sys/netinet/sctp_indata.c

   1 /*      $KAME: sctp_indata.c,v 1.35 2004/08/17 04:06:17 itojun Exp $    */
   2
   3 /*
   4  * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc,
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the project nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #if !(defined(__OpenBSD__) || defined(__APPLE__))
  33 #include "opt_ipsec.h"
  34 #endif
  35 #if defined(__FreeBSD__) || defined(__DragonFly__)
  36 #include "opt_inet6.h"
  37 #include "opt_inet.h"
  38 #endif
  39 #if defined(__NetBSD__)
  40 #include "opt_inet.h"
  41 #endif
  42
  43 #ifdef __APPLE__
  44 #include <sctp.h>
  45 #elif !defined(__OpenBSD__)
  46 #include "opt_sctp.h"
  47 #endif
  48
  49 #include <sys/param.h>
  50 #include <sys/systm.h>
  51 #include <sys/mbuf.h>
  52 #include <sys/malloc.h>
  53 #include <sys/socket.h>
  54 #include <sys/socketvar.h>
  55 #include <sys/sysctl.h>
  56
  57 #include <net/if.h>
  58 #include <net/route.h>
  59
  60
  61 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
  62 #include <sys/limits.h>
  63 #else
  64 #include <machine/limits.h>
  65 #endif
  66 #include <machine/cpu.h>
  67
  68 #include <netinet/in.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/ip.h>
  71 #ifdef INET6
  72 #include <netinet/ip6.h>
  73 #endif /* INET6 */
  74 #include <netinet/in_pcb.h>
  75 #include <netinet/in_var.h>
  76 #include <netinet/ip_var.h>
  77 #ifdef INET6
  78 #include <netinet6/ip6_var.h>
  79 #endif /* INET6 */
  80 #include <netinet/ip_icmp.h>
  81 #include <netinet/icmp_var.h>
  82 #include <netinet/sctp_var.h>
  83 #include <netinet/sctp_pcb.h>
  84 #include <netinet/sctp_header.h>
  85 #include <netinet/sctputil.h>
  86 #include <netinet/sctp_output.h>
  87 #include <netinet/sctp_input.h>
  88 #include <netinet/sctp_hashdriver.h>
  89 #include <netinet/sctp_indata.h>
  90 #include <netinet/sctp_uio.h>
  91 #include <netinet/sctp_timer.h>
  92 #ifdef IPSEC
  93 #ifndef __OpenBSD__
  94 #include <netinet6/ipsec.h>
  95 #include <netproto/key/key.h>
  96 #else
  97 #undef IPSEC
  98 #endif
  99 #endif /*IPSEC*/
 100
 101 #include <net/net_osdep.h>
 102
 103 #ifdef SCTP_DEBUG
 104 extern u_int32_t sctp_debug_on;
 105 #endif
 106
 107 /*
 108  * NOTES: On the outbound side of things I need to check the sack timer to
 109  * see if I should generate a sack into the chunk queue (if I have data to
 110  * send that is and will be sending it .. for bundling.
 111  *
 112  * The callback in sctp_usrreq.c will get called when the socket is read
 113  * from. This will cause sctp_service_queues() to get called on the top
 114  * entry in the list.
