t *)(ph + 1);
2160 *ippp = htonl(0x20000004);
2161 }
2162 sctp_abort_an_association(stcb->sctp_ep,
2163 stcb, SCTP_PEER_FAULTY, oper);
2164
2165 *abort_flag = 1;
2166 sctp_pegs[SCTP_DROP_FRAG]++;
2167 return (0);
2168 }
2169 }
2170 }
2171 if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
2172 /* queue directly into socket buffer */
2173 sctp_deliver_data(stcb, asoc, chk, 0);
2174 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2175 } else {
2176 /* Special check for when streams are resetting.
2177 * We could be more smart about this and check the
2178 * actual stream to see if it is not being reset.. that
2179 * way we would not create a HOLB when amongst streams
2180 * being reset and those not being reset.
2181 *
2182 * We take complete messages that have a stream reset
2183 * intervening (aka the TSN is after where our cum-ack needs
2184 * to be) off and put them on a pending_reply_queue. The
2185 * reassembly ones we do not have to worry about since
2186 * they are all sorted and proceessed by TSN order. It
2187 * is only the singletons I must worry about.
2188 */
2189 if ((asoc->pending_reply) &&
2190 ((compare_with_wrap(tsn, ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) ||
2191 (tsn == ntohl(asoc->pending_reply->reset_at_tsn)))
2192 ) {
2193 /* yep its past where we need to reset... go ahead and
2194 * queue it.
2195 */
2196 TAILQ_INSERT_TAIL(&asoc->pending_reply_queue , chk, sctp_next);
2197 } else {
2198 sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag);
2199 }
2200 }
2201 } else {
2202 /* Into the re-assembly queue */
2203 sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag);
2204 if (*abort_flag) {
2205 sctp_pegs[SCTP_DROP_FRAG]++;
2206 return (0);
2207 }
2208 }
2209 if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
2210 /* we have a new high score */
2211 asoc->highest_tsn_inside_map = tsn;
2212#ifdef SCTP_MAP_LOGGING
2213 sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2214#endif
2215 }
2216 finish_express_del:
2217 if (last_chunk) {
2218 *m = NULL;
2219 }
2220 sctp_pegs[SCTP_PEG_TSNS_RCVD]++;
2221 /* Set it present please */
2222#ifdef SCTP_STR_LOGGING
2223 sctp_log_strm_del_alt(tsn, strmseq, SCTP_STR_LOG_FROM_MARK_TSN);
2224#endif
2225#ifdef SCTP_MAP_LOGGING
2226 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2227 asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2228#endif
2229 SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
2230 return (1);
2231}
2232
2233void
2234sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort_flag)
2235{
2236 /*
2237 * Now we also need to check the mapping array in a couple of ways.
2238 * 1) Did we move the cum-ack point?
2239 */
2240 struct sctp_association *asoc;
2241 int i, at;
2242 int m_size, all_ones;
2243 int slide_from, slide_end, lgap, distance;
2244#ifdef SCTP_MAP_LOGGING
2245 uint32_t old_cumack, old_base, old_highest;
2246 unsigned char aux_array[64];
2247#endif
2248
2249 asoc = &stcb->asoc;
2250 at = 0;
2251
2252#ifdef SCTP_MAP_LOGGING
2253 old_cumack = asoc->cumulative_tsn;
2254 old_base = asoc->mapping_array_base_tsn;
2255 old_highest = asoc->highest_tsn_inside_map;
2256 if (asoc->mapping_array_size < 64)
2257 memcpy(aux_array, asoc->mapping_array,
2258 asoc->mapping_array_size);
2259 else
2260 memcpy(aux_array, asoc->mapping_array, 64);
2261#endif
2262
2263 /*
2264 * We could probably improve this a small bit by calculating the
2265 * offset of the current cum-ack as the starting point.
2266 */
2267 all_ones = 1;
2268 m_size = stcb->asoc.mapping_array_size << 3;
2269 for (i = 0; i < m_size; i++) {
2270 if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
2271 /*
2272 * Ok we found the first place that we are
2273 * missing a TSN.
2274 */
2275 at = i;
2276 all_ones = 0;
2277 asoc->cumulative_tsn = asoc->mapping_array_base_tsn +
2278 (i - 1);
2279 break;
2280 }
2281 }
2282 if (compare_with_wrap(asoc->cumulative_tsn,
2283 asoc->highest_tsn_inside_map,
2284 MAX_TSN)) {
2285 panic("huh, cumack greater than high-tsn in map");
2286 }
2287 if (all_ones ||
2288 (asoc->cumulative_tsn == asoc->highest_tsn_inside_map && at >= 8)) {
2289 /* The complete array was completed by a single FR */
2290 /* higest becomes the cum-ack */
2291 int clr;
2292 asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
2293 /* clear the array */
2294 if (all_ones)
2295 clr = asoc->mapping_array_size;
2296 else {
2297 clr = (at >> 3) + 1;
2298 /*
2299 * this should be the allones case
2300 * but just in case :>
2301 */
2302 if (clr > asoc->mapping_array_size)
2303 clr = asoc->mapping_array_size;
2304 }
2305 memset(asoc->mapping_array, 0, clr);
2306 /* base becomes one ahead of the cum-ack */
2307 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2308#ifdef SCTP_MAP_LOGGING
2309 sctp_log_map(old_base, old_cumack, old_highest,
2310 SCTP_MAP_PREPARE_SLIDE);
2311 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2312 asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_CLEARED);
2313#endif
2314 } else if (at >= 8) {
2315 /* we can slide the mapping array down */
2316 /* Calculate the new byte postion we can move down */
2317 slide_from = at >> 3;
2318 /* now calculate the ceiling of the move using our highest TSN value */
2319 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
2320 lgap = asoc->highest_tsn_inside_map -
2321 asoc->mapping_array_base_tsn;
2322 } else {
2323 lgap = (MAX_TSN - asoc->mapping_array_base_tsn) +
2324 asoc->highest_tsn_inside_map + 1;
2325 }
2326 slide_end = lgap >> 3;
2327 if (slide_end < slide_from) {
2328 panic("impossible slide");
2329 }
2330 distance = (slide_end-slide_from) + 1;
2331#ifdef SCTP_MAP_LOGGING
2332 sctp_log_map(old_base, old_cumack, old_highest,
2333 SCTP_MAP_PREPARE_SLIDE);
2334 sctp_log_map((uint32_t)slide_from, (uint32_t)slide_end,
2335 (uint32_t)lgap, SCTP_MAP_SLIDE_FROM);
2336#endif
2337 if (distance + slide_from > asoc->mapping_array_size ||
2338 distance < 0) {
2339#ifdef SCTP_DEBUG
2340 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 2341 kprintf("Ugh bad addition.. you can't hrumpp!\n");
8d60bf8a
EN
2342 }
2343#endif
2344 /*
2345 * Here we do NOT slide forward the array so that
2346 * hopefully when more data comes in to fill it up
2347 * we will be able to slide it forward. Really
2348 * I don't think this should happen :-0
2349 */
2350
2351#ifdef SCTP_MAP_LOGGING
2352 sctp_log_map((uint32_t)distance, (uint32_t)slide_from,
2353 (uint32_t)asoc->mapping_array_size,
2354 SCTP_MAP_SLIDE_NONE);
2355#endif
2356 } else {
2357 int ii;
2358 for (ii = 0; ii < distance; ii++) {
2359 asoc->mapping_array[ii] =
2360 asoc->mapping_array[slide_from + ii];
2361 }
2362 for (ii = distance;ii <= slide_end; ii++) {
2363 asoc->mapping_array[ii] = 0;
2364 }
2365 asoc->mapping_array_base_tsn += (slide_from << 3);
2366#ifdef SCTP_MAP_LOGGING
2367 sctp_log_map(asoc->mapping_array_base_tsn,
2368 asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2369 SCTP_MAP_SLIDE_RESULT);
2370#endif
2371 }
2372 }
2373
2374 /* check the special flag for stream resets */
2375 if ((asoc->pending_reply) &&
2376 ((compare_with_wrap((asoc->cumulative_tsn+1), ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) ||
2377 ((asoc->cumulative_tsn+1) == ntohl(asoc->pending_reply->reset_at_tsn)))
2378 ) {
2379 /* we have finished working through the backlogged TSN's now
2380 * time to reset streams.
2381 * 1: call reset function.
2382 * 2: free pending_reply space
2383 * 3: distribute any chunks in pending_reply_queue.
