kernel/netinet: Remove some unused variables.
[dragonfly.git] / sys / netinet / sctp_indata.c
1 /*      $KAME: sctp_indata.c,v 1.35 2004/08/17 04:06:17 itojun Exp $    */
2
3 /*
4  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31
32 #if !(defined(__OpenBSD__) || defined(__APPLE__))
33 #include "opt_ipsec.h"
34 #endif
35 #if defined(__FreeBSD__) || defined(__DragonFly__)
36 #include "opt_inet6.h"
37 #include "opt_inet.h"
38 #endif
39 #if defined(__NetBSD__)
40 #include "opt_inet.h"
41 #endif
42
43 #ifdef __APPLE__
44 #include <sctp.h>
45 #elif !defined(__OpenBSD__)
46 #include "opt_sctp.h"
47 #endif
48
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/mbuf.h>
52 #include <sys/malloc.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 #include <sys/sysctl.h>
56
57 #include <net/if.h>
58 #include <net/route.h>
59
60
61 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
62 #include <sys/limits.h>
63 #else
64 #include <machine/limits.h>
65 #endif
66 #include <machine/cpu.h>
67
68 #include <netinet/in.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #ifdef INET6
72 #include <netinet/ip6.h>
73 #endif /* INET6 */
74 #include <netinet/in_pcb.h>
75 #include <netinet/in_var.h>
76 #include <netinet/ip_var.h>
77 #ifdef INET6
78 #include <netinet6/ip6_var.h>
79 #endif /* INET6 */
80 #include <netinet/ip_icmp.h>
81 #include <netinet/icmp_var.h>
82 #include <netinet/sctp_var.h>
83 #include <netinet/sctp_pcb.h>
84 #include <netinet/sctp_header.h>
85 #include <netinet/sctputil.h>
86 #include <netinet/sctp_output.h>
87 #include <netinet/sctp_input.h>
88 #include <netinet/sctp_hashdriver.h>
89 #include <netinet/sctp_indata.h>
90 #include <netinet/sctp_uio.h>
91 #include <netinet/sctp_timer.h>
92 #ifdef IPSEC
93 #ifndef __OpenBSD__
94 #include <netinet6/ipsec.h>
95 #include <netproto/key/key.h>
96 #else
97 #undef IPSEC
98 #endif
99 #endif /*IPSEC*/
100
101 #include <net/net_osdep.h>
102
103 #ifdef SCTP_DEBUG
104 extern u_int32_t sctp_debug_on;
105 #endif
106
107 /*
108  * NOTES: On the outbound side of things I need to check the sack timer to
109  * see if I should generate a sack into the chunk queue (if I have data to
110  * send that is and will be sending it .. for bundling.
111  *
112  * The callback in sctp_usrreq.c will get called when the socket is read
113  * from. This will cause sctp_service_queues() to get called on the top
114  * entry in the list.
115  */
116
117 extern int sctp_strict_sacks;
118
119 void
120 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
121 {
122         u_int32_t calc, calc_w_oh;
123
124 #ifdef SCTP_DEBUG
125         if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
126                 kprintf("cc:%lu hiwat:%lu lowat:%lu mbcnt:%lu mbmax:%lu\n",
127                        (u_long)stcb->sctp_socket->so_rcv.ssb_cc,
128                        (u_long)stcb->sctp_socket->so_rcv.ssb_hiwat,
129                        (u_long)stcb->sctp_socket->so_rcv.ssb_lowat,
130                        (u_long)stcb->sctp_socket->so_rcv.ssb_mbcnt,
131                        (u_long)stcb->sctp_socket->so_rcv.ssb_mbmax);
132                 kprintf("Setting rwnd to: sb:%ld - (del:%d + reasm:%d str:%d)\n",
133                        sctp_sbspace(&stcb->sctp_socket->so_rcv),
134                        asoc->size_on_delivery_queue,
135                        asoc->size_on_reasm_queue,
136                        asoc->size_on_all_streams);
137         }
138 #endif
139         if (stcb->sctp_socket->so_rcv.ssb_cc == 0 &&
140             asoc->size_on_delivery_queue == 0 &&
141             asoc->size_on_reasm_queue == 0 &&
142             asoc->size_on_all_streams == 0) {
143                 /* Full rwnd granted */
144                 asoc->my_rwnd = max(stcb->sctp_socket->so_rcv.ssb_hiwat,
145                                     SCTP_MINIMAL_RWND);
146                 return;
147         }
148         /* get actual space */
149         calc = (u_int32_t)sctp_sbspace(&stcb->sctp_socket->so_rcv);
150
151         /* take out what has NOT been put on socket queue and
152          * we yet hold for putting up.
153          */
154         calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_delivery_queue);
155         calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_reasm_queue);
156         calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_all_streams);
157
158         /* what is the overhead of all these rwnd's */
159         calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
160
161         asoc->my_rwnd = calc;
162         if (calc_w_oh == 0) {
163                 /* If our overhead is greater than the advertised
164                  * rwnd, we clamp the rwnd to 1. This lets us
165                  * still accept inbound segments, but hopefully will
166                  * shut the sender down when he finally gets the message.
167                  */
168                 asoc->my_rwnd = 1;
169         } else {
170                 /* SWS threshold */
171                 if (asoc->my_rwnd &&
172                     (asoc->my_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
173                         /* SWS engaged, tell peer none left */
174                         asoc->my_rwnd = 1;
175 #ifdef SCTP_DEBUG
176                         if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
177                                 kprintf(" - SWS zeros\n");
178                         }
179                 } else {
180                         if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
181                                 kprintf("\n");
182                         }
183 #endif
184                 }
185         }
186 }
187
188 /*
189  * Take a chk structure and build it into an mbuf. Hmm should we change things
190  * so that instead we store the data side in a chunk?
191  */
192 static struct mbuf *
193 sctp_build_ctl_nchunk(struct sctp_tcb *stcb, uint32_t tsn, uint32_t ppid,
194     uint32_t context, uint16_t stream_no, uint16_t stream_seq, uint8_t flags)
195 {
196         struct sctp_sndrcvinfo *outinfo;
197         struct cmsghdr *cmh;
198         struct mbuf *ret;
199
200         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) {
201                 /* user does not want the sndrcv ctl */
202                 return (NULL);
203         }
204
205         MGETHDR(ret, MB_DONTWAIT, MT_CONTROL);
206         if (ret == NULL) {
207                 /* No space */
208                 return (ret);
209         }
210         /* We need a CMSG header followed by the struct  */
211         cmh = mtod(ret, struct cmsghdr *);
212         outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
213         cmh->cmsg_level = IPPROTO_SCTP;
214         cmh->cmsg_type = SCTP_SNDRCV;
215         cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
216         outinfo->sinfo_stream = stream_no;
217         outinfo->sinfo_ssn = stream_seq;
218         if (flags & SCTP_DATA_UNORDERED) {
219                 outinfo->sinfo_flags = MSG_UNORDERED;
220         } else {
221                 outinfo->sinfo_flags = 0;
222         }
223         outinfo->sinfo_ppid = ppid;
224         outinfo->sinfo_context = context;
225         outinfo->sinfo_assoc_id = sctp_get_associd(stcb);
226         outinfo->sinfo_tsn = tsn;
227         outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
228         ret->m_len = cmh->cmsg_len;
229         ret->m_pkthdr.len = ret->m_len;
230         /*
231          * We track how many control len's have gone upon the sb
232          * and do not count these in the rwnd calculation.
233          */
234         stcb->asoc.my_rwnd_control_len +=
235             CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
236
237         return (ret);
238 }
239
240 /*
241  * Take a chk structure and build it into an mbuf.  Should we change things
242  * so that instead we store the data side in a chunk?
243  */
244 static
245 struct mbuf *
246 sctp_build_ctl(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk)
247 {
248         struct sctp_sndrcvinfo *outinfo;
249         struct cmsghdr *cmh;
250         struct mbuf *ret;
251         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) {
252                 /* user does not want the sndrcv ctl */
253                 return (NULL);
254         }
255         MGET(ret, MB_DONTWAIT, MT_CONTROL);
256         if (ret == NULL) {
257                 /* No space */
258                 return (ret);
259         }
260
261         /* We need a CMSG header followed by the struct  */
262         cmh = mtod(ret, struct cmsghdr *);
263         outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
264         cmh->cmsg_level = IPPROTO_SCTP;
265         cmh->cmsg_type = SCTP_SNDRCV;
266         cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
267         outinfo->sinfo_stream = chk->rec.data.stream_number;
268         outinfo->sinfo_ssn = chk->rec.data.stream_seq;
269         if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
270                 outinfo->sinfo_flags = MSG_UNORDERED;
271         } else {
272                 outinfo->sinfo_flags = 0;
273         }
274         outinfo->sinfo_ppid = chk->rec.data.payloadtype;
275         outinfo->sinfo_context = chk->rec.data.context;
276         outinfo->sinfo_assoc_id = sctp_get_associd(stcb);
277         outinfo->sinfo_tsn = chk->rec.data.TSN_seq;
278         outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
279         ret->m_len = cmh->cmsg_len;
280         stcb->asoc.my_rwnd_control_len +=
281             CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
282
283         return (ret);
284 }
285
286 int
287 sctp_deliver_data(struct sctp_tcb *stcb, struct sctp_association *asoc,
288     struct sctp_tmit_chunk *chk, int hold_locks)
289 {
290         struct mbuf *control, *m;
291         int free_it;
292         struct sockaddr_in6 sin6;
293         struct sockaddr *to;
294
295 #ifdef SCTP_DEBUG
296         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
297                 kprintf("I am now in Deliver data! (%p)\n", chk);
298         }
299 #endif
300         /* get a write lock on the inp if not already */
301         if (hold_locks == 0) {
302                 SCTP_TCB_UNLOCK(stcb);
303                 SCTP_INP_WLOCK(stcb->sctp_ep);
304                 SCTP_TCB_LOCK(stcb);
305         }
306         free_it = 0;
307         /* We always add it to the queue */
308         if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
309                 /* socket above is long gone */
310 #ifdef SCTP_DEBUG
311                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
312                         kprintf("gone is gone!\n");
313                 }
314 #endif
315                 if (chk != NULL) {
316                         if (chk->data)
317                                 sctp_m_freem(chk->data);
318                         chk->data = NULL;
319                         sctp_free_remote_addr(chk->whoTo);
320                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
321                         sctppcbinfo.ipi_count_chunk--;
322                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
323                                 panic("Chunk count is negative");
324                         }
325                         sctppcbinfo.ipi_gencnt_chunk++;
326                 }
327                 TAILQ_FOREACH(chk, &asoc->delivery_queue, sctp_next) {
328                         asoc->size_on_delivery_queue -= chk->send_size;
329                         asoc->cnt_on_delivery_queue--;
330                         /*
331                          * Lose the data pointer, since its in the socket buffer
332                          */
333                         if (chk->data)
334                                 sctp_m_freem(chk->data);
335                         chk->data = NULL;
336                         /* Now free the address and data */
337                         sctp_free_remote_addr(chk->whoTo);
338                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
339                         sctppcbinfo.ipi_count_chunk--;
340                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
341                                 panic("Chunk count is negative");
342                         }
343                         sctppcbinfo.ipi_gencnt_chunk++;
344                 }
345                 if (hold_locks == 0)
346                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
347                 return (0);
348         }
349         if (chk != NULL) {
350                 TAILQ_INSERT_TAIL(&asoc->delivery_queue, chk, sctp_next);
351                 asoc->size_on_delivery_queue += chk->send_size;
352                 asoc->cnt_on_delivery_queue++;
353         }
354         if (asoc->fragmented_delivery_inprogress) {
355                 /*
356                  * oh oh, fragmented delivery in progress
357                  * return out of here.
358                  */
359 #ifdef SCTP_DEBUG
360                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
361                         kprintf("Fragmented delivery in progress?\n");
362                 }
363 #endif
364                 if (hold_locks == 0)
365                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
366                 return (0);
367         }
368         /* Now grab the first one  */
369         chk = TAILQ_FIRST(&asoc->delivery_queue);
370         if (chk == NULL) {
371                 /* Nothing in queue */
372 #ifdef SCTP_DEBUG
373                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
374                         kprintf("Nothing in queue?\n");
375                 }
376 #endif
377                 asoc->size_on_delivery_queue = 0;
378                 asoc->cnt_on_delivery_queue = 0;
379                 if (hold_locks == 0)
380                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
381                 return (0);
382         }
383
384         if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) {
385                 /* Boy, there really is NO room */
386                 if (hold_locks == 0)
387                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
388                 return (0);
389         }
390 #ifdef SCTP_DEBUG
391         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
392                 kprintf("Now to the delivery with chk(%p)!\n", chk);
393         }
394 #endif
395         /* XXX need to append PKTHDR to the socket buffer first */
396         if ((chk->data->m_flags & M_PKTHDR) == 0) {
397                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
398                 if (m == NULL) {
399                         /* no room! */
400                         if (hold_locks == 0)
401                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
402                         return (0);
403                 }
404                 m->m_pkthdr.len = chk->send_size;
405                 m->m_len = 0;
406                 m->m_next = chk->data;
407                 chk->data = m;
408         }
409         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
410                 if (chk->data->m_next == NULL) {
411                         /* hopefully we hit here most of the time */
412                         chk->data->m_flags |= M_EOR;
413                 } else {
414                         /* Add the flag to the LAST mbuf in the chain */
415                         m = chk->data;
416                         while (m->m_next != NULL) {
417                                 m = m->m_next;
418                         }
419                         m->m_flags |= M_EOR;
420                 }
421         }
422
423         if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
424                 struct sockaddr_in6 lsa6;
425
426                 control = sctp_build_ctl(stcb, chk);
427                 to = (struct sockaddr *)&chk->whoTo->ro._l_addr;
428                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
429                     to->sa_family == AF_INET) {
430                         struct sockaddr_in *sin;
431
432                         sin = (struct sockaddr_in *)to;
433                         bzero(&sin6, sizeof(sin6));
434                         sin6.sin6_family = AF_INET6;
435                         sin6.sin6_len = sizeof(struct sockaddr_in6);
436                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
437                         bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
438                             sizeof(sin6.sin6_addr.s6_addr16[3]));
439                         sin6.sin6_port = sin->sin_port;
440                         to = (struct sockaddr *)&sin6;
441                 }
442                 /* check and strip embedded scope junk */
443                 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
444                     &lsa6);
445                 if (((struct sockaddr_in *)to)->sin_port == 0) {
446                         kprintf("Huh a, port is %d not net:%p %d?\n",
447                                ((struct sockaddr_in *)to)->sin_port,
448                                chk->whoTo,
449                                (int)(ntohs(stcb->rport)));
450                         ((struct sockaddr_in *)to)->sin_port = stcb->rport;
451                 }
452                 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < (long)chk->send_size) {
453                         /* Gak not enough room */
454                         if (control) {
455                                 sctp_m_freem(control);
456                                 stcb->asoc.my_rwnd_control_len -=
457                                     CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
458                         }
459                         goto skip;
460                 }
461                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
462                 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
463                     to, chk->data, control, stcb->asoc.my_vtag,
464                     stcb->sctp_ep)) {
465                         /* Gak not enough room */
466                         if (control) {
467                                 sctp_m_freem(control);
468                                 stcb->asoc.my_rwnd_control_len -=
469                                     CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
470                         }
471                 } else {
472                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
473                                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
474                                         stcb->asoc.my_rwnd_control_len +=
475                                                 sizeof(struct mbuf);
476                                 }
477                         } else {
478                                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
479                         }
480                         free_it = 1;
481                 }
482                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
483         } else {
484                 /* append to a already started message. */
485                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
486                 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >=
487                     (long)chk->send_size) {
488                         ssb_append(&stcb->sctp_socket->so_rcv, chk->data);
489                         free_it = 1;
490                 }
491                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
492         }
493  skip:
494         if (hold_locks == 0)
495                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
496         /* free up the one we inserted */
497         if (free_it) {
498                 /* Pull it off the queue */
499 #ifdef SCTP_DEBUG
500                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
501                         kprintf("Free_it true, doing tickle wakeup\n");
502                 }
503 #endif
504                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
505                 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next);
506                 asoc->size_on_delivery_queue -= chk->send_size;
507                 asoc->cnt_on_delivery_queue--;
508                 /* Lose the data pointer, since its in the socket buffer */
509                 chk->data = NULL;
510                 /* Now free the address and data */
511                 sctp_free_remote_addr(chk->whoTo);
512                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
513                 sctppcbinfo.ipi_count_chunk--;
514                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
515                         panic("Chunk count is negative");
516                 }
517                 sctppcbinfo.ipi_gencnt_chunk++;
518         }
519         return (free_it);
520 }
521
522 /*
523  * We are delivering currently from the reassembly queue. We must continue to
524  * deliver until we either:
525  * 1) run out of space.