 115  */
 116
 117 extern int sctp_strict_sacks;
 118
 119 void
 120 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
 121 {
 122         u_int32_t calc, calc_w_oh;
 123
 124 #ifdef SCTP_DEBUG
 125         if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
 126                 kprintf("cc:%lu hiwat:%lu lowat:%lu mbcnt:%lu mbmax:%lu\n",
 127                        (u_long)stcb->sctp_socket->so_rcv.ssb_cc,
 128                        (u_long)stcb->sctp_socket->so_rcv.ssb_hiwat,
 129                        (u_long)stcb->sctp_socket->so_rcv.ssb_lowat,
 130                        (u_long)stcb->sctp_socket->so_rcv.ssb_mbcnt,
 131                        (u_long)stcb->sctp_socket->so_rcv.ssb_mbmax);
 132                 kprintf("Setting rwnd to: sb:%ld - (del:%d + reasm:%d str:%d)\n",
 133                        sctp_sbspace(&stcb->sctp_socket->so_rcv),
 134                        asoc->size_on_delivery_queue,
 135                        asoc->size_on_reasm_queue,
 136                        asoc->size_on_all_streams);
 137         }
 138 #endif
 139         if (stcb->sctp_socket->so_rcv.ssb_cc == 0 &&
 140             asoc->size_on_delivery_queue == 0 &&
 141             asoc->size_on_reasm_queue == 0 &&
 142             asoc->size_on_all_streams == 0) {
 143                 /* Full rwnd granted */
 144                 asoc->my_rwnd = max(stcb->sctp_socket->so_rcv.ssb_hiwat,
 145                                     SCTP_MINIMAL_RWND);
 146                 return;
 147         }
 148         /* get actual space */
 149         calc = (u_int32_t)sctp_sbspace(&stcb->sctp_socket->so_rcv);
 150
 151         /* take out what has NOT been put on socket queue and
 152          * we yet hold for putting up.
 153          */
 154         calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_delivery_queue);
 155         calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_reasm_queue);
 156         calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_all_streams);
 157
 158         /* what is the overhead of all these rwnd's */
 159         calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
 160
 161         asoc->my_rwnd = calc;
 162         if (calc_w_oh == 0) {
 163                 /* If our overhead is greater than the advertised
 164                  * rwnd, we clamp the rwnd to 1. This lets us
 165                  * still accept inbound segments, but hopefully will
 166                  * shut the sender down when he finally gets the message.
 167                  */
 168                 asoc->my_rwnd = 1;
 169         } else {
 170                 /* SWS threshold */
 171                 if (asoc->my_rwnd &&
 172                     (asoc->my_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
 173                         /* SWS engaged, tell peer none left */
 174                         asoc->my_rwnd = 1;
 175 #ifdef SCTP_DEBUG
 176                         if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
 177                                 kprintf(" - SWS zeros\n");
 178                         }
 179                 } else {
 180                         if (sctp_debug_on & SCTP_DEBUG_INDATA4) {
 181                                 kprintf("\n");
 182                         }
 183 #endif
 184                 }
 185         }
 186 }
 187
 188 /*
 189  * Take a chk structure and build it into an mbuf. Hmm should we change things
 190  * so that instead we store the data side in a chunk?
 191  */
 192 static struct mbuf *
 193 sctp_build_ctl_nchunk(struct sctp_tcb *stcb, uint32_t tsn, uint32_t ppid,
 194     uint32_t context, uint16_t stream_no, uint16_t stream_seq, uint8_t flags)
 195 {
 196         struct sctp_sndrcvinfo *outinfo;
 197         struct cmsghdr *cmh;
 198         struct mbuf *ret;
 199
 200         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) {
 201                 /* user does not want the sndrcv ctl */
 202                 return (NULL);
 203         }
 204
 205         MGETHDR(ret, MB_DONTWAIT, MT_CONTROL);
 206         if (ret == NULL) {
 207                 /* No space */
 208                 return (ret);
 209         }
 210         /* We need a CMSG header followed by the struct  */
 211         cmh = mtod(ret, struct cmsghdr *);
 212         outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
 213         cmh->cmsg_level = IPPROTO_SCTP;
 214         cmh->cmsg_type = SCTP_SNDRCV;
 215         cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 216         outinfo->sinfo_stream = stream_no;
 217         outinfo->sinfo_ssn = stream_seq;
 218         if (flags & SCTP_DATA_UNORDERED) {
 219                 outinfo->sinfo_flags = MSG_UNORDERED;
 220         } else {
 221                 outinfo->sinfo_flags = 0;
 222         }
 223         outinfo->sinfo_ppid = ppid;
 224         outinfo->sinfo_context = context;
 225         outinfo->sinfo_assoc_id = sctp_get_associd(stcb);
 226         outinfo->sinfo_tsn = tsn;
 227         outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
 228         ret->m_len = cmh->cmsg_len;
 229         ret->m_pkthdr.len = ret->m_len;
 230         /*
 231          * We track how many control len's have gone upon the sb
 232          * and do not count these in the rwnd calculation.