2384 */
2385 struct sctp_tmit_chunk *chk;
2386 sctp_handle_stream_reset_response(stcb, asoc->pending_reply);
884717e1 2387 kfree(asoc->pending_reply, M_PCB);
8d60bf8a
EN
2388 asoc->pending_reply = NULL;
2389 chk = TAILQ_FIRST(&asoc->pending_reply_queue);
2390 while (chk) {
2391 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next);
2392 sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag);
2393 if (*abort_flag) {
2394 return;
2395 }
2396 chk = TAILQ_FIRST(&asoc->pending_reply_queue);
2397 }
2398 }
2399 /*
2400 * Now we need to see if we need to queue a sack or just start
2401 * the timer (if allowed).
2402 */
2403 if (ok_to_sack) {
2404 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2405 /*
2406 * Ok special case, in SHUTDOWN-SENT case.
2407 * here we maker sure SACK timer is off and
2408 * instead send a SHUTDOWN and a SACK
2409 */
2410 if (callout_pending(&stcb->asoc.dack_timer.timer)) {
2411 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2412 stcb->sctp_ep, stcb, NULL);
2413 }
2414#ifdef SCTP_DEBUG
2415 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
a6ec04bc 2416 kprintf("%s:%d sends a shutdown\n",
8d60bf8a
EN
2417 __FILE__,
2418 __LINE__
2419 );
2420 }
2421#endif
2422 sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
2423 sctp_send_sack(stcb);
2424 } else {
2425 int is_a_gap;
2426 /* is there a gap now ? */
2427 is_a_gap = compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2428 stcb->asoc.cumulative_tsn, MAX_TSN);
2429 if ((stcb->asoc.first_ack_sent == 0) || /* First time we send a sack */
2430 ((was_a_gap) && (is_a_gap == 0)) || /* was a gap, but no longer is one */
2431 (stcb->asoc.numduptsns) || /* we have dup's */
2432 (is_a_gap) || /* is still a gap */
2433 (callout_pending(&stcb->asoc.dack_timer.timer)) /* timer was up . second packet */
2434 ) {
2435 /*
2436 * Ok we must build a SACK since the timer
2437 * is pending, we got our first packet OR
2438 * there are gaps or duplicates.
2439 */
2440 stcb->asoc.first_ack_sent = 1;
2441 sctp_send_sack(stcb);
2442 /* The sending will stop the timer */
2443 } else {
2444 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2445 stcb->sctp_ep, stcb, NULL);
2446 }
2447 }
2448 }
2449}
2450
2451void
2452sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks)
2453{
2454 struct sctp_tmit_chunk *chk;
2455 int tsize, cntDel;
2456 u_int16_t nxt_todel;
2457
2458 cntDel = 0;
2459 if (asoc->fragmented_delivery_inprogress) {
2460 sctp_service_reassembly(stcb, asoc, hold_locks);
2461 }
2462 /* Can we proceed further, i.e. the PD-API is complete */
2463 if (asoc->fragmented_delivery_inprogress) {
2464 /* no */
2465 return;
2466 }
2467
2468 /*
2469 * Yes, reassembly delivery no longer in progress see if we
2470 * have some on the sb hold queue.
2471 */
2472 do {
6d49aa6f 2473 if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) {
8d60bf8a
EN
2474 if (cntDel == 0)
2475 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2476 break;
2477 }
2478 /* If deliver_data says no we must stop */
2038fb68 2479 if (sctp_deliver_data(stcb, asoc, NULL, hold_locks) == 0)
8d60bf8a
EN
2480 break;
2481 cntDel++;
2482 chk = TAILQ_FIRST(&asoc->delivery_queue);
2483 } while (chk);
2484 if (cntDel) {
2485 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2486 }
2487 /*
2488 * Now is there some other chunk I can deliver
2489 * from the reassembly queue.
2490 */
2491 chk = TAILQ_FIRST(&asoc->reasmqueue);
2492 if (chk == NULL) {
2493 asoc->size_on_reasm_queue = 0;
2494 asoc->cnt_on_reasm_queue = 0;
2495 return;
2496 }
2497 nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
2498 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
2499 ((nxt_todel == chk->rec.data.stream_seq) ||
2500 (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
2501 /*
2502 * Yep the first one is here. We setup to
2503 * start reception, by backing down the TSN
2504 * just in case we can't deliver.
2505 */
2506
2507 /*
2508 * Before we start though either all of the
2509 * message should be here or 1/4 the socket buffer
2510 * max or nothing on the delivery queue and something
2511 * can be delivered.
2512 */
2513 if (TAILQ_EMPTY(&asoc->delivery_queue) &&
2514 (sctp_is_all_msg_on_reasm(asoc, &tsize) ||
2515 (asoc->size_on_reasm_queue >=
6d49aa6f 2516 (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) && tsize))) {
8d60bf8a
EN
2517 asoc->fragmented_delivery_inprogress = 1;
2518 asoc->tsn_last_delivered = chk->rec.data.TSN_seq-1;
2519 asoc->str_of_pdapi = chk->rec.data.stream_number;
2520 asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
2521 asoc->fragment_flags = chk->rec.data.rcv_flags;
2522 sctp_service_reassembly(stcb, asoc, hold_locks);
2523 }
2524 }
2525}
2526
2527int
2528sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2529 struct sctphdr *sh, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2530 struct sctp_nets *net, u_int32_t *high_tsn)
2531{
2532 struct sctp_data_chunk *ch, chunk_buf;
2533 struct sctp_association *asoc;
2534 int num_chunks = 0; /* number of control chunks processed */
2535 int chk_length, break_flag, last_chunk;
2536 int abort_flag = 0, was_a_gap = 0;
2537 struct mbuf *m;
2538
2539 /* set the rwnd */
2540 sctp_set_rwnd(stcb, &stcb->asoc);
2541
2542 m = *mm;
2543 asoc = &stcb->asoc;
2544 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2545 stcb->asoc.cumulative_tsn, MAX_TSN)) {
2546 /* there was a gap before this data was processed */
2547 was_a_gap = 1;
2548 }
2549 /*
2550 * setup where we got the last DATA packet from for
2551 * any SACK that may need to go out. Don't bump
2552 * the net. This is done ONLY when a chunk
2553 * is assigned.
2554 */
2555 asoc->last_data_chunk_from = net;
2556
2557 /*
2558 * Now before we proceed we must figure out if this
2559 * is a wasted cluster... i.e. it is a small packet
2560 * sent in and yet the driver underneath allocated a
2561 * full cluster for it. If so we must copy it to a
2562 * smaller mbuf and free up the cluster mbuf. This
2563 * will help with cluster starvation.
2564 */
2565 if (m->m_len < (long)MHLEN && m->m_next == NULL) {
2566 /* we only handle mbufs that are singletons.. not chains */
e8371644
EN
2567#ifdef __DragonFly__
2568 if ((*mm)->m_flags & M_PKTHDR)
2569 MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2570 else
2571#endif
2572 MGET(m, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
2573 if (m) {
2574 /* ok lets see if we can copy the data up */
2575 caddr_t *from, *to;
2576
2577 if ((*mm)->m_flags & M_PKTHDR) {
2578 /* got to copy the header first */
2579#ifdef __APPLE__
2580 M_COPY_PKTHDR(m, (*mm));
2581#else
2582 M_MOVE_PKTHDR(m, (*mm));
2583#endif
2584 }
2585 /* get the pointers and copy */
2586 to = mtod(m, caddr_t *);
2587 from = mtod((*mm), caddr_t *);
2588 memcpy(to, from, (*mm)->m_len);
2589 /* copy the length and free up the old */
2590 m->m_len = (*mm)->m_len;
2591 sctp_m_freem(*mm);
2592 /* sucess, back copy */
2593 *mm = m;
2594 } else {
2595 /* We are in trouble in the mbuf world .. yikes */
2596 m = *mm;
2597 }
2598 }
2599 /* get pointer to the first chunk header */
2600 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2601 sizeof(chunk_buf), (u_int8_t *)&chunk_buf);
2602 if (ch == NULL) {
a6ec04bc 2603 kprintf(" ... its short\n");
8d60bf8a
EN
2604 return (1);
2605 }
2606 /*
2607 * process all DATA chunks...
2608 */
2609
2610#ifdef SCTP_DEBUG
2611 if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
a6ec04bc 2612 kprintf("In process data off:%d length:%d iphlen:%d ch->type:%d\n",
8d60bf8a
EN
2613 *offset, length, iphlen, (int)ch->ch.chunk_type);
2614 }
2615#endif
2616
2617 *high_tsn = asoc->cumulative_tsn;
2618 break_flag = 0;
2619 while (ch->ch.chunk_type == SCTP_DATA) {
2620 /* validate chunk length */
2621 chk_length = ntohs(ch->ch.chunk_length);
2622 if ((size_t)chk_length < sizeof(struct sctp_data_chunk) + 1 ||
2623 length - *offset < chk_length) {
2624 /*
2625 * Need to send an abort since we had a invalid
2626 * data chunk.