526  * 2) run out of sequential TSN's
527  * 3) hit the SCTP_DATA_LAST_FRAG flag.
528  */
529 static void
530 sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks)
531 {
532         struct sockaddr *to;
533         struct sockaddr_in6 sin6;
534         struct sctp_tmit_chunk *chk, *at;
535         struct mbuf *control, *m;
536         u_int16_t nxt_todel;
537         u_int16_t stream_no;
538         int cntDel;
539         cntDel = stream_no = 0;
540         if (hold_locks == 0) {
541                 /*
542                  * you always have the TCB lock, we need
543                  * to have the inp write lock as well.
544                  */
545                 SCTP_TCB_UNLOCK(stcb);
546                 SCTP_INP_WLOCK(stcb->sctp_ep);
547                 SCTP_TCB_LOCK(stcb);
548         }
549         if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
550                 /* socket above is long gone */
551                 asoc->fragmented_delivery_inprogress = 0;
552                 TAILQ_FOREACH(chk, &asoc->reasmqueue, sctp_next) {
553                         asoc->size_on_delivery_queue -= chk->send_size;
554                         asoc->cnt_on_delivery_queue--;
555                         /*
556                          * Lose the data pointer, since its in the socket buffer
557                          */
558                         if (chk->data)
559                                 sctp_m_freem(chk->data);
560                         chk->data = NULL;
561                         /* Now free the address and data */
562                         sctp_free_remote_addr(chk->whoTo);
563                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
564                         sctppcbinfo.ipi_count_chunk--;
565                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
566                                 panic("Chunk count is negative");
567                         }
568                         sctppcbinfo.ipi_gencnt_chunk++;
569                 }
570                 if (hold_locks == 0)
571                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
572                 return;
573         }
574         do {
575                 if (stcb->sctp_socket->so_rcv.ssb_cc >=
576                     stcb->sctp_socket->so_rcv.ssb_hiwat) {
577                         if (cntDel) {
578                                 sctp_sorwakeup(stcb->sctp_ep,
579                                                stcb->sctp_socket);
580                         }
581                         if (hold_locks == 0)
582                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
583                         return;
584                 }
585                 chk = TAILQ_FIRST(&asoc->reasmqueue);
586                 if (chk == NULL) {
587                         if (cntDel) {
588                                 sctp_sorwakeup(stcb->sctp_ep,
589                                                stcb->sctp_socket);
590                         }
591                         if (hold_locks == 0)
592                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
593                         return;
594                 }
595                 if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) {
596                         /* Can't deliver more :< */
597                         if (cntDel) {
598                                 sctp_sorwakeup(stcb->sctp_ep,
599                                                stcb->sctp_socket);
600                         }
601                         if (hold_locks == 0)
602                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
603                         return;
604                 }
605                 stream_no = chk->rec.data.stream_number;
606                 nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1;
607                 if (nxt_todel != chk->rec.data.stream_seq &&
608                     (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
609                         /*
610                          * Not the next sequence to deliver in its stream OR
611                          * unordered
612                          */
613                         if (cntDel) {
614                                 sctp_sorwakeup(stcb->sctp_ep,
615                                                stcb->sctp_socket);
616                         }
617                         if (hold_locks == 0)
618                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
619                         return;
620                 }
621
622                 if ((chk->data->m_flags & M_PKTHDR) == 0) {
623                         MGETHDR(m, MB_DONTWAIT, MT_DATA);
624                         if (m == NULL) {
625                                 /* no room! */
626                                 if (hold_locks == 0)
627                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
628                                 return;
629                         }
630                         m->m_pkthdr.len = chk->send_size;
631                         m->m_len = 0;
632                         m->m_next = chk->data;
633                         chk->data = m;
634                 }
635                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
636                         if (chk->data->m_next == NULL) {
637                                 /* hopefully we hit here most of the time */
638                                 chk->data->m_flags |= M_EOR;
639                         } else {
640                                 /* Add the flag to the LAST mbuf in the chain */
641                                 m = chk->data;
642                                 while (m->m_next != NULL) {
643                                         m = m->m_next;
644                                 }
645                                 m->m_flags |= M_EOR;
646                         }
647                 }
648                 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
649                         struct sockaddr_in6 lsa6;
650
651                         control = sctp_build_ctl(stcb, chk);
652                         to = (struct sockaddr *)&chk->whoTo->ro._l_addr;
653                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
654                             to->sa_family == AF_INET) {
655                                 struct sockaddr_in *sin;
656                                 sin = (struct sockaddr_in *)to;
657                                 bzero(&sin6, sizeof(sin6));
658                                 sin6.sin6_family = AF_INET6;
659                                 sin6.sin6_len = sizeof(struct sockaddr_in6);
660                                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
661                                 bcopy(&sin->sin_addr,
662                                       &sin6.sin6_addr.s6_addr16[3],
663                                       sizeof(sin6.sin6_addr.s6_addr16[3]));
664                                 sin6.sin6_port = sin->sin_port;
665                                 to = (struct sockaddr *)&sin6;
666                         }
667                         /* check and strip embedded scope junk */
668                         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
669                                                                    &lsa6);
670                         if (((struct sockaddr_in *)to)->sin_port == 0) {
671                                 kprintf("Huh b, port is %d not net:%p %d?\n",
672                                        ((struct sockaddr_in *)to)->sin_port,
673                                        chk->whoTo,
674                                        (int)(ntohs(stcb->rport)));
675                                 ((struct sockaddr_in *)to)->sin_port = stcb->rport;
676                         }
677                         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) <
678                             (long)chk->send_size) {
679                                 if (control) {
680                                         sctp_m_freem(control);
681                                         stcb->asoc.my_rwnd_control_len -=
682                                                 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
683                                 }
684                                 sctp_sorwakeup(stcb->sctp_ep,
685                                                stcb->sctp_socket);
686                                 if (hold_locks == 0)
687                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
688                                 return;
689                         }
690                         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
691                         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
692                                                   to, chk->data, control, stcb->asoc.my_vtag,
693                                                   stcb->sctp_ep)) {
694                                 /* Gak not enough room */
695                                 if (control) {
696                                         sctp_m_freem(control);
697                                         stcb->asoc.my_rwnd_control_len -=
698                                                 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
699                                 }
700                                 sctp_sorwakeup(stcb->sctp_ep,
701                                                stcb->sctp_socket);
702                                 if (hold_locks == 0)
703                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
704                                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
705                                 return;
706                         }
707                         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
708                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
709                                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
710                                         stcb->asoc.my_rwnd_control_len +=
711                                                 sizeof(struct mbuf);
712                                 }
713                         } else {
714                                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
715                         }
716                         cntDel++;
717                 } else {
718                         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >=
719                             (long)chk->send_size) {
720                                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
721                                 ssb_append(&stcb->sctp_socket->so_rcv, chk->data);
722                                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
723                                 cntDel++;
724                         } else {
725                                 /* out of space in the sb */
726                                 sctp_sorwakeup(stcb->sctp_ep,
727                                                stcb->sctp_socket);
728                                 if (hold_locks == 0)
729                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
730                                 return;
731                         }
732                 }
733                 /* pull it we did it */
734                 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
735                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
736                         asoc->fragmented_delivery_inprogress = 0;
737                         if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
738                                 asoc->strmin[stream_no].last_sequence_delivered++;
739                         }
740                 }
741                 asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
742                 asoc->size_on_reasm_queue -= chk->send_size;
743                 asoc->cnt_on_reasm_queue--;
744                 /* free up the chk */
745                 sctp_free_remote_addr(chk->whoTo);
746                 chk->data = NULL;
747                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
748                 sctppcbinfo.ipi_count_chunk--;
749                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
750                         panic("Chunk count is negative");
751                 }
752                 sctppcbinfo.ipi_gencnt_chunk++;
753                 if (asoc->fragmented_delivery_inprogress == 0) {
754                         /*
755                          * Now lets see if we can deliver the next one on the
756                          * stream
757                          */
758                         u_int16_t nxt_todel;
759                         struct sctp_stream_in *strm;
760
761                         strm = &asoc->strmin[stream_no];
762                         nxt_todel = strm->last_sequence_delivered + 1;
763                         chk = TAILQ_FIRST(&strm->inqueue);
764                         if (chk && (nxt_todel == chk->rec.data.stream_seq)) {
765                                 while (chk != NULL) {
766                                         /* all delivered */
767                                         if (nxt_todel ==
768                                             chk->rec.data.stream_seq) {
769                                                 at = TAILQ_NEXT(chk, sctp_next);
770                                                 TAILQ_REMOVE(&strm->inqueue,
771                                                              chk, sctp_next);
772                                                 asoc->size_on_all_streams -=
773                                                         chk->send_size;
774                                                 asoc->cnt_on_all_streams--;
775                                                 strm->last_sequence_delivered++;
776                                                 /*
777                                                  * We ignore the return of
778                                                  * deliver_data here since we
779                                                  * always can hold the chunk on
780                                                  * the d-queue. And we have a
781                                                  * finite number that can be
782                                                  * delivered from the strq.
783                                                  */
784                                                 sctp_deliver_data(stcb, asoc, chk, 1);
785                                                 chk = at;
786                                         } else {
787                                                 break;
788                                         }
789                                         nxt_todel =
790                                                 strm->last_sequence_delivered + 1;
791                                 }
792                         }
793                         if (!TAILQ_EMPTY(&asoc->delivery_queue)) {
794                                 /* Here if deliver_data fails, we must break */
795                                 if (sctp_deliver_data(stcb, asoc, NULL, 1) == 0)
796                                         break;
797                         }
798                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
799                         if (hold_locks == 0)
800                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
801                         return;
802                 }
803                 chk = TAILQ_FIRST(&asoc->reasmqueue);
804         } while (chk);
805         if (cntDel) {
806                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
807         }
808         if (hold_locks == 0)
809                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
810 }
811
812 /*
813  * Queue the chunk either right into the socket buffer if it is the next one
814  * to go OR put it in the correct place in the delivery queue.  If we do
815  * append to the so_buf, keep doing so until we are out of order.
816  * One big question still remains, what to do when the socket buffer is FULL??
817  */
818 static void
819 sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc,
820     struct sctp_tmit_chunk *chk, int *abort_flag)
821 {
822         struct sctp_stream_in *strm;
823         struct sctp_tmit_chunk *at;
824         int queue_needed;
825         u_int16_t nxt_todel;
826         struct mbuf *oper;
827
828 /*** FIX FIX FIX ???
829  * Need to add code to deal with 16 bit seq wrap
830  * without a TSN wrap for ordered delivery (maybe).
831  * FIX FIX FIX ???
832  */
833         queue_needed = 1;
834         asoc->size_on_all_streams += chk->send_size;
835         asoc->cnt_on_all_streams++;
836         strm = &asoc->strmin[chk->rec.data.stream_number];
837         nxt_todel = strm->last_sequence_delivered + 1;
838 #ifdef SCTP_STR_LOGGING
839         sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
840 #endif
841 #ifdef SCTP_DEBUG
842         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
843                 kprintf("queue to stream called for ssn:%u lastdel:%u nxt:%u\n",
844                     (u_int)chk->rec.data.stream_seq,
845                     (u_int)strm->last_sequence_delivered, (u_int)nxt_todel);
846         }
847 #endif
848         if (compare_with_wrap(strm->last_sequence_delivered,
849             chk->rec.data.stream_seq, MAX_SEQ) ||
850             (strm->last_sequence_delivered == chk->rec.data.stream_seq)) {
851                 /* The incoming sseq is behind where we last delivered? */
852 #ifdef SCTP_DEBUG
853                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
854                         kprintf("Duplicate S-SEQ:%d delivered:%d from peer, Abort  association\n",
855                             chk->rec.data.stream_seq,
856                             strm->last_sequence_delivered);
857                 }
858 #endif
859                 /*
860                  * throw it in the stream so it gets cleaned up in
861                  * association destruction
862                  */
863                 TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next);
864                 MGET(oper, MB_DONTWAIT, MT_DATA);
865                 if (oper) {
866                         struct sctp_paramhdr *ph;
867                         u_int32_t *ippp;
868
869                         oper->m_len = sizeof(struct sctp_paramhdr) +
870                             sizeof(*ippp);
871                         ph = mtod(oper, struct sctp_paramhdr *);
872                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
873                         ph->param_length = htons(oper->m_len);
874                         ippp = (u_int32_t *)(ph + 1);
875                         *ippp = htonl(0x00000001);
876                 }
877                 sctp_abort_an_association(stcb->sctp_ep, stcb,
878                     SCTP_PEER_FAULTY, oper);
879
880                 *abort_flag = 1;
881                 return;
882
883         }
884         if (nxt_todel == chk->rec.data.stream_seq) {
885                 /* can be delivered right away */
886 #ifdef SCTP_DEBUG
887                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
888                         kprintf("It's NEXT!\n");
889                 }
890 #endif
891 #ifdef SCTP_STR_LOGGING
892                 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
893 #endif
894                 queue_needed = 0;
895                 asoc->size_on_all_streams -= chk->send_size;
896                 asoc->cnt_on_all_streams--;
897                 strm->last_sequence_delivered++;
898                 sctp_deliver_data(stcb, asoc, chk, 0);
899                 chk = TAILQ_FIRST(&strm->inqueue);
900                 while (chk != NULL) {
901                         /* all delivered */
902                         nxt_todel = strm->last_sequence_delivered + 1;
903                         if (nxt_todel == chk->rec.data.stream_seq) {
904                                 at = TAILQ_NEXT(chk, sctp_next);
905                                 TAILQ_REMOVE(&strm->inqueue, chk, sctp_next);
906                                 asoc->size_on_all_streams -= chk->send_size;
907                                 asoc->cnt_on_all_streams--;
908                                 strm->last_sequence_delivered++;
909                                 /*
910                                  * We ignore the return of deliver_data here
911                                  * since we always can hold the chunk on the
912                                  * d-queue. And we have a finite number that
913                                  * can be delivered from the strq.