 233          */
 234         stcb->asoc.my_rwnd_control_len +=
 235             CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 236
 237         return (ret);
 238 }
 239
 240 /*
 241  * Take a chk structure and build it into an mbuf.  Should we change things
 242  * so that instead we store the data side in a chunk?
 243  */
 244 static
 245 struct mbuf *
 246 sctp_build_ctl(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk)
 247 {
 248         struct sctp_sndrcvinfo *outinfo;
 249         struct cmsghdr *cmh;
 250         struct mbuf *ret;
 251         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) {
 252                 /* user does not want the sndrcv ctl */
 253                 return (NULL);
 254         }
 255         MGET(ret, MB_DONTWAIT, MT_CONTROL);
 256         if (ret == NULL) {
 257                 /* No space */
 258                 return (ret);
 259         }
 260
 261         /* We need a CMSG header followed by the struct  */
 262         cmh = mtod(ret, struct cmsghdr *);
 263         outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
 264         cmh->cmsg_level = IPPROTO_SCTP;
 265         cmh->cmsg_type = SCTP_SNDRCV;
 266         cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 267         outinfo->sinfo_stream = chk->rec.data.stream_number;
 268         outinfo->sinfo_ssn = chk->rec.data.stream_seq;
 269         if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
 270                 outinfo->sinfo_flags = MSG_UNORDERED;
 271         } else {
 272                 outinfo->sinfo_flags = 0;
 273         }
 274         outinfo->sinfo_ppid = chk->rec.data.payloadtype;
 275         outinfo->sinfo_context = chk->rec.data.context;
 276         outinfo->sinfo_assoc_id = sctp_get_associd(stcb);
 277         outinfo->sinfo_tsn = chk->rec.data.TSN_seq;
 278         outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
 279         ret->m_len = cmh->cmsg_len;
 280         stcb->asoc.my_rwnd_control_len +=
 281             CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 282
 283         return (ret);
 284 }
 285
 286 int
 287 sctp_deliver_data(struct sctp_tcb *stcb, struct sctp_association *asoc,
 288     struct sctp_tmit_chunk *chk, int hold_locks)
 289 {
 290         struct mbuf *control, *m;
 291         int free_it;
 292         struct sockaddr_in6 sin6;
 293         struct sockaddr *to;
 294
 295 #ifdef SCTP_DEBUG
 296         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 297                 kprintf("I am now in Deliver data! (%p)\n", chk);
 298         }
 299 #endif
 300         /* get a write lock on the inp if not already */
 301         if (hold_locks == 0) {
 302                 SCTP_TCB_UNLOCK(stcb);
 303                 SCTP_INP_WLOCK(stcb->sctp_ep);
 304                 SCTP_TCB_LOCK(stcb);
 305         }
 306         free_it = 0;
 307         /* We always add it to the queue */
 308         if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
 309                 /* socket above is long gone */
 310 #ifdef SCTP_DEBUG
 311                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 312                         kprintf("gone is gone!\n");
 313                 }
 314 #endif
 315                 if (chk != NULL) {
 316                         if (chk->data)
 317                                 sctp_m_freem(chk->data);
 318                         chk->data = NULL;
 319                         sctp_free_remote_addr(chk->whoTo);
 320                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 321                         sctppcbinfo.ipi_count_chunk--;
 322                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 323                                 panic("Chunk count is negative");
 324                         }
 325                         sctppcbinfo.ipi_gencnt_chunk++;
 326                 }
 327                 TAILQ_FOREACH(chk, &asoc->delivery_queue, sctp_next) {
 328                         asoc->size_on_delivery_queue -= chk->send_size;
 329                         asoc->cnt_on_delivery_queue--;
 330                         /*
 331                          * Lose the data pointer, since its in the socket buffer
 332                          */
 333                         if (chk->data)
 334                                 sctp_m_freem(chk->data);
 335                         chk->data = NULL;
 336                         /* Now free the address and data */
 337                         sctp_free_remote_addr(chk->whoTo);
 338                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 339                         sctppcbinfo.ipi_count_chunk--;
 340                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 341                                 panic("Chunk count is negative");
 342                         }
 343                         sctppcbinfo.ipi_gencnt_chunk++;
 344                 }
 345                 if (hold_locks == 0)
 346                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 347                 return (0);
 348         }
 349         if (chk != NULL) {
 350                 TAILQ_INSERT_TAIL(&asoc->delivery_queue, chk, sctp_next);
 351                 asoc->size_on_delivery_queue += chk->send_size;
 352                 asoc->cnt_on_delivery_queue++;
 353         }
 354         if (asoc->fragmented_delivery_inprogress) {
 355                 /*
 356                  * oh oh, fragmented delivery in progress
 357                  * return out of here.