2627 */
2628 struct mbuf *op_err;
19267c6d 2629 MGET(op_err, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
2630 if (op_err) {
2631 struct sctp_paramhdr *ph;
2632 u_int32_t *ippp;
2633
2634 op_err->m_len = sizeof(struct sctp_paramhdr) +
2635 sizeof(*ippp);
2636 ph = mtod(op_err, struct sctp_paramhdr *);
2637 ph->param_type =
2638 htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2639 ph->param_length = htons(op_err->m_len);
2640 ippp = (u_int32_t *)(ph + 1);
2641 *ippp = htonl(0x30000001);
2642 }
2643 sctp_abort_association(inp, stcb, m, iphlen, sh,
2644 op_err);
2645 return (2);
2646 }
2647#ifdef SCTP_DEBUG
2648 if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
a6ec04bc 2649 kprintf("A chunk of len:%d to process (tot:%d)\n",
8d60bf8a
EN
2650 chk_length, length - *offset);
2651 }
2652#endif
2653
2654#ifdef SCTP_AUDITING_ENABLED
2655 sctp_audit_log(0xB1, 0);
2656#endif
2657 if (SCTP_SIZE32(chk_length) == *offset - length) {
2658 last_chunk = 1;
2659 } else {
2660 last_chunk = 0;
2661 }
2662 if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch,
2663 chk_length, net, high_tsn, &abort_flag, &break_flag,
2664 last_chunk)) {
2665 num_chunks++;
2666#ifdef SCTP_DEBUG
2667 if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
a6ec04bc 2668 kprintf("Now incr num_chunks to %d\n",
8d60bf8a
EN
2669 num_chunks);
2670 }
2671#endif
2672 }
2673 if (abort_flag)
2674 return (2);
2675
2676 if (break_flag) {
2677 /*
2678 * Set because of out of rwnd space and no drop rep
2679 * space left.
2680 */
2681 break;
2682 }
2683
2684 *offset += SCTP_SIZE32(chk_length);
2685 if (*offset >= length) {
2686 /* no more data left in the mbuf chain */
2687 break;
2688 }
2689 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2690 sizeof(chunk_buf), (u_int8_t *)&chunk_buf);
2691 if (ch == NULL) {
2692 *offset = length;
2693 break;
2694 }
2695 } /* while */
2696 if (break_flag) {
2697 /*
2698 * we need to report rwnd overrun drops.
2699 */
2700 sctp_send_packet_dropped(stcb, net, *mm, iphlen, 0);
2701 }
2702 if (num_chunks) {
2703 /*
2704 * Did we get data, if so update the time for
2705 * auto-close and give peer credit for being
2706 * alive.
2707 */
2708 sctp_pegs[SCTP_DATA_DG_RECV]++;
2709 stcb->asoc.overall_error_count = 0;
2710 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2711 }
2712 /* now service all of the reassm queue and delivery queue */
2713 sctp_service_queues(stcb, asoc, 0);
2714 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2715 /*
2716 * Assure that we ack right away by making
2717 * sure that a d-ack timer is running. So the
2718 * sack_check will send a sack.
2719 */
2720 sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb,
2721 net);
2722 }
2723 /* Start a sack timer or QUEUE a SACK for sending */
2724 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
2725 if (abort_flag)
2726 return (2);
2727
2728 return (0);
2729}
2730
2731static void
2732sctp_handle_segments(struct sctp_tcb *stcb, struct sctp_association *asoc,
2733 struct sctp_sack_chunk *ch, u_long last_tsn, u_long *biggest_tsn_acked,
2734 u_long *biggest_newly_acked_tsn, int num_seg, int *ecn_seg_sums)
2735{
2736 /************************************************/
2737 /* process fragments and update sendqueue */
2738 /************************************************/
2739 struct sctp_sack *sack;
2740 struct sctp_gap_ack_block *frag;
2741 struct sctp_tmit_chunk *tp1;
2742 int i;
2743 unsigned int j;
2744#ifdef SCTP_FR_LOGGING
2745 int num_frs=0;
2746#endif
2747 uint16_t frag_strt, frag_end, primary_flag_set;
2748 u_long last_frag_high;
2749
2750 if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
2751 primary_flag_set = 1;
2752 } else {
2753 primary_flag_set = 0;
2754 }
2755
2756 sack = &ch->sack;
2757 frag = (struct sctp_gap_ack_block *)((caddr_t)sack +
2758 sizeof(struct sctp_sack));
2759 tp1 = NULL;
2760 last_frag_high = 0;
2761 for (i = 0; i < num_seg; i++) {
2762 frag_strt = ntohs(frag->start);
2763 frag_end = ntohs(frag->end);
2764 /* some sanity checks on the fargment offsets */
2765 if (frag_strt > frag_end) {
2766 /* this one is malformed, skip */
2767 frag++;
2768 continue;
2769 }
2770 if (compare_with_wrap((frag_end+last_tsn), *biggest_tsn_acked,
2771 MAX_TSN))
2772 *biggest_tsn_acked = frag_end+last_tsn;
2773
2774 /* mark acked dgs and find out the highestTSN being acked */
2775 if (tp1 == NULL) {
2776 tp1 = TAILQ_FIRST(&asoc->sent_queue);
2777
2778 /* save the locations of the last frags */
2779 last_frag_high = frag_end + last_tsn;
2780 } else {
2781 /*
2782 * now lets see if we need to reset the queue
2783 * due to a out-of-order SACK fragment
2784 */
2785 if (compare_with_wrap(frag_strt+last_tsn,
2786 last_frag_high, MAX_TSN)) {
2787 /*
2788 * if the new frag starts after the last TSN
2789 * frag covered, we are ok
2790 * and this one is beyond the last one
2791 */
2792 ;
2793 } else {
2794 /*
2795 * ok, they have reset us, so we need to reset
2796 * the queue this will cause extra hunting but
2797 * hey, they chose the performance
2798 * hit when they failed to order there gaps..
2799 */
2800 tp1 = TAILQ_FIRST(&asoc->sent_queue);
2801 }
2802 last_frag_high = frag_end + last_tsn;
2803 }
2804 for (j = frag_strt + last_tsn; j <= frag_end + last_tsn; j++) {
2805 while (tp1) {
2806#ifdef SCTP_FR_LOGGING
2807 if (tp1->rec.data.doing_fast_retransmit)
2808 num_frs++;
2809#endif
2810
2811 if (tp1->rec.data.TSN_seq == j) {
2812 if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2813 /* must be held until cum-ack passes */
2814 /* ECN Nonce: Add the nonce value to the sender's nonce sum */
2815 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
2816 /*
2817 * If it is less than
2818 * ACKED, it is now
2819 * no-longer in flight.
2820 * Higher values may
2821 * already be set via
2822 * previous Gap Ack
2823 * Blocks...
2824 * i.e. ACKED or MARKED.