914                                  */
915 #ifdef SCTP_STR_LOGGING
916                                 sctp_log_strm_del(chk, NULL,
917                                     SCTP_STR_LOG_FROM_IMMED_DEL);
918 #endif
919                                 sctp_deliver_data(stcb, asoc, chk, 0);
920                                 chk = at;
921                                 continue;
922                         }
923                         break;
924                 }
925         }
926         if (queue_needed) {
927                 /*
928                  * Ok, we did not deliver this guy, find
929                  * the correct place to put it on the queue.
930                  */
931 #ifdef SCTP_DEBUG
932                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
933                         kprintf("Queue Needed!\n");
934                 }
935 #endif
936                 if (TAILQ_EMPTY(&strm->inqueue)) {
937                         /* Empty queue */
938 #ifdef SCTP_STR_LOGGING
939                         sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INSERT_HD);
940 #endif
941                         TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next);
942                 } else {
943                         TAILQ_FOREACH(at, &strm->inqueue, sctp_next) {
944                                 if (compare_with_wrap(at->rec.data.stream_seq,
945                                     chk->rec.data.stream_seq, MAX_SEQ)) {
946                                         /*
947                                          * one in queue is bigger than the new
948                                          * one, insert before this one
949                                          */
950 #ifdef SCTP_STR_LOGGING
951                                         sctp_log_strm_del(chk, at,
952                                             SCTP_STR_LOG_FROM_INSERT_MD);
953 #endif
954                                         TAILQ_INSERT_BEFORE(at, chk, sctp_next);
955                                         break;
956                                 } else if (at->rec.data.stream_seq ==
957                                     chk->rec.data.stream_seq) {
958                                         /*
959                                          * Gak, He sent me a duplicate str seq
960                                          * number
961                                          */
962                                         /*
963                                          * foo bar, I guess I will just free
964                                          * this new guy, should we abort too?
965                                          * FIX ME MAYBE? Or it COULD be that
966                                          * the SSN's have wrapped. Maybe I
967                                          * should compare to TSN somehow...
968                                          * sigh for now just blow away the
969                                          * chunk!
970                                          */
971
972                                         if (chk->data)
973                                                 sctp_m_freem(chk->data);
974                                         chk->data = NULL;
975                                         asoc->size_on_all_streams -= chk->send_size;
976                                         asoc->cnt_on_all_streams--;
977                                         sctp_pegs[SCTP_DUP_SSN_RCVD]++;
978                                         sctp_free_remote_addr(chk->whoTo);
979                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
980                                         sctppcbinfo.ipi_count_chunk--;
981                                         if ((int)sctppcbinfo.ipi_count_chunk <
982                                             0) {
983                                                 panic("Chunk count is negative");
984                                         }
985                                         sctppcbinfo.ipi_gencnt_chunk++;
986                                         return;
987                                 } else {
988                                         if (TAILQ_NEXT(at, sctp_next) == NULL) {
989                                                 /*
990                                                  * We are at the end, insert it
991                                                  * after this one
992                                                  */
993 #ifdef SCTP_STR_LOGGING
994                                                 sctp_log_strm_del(chk, at,
995                                                     SCTP_STR_LOG_FROM_INSERT_TL);
996 #endif
997                                                 TAILQ_INSERT_AFTER(&strm->inqueue,
998                                                     at, chk, sctp_next);
999                                                 break;
1000                                         }
1001                                 }
1002                         }
1003                 }
1004         } else {
1005                 /* We delivered some chunks, wake them up */
1006
1007 #ifdef SCTP_DEBUG
1008                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1009                         kprintf("Doing WAKEUP!\n");
1010                 }
1011 #endif
1012                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1013         }
1014 }
1015
1016 /*
1017  * Returns two things: You get the total size of the deliverable parts of the
1018  * first fragmented message on the reassembly queue. And you get a 1 back if
1019  * all of the message is ready or a 0 back if the message is still incomplete
1020  */
1021 static int
1022 sctp_is_all_msg_on_reasm(struct sctp_association *asoc, int *t_size)
1023 {
1024         struct sctp_tmit_chunk *chk;
1025         u_int32_t tsn;
1026
1027         *t_size = 0;
1028         chk = TAILQ_FIRST(&asoc->reasmqueue);
1029         if (chk == NULL) {
1030                 /* nothing on the queue */
1031                 return (0);
1032         }
1033         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
1034                 /* Not a first on the queue */
1035                 return (0);
1036         }
1037         tsn = chk->rec.data.TSN_seq;
1038         while (chk) {
1039                 if (tsn != chk->rec.data.TSN_seq) {
1040                         return (0);
1041                 }
1042                 *t_size += chk->send_size;
1043                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1044                         return (1);
1045                 }
1046                 tsn++;
1047                 chk = TAILQ_NEXT(chk, sctp_next);
1048         }
1049         return (0);
1050 }
1051
1052 /*
1053  * Dump onto the re-assembly queue, in its proper place. After dumping on
1054  * the queue, see if anthing can be delivered. If so pull it off (or as much
1055  * as we can. If we run out of space then we must dump what we can and set
1056  * the appropriate flag to say we queued what we could.
1057  */
1058 static void
1059 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
1060     struct sctp_tmit_chunk *chk, int *abort_flag)
1061 {
1062         struct mbuf *oper;
1063         u_int16_t nxt_todel;
1064         u_int32_t cum_ackp1, prev_tsn, post_tsn;
1065         int tsize;
1066         struct sctp_tmit_chunk *at, *prev, *next;
1067
1068         prev = next = NULL;
1069         cum_ackp1 = asoc->tsn_last_delivered + 1;
1070
1071         if (TAILQ_EMPTY(&asoc->reasmqueue)) {
1072                 /* This is the first one on the queue */
1073                 TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next);
1074                 /*
1075                  * we do not check for delivery of anything when
1076                  * only one fragment is here
1077                  */
1078                 asoc->size_on_reasm_queue = chk->send_size;
1079                 asoc->cnt_on_reasm_queue++;
1080                 if (chk->rec.data.TSN_seq == cum_ackp1) {
1081                         if (asoc->fragmented_delivery_inprogress == 0  &&
1082                             (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) !=
1083                             SCTP_DATA_FIRST_FRAG) {
1084                                 /*
1085                                  * An empty queue, no delivery inprogress, we
1086                                  * hit the next one and it does NOT have a
1087                                  * FIRST fragment mark.
1088                                  */
1089 #ifdef SCTP_DEBUG
1090                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1091                                         kprintf("Gak, Evil plot, its not first, no fragmented delivery in progress\n");
1092                                 }
1093 #endif
1094                                 MGET(oper, MB_DONTWAIT, MT_DATA);
1095                                 if (oper) {
1096                                         struct sctp_paramhdr *ph;
1097                                         u_int32_t *ippp;
1098
1099                                         oper->m_len =
1100                                             sizeof(struct sctp_paramhdr) +
1101                                             sizeof(*ippp);
1102                                         ph = mtod(oper, struct sctp_paramhdr *);
1103                                         ph->param_type =
1104                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1105                                         ph->param_length = htons(oper->m_len);
1106                                         ippp = (u_int32_t *)(ph + 1);
1107                                         *ippp = htonl(0x10000001);
1108                                 }
1109                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1110                                     SCTP_PEER_FAULTY, oper);
1111                                 *abort_flag = 1;
1112                         } else if (asoc->fragmented_delivery_inprogress &&
1113                             (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
1114                                 /*
1115                                  * We are doing a partial delivery and the NEXT
1116                                  * chunk MUST be either the LAST or MIDDLE
1117                                  * fragment NOT a FIRST
1118                                  */
1119 #ifdef SCTP_DEBUG
1120                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1121                                         kprintf("Gak, Evil plot, it IS a first and fragmented delivery in progress\n");
1122                                 }
1123 #endif
1124                                 MGET(oper, MB_DONTWAIT, MT_DATA);
1125                                 if (oper) {
1126                                         struct sctp_paramhdr *ph;
1127                                         u_int32_t *ippp;
1128
1129                                         oper->m_len =
1130                                             sizeof(struct sctp_paramhdr) +
1131                                             sizeof(*ippp);
1132                                         ph = mtod(oper, struct sctp_paramhdr *);
1133                                         ph->param_type =
1134                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1135                                         ph->param_length = htons(oper->m_len);
1136                                         ippp = (u_int32_t *)(ph + 1);
1137                                         *ippp = htonl(0x10000002);
1138                                 }
1139                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1140                                     SCTP_PEER_FAULTY, oper);
1141                                 *abort_flag = 1;
1142                         } else if (asoc->fragmented_delivery_inprogress) {
1143                                 /* Here we are ok with a MIDDLE or LAST piece */
1144                                 if (chk->rec.data.stream_number !=
1145                                     asoc->str_of_pdapi) {
1146                                         /* Got to be the right STR No */
1147 #ifdef SCTP_DEBUG
1148                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1149                                                 kprintf("Gak, Evil plot, it IS not same stream number %d vs %d\n",
1150                                                     chk->rec.data.stream_number,
1151                                                     asoc->str_of_pdapi);
1152                                         }
1153 #endif
1154                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1155                                         if (oper) {
1156                                                 struct sctp_paramhdr *ph;
1157                                                 u_int32_t *ippp;
1158                                                 oper->m_len =
1159                                                     sizeof(struct sctp_paramhdr) +
1160                                                     sizeof(*ippp);
1161                                                 ph = mtod(oper,
1162                                                     struct sctp_paramhdr *);
1163                                                 ph->param_type =
1164                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1165                                                 ph->param_length =
1166                                                     htons(oper->m_len);
1167                                                 ippp = (u_int32_t *)(ph + 1);
1168                                                 *ippp = htonl(0x10000003);
1169                                         }
1170                                         sctp_abort_an_association(stcb->sctp_ep,
1171                                             stcb, SCTP_PEER_FAULTY, oper);
1172                                         *abort_flag = 1;
1173                                 } else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) !=
1174                                     SCTP_DATA_UNORDERED &&
1175                                     chk->rec.data.stream_seq !=
1176                                     asoc->ssn_of_pdapi) {
1177                                         /* Got to be the right STR Seq */
1178 #ifdef SCTP_DEBUG
1179                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1180                                                 kprintf("Gak, Evil plot, it IS not same stream seq %d vs %d\n",
1181                                                     chk->rec.data.stream_seq,
1182                                                     asoc->ssn_of_pdapi);
1183                                         }
1184 #endif
1185                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1186                                         if (oper) {
1187                                                 struct sctp_paramhdr *ph;
1188                                                 u_int32_t *ippp;
1189                                                 oper->m_len =
1190                                                     sizeof(struct sctp_paramhdr) +
1191                                                     sizeof(*ippp);
1192                                                 ph = mtod(oper,
1193                                                     struct sctp_paramhdr *);
1194                                                 ph->param_type =
1195                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1196                                                 ph->param_length =
1197                                                     htons(oper->m_len);
1198                                                 ippp = (u_int32_t *)(ph + 1);
1199                                                 *ippp = htonl(0x10000004);
1200                                         }
1201                                         sctp_abort_an_association(stcb->sctp_ep,
1202                                             stcb, SCTP_PEER_FAULTY, oper);
1203                                         *abort_flag = 1;
1204                                 }
1205                         }
1206                 }
1207                 return;
1208         }
1209         /* Find its place */
1210         at = TAILQ_FIRST(&asoc->reasmqueue);
1211
1212         /* Grab the top flags */
1213         TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1214                 if (compare_with_wrap(at->rec.data.TSN_seq,
1215                     chk->rec.data.TSN_seq, MAX_TSN)) {
1216                         /*
1217                          * one in queue is bigger than the new one, insert
1218                          * before this one
1219                          */
1220                         /* A check */
1221                         asoc->size_on_reasm_queue += chk->send_size;
1222                         asoc->cnt_on_reasm_queue++;
1223                         next = at;
1224                         TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1225                         break;
1226                 } else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) {
1227                         /* Gak, He sent me a duplicate str seq number */
1228                         /*
1229                          * foo bar, I guess I will just free this new guy,
1230                          * should we abort too? FIX ME MAYBE? Or it COULD be
1231                          * that the SSN's have wrapped. Maybe I should compare
1232                          * to TSN somehow... sigh for now just blow away the
1233                          * chunk!
1234                          */
1235                         if (chk->data)
1236                                 sctp_m_freem(chk->data);
1237                         chk->data = NULL;
1238                         sctp_free_remote_addr(chk->whoTo);
1239                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
1240                         sctppcbinfo.ipi_count_chunk--;
1241                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
1242                                 panic("Chunk count is negative");
1243                         }
1244                         sctppcbinfo.ipi_gencnt_chunk++;
1245                         return;
1246                 } else {
1247                         prev = at;
1248                         if (TAILQ_NEXT(at, sctp_next) == NULL) {
1249                                 /*
1250                                  * We are at the end, insert it after this one
1251                                  */
1252                                 /* check it first */
1253                                 asoc->size_on_reasm_queue += chk->send_size;
1254                                 asoc->cnt_on_reasm_queue++;
1255                                 TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next);
1256                                 break;
1257                         }
1258                 }
1259         }
1260         /* Now the audits */
1261         if (prev) {
1262                 prev_tsn = chk->rec.data.TSN_seq - 1;
1263                 if (prev_tsn == prev->rec.data.TSN_seq) {
1264                         /*
1265                          * Ok the one I am dropping onto the end
1266                          * is the NEXT. A bit of valdiation here.