 358                  */
 359 #ifdef SCTP_DEBUG
 360                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 361                         kprintf("Fragmented delivery in progress?\n");
 362                 }
 363 #endif
 364                 if (hold_locks == 0)
 365                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 366                 return (0);
 367         }
 368         /* Now grab the first one  */
 369         chk = TAILQ_FIRST(&asoc->delivery_queue);
 370         if (chk == NULL) {
 371                 /* Nothing in queue */
 372 #ifdef SCTP_DEBUG
 373                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 374                         kprintf("Nothing in queue?\n");
 375                 }
 376 #endif
 377                 asoc->size_on_delivery_queue = 0;
 378                 asoc->cnt_on_delivery_queue = 0;
 379                 if (hold_locks == 0)
 380                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 381                 return (0);
 382         }
 383
 384         if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) {
 385                 /* Boy, there really is NO room */
 386                 if (hold_locks == 0)
 387                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 388                 return (0);
 389         }
 390 #ifdef SCTP_DEBUG
 391         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 392                 kprintf("Now to the delivery with chk(%p)!\n", chk);
 393         }
 394 #endif
 395         /* XXX need to append PKTHDR to the socket buffer first */
 396         if ((chk->data->m_flags & M_PKTHDR) == 0) {
 397                 MGETHDR(m, MB_DONTWAIT, MT_DATA);
 398                 if (m == NULL) {
 399                         /* no room! */
 400                         if (hold_locks == 0)
 401                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 402                         return (0);
 403                 }
 404                 m->m_pkthdr.len = chk->send_size;
 405                 m->m_len = 0;
 406                 m->m_next = chk->data;
 407                 chk->data = m;
 408         }
 409         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
 410                 if (chk->data->m_next == NULL) {
 411                         /* hopefully we hit here most of the time */
 412                         chk->data->m_flags |= M_EOR;
 413                 } else {
 414                         /* Add the flag to the LAST mbuf in the chain */
 415                         m = chk->data;
 416                         while (m->m_next != NULL) {
 417                                 m = m->m_next;
 418                         }
 419                         m->m_flags |= M_EOR;
 420                 }
 421         }
 422
 423         if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 424                 struct sockaddr_in6 lsa6;
 425
 426                 control = sctp_build_ctl(stcb, chk);
 427                 to = (struct sockaddr *)&chk->whoTo->ro._l_addr;
 428                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
 429                     to->sa_family == AF_INET) {
 430                         struct sockaddr_in *sin;
 431
 432                         sin = (struct sockaddr_in *)to;
 433                         bzero(&sin6, sizeof(sin6));
 434                         sin6.sin6_family = AF_INET6;
 435                         sin6.sin6_len = sizeof(struct sockaddr_in6);
 436                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
 437                         bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3],
 438                             sizeof(sin6.sin6_addr.s6_addr16[3]));
 439                         sin6.sin6_port = sin->sin_port;
 440                         to = (struct sockaddr *)&sin6;
 441                 }
 442                 /* check and strip embedded scope junk */
 443                 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
 444                     &lsa6);
 445                 if (((struct sockaddr_in *)to)->sin_port == 0) {
 446                         kprintf("Huh a, port is %d not net:%p %d?\n",
 447                                ((struct sockaddr_in *)to)->sin_port,
 448                                chk->whoTo,
 449                                (int)(ntohs(stcb->rport)));
 450                         ((struct sockaddr_in *)to)->sin_port = stcb->rport;
 451                 }