2825 */
2826 if (compare_with_wrap(tp1->rec.data.TSN_seq,
2827 *biggest_newly_acked_tsn,
2828 MAX_TSN)) {
2829 *biggest_newly_acked_tsn =
2830 tp1->rec.data.TSN_seq;
2831 }
2832 tp1->whoTo->flight_size -= tp1->book_size;
2833 if (tp1->whoTo->flight_size < 0) {
2834 tp1->whoTo->flight_size = 0;
2835 }
2836 asoc->total_flight -=
2837 tp1->book_size;
2838
2839 if (asoc->total_flight < 0) {
2840 asoc->total_flight = 0;
2841 }
2842
2843 asoc->total_flight_count--;
2844 if (asoc->total_flight_count < 0) {
2845 asoc->total_flight_count = 0;
2846 }
2847
2848 if (tp1->snd_count < 2) {
2849 /* True non-retransmited chunk */
2850 tp1->whoTo->net_ack2 +=
2851 tp1->send_size;
2852
2853 /* update RTO too? */
2854 if (tp1->do_rtt) {
2855 tp1->whoTo->RTO =
2856 sctp_calculate_rto(stcb,
2857 asoc,
2858 tp1->whoTo,
2859 &tp1->sent_rcv_time);
2860 tp1->whoTo->rto_pending = 0;
2861 tp1->do_rtt = 0;
2862 }
2863 }
2864 }
2865 if (tp1->sent <= SCTP_DATAGRAM_RESEND &&
2866 tp1->sent != SCTP_DATAGRAM_UNSENT &&
2867 compare_with_wrap(tp1->rec.data.TSN_seq,
2868 asoc->this_sack_highest_gap,
2869 MAX_TSN)) {
2870 asoc->this_sack_highest_gap =
2871 tp1->rec.data.TSN_seq;
2872 if (primary_flag_set) {
2873 tp1->whoTo->cacc_saw_newack = 1;
2874 }
2875 }
2876 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
2877#ifdef SCTP_DEBUG
2878 if (sctp_debug_on &
2879 SCTP_DEBUG_INDATA3) {
a6ec04bc 2880 kprintf("Hmm. one that is in RESEND that is now ACKED\n");
8d60bf8a
EN
2881 }
2882#endif
2883 asoc->sent_queue_retran_cnt--;
2884#ifdef SCTP_AUDITING_ENABLED
2885 sctp_audit_log(0xB2,
2886 (asoc->sent_queue_retran_cnt & 0x000000ff));
2887#endif
2888
2889 if (asoc->sent_queue_retran_cnt < 0) {
a6ec04bc 2890 kprintf("huh3 retran went negative?\n");
8d60bf8a
EN
2891#ifdef SCTP_AUDITING_ENABLED
2892 sctp_auditing(30,
2893 inp, tcb,
2894 NULL);
2895#else
2896 asoc->sent_queue_retran_cnt = 0;
2897#endif
2898 }
2899 }
2900 (*ecn_seg_sums) += tp1->rec.data.ect_nonce;
2901 (*ecn_seg_sums) &= SCTP_SACK_NONCE_SUM;
2902 tp1->sent = SCTP_DATAGRAM_MARKED;
2903 }
2904 break;
2905 } /* if (tp1->TSN_seq == j) */
2906 if (compare_with_wrap(tp1->rec.data.TSN_seq, j,
2907 MAX_TSN))
2908 break;
2909 tp1 = TAILQ_NEXT(tp1, sctp_next);
2910 }/* end while (tp1) */
2911 } /* end for (j = fragStart */
2912 frag++; /* next one */
2913 }
2914#ifdef SCTP_FR_LOGGING
2915 if (num_frs)
2916 sctp_log_fr(*biggest_tsn_acked, *biggest_newly_acked_tsn,
2917 last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
2918#endif
2919}
2920
2921static void
2922sctp_check_for_revoked(struct sctp_association *asoc, u_long cum_ack,
2923 u_long biggest_tsn_acked)
2924{
2925 struct sctp_tmit_chunk *tp1;
2926 int tot_revoked=0;
2927
2928 tp1 = TAILQ_FIRST(&asoc->sent_queue);
2929 while (tp1) {
2930 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
2931 MAX_TSN)) {
2932 /*
2933 * ok this guy is either ACK or MARKED. If it is ACKED
2934 * it has been previously acked but not this time i.e.
2935 * revoked. If it is MARKED it was ACK'ed again.
2936 */
2937 if (tp1->sent == SCTP_DATAGRAM_ACKED) {
2938 /* it has been revoked */
2939 /*
2940 * We do NOT add back to flight size here since
2941 * it is really NOT in flight. Resend (when/if
2942 * it occurs will add to flight size
2943 */
2944 tp1->sent = SCTP_DATAGRAM_SENT;
2945 tot_revoked++;
2946 } else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
2947 /* it has been re-acked in this SACK */
2948 tp1->sent = SCTP_DATAGRAM_ACKED;
2949 }
2950 }
2951 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
2952 MAX_TSN)) {
2953 /* above the sack */
2954 break;
2955 }
2956 if (tp1->sent == SCTP_DATAGRAM_UNSENT)
2957 break;
2958 tp1 = TAILQ_NEXT(tp1, sctp_next);
2959 }
2960 if (tot_revoked > 0) {
2961 /* Setup the ecn nonce re-sync point. We
2962 * do this since once data is revoked
2963 * we begin to retransmit things, which
2964 * do NOT have the ECN bits set. This means
2965 * we are now out of sync and must wait until
2966 * we get back in sync with the peer to
2967 * check ECN bits.
2968 */
2969 tp1 = TAILQ_FIRST(&asoc->send_queue);
2970 if (tp1 == NULL) {
2971 asoc->nonce_resync_tsn = asoc->sending_seq;
2972 } else {
2973 asoc->nonce_resync_tsn = tp1->rec.data.TSN_seq;
2974 }
2975 asoc->nonce_wait_for_ecne = 0;
2976 asoc->nonce_sum_check = 0;
2977 }
2978
2979}
2980
2981extern int sctp_peer_chunk_oh;
2982
2983static void
2984sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
2985 u_long biggest_tsn_acked, int strike_enabled,
2986 u_long biggest_tsn_newly_acked, int accum_moved)
2987{
2988 struct sctp_tmit_chunk *tp1;
2989 int strike_flag=0;
2990 struct timeval now;
2991 int tot_retrans=0;
2992 u_int32_t sending_seq;
2993 int primary_switch_active = 0;
2994 int double_switch_active = 0;
2995
2996 /* select the sending_seq, this is
2997 * either the next thing ready to
2998 * be sent but not transmitted, OR,
2999 * the next seq we assign.
3000 */
3001 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3002 if (tp1 == NULL) {
3003 sending_seq = asoc->sending_seq;
3004 } else {
3005 sending_seq = tp1->rec.data.TSN_seq;
3006 }
3007
3008 if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
3009 primary_switch_active = 1;
3010 }
3011 if (asoc->primary_destination->dest_state & SCTP_ADDR_DOUBLE_SWITCH) {
3012 double_switch_active = 1;
3013 }
3014 if (stcb->asoc.peer_supports_prsctp ) {
3015 SCTP_GETTIME_TIMEVAL(&now);
3016 }
3017 tp1 = TAILQ_FIRST(&asoc->sent_queue);
3018 while (tp1) {
3019 strike_flag=0;
3020 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
3021 MAX_TSN) ||
3022 tp1->sent == SCTP_DATAGRAM_UNSENT) {
3023 /* done */
3024 break;
3025 }
3026 if ((tp1->flags & (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) ==
3027 SCTP_PR_SCTP_ENABLED &&
3028 tp1->sent < SCTP_DATAGRAM_ACKED) {
3029 /* Is it expired? */
3030#ifndef __FreeBSD__
3031 if (timercmp(&now, &tp1->rec.data.timetodrop, >))
3032#else
3033 if (timevalcmp(&now, &tp1->rec.data.timetodrop, >))
3034#endif
3035 {
3036 /* Yes so drop it */
3037 if (tp1->data != NULL) {
3038 sctp_release_pr_sctp_chunk(stcb, tp1,
3039 (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3040 &asoc->sent_queue);
3041 }
3042 tp1 = TAILQ_NEXT(tp1, sctp_next);
3043 continue;
3044 }
3045 }
3046
3047 if (compare_with_wrap(tp1->rec.data.TSN_seq,
3048 asoc->this_sack_highest_gap, MAX_TSN)) {
3049 /* we are beyond the tsn in the sack */
3050 break;
3051 }
3052 if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3053 /* either a RESEND, ACKED, or MARKED */
3054 /* skip */
3055 tp1 = TAILQ_NEXT(tp1, sctp_next);
3056 continue;
3057 }
3058 if (primary_switch_active && (strike_enabled == 0)) {
3059 if (tp1->whoTo != asoc->primary_destination) {
3060 /*
3061 * We can only strike things on the primary if
3062 * the strike_enabled flag is clear
3063 */
3064 tp1 = TAILQ_NEXT(tp1, sctp_next);
3065 continue;
3066 }
3067 } else if (primary_switch_active) {
3068 if (tp1->whoTo->cacc_saw_newack == 0) {
3069 /*
3070 * Only one was received but it was NOT
3071 * this one.
3072 */
3073 tp1 = TAILQ_NEXT(tp1, sctp_next);
3074 continue;
3075 }
3076 }
3077 if (double_switch_active &&
3078 (compare_with_wrap(asoc->primary_destination->next_tsn_at_change,
3079 tp1->rec.data.TSN_seq, MAX_TSN))) {
3080 /*
3081 * With a double switch we do NOT mark unless we
3082 * are beyond the switch point.
3083 */
3084 tp1 = TAILQ_NEXT(tp1, sctp_next);
3085 continue;
3086 }
3087 /*
3088 * Here we check to see if we were have already done a FR
3089 * and if so we see if the biggest TSN we saw in the sack is
3090 * smaller than the recovery point. If so we don't strike the
3091 * tsn... otherwise we CAN strike the TSN.