1267                          */
1268                         if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1269                             SCTP_DATA_FIRST_FRAG ||
1270                             (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1271                             SCTP_DATA_MIDDLE_FRAG) {
1272                                 /*
1273                                  * Insert chk MUST be a MIDDLE or LAST fragment
1274                                  */
1275                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1276                                     SCTP_DATA_FIRST_FRAG) {
1277 #ifdef SCTP_DEBUG
1278                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1279                                                 kprintf("Prev check - It can be a midlle or last but not a first\n");
1280                                                 kprintf("Gak, Evil plot, it's a FIRST!\n");
1281                                         }
1282 #endif
1283                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1284                                         if (oper) {
1285                                                 struct sctp_paramhdr *ph;
1286                                                 u_int32_t *ippp;
1287
1288                                                 oper->m_len =
1289                                                     sizeof(struct sctp_paramhdr) +
1290                                                     sizeof(*ippp);
1291                                                 ph = mtod(oper,
1292                                                     struct sctp_paramhdr *);
1293                                                 ph->param_type =
1294                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1295                                                 ph->param_length =
1296                                                     htons(oper->m_len);
1297
1298                                                 ippp = (u_int32_t *)(ph + 1);
1299                                                 *ippp = htonl(0x10000005);
1300                                         }
1301                                         sctp_abort_an_association(stcb->sctp_ep,
1302                                             stcb, SCTP_PEER_FAULTY, oper);
1303                                         *abort_flag = 1;
1304                                         return;
1305                                 }
1306                                 if (chk->rec.data.stream_number !=
1307                                     prev->rec.data.stream_number) {
1308                                         /*
1309                                          * Huh, need the correct STR here, they
1310                                          * must be the same.
1311                                          */
1312 #ifdef SCTP_DEBUG
1313                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1314                                                 kprintf("Prev check - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1315                                                     chk->rec.data.stream_number,
1316                                                     prev->rec.data.stream_number);
1317                                         }
1318 #endif
1319                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1320                                         if (oper) {
1321                                                 struct sctp_paramhdr *ph;
1322                                                 u_int32_t *ippp;
1323
1324                                                 oper->m_len =
1325                                                     sizeof(struct sctp_paramhdr) +
1326                                                     sizeof(*ippp);
1327                                                 ph = mtod(oper,
1328                                                     struct sctp_paramhdr *);
1329                                                 ph->param_type =
1330                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1331                                                 ph->param_length =
1332                                                     htons(oper->m_len);
1333                                                 ippp = (u_int32_t *)(ph + 1);
1334                                                 *ippp = htonl(0x10000006);
1335                                         }
1336
1337                                         sctp_abort_an_association(stcb->sctp_ep,
1338                                             stcb, SCTP_PEER_FAULTY, oper);
1339
1340                                         *abort_flag = 1;
1341                                         return;
1342                                 }
1343                                 if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1344                                     chk->rec.data.stream_seq !=
1345                                     prev->rec.data.stream_seq) {
1346                                         /*
1347                                          * Huh, need the correct STR here, they
1348                                          * must be the same.
1349                                          */
1350 #ifdef SCTP_DEBUG
1351                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1352                                                 kprintf("Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1353                                                     chk->rec.data.stream_seq,
1354                                                     prev->rec.data.stream_seq);
1355                                         }
1356 #endif
1357                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1358                                         if (oper) {
1359                                                 struct sctp_paramhdr *ph;
1360                                                 u_int32_t *ippp;
1361
1362                                                 oper->m_len =
1363                                                     sizeof(struct sctp_paramhdr) +
1364                                                     sizeof(*ippp);
1365                                                 ph = mtod(oper,
1366                                                     struct sctp_paramhdr *);
1367                                                 ph->param_type =
1368                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1369                                                 ph->param_length =
1370                                                     htons(oper->m_len);
1371                                                 ippp = (u_int32_t *)(ph + 1);
1372                                                 *ippp = htonl(0x10000007);
1373                                         }
1374
1375                                         sctp_abort_an_association(stcb->sctp_ep,
1376                                             stcb, SCTP_PEER_FAULTY, oper);
1377
1378                                         *abort_flag = 1;
1379                                         return;
1380                                 }
1381                         } else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1382                             SCTP_DATA_LAST_FRAG) {
1383                                 /* Insert chk MUST be a FIRST */
1384                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1385                                     SCTP_DATA_FIRST_FRAG) {
1386 #ifdef SCTP_DEBUG
1387                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1388                                                 kprintf("Prev check - Gak, evil plot, its not FIRST and it must be!\n");
1389                                         }
1390 #endif
1391                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1392                                         if (oper) {
1393                                                 struct sctp_paramhdr *ph;
1394                                                 u_int32_t *ippp;
1395
1396                                                 oper->m_len =
1397                                                     sizeof(struct sctp_paramhdr) +
1398                                                     sizeof(*ippp);
1399                                                 ph = mtod(oper,
1400                                                     struct sctp_paramhdr *);
1401                                                 ph->param_type =
1402                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1403                                                 ph->param_length =
1404                                                     htons(oper->m_len);
1405                                                 ippp = (u_int32_t *)(ph + 1);
1406                                                 *ippp = htonl(0x10000008);
1407                                         }
1408
1409                                         sctp_abort_an_association(stcb->sctp_ep,
1410                                             stcb, SCTP_PEER_FAULTY, oper);
1411
1412                                         *abort_flag = 1;
1413                                         return;
1414                                 }
1415                         }
1416                 }
1417         }
1418
1419         if (next) {
1420                 post_tsn = chk->rec.data.TSN_seq + 1;
1421                 if (post_tsn == next->rec.data.TSN_seq) {
1422                         /*
1423                          * Ok the one I am inserting ahead of
1424                          * is my NEXT one. A bit of valdiation here.
1425                          */
1426                         if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1427                                 /* Insert chk MUST be a last fragment */
1428                                 if ((chk->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK)
1429                                    != SCTP_DATA_LAST_FRAG) {
1430 #ifdef SCTP_DEBUG
1431                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1432                                                 kprintf("Next chk - Next is FIRST, we must be LAST\n");
1433                                                 kprintf("Gak, Evil plot, its not a last!\n");
1434                                         }
1435 #endif
1436                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1437                                         if (oper) {
1438                                                 struct sctp_paramhdr *ph;
1439                                                 u_int32_t *ippp;
1440
1441                                                 oper->m_len =
1442                                                     sizeof(struct sctp_paramhdr) +
1443                                                     sizeof(*ippp);
1444                                                 ph = mtod(oper,
1445                                                     struct sctp_paramhdr *);
1446                                                 ph->param_type =
1447                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1448                                                 ph->param_length =
1449                                                     htons(oper->m_len);
1450                                                 ippp = (u_int32_t *)(ph + 1);
1451                                                 *ippp = htonl(0x10000009);
1452                                         }
1453
1454                                         sctp_abort_an_association(stcb->sctp_ep,
1455                                             stcb, SCTP_PEER_FAULTY, oper);
1456
1457                                         *abort_flag = 1;
1458                                         return;
1459                                 }
1460                         } else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1461                             SCTP_DATA_MIDDLE_FRAG ||
1462                             (next->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK) ==
1463                             SCTP_DATA_LAST_FRAG) {
1464                                 /* Insert chk CAN be MIDDLE or FIRST NOT LAST */
1465                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1466                                     SCTP_DATA_LAST_FRAG) {
1467 #ifdef SCTP_DEBUG
1468                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1469                                                 kprintf("Next chk - Next is a MIDDLE/LAST\n");
1470                                                 kprintf("Gak, Evil plot, new prev chunk is a LAST\n");
1471                                         }
1472 #endif
1473                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1474                                         if (oper) {
1475                                                 struct sctp_paramhdr *ph;
1476                                                 u_int32_t *ippp;
1477
1478                                                 oper->m_len =
1479                                                     sizeof(struct sctp_paramhdr) +
1480                                                     sizeof(*ippp);
1481                                                 ph = mtod(oper,
1482                                                     struct sctp_paramhdr *);
1483                                                 ph->param_type =
1484                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1485                                                 ph->param_length =
1486                                                     htons(oper->m_len);
1487                                                 ippp = (u_int32_t *)(ph + 1);
1488                                                 *ippp = htonl(0x1000000a);
1489                                         }
1490                                         sctp_abort_an_association(stcb->sctp_ep,
1491                                             stcb, SCTP_PEER_FAULTY, oper);
1492
1493                                         *abort_flag = 1;
1494                                         return;
1495                                 }
1496                                 if (chk->rec.data.stream_number !=
1497                                     next->rec.data.stream_number) {
1498                                         /*
1499                                          * Huh, need the correct STR here, they
1500                                          * must be the same.
1501                                          */
1502 #ifdef SCTP_DEBUG
1503                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1504                                                 kprintf("Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1505                                                     chk->rec.data.stream_number,
1506                                                     next->rec.data.stream_number);
1507                                         }
1508 #endif
1509                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1510                                         if (oper) {
1511                                                 struct sctp_paramhdr *ph;
1512                                                 u_int32_t *ippp;
1513
1514                                                 oper->m_len =
1515                                                     sizeof(struct sctp_paramhdr) +
1516                                                     sizeof(*ippp);
1517                                                 ph = mtod(oper,
1518                                                     struct sctp_paramhdr *);
1519                                                 ph->param_type =
1520                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1521                                                 ph->param_length =
1522                                                     htons(oper->m_len);
1523                                                 ippp = (u_int32_t *)(ph + 1);
1524                                                 *ippp = htonl(0x1000000b);
1525                                         }
1526
1527                                         sctp_abort_an_association(stcb->sctp_ep,
1528                                             stcb, SCTP_PEER_FAULTY, oper);
1529
1530                                         *abort_flag = 1;
1531                                         return;
1532                                 }
1533                                 if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1534                                     chk->rec.data.stream_seq !=
1535                                     next->rec.data.stream_seq) {
1536                                         /*
1537                                          * Huh, need the correct STR here, they
1538                                          * must be the same.
1539                                          */
1540 #ifdef SCTP_DEBUG
1541                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1542                                                 kprintf("Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1543                                                     chk->rec.data.stream_seq,
1544                                                     next->rec.data.stream_seq);
1545                                         }
1546 #endif
1547                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1548                                         if (oper) {
1549                                                 struct sctp_paramhdr *ph;
1550                                                 u_int32_t *ippp;
1551
1552                                                 oper->m_len =
1553                                                     sizeof(struct sctp_paramhdr) +
1554                                                     sizeof(*ippp);
1555                                                 ph = mtod(oper,
1556                                                     struct sctp_paramhdr *);
1557                                                 ph->param_type =
1558                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1559                                                 ph->param_length =
1560                                                     htons(oper->m_len);
1561                                                 ippp = (u_int32_t *)(ph + 1);
1562                                                 *ippp = htonl(0x1000000c);
1563                                         }
1564
1565                                         sctp_abort_an_association(stcb->sctp_ep,
1566                                             stcb, SCTP_PEER_FAULTY, oper);
1567
1568                                         *abort_flag = 1;
1569                                         return;
1570
1571                                 }
1572                         }
1573                 }
1574         }
1575         /*
1576          * now that we have all in there place we must check a number of
1577          * things to see if we can send data to the ULP.
1578          */
1579         /* we need to do some delivery, if we can */
1580         chk = TAILQ_FIRST(&asoc->reasmqueue);
1581         if (chk == NULL) {
1582                 /* Huh? */
1583                 asoc->size_on_reasm_queue = 0;
1584                 asoc->cnt_on_reasm_queue = 0;
1585                 return;
1586         }
1587         if (asoc->fragmented_delivery_inprogress == 0) {
1588                 nxt_todel =
1589                     asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
1590                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
1591                     (nxt_todel == chk->rec.data.stream_seq ||
1592                      (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
1593                         /*
1594                          * Yep the first one is here and its
1595                          * ok to deliver but should we?
1596                          */
1597                         if (TAILQ_EMPTY(&asoc->delivery_queue) &&
1598                             (sctp_is_all_msg_on_reasm(asoc, &tsize) ||
1599                              (asoc->size_on_reasm_queue >=
1600                               (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) &&
1601                               tsize))) {
1602                                 /*
1603                                  * Yes, we setup to
1604                                  * start reception, by backing down the TSN
1605                                  * just in case we can't deliver. If we
1606                                  */
1607                                 asoc->fragmented_delivery_inprogress = 1;
1608                                 asoc->tsn_last_delivered =
1609                                     chk->rec.data.TSN_seq - 1;
1610                                 asoc->str_of_pdapi =
1611                                     chk->rec.data.stream_number;
1612                                 asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
1613                                 asoc->fragment_flags = chk->rec.data.rcv_flags;
1614                                 sctp_service_reassembly(stcb, asoc, 0);
1615                         }
1616                 }
1617         } else {
1618                 sctp_service_reassembly(stcb, asoc, 0);
1619         }
1620 }
1621
1622 /*
1623  * This is an unfortunate routine. It checks to make sure a evil guy is not
1624  * stuffing us full of bad packet fragments. A broken peer could also do this
1625  * but this is doubtful. It is to bad I must worry about evil crackers sigh
1626  * :< more cycles.
1627  */
1628 static int
1629 sctp_does_chk_belong_to_reasm(struct sctp_association *asoc,
1630     struct sctp_tmit_chunk *chk)
1631 {
1632         struct sctp_tmit_chunk *at;
1633         u_int32_t tsn_est;
1634
1635         TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1636                 if (compare_with_wrap(chk->rec.data.TSN_seq,
1637                     at->rec.data.TSN_seq, MAX_TSN)) {
1638                         /* is it one bigger? */
1639                         tsn_est = at->rec.data.TSN_seq + 1;
1640                         if (tsn_est == chk->rec.data.TSN_seq) {
1641                                 /* yep. It better be a last then*/
1642                                 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1643                                     SCTP_DATA_LAST_FRAG) {
1644                                         /*
1645                                          * Ok this guy belongs next to a guy
1646                                          * that is NOT last, it should be a
1647                                          * middle/last, not a complete chunk.
1648                                          */
1649                                         return (1);
1650                                 } else {
1651                                         /*
1652                                          * This guy is ok since its a LAST and
1653                                          * the new chunk is a fully self-
1654                                          * contained one.
1655                                          */
1656                                         return (0);
1657                                 }
1658                         }
1659                 } else if (chk->rec.data.TSN_seq == at->rec.data.TSN_seq) {
1660                         /* Software error since I have a dup? */
1661                         return (1);
1662                 } else {
1663                         /*
1664                          * Ok, 'at' is larger than new chunk but does it
1665                          * need to be right before it.