 452                 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < (long)chk->send_size) {
 453                         /* Gak not enough room */
 454                         if (control) {
 455                                 sctp_m_freem(control);
 456                                 stcb->asoc.my_rwnd_control_len -=
 457                                     CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 458                         }
 459                         goto skip;
 460                 }
 461                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
 462                 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
 463                     to, chk->data, control, stcb->asoc.my_vtag,
 464                     stcb->sctp_ep)) {
 465                         /* Gak not enough room */
 466                         if (control) {
 467                                 sctp_m_freem(control);
 468                                 stcb->asoc.my_rwnd_control_len -=
 469                                     CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 470                         }
 471                 } else {
 472                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
 473                                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
 474                                         stcb->asoc.my_rwnd_control_len +=
 475                                                 sizeof(struct mbuf);
 476                                 }
 477                         } else {
 478                                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
 479                         }
 480                         free_it = 1;
 481                 }
 482                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
 483         } else {
 484                 /* append to a already started message. */
 485                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
 486                 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >=
 487                     (long)chk->send_size) {
 488                         ssb_append(&stcb->sctp_socket->so_rcv, chk->data);
 489                         free_it = 1;
 490                 }
 491                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
 492         }
 493  skip:
 494         if (hold_locks == 0)
 495                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 496         /* free up the one we inserted */
 497         if (free_it) {
 498                 /* Pull it off the queue */
 499 #ifdef SCTP_DEBUG
 500                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 501                         kprintf("Free_it true, doing tickle wakeup\n");
 502                 }
 503 #endif
 504                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 505                 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next);
 506                 asoc->size_on_delivery_queue -= chk->send_size;
 507                 asoc->cnt_on_delivery_queue--;
 508                 /* Lose the data pointer, since its in the socket buffer */
 509                 chk->data = NULL;
 510                 /* Now free the address and data */
 511                 sctp_free_remote_addr(chk->whoTo);
 512                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 513                 sctppcbinfo.ipi_count_chunk--;
 514                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 515                         panic("Chunk count is negative");
 516                 }
 517                 sctppcbinfo.ipi_gencnt_chunk++;
 518         }
 519         return (free_it);
 520 }
 521
 522 /*
 523  * We are delivering currently from the reassembly queue. We must continue to
 524  * deliver until we either:
 525  * 1) run out of space.
 526  * 2) run out of sequential TSN's
 527  * 3) hit the SCTP_DATA_LAST_FRAG flag.
 528  */
 529 static void
 530 sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks)
 531 {
 532         struct sockaddr *to;
 533         struct sockaddr_in6 sin6;
 534         struct sctp_tmit_chunk *chk, *at;
 535         struct mbuf *control, *m;
 536         u_int16_t nxt_todel;
 537         u_int16_t stream_no;
 538         int cntDel;
 539         cntDel = stream_no = 0;
 540         if (hold_locks == 0) {
 541                 /*
 542                  * you always have the TCB lock, we need
 543                  * to have the inp write lock as well.