3092 */
3093 if (accum_moved && asoc->fast_retran_loss_recovery) {
3094 /*
3095 * Strike the TSN if in fast-recovery and
3096 * cum-ack moved.
3097 */
3098 tp1->sent++;
3099 } else if (tp1->rec.data.doing_fast_retransmit) {
3100 /*
3101 * For those that have done a FR we must
3102 * take special consideration if we strike. I.e
3103 * the biggest_newly_acked must be higher
3104 * than the sending_seq at the time we did
3105 * the FR.
3106 */
3107#ifdef SCTP_FR_TO_ALTERNATE
3108 /*
3109 * If FR's go to new networks, then we
3110 * must only do this for singly homed asoc's. However
3111 * if the FR's go to the same network (Armando's work)
3112 * then its ok to FR multiple times.
3113 */
3114 if (asoc->numnets < 2)
3115#else
3116 if (1)
3117#endif
3118 {
3119 if ((compare_with_wrap(biggest_tsn_newly_acked,
3120 tp1->rec.data.fast_retran_tsn, MAX_TSN)) ||
3121 (biggest_tsn_newly_acked ==
3122 tp1->rec.data.fast_retran_tsn)) {
3123 /*
3124 * Strike the TSN, since this ack is
3125 * beyond where things were when we did
3126 * a FR.
3127 */
3128#ifdef SCTP_FR_LOGGING
3129 sctp_log_fr(biggest_tsn_newly_acked,
3130 tp1->rec.data.TSN_seq,
3131 tp1->rec.data.fast_retran_tsn,
3132 SCTP_FR_LOG_STRIKE_CHUNK);
3133#endif
3134 tp1->sent++;
3135 strike_flag=1;
3136 }
3137 }
3138 } else if (compare_with_wrap(tp1->rec.data.TSN_seq,
3139 biggest_tsn_newly_acked, MAX_TSN)) {
3140 /*
3141 * We don't strike these:
3142 * This is the HTNA algorithm i.e. we don't strike
3143 * If our TSN is larger than the Highest TSN Newly
3144 * Acked.
3145 */
3146 ;
3147 } else {
3148 /* Strike the TSN */
3149 tp1->sent++;
3150 }
3151 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3152 /* Increment the count to resend */
3153 struct sctp_nets *alt;
3154
3155#ifdef SCTP_FR_LOGGING
3156 sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count,
3157 0, SCTP_FR_MARKED);
3158#endif
3159 if (strike_flag) {
3160 /* This is a subsequent FR */
3161 sctp_pegs[SCTP_DUP_FR]++;
3162 }
3163 asoc->sent_queue_retran_cnt++;
3164#ifdef SCTP_FR_TO_ALTERNATE
3165 /* Can we find an alternate? */
3166 alt = sctp_find_alternate_net(stcb, tp1->whoTo);
3167#else
3168 /*
3169 * default behavior is to NOT retransmit FR's
3170 * to an alternate. Armando Caro's paper details
3171 * why.
3172 */
3173 alt = tp1->whoTo;
3174#endif
3175 tp1->rec.data.doing_fast_retransmit = 1;
3176 tot_retrans++;
3177 /* mark the sending seq for possible subsequent FR's */
3178 if (TAILQ_EMPTY(&asoc->send_queue)) {
3179 /*
3180 * If the queue of send is empty then its the
3181 * next sequence number that will be assigned so
3182 * we subtract one from this to get the one we
3183 * last sent.
3184 */
3185 tp1->rec.data.fast_retran_tsn = sending_seq - 1;
3186 } else {
3187 /*
3188 * If there are chunks on the send queue
3189 * (unsent data that has made it from the
3190 * stream queues but not out the door, we take
3191 * the first one (which will have the lowest
3192 * TSN) and subtract one to get the one we last
3193 * sent.
3194 */
3195 struct sctp_tmit_chunk *ttt;
3196 ttt = TAILQ_FIRST(&asoc->send_queue);
3197 tp1->rec.data.fast_retran_tsn =
3198 ttt->rec.data.TSN_seq - 1;
3199 }
3200 if (tp1->do_rtt) {
3201 /*
3202 * this guy had a RTO calculation pending on it,
3203 * cancel it
3204 */
3205 tp1->whoTo->rto_pending = 0;
3206 tp1->do_rtt = 0;
3207 }
3208 /* fix counts and things */
3209
3210 tp1->whoTo->net_ack++;
3211 tp1->whoTo->flight_size -= tp1->book_size;
3212 if (tp1->whoTo->flight_size < 0) {
3213 tp1->whoTo->flight_size = 0;
3214 }
3215#ifdef SCTP_LOG_RWND
3216 sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3217 asoc->peers_rwnd , tp1->send_size, sctp_peer_chunk_oh);
3218#endif
3219 /* add back to the rwnd */
3220 asoc->peers_rwnd += (tp1->send_size + sctp_peer_chunk_oh);
3221
3222 /* remove from the total flight */
3223 asoc->total_flight -= tp1->book_size;
3224 if (asoc->total_flight < 0) {
3225 asoc->total_flight = 0;
3226 }
3227 asoc->total_flight_count--;
3228 if (asoc->total_flight_count < 0) {
3229 asoc->total_flight_count = 0;
3230 }
3231 if (alt != tp1->whoTo) {
3232 /* yes, there is an alternate. */
3233 sctp_free_remote_addr(tp1->whoTo);
3234 tp1->whoTo = alt;
3235 alt->ref_count++;
3236 }
3237 }
3238 tp1 = TAILQ_NEXT(tp1, sctp_next);
3239 } /* while (tp1) */
3240
3241 if (tot_retrans > 0) {
3242 /* Setup the ecn nonce re-sync point. We
3243 * do this since once we go to FR something
3244 * we introduce a Karn's rule scenario and
3245 * won't know the totals for the ECN bits.
3246 */
3247 asoc->nonce_resync_tsn = sending_seq;
3248 asoc->nonce_wait_for_ecne = 0;
3249 asoc->nonce_sum_check = 0;
3250 }
3251
3252}
3253
3254struct sctp_tmit_chunk *
3255sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3256 struct sctp_association *asoc)
3257{
3258 struct sctp_tmit_chunk *tp1, *tp2, *a_adv=NULL;
3259 struct timeval now;
3260 int now_filled=0;
3261
3262 if (asoc->peer_supports_prsctp == 0) {
3263 return (NULL);
3264 }
3265 tp1 = TAILQ_FIRST(&asoc->sent_queue);
3266 while (tp1) {
3267 if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3268 tp1->sent != SCTP_DATAGRAM_RESEND) {
3269 /* no chance to advance, out of here */
3270 break;
3271 }
3272 if ((tp1->flags & SCTP_PR_SCTP_ENABLED) == 0) {
3273 /*
3274 * We can't fwd-tsn past any that are reliable
3275 * aka retransmitted until the asoc fails.
3276 */
3277 break;
3278 }
3279 if (!now_filled) {
3280 SCTP_GETTIME_TIMEVAL(&now);
3281 now_filled = 1;
3282 }
3283 tp2 = TAILQ_NEXT(tp1, sctp_next);
3284 /*
3285 * now we got a chunk which is marked for another
3286 * retransmission to a PR-stream but has run
3287 * out its chances already maybe OR has been
3288 * marked to skip now. Can we skip it if its a
3289 * resend?
3290 */
3291 if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3292 (tp1->flags & SCTP_PR_SCTP_BUFFER) == 0) {
3293 /*
3294 * Now is this one marked for resend and its time
3295 * is now up?
3296 */
3297#ifndef __FreeBSD__
3298 if (timercmp(&now, &tp1->rec.data.timetodrop, >))
3299#else
3300 if (timevalcmp(&now, &tp1->rec.data.timetodrop, >))
3301#endif
3302 {
3303 /* Yes so drop it */
3304 if (tp1->data) {
3305 sctp_release_pr_sctp_chunk(stcb, tp1,
3306 (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3307 &asoc->sent_queue);
3308 }
3309 } else {
3310 /*
3311 * No, we are done when hit one for resend whos
3312 * time as not expired.
3313 */
3314 break;
3315 }
3316 }
3317 /*
3318 * Ok now if this chunk is marked to drop it
3319 * we can clean up the chunk, advance our peer ack point
3320 * and we can check the next chunk.
3321 */
3322 if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3323 /* advance PeerAckPoint goes forward */
3324 asoc->advanced_peer_ack_point = tp1->rec.data.TSN_seq;
3325 a_adv = tp1;
3326 /*
3327 * we don't want to de-queue it here. Just wait for the
3328 * next peer SACK to come with a new cumTSN and then
3329 * the chunk will be droped in the normal fashion.