1666                          */
1667                         tsn_est = chk->rec.data.TSN_seq + 1;
1668                         if (tsn_est == at->rec.data.TSN_seq) {
1669                                 /* Yep, It better be a first */
1670                                 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1671                                     SCTP_DATA_FIRST_FRAG) {
1672                                         return (1);
1673                                 } else {
1674                                         return (0);
1675                                 }
1676                         }
1677                 }
1678         }
1679         return (0);
1680 }
1681
1682 extern unsigned int sctp_max_chunks_on_queue;
1683 static int
1684 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1685     struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length,
1686     struct sctp_nets *net, u_int32_t *high_tsn, int *abort_flag,
1687     int *break_flag, int last_chunk)
1688 {
1689         /* Process a data chunk */
1690         /*  struct sctp_tmit_chunk *chk;*/
1691         struct sctp_tmit_chunk *chk;
1692         u_int32_t tsn, gap;
1693         struct mbuf *dmbuf;
1694         int the_len;
1695         u_int16_t strmno, strmseq;
1696         struct mbuf *oper;
1697
1698         chk = NULL;
1699         tsn = ntohl(ch->dp.tsn);
1700 #ifdef SCTP_MAP_LOGGING
1701         sctp_log_map(0, tsn, asoc->cumulative_tsn, SCTP_MAP_PREPARE_SLIDE);
1702 #endif
1703         if (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN) ||
1704             asoc->cumulative_tsn == tsn) {
1705                 /* It is a duplicate */
1706                 sctp_pegs[SCTP_DUPTSN_RECVD]++;
1707                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1708                         /* Record a dup for the next outbound sack */
1709                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1710                         asoc->numduptsns++;
1711                 }
1712                 return (0);
1713         }
1714         /* Calculate the number of TSN's between the base and this TSN */
1715         if (tsn >= asoc->mapping_array_base_tsn) {
1716                 gap  = tsn - asoc->mapping_array_base_tsn;
1717         } else {
1718                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + tsn + 1;
1719         }
1720         if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1721                 /* Can't hold the bit in the mapping at max array, toss it */
1722                 return (0);
1723         }
1724         if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) {
1725                 if (sctp_expand_mapping_array(asoc)) {
1726                         /* Can't expand, drop it */
1727                         return (0);
1728                 }
1729         }
1730         if (compare_with_wrap(tsn, *high_tsn, MAX_TSN)) {
1731                 *high_tsn = tsn;
1732         }
1733         /* See if we have received this one already */
1734         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
1735                 sctp_pegs[SCTP_DUPTSN_RECVD]++;
1736                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1737                         /* Record a dup for the next outbound sack */
1738                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1739                         asoc->numduptsns++;
1740                 }
1741                 if (!callout_pending(&asoc->dack_timer.timer)) {
1742                         /*
1743                          * By starting the timer we assure that we
1744                          * WILL sack at the end of the packet
1745                          * when sctp_sack_check gets called.
1746                          */
1747                         sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep,
1748                             stcb, NULL);
1749                 }
1750                 return (0);
1751         }
1752         /*
1753          * Check to see about the GONE flag, duplicates would cause
1754          * a sack to be sent up above
1755          */
1756         if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
1757                 /*
1758                  * wait a minute, this guy is gone, there is no
1759                  * longer a receiver. Send peer an ABORT!
1760                  */
1761                 struct mbuf *op_err;
1762                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1763                 sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
1764                 *abort_flag = 1;
1765                 return (0);
1766         }
1767         /*
1768          * Now before going further we see if there is room. If NOT then
1769          * we MAY let one through only IF this TSN is the one we are
1770          * waiting for on a partial delivery API.
1771          */
1772
1773         /* now do the tests */
1774         if (((asoc->cnt_on_all_streams +
1775          asoc->cnt_on_delivery_queue +
1776          asoc->cnt_on_reasm_queue +
1777           asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) ||
1778            (((int)asoc->my_rwnd) <= 0)) {
1779                 /*
1780                  * When we have NO room in the rwnd we check
1781                  * to make sure the reader is doing its job...
1782                  */
1783                 if (stcb->sctp_socket->so_rcv.ssb_cc) {
1784                         /* some to read, wake-up */
1785                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1786                 }
1787                 /* now is it in the mapping array of what we have accepted? */
1788                 if (compare_with_wrap(tsn,
1789                     asoc->highest_tsn_inside_map, MAX_TSN)) {
1790
1791                         /* Nope not in the valid range dump it */
1792 #ifdef SCTP_DEBUG
1793                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1794                                 kprintf("My rwnd overrun1:tsn:%lx rwnd %lu sbspace:%ld delq:%d!\n",
1795                                     (u_long)tsn, (u_long)asoc->my_rwnd,
1796                                     sctp_sbspace(&stcb->sctp_socket->so_rcv),
1797                                     stcb->asoc.cnt_on_delivery_queue);
1798                         }
1799 #endif
1800                         sctp_set_rwnd(stcb, asoc);
1801                         if ((asoc->cnt_on_all_streams +
1802                             asoc->cnt_on_delivery_queue +
1803                             asoc->cnt_on_reasm_queue +
1804                             asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) {
1805                                 sctp_pegs[SCTP_MSGC_DROP]++;
1806                         } else {
1807                                 sctp_pegs[SCTP_RWND_DROPS]++;
1808                         }
1809                         *break_flag = 1;
1810                         return (0);
1811                 }
1812         }
1813         strmno = ntohs(ch->dp.stream_id);
1814         if (strmno >= asoc->streamincnt) {
1815                 struct sctp_paramhdr *phdr;
1816                 struct mbuf *mb;
1817
1818                 MGETHDR(mb, MB_DONTWAIT, MT_DATA);
1819                 if (mb != NULL) {
1820                         /* add some space up front so prepend will work well */
1821                         mb->m_data += sizeof(struct sctp_chunkhdr);
1822                         phdr = mtod(mb, struct sctp_paramhdr *);
1823                         /*
1824                          * Error causes are just param's and this one has
1825                          * two back to back phdr, one with the error type
1826                          * and size, the other with the streamid and a rsvd
1827                          */
1828                         mb->m_pkthdr.len = mb->m_len =
1829                             (sizeof(struct sctp_paramhdr) * 2);
1830                         phdr->param_type = htons(SCTP_CAUSE_INV_STRM);
1831                         phdr->param_length =
1832                             htons(sizeof(struct sctp_paramhdr) * 2);
1833                         phdr++;
1834                         /* We insert the stream in the type field */
1835                         phdr->param_type = ch->dp.stream_id;
1836                         /* And set the length to 0 for the rsvd field */
1837                         phdr->param_length = 0;
1838                         sctp_queue_op_err(stcb, mb);
1839                 }
1840                 sctp_pegs[SCTP_BAD_STRMNO]++;
1841                 return (0);
1842         }
1843         /*
1844          * Before we continue lets validate that we are not
1845          * being fooled by an evil attacker. We can only
1846          * have 4k chunks based on our TSN spread allowed
1847          * by the mapping array 512 * 8 bits, so there is
1848          * no way our stream sequence numbers could have wrapped.
1849          * We of course only validate the FIRST fragment so the
1850          * bit must be set.
1851          */
1852         strmseq = ntohs(ch->dp.stream_sequence);
1853         if ((ch->ch.chunk_flags & SCTP_DATA_FIRST_FRAG) &&
1854             (ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0 &&
1855             (compare_with_wrap(asoc->strmin[strmno].last_sequence_delivered,
1856              strmseq, MAX_SEQ) ||
1857              asoc->strmin[strmno].last_sequence_delivered == strmseq)) {
1858                 /* The incoming sseq is behind where we last delivered? */
1859 #ifdef SCTP_DEBUG
1860                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1861                         kprintf("EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n",
1862                             strmseq,
1863                             asoc->strmin[strmno].last_sequence_delivered);
1864                 }
1865 #endif
1866                 /*
1867                  * throw it in the stream so it gets cleaned up in
1868                  * association destruction
1869                  */
1870                 MGET(oper, MB_DONTWAIT, MT_DATA);
1871                 if (oper) {
1872                         struct sctp_paramhdr *ph;
1873                         u_int32_t *ippp;
1874
1875                         oper->m_len = sizeof(struct sctp_paramhdr) +
1876                             sizeof(*ippp);
1877                         ph = mtod(oper, struct sctp_paramhdr *);
1878                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1879                         ph->param_length = htons(oper->m_len);
1880                         ippp = (u_int32_t *)(ph + 1);
1881                         *ippp = htonl(0x20000001);
1882                 }
1883                 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY,
1884                     oper);
1885                 sctp_pegs[SCTP_BAD_SSN_WRAP]++;
1886                 *abort_flag = 1;
1887                 return (0);
1888         }
1889
1890         the_len = (chk_length-sizeof(struct sctp_data_chunk));
1891         if (last_chunk == 0) {
1892                 dmbuf = sctp_m_copym(*m,
1893                     (offset + sizeof(struct sctp_data_chunk)),
1894                     the_len, MB_DONTWAIT);
1895         } else {
1896                 /* We can steal the last chunk */
1897                 dmbuf = *m;
1898                 /* lop off the top part */
1899                 m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
1900                 if (dmbuf->m_pkthdr.len > the_len) {
1901                         /* Trim the end round bytes off  too */
1902                         m_adj(dmbuf, -(dmbuf->m_pkthdr.len-the_len));
1903                 }
1904                 sctp_pegs[SCTP_NO_COPY_IN]++;
1905         }
1906         if (dmbuf == NULL) {
1907                 sctp_pegs[SCTP_DROP_NOMEMORY]++;
1908                 return (0);
1909         }
1910         if ((ch->ch.chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
1911             asoc->fragmented_delivery_inprogress == 0 &&
1912             TAILQ_EMPTY(&asoc->delivery_queue) &&
1913             ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) ||
1914              ((asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq &&
1915               TAILQ_EMPTY(&asoc->strmin[strmno].inqueue))) &&
1916             ((long)(stcb->sctp_socket->so_rcv.ssb_hiwat -
1917                     stcb->sctp_socket->so_rcv.ssb_cc) >= (long)the_len)) {
1918                 /* Candidate for express delivery */
1919                 /*
1920                  * Its not fragmented,
1921                  * No PD-API is up,
1922                  * Nothing in the delivery queue,
1923                  * Its un-ordered OR ordered and the next to deliver AND
1924                  * nothing else is stuck on the stream queue,
1925                  * And there is room for it in the socket buffer.
1926                  * Lets just stuff it up the buffer....
1927                  */
1928
1929                 struct mbuf *control, *mmm;
1930                 struct sockaddr_in6 sin6;
1931                 struct sockaddr_in6 lsa6;
1932                 struct sockaddr *to;
1933
1934                 /* It would be nice to avoid this copy if we could :< */
1935                 control = sctp_build_ctl_nchunk(stcb, tsn,
1936                     ch->dp.protocol_id, 0, strmno, strmseq,
1937                     ch->ch.chunk_flags);
1938                 /* XXX need to append PKTHDR to the socket buffer first */
1939
1940                 if ((dmbuf->m_flags & M_PKTHDR) == 0) {
1941                         struct mbuf *tmp;
1942                         MGETHDR(tmp, MB_DONTWAIT, MT_DATA);
1943                         if (tmp == NULL) {
1944
1945                                 /* no room! */
1946                                 if (control) {
1947                                         sctp_m_freem(control);
1948                                         stcb->asoc.my_rwnd_control_len -=
1949                                             CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
1950                                 }
1951
1952                                 goto failed_express_del;
1953                         }
1954                         tmp->m_pkthdr.len = the_len;
1955                         tmp->m_len = 0;
1956                         tmp->m_next = dmbuf;
1957                         dmbuf = tmp;
1958                 }
1959                 to = (struct sockaddr *)&net->ro._l_addr;
1960                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
1961                     to->sa_family == AF_INET) {
1962                         struct sockaddr_in *sin;
1963
1964                         sin = (struct sockaddr_in *)to;
1965                         bzero(&sin6, sizeof(sin6));
1966                         sin6.sin6_family = AF_INET6;
1967                         sin6.sin6_len = sizeof(struct sockaddr_in6);
1968                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
1969                         bcopy(&sin->sin_addr,
1970                             &sin6.sin6_addr.s6_addr16[3],
1971                             sizeof(sin6.sin6_addr.s6_addr16[3]));
1972                         sin6.sin6_port = sin->sin_port;
1973                         to = (struct sockaddr *)&sin6;
1974                 }
1975
1976                 /* check and strip embedded scope junk */
1977                 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
1978                     &lsa6);
1979                 if (((struct sockaddr_in *)to)->sin_port == 0) {
1980                         kprintf("Huh c, port is %d not net:%p %d?\n",
1981                                ((struct sockaddr_in *)to)->sin_port,
1982                                net,
1983                                (int)(ntohs(stcb->rport)));
1984                         ((struct sockaddr_in *)to)->sin_port = stcb->rport;
1985                 }
1986
1987                 mmm = dmbuf;
1988                 /* Mark the EOR */
1989                 while (mmm->m_next != NULL) {
1990                         mmm = mmm->m_next;
1991                 }
1992                 mmm->m_flags |= M_EOR;
1993                 if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
1994                         /* we have a new high score */
1995                         asoc->highest_tsn_inside_map = tsn;
1996 #ifdef SCTP_MAP_LOGGING
1997                         sctp_log_map(0, 1, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
1998 #endif
1999                 }
2000                 SCTP_TCB_UNLOCK(stcb);
2001                 SCTP_INP_WLOCK(stcb->sctp_ep);
2002                 SCTP_TCB_LOCK(stcb);
2003                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2004                 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to, dmbuf,
2005                     control, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2006                         if (control) {
2007                                 sctp_m_freem(control);
2008                                 stcb->asoc.my_rwnd_control_len -=
2009                                     CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
2010                         }
2011                         sctp_m_freem(dmbuf);
2012                         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2013                         goto failed_express_del;
2014                 }
2015                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2016                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
2017                         if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2018                                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2019                         }
2020                 } else {
2021                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2022                 }
2023                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2024                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2025                 if ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0) {
2026
2027                         /* for ordered, bump what we delivered */
2028                         asoc->strmin[strmno].last_sequence_delivered++;
2029                 }
2030                 sctp_pegs[SCTP_EXPRESS_ROUTE]++;
2031 #ifdef SCTP_STR_LOGGING
2032                 sctp_log_strm_del_alt(tsn, strmseq,
2033                     SCTP_STR_LOG_FROM_EXPRS_DEL);
2034 #endif
2035 #ifdef SCTP_DEBUG
2036                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
2037                         kprintf("Express Delivery succeeds\n");
2038                 }
2039 #endif
2040                 goto finish_express_del;
2041         }
2042
2043  failed_express_del:
2044         /* If we reach here this is a new chunk */
2045         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
2046         if (chk == NULL) {
2047                 /* No memory so we drop the chunk */
2048                 sctp_pegs[SCTP_DROP_NOMEMORY]++;
2049                 if (last_chunk == 0) {
2050                         /* we copied it, free the copy */
2051                         sctp_m_freem(dmbuf);
2052                 }
2053                 return (0);
2054         }
2055         sctppcbinfo.ipi_count_chunk++;
2056         sctppcbinfo.ipi_gencnt_chunk++;
2057         chk->rec.data.TSN_seq = tsn;
2058         chk->rec.data.stream_seq = strmseq;
2059         chk->rec.data.stream_number = strmno;
2060         chk->rec.data.payloadtype = ch->dp.protocol_id;
2061         chk->rec.data.context = 0;
2062         chk->rec.data.doing_fast_retransmit = 0;
2063         chk->rec.data.rcv_flags = ch->ch.chunk_flags;
2064         chk->asoc = asoc;
2065         chk->send_size = the_len;
2066         chk->whoTo = net;
2067         net->ref_count++;
2068         chk->data = dmbuf;
2069
2070
2071         /* Mark it as received */
2072         /* Now queue it where it belongs */
2073         if ((chk->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
2074             SCTP_DATA_NOT_FRAG) {
2075                 /* First a sanity check */
2076                 if (asoc->fragmented_delivery_inprogress) {
2077                         /*
2078                          * Ok, we have a fragmented delivery in progress
2079                          * if this chunk is next to deliver OR belongs in
2080                          * our view to the reassembly, the peer is evil
2081                          * or broken.