3330 */
3331 if (tp1->data) {
3332 sctp_free_bufspace(stcb, asoc, tp1);
3333#ifdef SCTP_DEBUG
3334 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
a6ec04bc 3335 kprintf("--total out:%lu total_mbuf_out:%lu\n",
8d60bf8a
EN
3336 (u_long)asoc->total_output_queue_size,
3337 (u_long)asoc->total_output_mbuf_queue_size);
3338 }
3339#endif
3340 /*
3341 * Maybe there should be another notification
3342 * type
3343 */
3344 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3345 (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3346 tp1);
3347 sctp_m_freem(tp1->data);
3348 tp1->data = NULL;
3349 sctp_sowwakeup(stcb->sctp_ep,
3350 stcb->sctp_socket);
3351 }
3352 } else {
3353 /* If it is still in RESEND we can advance no further */
3354 break;
3355 }
3356 /*
3357 * If we hit here we just dumped tp1, move to next
3358 * tsn on sent queue.
3359 */
3360 tp1 = tp2;
3361 }
3362 return (a_adv);
3363}
3364
3365#ifdef SCTP_HIGH_SPEED
3366struct sctp_hs_raise_drop {
3367 int32_t cwnd;
3368 int32_t increase;
3369 int32_t drop_percent;
3370};
3371
3372#define SCTP_HS_TABLE_SIZE 73
3373
3374struct sctp_hs_raise_drop sctp_cwnd_adjust[SCTP_HS_TABLE_SIZE] = {
3375 {38,1,50}, /* 0 */
3376 {118,2,44}, /* 1 */
3377 {221,3,41}, /* 2 */
3378 {347,4,38}, /* 3 */
3379 {495,5,37}, /* 4 */
3380 {663,6,35}, /* 5 */
3381 {851,7,34}, /* 6 */
3382 {1058,8,33}, /* 7 */
3383 {1284,9,32}, /* 8 */
3384 {1529,10,31}, /* 9 */
3385 {1793,11,30}, /* 10 */
3386 {2076,12,29}, /* 11 */
3387 {2378,13,28}, /* 12 */
3388 {2699,14,28}, /* 13 */
3389 {3039,15,27}, /* 14 */
3390 {3399,16,27}, /* 15 */
3391 {3778,17,26}, /* 16 */
3392 {4177,18,26}, /* 17 */
3393 {4596,19,25}, /* 18 */
3394 {5036,20,25}, /* 19 */
3395 {5497,21,24}, /* 20 */
3396 {5979,22,24}, /* 21 */
3397 {6483,23,23}, /* 22 */
3398 {7009,24,23}, /* 23 */
3399 {7558,25,22}, /* 24 */
3400 {8130,26,22}, /* 25 */
3401 {8726,27,22}, /* 26 */
3402 {9346,28,21}, /* 27 */
3403 {9991,29,21}, /* 28 */
3404 {10661,30,21}, /* 29 */
3405 {11358,31,20}, /* 30 */
3406 {12082,32,20}, /* 31 */
3407 {12834,33,20}, /* 32 */
3408 {13614,34,19}, /* 33 */
3409 {14424,35,19}, /* 34 */
3410 {15265,36,19}, /* 35 */
3411 {16137,37,19}, /* 36 */
3412 {17042,38,18}, /* 37 */
3413 {17981,39,18}, /* 38 */
3414 {18955,40,18}, /* 39 */
3415 {19965,41,17}, /* 40 */
3416 {21013,42,17}, /* 41 */
3417 {22101,43,17}, /* 42 */
3418 {23230,44,17}, /* 43 */
3419 {24402,45,16}, /* 44 */
3420 {25618,46,16}, /* 45 */
3421 {26881,47,16}, /* 46 */
3422 {28193,48,16}, /* 47 */
3423 {29557,49,15}, /* 48 */
3424 {30975,50,15}, /* 49 */
3425 {32450,51,15}, /* 50 */
3426 {33986,52,15}, /* 51 */
3427 {35586,53,14}, /* 52 */
3428 {37253,54,14}, /* 53 */
3429 {38992,55,14}, /* 54 */
3430 {40808,56,14}, /* 55 */
3431 {42707,57,13}, /* 56 */
3432 {44694,58,13}, /* 57 */
3433 {46776,59,13}, /* 58 */
3434 {48961,60,13}, /* 59 */
3435 {51258,61,13}, /* 60 */
3436 {53677,62,12}, /* 61 */
3437 {56230,63,12}, /* 62 */
3438 {58932,64,12}, /* 63 */
3439 {61799,65,12}, /* 64 */
3440 {64851,66,11}, /* 65 */
3441 {68113,67,11}, /* 66 */
3442 {71617,68,11}, /* 67 */
3443 {75401,69,10}, /* 68 */
3444 {79517,70,10}, /* 69 */
3445 {84035,71,10}, /* 70 */
3446 {89053,72,10}, /* 71 */
3447 {94717,73,9} /* 72 */
3448};
3449
3450static void
3451sctp_hs_cwnd_increase(struct sctp_nets *net)
3452{
3453 int cur_val, i, indx, incr;
3454
3455 cur_val = net->cwnd >> 10;
3456 indx = SCTP_HS_TABLE_SIZE - 1;
3457
3458 if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3459 /* normal mode */
3460 if (net->net_ack > net->mtu) {
3461 net->cwnd += net->mtu;
3462#ifdef SCTP_CWND_LOGGING
3463 sctp_log_cwnd(net, net->mtu, SCTP_CWND_LOG_FROM_SS);
3464#endif
3465 } else {
3466 net->cwnd += net->net_ack;
3467#ifdef SCTP_CWND_LOGGING
3468 sctp_log_cwnd(net, net->net_ack, SCTP_CWND_LOG_FROM_SS);
3469#endif
3470 }
3471 } else {
3472 for (i=net->last_hs_used; i<SCTP_HS_TABLE_SIZE; i++) {
3473 if (cur_val < sctp_cwnd_adjust[i].cwnd) {
3474 indx = i;
3475 break;
3476 }
3477 }
3478 net->last_hs_used = indx;
3479 incr = ((sctp_cwnd_adjust[indx].increase) << 10);
3480 net->cwnd += incr;
3481#ifdef SCTP_CWND_LOGGING
3482 sctp_log_cwnd(net, incr, SCTP_CWND_LOG_FROM_SS);
3483#endif
3484 }
3485}
3486
3487static void
3488sctp_hs_cwnd_decrease(struct sctp_nets *net)
3489{
3490 int cur_val, i, indx;
3491#ifdef SCTP_CWND_LOGGING
3492 int old_cwnd = net->cwnd;
3493#endif
3494
3495 cur_val = net->cwnd >> 10;
3496 indx = net->last_hs_used;
3497 if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3498 /* normal mode */
3499 net->ssthresh = net->cwnd / 2;
3500 if (net->ssthresh < (net->mtu*2)) {
3501 net->ssthresh = 2 * net->mtu;
3502 }
3503 net->cwnd = net->ssthresh;
3504#ifdef SCTP_CWND_LOGGING
3505 sctp_log_cwnd(net, (net->cwnd-old_cwnd), SCTP_CWND_LOG_FROM_FR);
3506#endif
3507 } else {
3508 /* drop by the proper amount */
3509 net->ssthresh = net->cwnd - (int)((net->cwnd / 100) *
3510 sctp_cwnd_adjust[net->last_hs_used].drop_percent);
3511 net->cwnd = net->ssthresh;
3512 /* now where are we */
3513 indx = net->last_hs_used;
3514 cur_val = net->cwnd >> 10;
3515 /* reset where we are in the table */
3516 if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3517 /* feel out of hs */
3518 net->last_hs_used = 0;
3519 } else {
3520 for (i = indx; i >= 1; i--) {
3521 if (cur_val > sctp_cwnd_adjust[i - 1].cwnd) {
3522 break;
3523 }
3524 }
3525 net->last_hs_used = indx;
3526 }
3527 }
3528}
3529#endif
3530
3531void
3532sctp_handle_sack(struct sctp_sack_chunk *ch, struct sctp_tcb *stcb,
3533 struct sctp_nets *net_from, int *abort_now)
3534{
3535 struct sctp_association *asoc;
3536 struct sctp_sack *sack;
3537 struct sctp_tmit_chunk *tp1, *tp2;
3538 u_long cum_ack, last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked;
3539 uint16_t num_seg;
3540 unsigned int sack_length;
3541 uint32_t send_s;
3542 int some_on_streamwheel;
8d60bf8a
EN
3543 int strike_enabled = 0, cnt_of_cacc = 0;
3544 int accum_moved = 0;
3545 int marking_allowed = 1;
3546 int will_exit_fast_recovery=0;
3547 u_int32_t a_rwnd;
3548 struct sctp_nets *net = NULL;
3549 int nonce_sum_flag, ecn_seg_sums=0;
3550 asoc = &stcb->asoc;
3551
3552 /*
3553 * Handle the incoming sack on data I have been sending.