2082                          */
2083                         u_int32_t estimate_tsn;
2084                         estimate_tsn = asoc->tsn_last_delivered + 1;
2085                         if (TAILQ_EMPTY(&asoc->reasmqueue) &&
2086                             (estimate_tsn == chk->rec.data.TSN_seq)) {
2087                                 /* Evil/Broke peer */
2088                                 MGET(oper, MB_DONTWAIT, MT_DATA);
2089                                 if (oper) {
2090                                         struct sctp_paramhdr *ph;
2091                                         u_int32_t *ippp;
2092
2093                                         oper->m_len =
2094                                             sizeof(struct sctp_paramhdr) +
2095                                             sizeof(*ippp);
2096                                         ph = mtod(oper, struct sctp_paramhdr *);
2097                                         ph->param_type =
2098                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2099                                         ph->param_length = htons(oper->m_len);
2100                                         ippp = (u_int32_t *)(ph + 1);
2101                                         *ippp = htonl(0x20000002);
2102                                 }
2103                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
2104                                     SCTP_PEER_FAULTY, oper);
2105
2106                                 *abort_flag = 1;
2107                                 sctp_pegs[SCTP_DROP_FRAG]++;
2108                                 return (0);
2109                         } else {
2110                                 if (sctp_does_chk_belong_to_reasm(asoc, chk)) {
2111                                         MGET(oper, MB_DONTWAIT, MT_DATA);
2112                                         if (oper) {
2113                                                 struct sctp_paramhdr *ph;
2114                                                 u_int32_t *ippp;
2115
2116                                                 oper->m_len =
2117                                                     sizeof(struct sctp_paramhdr) +
2118                                                     sizeof(*ippp);
2119                                                 ph = mtod(oper,
2120                                                     struct sctp_paramhdr *);
2121                                                 ph->param_type =
2122                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2123                                                 ph->param_length =
2124                                                     htons(oper->m_len);
2125                                                 ippp = (u_int32_t *)(ph + 1);
2126                                                 *ippp = htonl(0x20000003);
2127                                         }
2128                                         sctp_abort_an_association(stcb->sctp_ep,
2129                                             stcb, SCTP_PEER_FAULTY, oper);
2130
2131                                         *abort_flag = 1;
2132                                         sctp_pegs[SCTP_DROP_FRAG]++;
2133                                         return (0);
2134                                 }
2135                         }
2136                 } else {
2137                         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
2138                                 /*
2139                                  * Reassembly queue is NOT empty
2140                                  * validate that this chk does not need to
2141                                  * be in reasembly queue. If it does then
2142                                  * our peer is broken or evil.
2143                                  */
2144                                 if (sctp_does_chk_belong_to_reasm(asoc, chk)) {
2145                                         MGET(oper, MB_DONTWAIT, MT_DATA);
2146                                         if (oper) {
2147                                                 struct sctp_paramhdr *ph;
2148                                                 u_int32_t *ippp;
2149
2150                                                 oper->m_len =
2151                                                     sizeof(struct sctp_paramhdr) +
2152                                                     sizeof(*ippp);
2153                                                 ph = mtod(oper,
2154                                                     struct sctp_paramhdr *);
2155                                                 ph->param_type =
2156                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2157                                                 ph->param_length =
2158                                                     htons(oper->m_len);
2159                                                 ippp = (u_int32_t *)(ph + 1);
2160                                                 *ippp = htonl(0x20000004);
2161                                         }
2162                                         sctp_abort_an_association(stcb->sctp_ep,
2163                                             stcb, SCTP_PEER_FAULTY, oper);
2164
2165                                         *abort_flag = 1;
2166                                         sctp_pegs[SCTP_DROP_FRAG]++;
2167                                         return (0);
2168                                 }
2169                         }
2170                 }
2171                 if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
2172                         /* queue directly into socket buffer */
2173                         sctp_deliver_data(stcb, asoc, chk, 0);
2174                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2175                 } else {
2176                         /* Special check for when streams are resetting.
2177                          * We could be more smart about this and check the
2178                          * actual stream to see if it is not being reset.. that
2179                          * way we would not create a HOLB when amongst streams
2180                          * being reset and those not being reset.
2181                          *
2182                          * We take complete messages that have a stream reset
2183                          * intervening (aka the TSN is after where our cum-ack needs
2184                          * to be) off and put them on a pending_reply_queue. The
2185                          * reassembly ones we do not have to worry about since
2186                          * they are all sorted and proceessed by TSN order. It
2187                          * is only the singletons I must worry about.
2188                          */
2189                         if ((asoc->pending_reply) &&
2190                            ((compare_with_wrap(tsn, ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) ||
2191                             (tsn == ntohl(asoc->pending_reply->reset_at_tsn)))
2192                                 ) {
2193                                 /* yep its past where we need to reset... go ahead and
2194                                  * queue it.
2195                                  */
2196                                 TAILQ_INSERT_TAIL(&asoc->pending_reply_queue , chk, sctp_next);
2197                         }  else {
2198                                 sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag);
2199                         }
2200                 }
2201         } else {
2202                 /* Into the re-assembly queue */
2203                 sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag);
2204                 if (*abort_flag) {
2205                         sctp_pegs[SCTP_DROP_FRAG]++;
2206                         return (0);
2207                 }
2208         }
2209         if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
2210                 /* we have a new high score */
2211                 asoc->highest_tsn_inside_map = tsn;
2212 #ifdef SCTP_MAP_LOGGING
2213                 sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2214 #endif
2215         }
2216  finish_express_del:
2217         if (last_chunk) {
2218                 *m = NULL;
2219         }
2220         sctp_pegs[SCTP_PEG_TSNS_RCVD]++;
2221         /* Set it present please */
2222 #ifdef SCTP_STR_LOGGING
2223         sctp_log_strm_del_alt(tsn, strmseq, SCTP_STR_LOG_FROM_MARK_TSN);
2224 #endif
2225 #ifdef SCTP_MAP_LOGGING
2226         sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2227                      asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2228 #endif
2229         SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
2230         return (1);
2231 }
2232
2233 void
2234 sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort_flag)
2235 {
2236         /*
2237          * Now we also need to check the mapping array in a couple of ways.
2238          * 1) Did we move the cum-ack point?
2239          */
2240         struct sctp_association *asoc;
2241         int i, at;
2242         int m_size, all_ones;
2243         int slide_from, slide_end, lgap, distance;
2244 #ifdef SCTP_MAP_LOGGING
2245         uint32_t old_cumack, old_base, old_highest;
2246         unsigned char aux_array[64];
2247 #endif
2248
2249         asoc = &stcb->asoc;
2250         at = 0;
2251
2252 #ifdef SCTP_MAP_LOGGING
2253         old_cumack = asoc->cumulative_tsn;
2254         old_base = asoc->mapping_array_base_tsn;
2255         old_highest = asoc->highest_tsn_inside_map;
2256         if (asoc->mapping_array_size < 64)
2257                 memcpy(aux_array, asoc->mapping_array,
2258                     asoc->mapping_array_size);
2259         else
2260                 memcpy(aux_array, asoc->mapping_array, 64);
2261 #endif
2262
2263         /*
2264          * We could probably improve this a small bit by calculating the
2265          * offset of the current cum-ack as the starting point.
2266          */
2267         all_ones = 1;
2268         m_size = stcb->asoc.mapping_array_size << 3;
2269         for (i = 0; i < m_size; i++) {
2270                 if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
2271                         /*
2272                          * Ok we found the first place that we are
2273                          * missing a TSN.
2274                          */
2275                         at = i;
2276                         all_ones = 0;
2277                         asoc->cumulative_tsn = asoc->mapping_array_base_tsn +
2278                             (i - 1);
2279                         break;
2280                 }
2281         }
2282         if (compare_with_wrap(asoc->cumulative_tsn,
2283                               asoc->highest_tsn_inside_map,
2284                               MAX_TSN)) {
2285                 panic("huh, cumack greater than high-tsn in map");
2286         }
2287         if (all_ones ||
2288             (asoc->cumulative_tsn == asoc->highest_tsn_inside_map && at >= 8)) {
2289                 /* The complete array was completed by a single FR */
2290                 /* higest becomes the cum-ack */
2291                 int clr;
2292                 asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
2293                 /* clear the array */
2294                 if (all_ones)
2295                         clr = asoc->mapping_array_size;
2296                 else {
2297                         clr = (at >> 3) + 1;
2298                         /*
2299                          * this should be the allones case
2300                          * but just in case :>
2301                          */
2302                         if (clr > asoc->mapping_array_size)
2303                                 clr = asoc->mapping_array_size;
2304                 }
2305                 memset(asoc->mapping_array, 0, clr);
2306                 /* base becomes one ahead of the cum-ack */
2307                 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2308 #ifdef SCTP_MAP_LOGGING
2309                 sctp_log_map(old_base, old_cumack, old_highest,
2310                     SCTP_MAP_PREPARE_SLIDE);
2311                 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2312                     asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_CLEARED);
2313 #endif
2314         } else if (at >= 8) {
2315                 /* we can slide the mapping array down */
2316                 /* Calculate the new byte postion we can move down */
2317                 slide_from = at >> 3;
2318                 /* now calculate the ceiling of the move using our highest TSN value */
2319                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
2320                         lgap = asoc->highest_tsn_inside_map -
2321                             asoc->mapping_array_base_tsn;
2322                 } else {
2323                         lgap = (MAX_TSN - asoc->mapping_array_base_tsn) +
2324                             asoc->highest_tsn_inside_map + 1;
2325                 }
2326                 slide_end = lgap >> 3;
2327                 if (slide_end < slide_from) {
2328                         panic("impossible slide");
2329                 }
2330                 distance = (slide_end-slide_from) + 1;
2331 #ifdef SCTP_MAP_LOGGING
2332                 sctp_log_map(old_base, old_cumack, old_highest,
2333                     SCTP_MAP_PREPARE_SLIDE);
2334                 sctp_log_map((uint32_t)slide_from, (uint32_t)slide_end,
2335                     (uint32_t)lgap, SCTP_MAP_SLIDE_FROM);
2336 #endif
2337                 if (distance + slide_from > asoc->mapping_array_size ||
2338                     distance < 0) {
2339 #ifdef SCTP_DEBUG
2340                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
2341                                 kprintf("Ugh bad addition.. you can't hrumpp!\n");
2342                         }
2343 #endif
2344                         /*
2345                          * Here we do NOT slide forward the array so that
2346                          * hopefully when more data comes in to fill it up
2347                          * we will be able to slide it forward. Really
2348                          * I don't think this should happen :-0
2349                          */
2350
2351 #ifdef SCTP_MAP_LOGGING
2352                         sctp_log_map((uint32_t)distance, (uint32_t)slide_from,
2353                             (uint32_t)asoc->mapping_array_size,
2354                             SCTP_MAP_SLIDE_NONE);
2355 #endif
2356                 } else {
2357                         int ii;
2358                         for (ii = 0; ii < distance; ii++) {
2359                                 asoc->mapping_array[ii] =
2360                                     asoc->mapping_array[slide_from + ii];
2361                         }
2362                         for (ii = distance;ii <= slide_end; ii++) {
2363                                 asoc->mapping_array[ii] = 0;
2364                         }
2365                         asoc->mapping_array_base_tsn += (slide_from << 3);
2366 #ifdef SCTP_MAP_LOGGING
2367                         sctp_log_map(asoc->mapping_array_base_tsn,
2368                             asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2369                             SCTP_MAP_SLIDE_RESULT);
2370 #endif
2371                 }
2372         }
2373
2374         /* check the special flag for stream resets */
2375         if ((asoc->pending_reply) &&
2376            ((compare_with_wrap((asoc->cumulative_tsn+1), ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) ||
2377             ((asoc->cumulative_tsn+1) ==  ntohl(asoc->pending_reply->reset_at_tsn)))
2378                 ) {
2379                 /* we have finished working through the backlogged TSN's now
2380                  * time to reset streams.
2381                  * 1: call reset function.
2382                  * 2: free pending_reply space
2383                  * 3: distribute any chunks in pending_reply_queue.
2384                  */
2385                 struct sctp_tmit_chunk *chk;
2386                 sctp_handle_stream_reset_response(stcb, asoc->pending_reply);
2387                 kfree(asoc->pending_reply, M_PCB);
2388                 asoc->pending_reply = NULL;
2389                 chk = TAILQ_FIRST(&asoc->pending_reply_queue);
2390                 while (chk) {
2391                         TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next);
2392                         sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag);
2393                         if (*abort_flag) {
2394                                 return;
2395                         }
2396                         chk = TAILQ_FIRST(&asoc->pending_reply_queue);
2397                 }
2398         }
2399         /*
2400          * Now we need to see if we need to queue a sack or just start
2401          * the timer (if allowed).
2402          */
2403         if (ok_to_sack) {
2404                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2405                         /*
2406                          * Ok special case, in SHUTDOWN-SENT case.
2407                          * here we maker sure SACK timer is off and
2408                          * instead send a SHUTDOWN and a SACK
2409                          */
2410                         if (callout_pending(&stcb->asoc.dack_timer.timer)) {
2411                                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2412                                     stcb->sctp_ep, stcb, NULL);
2413                         }
2414 #ifdef SCTP_DEBUG
2415                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2416                                 kprintf("%s:%d sends a shutdown\n",
2417                                        __FILE__,
2418                                        __LINE__
2419                                        );
2420                         }
2421 #endif
2422                         sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
2423                         sctp_send_sack(stcb);
2424                 } else {
2425                         int is_a_gap;
2426                         /* is there a gap now ? */
2427                         is_a_gap = compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2428                             stcb->asoc.cumulative_tsn, MAX_TSN);
2429                         if ((stcb->asoc.first_ack_sent == 0) || /* First time we send a sack */
2430                             ((was_a_gap) && (is_a_gap == 0)) || /* was a gap, but no longer is one */
2431                             (stcb->asoc.numduptsns) ||          /* we have dup's */
2432                             (is_a_gap) ||                       /* is still a gap */
2433                             (callout_pending(&stcb->asoc.dack_timer.timer)) /* timer was up . second packet */
2434                                 ) {
2435                                 /*
2436                                  * Ok we must build a SACK since the timer
2437                                  * is pending, we got our first packet OR
2438                                  * there are gaps or duplicates.
2439                                  */
2440                                 stcb->asoc.first_ack_sent = 1;
2441                                 sctp_send_sack(stcb);
2442                                 /* The sending will stop the timer */
2443                         } else {
2444                                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2445                                     stcb->sctp_ep, stcb, NULL);
2446                         }
2447                 }
2448         }
2449 }
2450
2451 void
2452 sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks)
2453 {
2454         struct sctp_tmit_chunk *chk;
2455         int tsize, cntDel;
2456         u_int16_t nxt_todel;
2457
2458         cntDel = 0;
2459         if (asoc->fragmented_delivery_inprogress) {
2460                 sctp_service_reassembly(stcb, asoc, hold_locks);
2461         }
2462         /* Can we proceed further, i.e. the PD-API is complete */
2463         if (asoc->fragmented_delivery_inprogress) {
2464                 /* no */
2465                 return;
2466         }
2467
2468         /*
2469          * Yes, reassembly delivery no longer in progress see if we
2470          * have some on the sb hold queue.
2471          */
2472         do {
2473                 if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) {
2474                         if (cntDel == 0)
2475                                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2476                         break;
2477                 }
2478                 /* If deliver_data says no we must stop */
2479                 if (sctp_deliver_data(stcb, asoc, NULL, hold_locks) == 0)
2480                         break;
2481                 cntDel++;
2482                 chk = TAILQ_FIRST(&asoc->delivery_queue);
2483         } while (chk);
2484         if (cntDel) {
2485                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2486         }
2487         /*
2488          * Now is there some other chunk I can deliver
2489          * from the reassembly queue.
2490          */
2491         chk = TAILQ_FIRST(&asoc->reasmqueue);
2492         if (chk == NULL) {
2493                 asoc->size_on_reasm_queue = 0;
2494                 asoc->cnt_on_reasm_queue = 0;
2495                 return;
2496         }
2497         nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
2498         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
2499             ((nxt_todel == chk->rec.data.stream_seq) ||
2500              (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
2501                 /*
2502                  * Yep the first one is here. We setup to
2503                  * start reception, by backing down the TSN
2504                  * just in case we can't deliver.
2505                  */
2506
2507                 /*
2508                  * Before we start though either all of the
2509                  * message should be here or 1/4 the socket buffer
2510                  * max or nothing on the delivery queue and something
2511                  * can be delivered.
2512                  */
2513                 if (TAILQ_EMPTY(&asoc->delivery_queue) &&
2514                     (sctp_is_all_msg_on_reasm(asoc, &tsize) ||
2515                      (asoc->size_on_reasm_queue >=
2516                       (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) && tsize))) {
2517                         asoc->fragmented_delivery_inprogress = 1;
2518                         asoc->tsn_last_delivered = chk->rec.data.TSN_seq-1;
2519                         asoc->str_of_pdapi = chk->rec.data.stream_number;
2520                         asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
2521                         asoc->fragment_flags = chk->rec.data.rcv_flags;
2522                         sctp_service_reassembly(stcb, asoc, hold_locks);
2523                 }
2524         }
2525 }
2526
2527 int
2528 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2529     struct sctphdr *sh, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2530     struct sctp_nets *net, u_int32_t *high_tsn)
2531 {
2532         struct sctp_data_chunk *ch, chunk_buf;
2533         struct sctp_association *asoc;
2534         int num_chunks = 0;     /* number of control chunks processed */
2535         int chk_length, break_flag, last_chunk;
2536         int abort_flag = 0, was_a_gap = 0;
2537         struct mbuf *m;
2538
2539         /* set the rwnd */
2540         sctp_set_rwnd(stcb, &stcb->asoc);
2541
2542         m = *mm;
2543         asoc = &stcb->asoc;
2544         if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2545             stcb->asoc.cumulative_tsn, MAX_TSN)) {
2546                 /* there was a gap before this data was processed */
2547                 was_a_gap = 1;
2548         }
2549         /*
2550          * setup where we got the last DATA packet from for
2551          * any SACK that may need to go out. Don't bump
2552          * the net. This is done ONLY when a chunk
2553          * is assigned.
2554          */
2555         asoc->last_data_chunk_from = net;
2556
2557         /*
2558          * Now before we proceed we must figure out if this
2559          * is a wasted cluster... i.e. it is a small packet
2560          * sent in and yet the driver underneath allocated a
2561          * full cluster for it. If so we must copy it to a
2562          * smaller mbuf and free up the cluster mbuf. This
2563          * will help with cluster starvation.
2564          */
2565         if (m->m_len < (long)MHLEN && m->m_next == NULL) {
2566                 /* we only handle mbufs that are singletons.. not chains */
2567 #ifdef __DragonFly__
2568                 if ((*mm)->m_flags & M_PKTHDR)
2569                         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2570                 else
2571 #endif
2572                         MGET(m, MB_DONTWAIT, MT_DATA);
2573                 if (m) {
2574                         /* ok lets see if we can copy the data up */
2575                         caddr_t *from, *to;
2576
2577                         if ((*mm)->m_flags & M_PKTHDR) {
2578                                 /* got to copy the header first */
2579 #ifdef __APPLE__
2580                                 M_COPY_PKTHDR(m, (*mm));
2581 #else
2582                                 M_MOVE_PKTHDR(m, (*mm));
2583 #endif
2584                         }
2585                         /* get the pointers and copy */
2586                         to = mtod(m, caddr_t *);
2587                         from = mtod((*mm), caddr_t *);
2588                         memcpy(to, from, (*mm)->m_len);
2589                         /* copy the length and free up the old */
2590                         m->m_len = (*mm)->m_len;
2591                         sctp_m_freem(*mm);
2592                         /* sucess, back copy */
2593                         *mm = m;
2594                 } else {
2595                         /* We are in trouble in the mbuf world .. yikes */
2596                         m = *mm;
2597                 }
2598         }
2599         /* get pointer to the first chunk header */
2600         ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2601             sizeof(chunk_buf), (u_int8_t *)&chunk_buf);
2602         if (ch == NULL) {
2603                 kprintf(" ... its short\n");
2604                 return (1);
2605         }
2606         /*
2607          * process all DATA chunks...
2608          */
2609
2610 #ifdef SCTP_DEBUG
2611         if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2612                 kprintf("In process data off:%d length:%d iphlen:%d ch->type:%d\n",
2613                     *offset, length, iphlen, (int)ch->ch.chunk_type);
2614         }
2615 #endif
2616
2617         *high_tsn = asoc->cumulative_tsn;
2618         break_flag = 0;
2619         while (ch->ch.chunk_type == SCTP_DATA) {
2620                 /* validate chunk length */
2621                 chk_length = ntohs(ch->ch.chunk_length);
2622                 if ((size_t)chk_length < sizeof(struct sctp_data_chunk) + 1 ||
2623                     length - *offset < chk_length) {
2624                         /*
2625                          * Need to send an abort since we had a invalid
2626                          * data chunk.
2627                          */
2628                         struct mbuf *op_err;
2629                         MGET(op_err, MB_DONTWAIT, MT_DATA);
2630                         if (op_err) {
2631                                 struct sctp_paramhdr *ph;
2632                                 u_int32_t *ippp;
2633
2634                                 op_err->m_len = sizeof(struct sctp_paramhdr) +
2635                                     sizeof(*ippp);
2636                                 ph = mtod(op_err, struct sctp_paramhdr *);
2637                                 ph->param_type =
2638                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2639                                 ph->param_length = htons(op_err->m_len);
2640                                 ippp = (u_int32_t *)(ph + 1);
2641                                 *ippp = htonl(0x30000001);
2642                         }
2643                         sctp_abort_association(inp, stcb, m, iphlen, sh,
2644                             op_err);
2645                         return (2);
2646                 }
2647 #ifdef SCTP_DEBUG
2648                 if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2649                         kprintf("A chunk of len:%d to process (tot:%d)\n",
2650                             chk_length, length - *offset);
2651                 }
2652 #endif
2653
2654 #ifdef SCTP_AUDITING_ENABLED
2655                 sctp_audit_log(0xB1, 0);
2656 #endif
2657                 if (SCTP_SIZE32(chk_length) == *offset - length) {
2658                         last_chunk = 1;
2659                 } else {
2660                         last_chunk = 0;
2661                 }
2662                 if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch,
2663                     chk_length, net, high_tsn, &abort_flag, &break_flag,
2664                     last_chunk)) {
2665                         num_chunks++;
2666 #ifdef SCTP_DEBUG
2667                         if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2668                                 kprintf("Now incr num_chunks to %d\n",
2669                                     num_chunks);
2670                         }
2671 #endif
2672                 }
2673                 if (abort_flag)
2674                         return (2);
2675
2676                 if (break_flag) {
2677                         /*
2678                          * Set because of out of rwnd space and no drop rep
2679                          * space left.
2680                          */
2681                         break;
2682                 }
2683
2684                 *offset += SCTP_SIZE32(chk_length);
2685                 if (*offset >= length) {
2686                         /* no more data left in the mbuf chain */
2687                         break;
2688                 }
2689                 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2690                     sizeof(chunk_buf), (u_int8_t *)&chunk_buf);
2691                 if (ch == NULL) {
2692                         *offset = length;
2693                         break;
2694                 }
2695         } /* while */
2696         if (break_flag) {
2697                 /*
2698                  * we need to report rwnd overrun drops.
2699                  */
2700                 sctp_send_packet_dropped(stcb, net, *mm, iphlen, 0);
2701         }
2702         if (num_chunks) {
2703                 /*
2704                  * Did we get data, if so update the time for
2705                  * auto-close and give peer credit for being
2706                  * alive.
2707                  */
2708                 sctp_pegs[SCTP_DATA_DG_RECV]++;
2709                 stcb->asoc.overall_error_count = 0;
2710                 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2711         }
2712         /* now service all of the reassm queue and delivery queue */
2713         sctp_service_queues(stcb, asoc, 0);
2714         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2715                 /*
2716                  * Assure that we ack right away by making
2717                  * sure that a d-ack timer is running. So the
2718                  * sack_check will send a sack.
2719                  */
2720                 sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb,
2721                     net);
2722         }
2723         /* Start a sack timer or QUEUE a SACK for sending */
2724         sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
2725         if (abort_flag)
2726                 return (2);
2727
2728         return (0);
2729 }
2730
2731 static void
2732 sctp_handle_segments(struct sctp_tcb *stcb, struct sctp_association *asoc,
2733     struct sctp_sack_chunk *ch, u_long last_tsn, u_long *biggest_tsn_acked,
2734     u_long *biggest_newly_acked_tsn, int num_seg, int *ecn_seg_sums)
2735 {
2736         /************************************************/
2737         /* process fragments and update sendqueue        */
2738         /************************************************/
2739         struct sctp_sack *sack;
2740         struct sctp_gap_ack_block *frag;
2741         struct sctp_tmit_chunk *tp1;
2742         int i;
2743         unsigned int j;
2744 #ifdef SCTP_FR_LOGGING
2745         int num_frs=0;
2746 #endif
2747         uint16_t frag_strt, frag_end, primary_flag_set;
2748         u_long last_frag_high;
2749
2750         if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
2751                 primary_flag_set = 1;
2752         } else {
2753                 primary_flag_set = 0;
2754         }
2755
2756         sack = &ch->sack;
2757         frag = (struct sctp_gap_ack_block *)((caddr_t)sack +
2758             sizeof(struct sctp_sack));
2759         tp1 = NULL;
2760         last_frag_high = 0;
2761         for (i = 0; i < num_seg; i++) {
2762                 frag_strt = ntohs(frag->start);
2763                 frag_end = ntohs(frag->end);
2764                 /* some sanity checks on the fargment offsets */
2765                 if (frag_strt > frag_end) {
2766                         /* this one is malformed, skip */
2767                         frag++;
2768                         continue;
2769                 }
2770                 if (compare_with_wrap((frag_end+last_tsn), *biggest_tsn_acked,
2771                     MAX_TSN))
2772                         *biggest_tsn_acked = frag_end+last_tsn;
2773
2774                 /* mark acked dgs and find out the highestTSN being acked */
2775                 if (tp1 == NULL) {
2776                         tp1 = TAILQ_FIRST(&asoc->sent_queue);
2777
2778                         /* save the locations of the last frags */
2779                         last_frag_high = frag_end + last_tsn;
2780                 } else {
2781                         /*
2782                          * now lets see if we need to reset the queue
2783                          * due to a out-of-order SACK fragment
2784                          */
2785                         if (compare_with_wrap(frag_strt+last_tsn,
2786                             last_frag_high, MAX_TSN)) {
2787                                 /*
2788                                  * if the new frag starts after the last TSN
2789                                  * frag covered, we are ok
2790                                  * and this one is beyond the last one
2791                                  */
2792                                 ;
2793                         } else {
2794                                 /*
2795                                  * ok, they have reset us, so we need to reset
2796                                  * the queue this will cause extra hunting but
2797                                  * hey, they chose the performance
2798                                  * hit when they failed to order there gaps..