3554 */
3555
3556 /*
3557 * we take any chance we can to service our queues since we
3558 * cannot get awoken when the socket is read from :<
3559 */
3560 asoc->overall_error_count = 0;
3561
3562 if (asoc->sent_queue_retran_cnt) {
3563#ifdef SCTP_DEBUG
3564 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 3565 kprintf("Handling SACK for asoc:%p retran:%d\n",
8d60bf8a
EN
3566 asoc, asoc->sent_queue_retran_cnt);
3567 }
3568#endif
3569 }
3570
3571 sctp_service_queues(stcb, asoc, 0);
3572
3573 /*
3574 * Now perform the actual SACK handling:
3575 * 1) Verify that it is not an old sack, if so discard.
3576 * 2) If there is nothing left in the send queue (cum-ack is equal
3577 * to last acked) then you have a duplicate too, update any rwnd
3578 * change and verify no timers are running. then return.
3579 * 3) Process any new consequtive data i.e. cum-ack moved
3580 * process these first and note that it moved.
3581 * 4) Process any sack blocks.
3582 * 5) Drop any acked from the queue.
3583 * 6) Check for any revoked blocks and mark.
3584 * 7) Update the cwnd.
3585 * 8) Nothing left, sync up flightsizes and things, stop all timers
3586 * and also check for shutdown_pending state. If so then go ahead
3587 * and send off the shutdown. If in shutdown recv, send off the
3588 * shutdown-ack and start that timer, Ret.
3589 * 9) Strike any non-acked things and do FR procedure if needed being
3590 * sure to set the FR flag.
3591 * 10) Do pr-sctp procedures.
3592 * 11) Apply any FR penalties.
3593 * 12) Assure we will SACK if in shutdown_recv state.
3594 */
3595
8d60bf8a
EN
3596 sack_length = ntohs(ch->ch.chunk_length);
3597 if (sack_length < sizeof(struct sctp_sack_chunk)) {
3598#ifdef SCTP_DEBUG
3599 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 3600 kprintf("Bad size on sack chunk .. to small\n");
8d60bf8a
EN
3601 }
3602#endif
3603 return;
3604 }
3605 /* ECN Nonce */
3606 nonce_sum_flag = ch->ch.chunk_flags & SCTP_SACK_NONCE_SUM;
3607 sack = &ch->sack;
3608 cum_ack = last_tsn = ntohl(sack->cum_tsn_ack);
3609 num_seg = ntohs(sack->num_gap_ack_blks);
3610
3611 /* reality check */
3612 if (TAILQ_EMPTY(&asoc->send_queue)) {
3613 send_s = asoc->sending_seq;
3614 } else {
3615 tp1 = TAILQ_FIRST(&asoc->send_queue);
3616 send_s = tp1->rec.data.TSN_seq;
3617 }
3618
3619 if (sctp_strict_sacks) {
3620 if (cum_ack == send_s ||
3621 compare_with_wrap(cum_ack, send_s, MAX_TSN)) {
3622 struct mbuf *oper;
3623 /*
3624 * no way, we have not even sent this TSN out yet.
3625 * Peer is hopelessly messed up with us.
3626 */
3627 hopeless_peer:
3628 *abort_now = 1;
3629 /* XXX */
19267c6d 3630 MGET(oper, MB_DONTWAIT, MT_DATA);
8d60bf8a
EN
3631 if (oper) {
3632 struct sctp_paramhdr *ph;
3633 u_int32_t *ippp;
3634
3635 oper->m_len = sizeof(struct sctp_paramhdr) +
3636 sizeof(*ippp);
3637 ph = mtod(oper, struct sctp_paramhdr *);
3638 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
3639 ph->param_length = htons(oper->m_len);
3640 ippp = (u_int32_t *)(ph + 1);
3641 *ippp = htonl(0x30000002);
3642 }
3643 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper);
3644 return;
3645 }
3646 }
3647 /* update the Rwnd of the peer */
3648 a_rwnd = (u_int32_t)ntohl(sack->a_rwnd);
3649 if (asoc->sent_queue_retran_cnt) {
3650#ifdef SCTP_DEBUG
3651 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 3652 kprintf("cum_ack:%lx num_seg:%u last_acked_seq:%x\n",
8d60bf8a
EN
3653 cum_ack, (u_int)num_seg, asoc->last_acked_seq);
3654 }
3655#endif
3656 }
3657 if (compare_with_wrap(asoc->t3timeout_highest_marked, cum_ack, MAX_TSN)) {
3658 /* we are not allowed to mark for FR */
3659 marking_allowed = 0;
3660 }
3661 /**********************/
3662 /* 1) check the range */
3663 /**********************/
3664 if (compare_with_wrap(asoc->last_acked_seq, last_tsn, MAX_TSN)) {
3665 /* acking something behind */
3666 if (asoc->sent_queue_retran_cnt) {
3667#ifdef SCTP_DEBUG
3668 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 3669 kprintf("The cum-ack is behind us\n");
8d60bf8a
EN
3670 }
3671#endif
3672 }
3673 return;
3674 }
3675
3676 if (TAILQ_EMPTY(&asoc->sent_queue)) {
3677 /* nothing left on sendqueue.. consider done */
3678#ifdef SCTP_LOG_RWND
3679 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
3680 asoc->peers_rwnd, 0, 0, a_rwnd);
3681#endif
3682 asoc->peers_rwnd = a_rwnd;
3683 if (asoc->sent_queue_retran_cnt) {
3684#ifdef SCTP_DEBUG
3685 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
a6ec04bc 3686 kprintf("Huh? retran set but none on queue\n");
8d60bf8a
EN
3687 }
3688#endif
3689 asoc->sent_queue_retran_cnt = 0;
3690 }
3691 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3692 /* SWS sender side engages */
3693 asoc->peers_rwnd = 0;
3694 }
3695 /* stop any timers */
3696 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3697 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3698 stcb, net);
3699 net->partial_bytes_acked = 0;
3700 net->flight_size = 0;
3701 }
3702 asoc->total_flight = 0;
3703 asoc->total_flight_count = 0;
3704 return;
3705 }
3706 /*
3707 * We init netAckSz and netAckSz2 to 0. These are used to track 2
3708 * things. The total byte count acked is tracked in netAckSz AND
3709 * netAck2 is used to track the total bytes acked that are un-
3710 * amibguious and were never retransmitted. We track these on a
3711 * per destination address basis.
3712 */
3713 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3714 net->prev_cwnd = net->cwnd;
3715 net->net_ack = 0;
3716 net->net_ack2 = 0;
3717 }
3718 /* process the new consecutive TSN first */
3719 tp1 = TAILQ_FIRST(&asoc->sent_queue);
3720 while (tp1) {
3721 if (compare_with_wrap(last_tsn, tp1->rec.data.TSN_seq,
3722 MAX_TSN) ||
3723 last_tsn == tp1->rec.data.TSN_seq) {
3724 if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
3725 /* ECN Nonce: Add the nonce to the sender's nonce sum */
3726 asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce;
3727 accum_moved = 1;
3728 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
3729 /*
3730 * If it is less than ACKED, it is now
3731 * no-longer in flight. Higher values
3732 * may occur during marking
3733 */
3734 if ((tp1->whoTo->dest_state &
3735 SCTP_ADDR_UNCONFIRMED) &&
3736 (tp1->snd_count < 2) ) {
3737 /*
3738 * If there was no retran and
3739 * the address is un-confirmed
3740 * and we sent there and are
3741 * now sacked.. its confirmed,
3742 * mark it so.
3743 */
3744 tp1->whoTo->dest_state &=
3745 ~SCTP_ADDR_UNCONFIRMED;
3746 }
3747 tp1->whoTo->flight_size -=
3748 tp1->book_size;
3749 if (tp1->whoTo->flight_size < 0) {
3750 tp1->whoTo->flight_size = 0;
3751 }
3752 asoc->total_flight -= tp1->book_size;
3753 if (asoc->total_flight < 0) {
3754 asoc->total_flight = 0;
3755 }
3756 asoc->total_flight_count--;
3757 if (asoc->total_flight_count < 0) {
3758 asoc->total_flight_count = 0;
3759 }
3760 tp1->whoTo->net_ack += tp1->send_size;
3761 if (tp1->snd_count < 2) {
3762 /* True non-retransmited chunk */
3763 tp1->whoTo->net_ack2 +=
3764 tp1->send_size;
3765 /* update RTO too? */
3766 if (tp1->do_rtt) {
3767 tp1->whoTo->RTO =
3768 sctp_calculate_rto(stcb,
3769 asoc, tp1->whoTo,
3770 &tp1->sent_rcv_time);
3771 tp1->whoTo->rto_pending = 0;
3772 tp1->do_rtt = 0;
3773 }
3774 }
3775 }
3776 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3777#ifdef SCTP_DEBUG
3778 if (sctp_debug_on & SCTP_DEBUG_INDATA3) {
a6ec04bc 3779 kprintf("Hmm. one that is in RESEND that is now ACKED\n");
8d60bf8a
EN
3780 }
3781#endif
3782 asoc->sent_queue_retran_cnt--;
3783#ifdef SCTP_AUDITING_ENABLED
3784 sctp_audit_log(0xB3,
3785 (asoc->sent_queue_retran_cnt & 0x000000ff));
3786#endif
3787 if (asoc->sent_queue_retran_cnt < 0) {
a6ec04bc 3788 kprintf("huh4 retran went negative?\n");
8d60bf8a
EN
3789#ifdef SCTP_AUDITING_ENABLED
3790 sctp_auditing(31, inp, tcb,
3791 NULL);
3792#else
3793 asoc->sent_queue_retran_cnt = 0;
3794#endif
3795 }
3796
3797 }
3798 tp1->sent = SCTP_DATAGRAM_ACKED;
3799 }
3800 } else {
3801 break;
3802 }
3803 tp1 = TAILQ_NEXT(tp1, sctp_next);
3804 }
3805 /*******************************************/
3806 /* cancel ALL T3-send timer if accum moved */
3807 /*******************************************/
3808 if (accum_moved) {
3809 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3810 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3811 stcb, net);
3812 }
3813 }
3814 biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
3815 /* always set this up to cum-ack */
3816 asoc->this_sack_highest_gap = last_tsn;
3817
97bdff46 3818 if (((num_seg * sizeof(struct sctp_gap_ack_block)) + sizeof(struct sctp_sack_chunk)) > sack_length) {
8d60bf8a
EN
3819 /* skip corrupt segments */
3820 strike_enabled = 0;
3821 goto skip_segments;
3822 }
3823
3824 if (num_seg > 0) {
3825 if (asoc->primary_destination->dest_state &
3826 SCTP_ADDR_SWITCH_PRIMARY) {
3827 /* clear the nets CACC flags */
3828 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3829 net->cacc_saw_newack = 0;
3830 }
3831 }
3832 /*
3833 * thisSackHighestGap will increase while handling NEW segments
3834 */
3835
3836 sctp_handle_segments(stcb, asoc, ch, last_tsn,
3837 &biggest_tsn_acked, &biggest_tsn_newly_acked,
3838 num_seg, &ecn_seg_sums);
3839
3840 if (sctp_strict_sacks) {
3841 /* validate the biggest_tsn_acked in the gap acks
3842 * if strict adherence is wanted.
3843 */
3844 if ((biggest_tsn_acked == send_s) ||
3845 (compare_with_wrap(biggest_tsn_acked, send_s, MAX_TSN))) {
3846 /*
3847 * peer is either confused or we are under
3848 * attack. We must abort.
3849 */
3850 goto hopeless_peer;
3851 }
3852 }
3853
3854 if (asoc->primary_destination->dest_state &
3855 SCTP_ADDR_SWITCH_PRIMARY) {
3856 /* clear the nets CACC flags */
3857 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3858 if (net->cacc_saw_newack) {
3859 cnt_of_cacc++;
3860 }
3861 }
3862 }
3863
3864 }
3865
3866 if (cnt_of_cacc < 2) {
3867 strike_enabled = 1;
3868 } else {
3869 strike_enabled = 0;
3870 }
3871 skip_segments:
3872 /********************************************/
3873 /* drop the acked chunks from the sendqueue */
3874 /********************************************/
3875 asoc->last_acked_seq = cum_ack;
3876 if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
3877 if ((cum_ack == asoc->primary_destination->next_tsn_at_change) ||
3878 (compare_with_wrap(cum_ack,
3879 asoc->primary_destination->next_tsn_at_change, MAX_TSN))) {
3880 struct sctp_nets *lnet;
3881 /* Turn off the switch flag for ALL addresses */
3882 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3883 asoc->primary_destination->dest_state &=
3884 ~(SCTP_ADDR_SWITCH_PRIMARY|SCTP_ADDR_DOUBLE_SWITCH);
3885 }
3886 }
3887 }
3888 /* Drag along the t3 timeout point so we don't have a problem at wrap */
3889 if (marking_allowed) {
3890 asoc->t3timeout_highest_marked = cum_ack;
3891 }
3892 tp1 = TAILQ_FIRST(&asoc->sent_queue);
3893 do {
3894 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
3895 MAX_TSN)) {
3896 break;
3897 }
3898 if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
3899 /* no more sent on list */
3900 break;
3901 }
3902 tp2 = TAILQ_NEXT(tp1, sctp_next);
3903 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
3904 if (tp1->data) {
3905 sctp_free_bufspace(stcb, asoc, tp1);
3906#ifdef SCTP_DEBUG
3907 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
a6ec04bc 3908 kprintf("--total out:%lu total_mbuf_out:%lu\n",
8d60bf8a
EN
3909 (u_long)asoc->total_output_queue_size,
3910 (u_long)asoc->total_output_mbuf_queue_size);
3911 }
3912#endif
3913
3914 sctp_m_freem(tp1->data);
3915 if (tp1->flags & SCTP_PR_SCTP_BUFFER) {
3916 asoc->sent_queue_cnt_removeable--;
3917 }
3918
3919 }
3920 tp1->data = NULL;
3921 asoc->sent_queue_cnt--;
3922 sctp_free_remote_addr(tp1->whoTo);
3923 sctppcbinfo.ipi_count_chunk--;
3924 asoc->chunks_on_out_queue--;
3925
3926 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3927 panic("Chunk count is going negative");
3928 }
3929 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, tp1);
3930 sctppcbinfo.ipi_gencnt_chunk++;
3931 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
3932 tp1 = tp2;
3933 } while (tp1 != NULL);
3934
3935
3936 if (asoc->fast_retran_loss_recovery && accum_moved) {
3937 if (compare_with_wrap(asoc->last_acked_seq,
3938 asoc->fast_recovery_tsn, MAX_TSN) ||
3939 asoc->last_acked_seq == asoc->fast_recovery_tsn) {
3940 /* Setup so we will exit RFC2582 fast recovery */
3941 will_exit_fast_recovery = 1;
3942 }
3943 }
3944
3945 /* Check for revoked fragments if we hand
3946 * fragments in a previous segment. If we
3947 * had no previous fragments we cannot have
3948 * a revoke issue.
3949 */
3950 if (asoc->saw_sack_with_frags)
3951 sctp_check_for_revoked(asoc, cum_ack, biggest_tsn_acked);
3952
3953 if (num_seg)
3954 asoc->saw_sack_with_frags = 1;
3955 else
3956 asoc->saw_sack_with_frags = 0;
3957
3958 /******************************/
3959 /* update cwnd */
3960 /******************************/
3961 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3962 /* if nothing was acked on this destination skip it */
3963 if (net->net_ack == 0)
3964 continue;
3965
3966 if (net->net_ack2 > 0) {
3967 /*
3968 * Karn's rule applies to clearing error count,
3969 * this is optional.
3970 */
3971 net->error_count = 0;
3972 if ((net->dest_state&SCTP_ADDR_NOT_REACHABLE) ==
3973 SCTP_ADDR_NOT_REACHABLE) {
3974 /* addr came good */
3975 net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
3976 net->dest_state |= SCTP_ADDR_REACHABLE;
3977 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
3978 SCTP_RECEIVED_SACK, (void *)net);
3979 /* now was it the primary? if so restore */
3980 if (net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
2038fb68 3981 sctp_set_primary_addr(stcb, NULL, net);
8d60bf8a
EN
3982 }
3983 }
3984 }
3985
3986 if (asoc->fast_retran_loss_recovery &&
3987 will_exit_fast_recovery == 0) {
3988 /* If we are in loss recovery we skip any cwnd update */
3989 sctp_pegs[SCTP_CWND_SKIP]++;
3990 goto skip_cwnd_update;
3991 }
3992 if (accum_moved) {
3993 /* If the cumulative ack moved we can proceed */
3994 if (net->cwnd <= net->ssthresh) {
3995 /* We are in slow start */