2799                                  */
2800                                 tp1 = TAILQ_FIRST(&asoc->sent_queue);
2801                         }
2802                         last_frag_high = frag_end + last_tsn;
2803                 }
2804                 for (j = frag_strt + last_tsn; j <= frag_end + last_tsn; j++) {
2805                         while (tp1) {
2806 #ifdef SCTP_FR_LOGGING
2807                                 if (tp1->rec.data.doing_fast_retransmit)
2808                                         num_frs++;
2809 #endif
2810
2811                                 if (tp1->rec.data.TSN_seq == j) {
2812                                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2813                                                 /* must be held until cum-ack passes */
2814                                                 /* ECN Nonce: Add the nonce value to the sender's nonce sum */
2815                                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
2816                                                         /*
2817                                                          * If it is less than
2818                                                          * ACKED, it is now
2819                                                          * no-longer in flight.
2820                                                          * Higher values may
2821                                                          * already be set via
2822                                                          * previous Gap Ack
2823                                                          * Blocks...
2824                                                          * i.e. ACKED or MARKED.
2825                                                          */
2826                                                         if (compare_with_wrap(tp1->rec.data.TSN_seq,
2827                                                             *biggest_newly_acked_tsn,
2828                                                             MAX_TSN)) {
2829                                                                 *biggest_newly_acked_tsn =
2830                                                                     tp1->rec.data.TSN_seq;
2831                                                         }
2832                                                         tp1->whoTo->flight_size -= tp1->book_size;
2833                                                         if (tp1->whoTo->flight_size < 0) {
2834                                                                 tp1->whoTo->flight_size = 0;
2835                                                         }
2836                                                         asoc->total_flight -=
2837                                                             tp1->book_size;
2838
2839                                                         if (asoc->total_flight < 0) {
2840                                                                 asoc->total_flight = 0;
2841                                                         }
2842
2843                                                         asoc->total_flight_count--;
2844                                                         if (asoc->total_flight_count < 0) {
2845                                                                 asoc->total_flight_count = 0;
2846                                                         }
2847
2848                                                         if (tp1->snd_count < 2) {
2849                                                                 /* True non-retransmited chunk */
2850                                                                 tp1->whoTo->net_ack2 +=
2851                                                                     tp1->send_size;
2852
2853                                                                 /* update RTO too? */
2854                                                                 if (tp1->do_rtt) {
2855                                                                         tp1->whoTo->RTO =
2856                                                                             sctp_calculate_rto(stcb,
2857                                                                             asoc,
2858                                                                             tp1->whoTo,
2859                                                                             &tp1->sent_rcv_time);
2860                                                                         tp1->whoTo->rto_pending = 0;
2861                                                                         tp1->do_rtt = 0;
2862                                                                 }
2863                                                         }
2864                                                 }
2865                                                 if (tp1->sent <= SCTP_DATAGRAM_RESEND &&
2866                                                     tp1->sent != SCTP_DATAGRAM_UNSENT &&
2867                                                     compare_with_wrap(tp1->rec.data.TSN_seq,
2868                                                     asoc->this_sack_highest_gap,
2869                                                     MAX_TSN)) {
2870                                                         asoc->this_sack_highest_gap =
2871                                                             tp1->rec.data.TSN_seq;
2872                                                         if (primary_flag_set) {
2873                                                                 tp1->whoTo->cacc_saw_newack = 1;
2874                                                         }
2875                                                 }
2876                                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
2877 #ifdef SCTP_DEBUG
2878                                                         if (sctp_debug_on &
2879                                                             SCTP_DEBUG_INDATA3) {
2880                                                                 kprintf("Hmm. one that is in RESEND that is now ACKED\n");
2881                                                         }
2882 #endif
2883                                                         asoc->sent_queue_retran_cnt--;
2884 #ifdef SCTP_AUDITING_ENABLED
2885                                                         sctp_audit_log(0xB2,
2886                                                             (asoc->sent_queue_retran_cnt & 0x000000ff));
2887 #endif
2888
2889                                                         if (asoc->sent_queue_retran_cnt < 0) {
2890                                                                 kprintf("huh3 retran went negative?\n");
2891 #ifdef SCTP_AUDITING_ENABLED
2892                                                                 sctp_auditing(30,
2893                                                                     inp, tcb,
2894                                                                     NULL);
2895 #else
2896                                                                 asoc->sent_queue_retran_cnt = 0;
2897 #endif
2898                                                         }
2899                                                 }
2900                                                 (*ecn_seg_sums) += tp1->rec.data.ect_nonce;
2901                                                 (*ecn_seg_sums) &= SCTP_SACK_NONCE_SUM;
2902                                                 tp1->sent = SCTP_DATAGRAM_MARKED;
2903                                         }
2904                                         break;
2905                                 } /* if (tp1->TSN_seq == j) */
2906                                 if (compare_with_wrap(tp1->rec.data.TSN_seq, j,
2907                                     MAX_TSN))
2908                                         break;
2909                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
2910                         }/* end while (tp1) */
2911                 }  /* end for (j = fragStart */
2912                 frag++; /* next one */
2913         }
2914 #ifdef SCTP_FR_LOGGING
2915         if (num_frs)
2916                 sctp_log_fr(*biggest_tsn_acked, *biggest_newly_acked_tsn,
2917                     last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
2918 #endif
2919 }
2920
2921 static void
2922 sctp_check_for_revoked(struct sctp_association *asoc, u_long cum_ack,
2923     u_long biggest_tsn_acked)
2924 {
2925         struct sctp_tmit_chunk *tp1;
2926         int tot_revoked=0;
2927
2928         tp1 = TAILQ_FIRST(&asoc->sent_queue);
2929         while (tp1) {
2930                 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
2931                     MAX_TSN)) {
2932                         /*
2933                          * ok this guy is either ACK or MARKED. If it is ACKED
2934                          * it has been previously acked but not this time i.e.
2935                          * revoked.  If it is MARKED it was ACK'ed again.
2936                          */
2937                         if (tp1->sent == SCTP_DATAGRAM_ACKED) {
2938                                 /* it has been revoked */
2939                                 /*
2940                                  * We do NOT add back to flight size here since
2941                                  * it is really NOT in flight. Resend (when/if
2942                                  * it occurs will add to flight size
2943                                  */
2944                                 tp1->sent = SCTP_DATAGRAM_SENT;
2945                                 tot_revoked++;
2946                         } else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
2947                                 /* it has been re-acked in this SACK */
2948                                 tp1->sent = SCTP_DATAGRAM_ACKED;
2949                         }
2950                 }
2951                 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
2952                     MAX_TSN)) {
2953                         /* above the sack */
2954                         break;
2955                 }
2956                 if (tp1->sent == SCTP_DATAGRAM_UNSENT)
2957                         break;
2958                 tp1 = TAILQ_NEXT(tp1, sctp_next);
2959         }
2960         if (tot_revoked > 0) {
2961                 /* Setup the ecn nonce re-sync point. We
2962                  * do this since once data is revoked
2963                  * we begin to retransmit things, which
2964                  * do NOT have the ECN bits set. This means
2965                  * we are now out of sync and must wait until
2966                  * we get back in sync with the peer to
2967                  * check ECN bits.
2968                  */
2969                 tp1 = TAILQ_FIRST(&asoc->send_queue);
2970                 if (tp1 == NULL) {
2971                         asoc->nonce_resync_tsn = asoc->sending_seq;
2972                 } else {
2973                         asoc->nonce_resync_tsn = tp1->rec.data.TSN_seq;
2974                 }
2975                 asoc->nonce_wait_for_ecne = 0;
2976                 asoc->nonce_sum_check = 0;
2977         }
2978
2979 }
2980
2981 extern int sctp_peer_chunk_oh;
2982
2983 static void
2984 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
2985     u_long biggest_tsn_acked, int strike_enabled,
2986     u_long biggest_tsn_newly_acked, int accum_moved)
2987 {
2988         struct sctp_tmit_chunk *tp1;
2989         int strike_flag=0;
2990         struct timeval now;
2991         int tot_retrans=0;
2992         u_int32_t sending_seq;
2993         int primary_switch_active = 0;
2994         int double_switch_active = 0;
2995
2996         /* select the sending_seq, this is
2997          * either the next thing ready to
2998          * be sent but not transmitted, OR,
2999          * the next seq we assign.
3000          */
3001         tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3002         if (tp1 == NULL) {
3003                 sending_seq = asoc->sending_seq;
3004         } else {
3005                 sending_seq = tp1->rec.data.TSN_seq;
3006         }
3007
3008         if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
3009                 primary_switch_active = 1;
3010         }
3011         if (asoc->primary_destination->dest_state & SCTP_ADDR_DOUBLE_SWITCH) {
3012                 double_switch_active = 1;
3013         }
3014         if (stcb->asoc.peer_supports_prsctp ) {
3015                 SCTP_GETTIME_TIMEVAL(&now);
3016         }
3017         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3018         while (tp1) {
3019                 strike_flag=0;
3020                 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
3021                     MAX_TSN) ||
3022                     tp1->sent == SCTP_DATAGRAM_UNSENT) {
3023                         /* done */
3024                         break;
3025                 }
3026                 if ((tp1->flags & (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) ==
3027                     SCTP_PR_SCTP_ENABLED &&
3028                     tp1->sent < SCTP_DATAGRAM_ACKED) {
3029                         /* Is it expired? */
3030 #ifndef __FreeBSD__
3031                         if (timercmp(&now, &tp1->rec.data.timetodrop, >))
3032 #else
3033                         if (timevalcmp(&now, &tp1->rec.data.timetodrop, >))
3034 #endif
3035                         {
3036                                 /* Yes so drop it */
3037                                 if (tp1->data != NULL) {
3038                                         sctp_release_pr_sctp_chunk(stcb, tp1,
3039                                             (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3040                                             &asoc->sent_queue);
3041                                 }
3042                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3043                                 continue;
3044                         }
3045                 }
3046
3047                 if (compare_with_wrap(tp1->rec.data.TSN_seq,
3048                     asoc->this_sack_highest_gap, MAX_TSN)) {
3049                         /* we are beyond the tsn in the sack  */
3050                         break;
3051                 }
3052                 if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3053                         /* either a RESEND, ACKED, or MARKED */
3054                         /* skip */
3055                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3056                         continue;
3057                 }
3058                 if (primary_switch_active && (strike_enabled == 0)) {
3059                         if (tp1->whoTo != asoc->primary_destination) {
3060                                 /*
3061                                  * We can only strike things on the primary if
3062                                  * the strike_enabled flag is clear
3063                                  */
3064                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3065                                 continue;
3066                         }
3067                 } else if (primary_switch_active) {
3068                         if (tp1->whoTo->cacc_saw_newack == 0) {
3069                                 /*
3070                                  * Only one was received but it was NOT
3071                                  * this one.
3072                                  */
3073                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3074                                 continue;
3075                         }
3076                 }
3077                 if (double_switch_active &&
3078                     (compare_with_wrap(asoc->primary_destination->next_tsn_at_change,
3079                     tp1->rec.data.TSN_seq, MAX_TSN))) {
3080                         /*
3081                          * With a double switch we do NOT mark unless we
3082                          * are beyond the switch point.
3083                          */
3084                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3085                         continue;
3086                 }
3087                 /*
3088                  * Here we check to see if we were have already done a FR
3089                  * and if so we see if the biggest TSN we saw in the sack is
3090                  * smaller than the recovery point. If so we don't strike the
3091                  * tsn... otherwise we CAN strike the TSN.
3092                  */
3093                 if (accum_moved && asoc->fast_retran_loss_recovery) {
3094                         /*
3095                          * Strike the TSN if in fast-recovery and
3096                          * cum-ack moved.
3097                          */
3098                         tp1->sent++;
3099                 } else if (tp1->rec.data.doing_fast_retransmit) {
3100                         /*
3101                          * For those that have done a FR we must
3102                          * take special consideration if we strike. I.e
3103                          * the biggest_newly_acked must be higher
3104                          * than the sending_seq at the time we did
3105                          * the FR.
3106                          */
3107 #ifdef SCTP_FR_TO_ALTERNATE
3108                         /*
3109                          * If FR's go to new networks, then we
3110                          * must only do this for singly homed asoc's. However
3111                          * if the FR's go to the same network (Armando's work)
3112                          * then its ok to FR multiple times.
3113                          */
3114                         if (asoc->numnets < 2)
3115 #else
3116                         if (1)
3117 #endif
3118                         {
3119                                 if ((compare_with_wrap(biggest_tsn_newly_acked,
3120                                     tp1->rec.data.fast_retran_tsn, MAX_TSN)) ||
3121                                     (biggest_tsn_newly_acked ==
3122                                      tp1->rec.data.fast_retran_tsn)) {
3123                                         /*
3124                                          * Strike the TSN, since this ack is
3125                                          * beyond where things were when we did
3126                                          * a FR.
3127                                          */
3128 #ifdef SCTP_FR_LOGGING
3129                                         sctp_log_fr(biggest_tsn_newly_acked,
3130                                             tp1->rec.data.TSN_seq,
3131                                             tp1->rec.data.fast_retran_tsn,
3132                                             SCTP_FR_LOG_STRIKE_CHUNK);
3133 #endif
3134                                         tp1->sent++;
3135                                         strike_flag=1;
3136                                 }
3137                         }
3138                 } else if (compare_with_wrap(tp1->rec.data.TSN_seq,
3139                     biggest_tsn_newly_acked, MAX_TSN)) {
3140                         /*
3141                          * We don't strike these:
3142                          * This is the  HTNA algorithm i.e. we don't strike
3143                          * If our TSN is larger than the Highest TSN Newly
3144                          * Acked.
3145                          */
3146                         ;
3147                 } else {
3148                         /* Strike the TSN */
3149                         tp1->sent++;
3150                 }
3151                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3152                         /* Increment the count to resend */
3153                         struct sctp_nets *alt;
3154
3155 #ifdef SCTP_FR_LOGGING
3156                         sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count,
3157                             0, SCTP_FR_MARKED);
3158 #endif
3159                         if (strike_flag) {
3160                                 /* This is a subsequent FR */
3161                                 sctp_pegs[SCTP_DUP_FR]++;
3162                         }
3163                         asoc->sent_queue_retran_cnt++;
3164 #ifdef SCTP_FR_TO_ALTERNATE
3165                         /* Can we find an alternate? */
3166                         alt = sctp_find_alternate_net(stcb, tp1->whoTo);
3167 #else
3168                         /*
3169                          * default behavior is to NOT retransmit FR's
3170                          * to an alternate. Armando Caro's paper details
3171                          * why.
3172                          */
3173                         alt = tp1->whoTo;
3174 #endif
3175                         tp1->rec.data.doing_fast_retransmit = 1;
3176                         tot_retrans++;
3177                         /* mark the sending seq for possible subsequent FR's */
3178                         if (TAILQ_EMPTY(&asoc->send_queue)) {
3179