 544                  */
 545                 SCTP_TCB_UNLOCK(stcb);
 546                 SCTP_INP_WLOCK(stcb->sctp_ep);
 547                 SCTP_TCB_LOCK(stcb);
 548         }
 549         if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
 550                 /* socket above is long gone */
 551                 asoc->fragmented_delivery_inprogress = 0;
 552                 TAILQ_FOREACH(chk, &asoc->reasmqueue, sctp_next) {
 553                         asoc->size_on_delivery_queue -= chk->send_size;
 554                         asoc->cnt_on_delivery_queue--;
 555                         /*
 556                          * Lose the data pointer, since its in the socket buffer
 557                          */
 558                         if (chk->data)
 559                                 sctp_m_freem(chk->data);
 560                         chk->data = NULL;
 561                         /* Now free the address and data */
 562                         sctp_free_remote_addr(chk->whoTo);
 563                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 564                         sctppcbinfo.ipi_count_chunk--;
 565                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 566                                 panic("Chunk count is negative");
 567                         }
 568                         sctppcbinfo.ipi_gencnt_chunk++;
 569                 }
 570                 if (hold_locks == 0)
 571                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 572                 return;
 573         }
 574         do {
 575                 if (stcb->sctp_socket->so_rcv.ssb_cc >=
 576                     stcb->sctp_socket->so_rcv.ssb_hiwat) {
 577                         if (cntDel) {
 578                                 sctp_sorwakeup(stcb->sctp_ep,
 579                                                stcb->sctp_socket);
 580                         }
 581                         if (hold_locks == 0)
 582                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 583                         return;
 584                 }
 585                 chk = TAILQ_FIRST(&asoc->reasmqueue);
 586                 if (chk == NULL) {
 587                         if (cntDel) {
 588                                 sctp_sorwakeup(stcb->sctp_ep,
 589                                                stcb->sctp_socket);
 590                         }
 591                         if (hold_locks == 0)
 592                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 593                         return;
 594                 }
 595                 if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) {
 596                         /* Can't deliver more :< */
 597                         if (cntDel) {
 598                                 sctp_sorwakeup(stcb->sctp_ep,
 599                                                stcb->sctp_socket);
 600                         }
 601                         if (hold_locks == 0)
 602                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 603                         return;
 604                 }
 605                 stream_no = chk->rec.data.stream_number;
 606                 nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1;
 607                 if (nxt_todel != chk->rec.data.stream_seq &&
 608                     (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
 609                         /*
 610                          * Not the next sequence to deliver in its stream OR
 611                          * unordered
 612                          */
 613                         if (cntDel) {
 614                                 sctp_sorwakeup(stcb->sctp_ep,
 615                                                stcb->sctp_socket);
 616                         }
 617                         if (hold_locks == 0)
 618                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 619                         return;
 620                 }
 621
 622                 if ((chk->data->m_flags & M_PKTHDR) == 0) {
 623                         MGETHDR(m, MB_DONTWAIT, MT_DATA);
 624                         if (m == NULL) {
 625                                 /* no room! */
 626                                 if (hold_locks == 0)
 627                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 628                                 return;
 629                         }
 630                         m->m_pkthdr.len = chk->send_size;
 631                         m->m_len = 0;
 632                         m->m_next = chk->data;
 633                         chk->data = m;
 634                 }
 635                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
 636                         if (chk->data->m_next == NULL) {
 637                                 /* hopefully we hit here most of the time */
 638                                 chk->data->m_flags |= M_EOR;
 639                         } else {
 640                                 /* Add the flag to the LAST mbuf in the chain */
 641                                 m = chk->data;
 642                                 while (m->m_next != NULL) {
 643                                         m = m->m_next;
 644                                 }
 645                                 m->m_flags |= M_EOR;
 646                         }
 647                 }
 648                 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 649                         struct sockaddr_in6 lsa6;
 650
 651                         control = sctp_build_ctl(stcb, chk);
 652                         to = (struct sockaddr *)&chk->whoTo->ro._l_addr;
 653                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
 654                             to->sa_family == AF_INET) {
 655                                 struct sockaddr_in *sin;
 656                                 sin = (struct sockaddr_in *)to;
 657                                 bzero(&sin6, sizeof(sin6));
 658                                 sin6.sin6_family = AF_INET6;
 659                                 sin6.sin6_len = sizeof(struct sockaddr_in6);
 660                                 sin6.sin6_addr.s6_addr16[2] = 0xffff;
 661                                 bcopy(&sin->sin_addr,
 662                                       &sin6.sin6_addr.s6_addr16[3],
 663                                       sizeof(sin6.sin6_addr.s6_addr16[3]));
 664                                 sin6.sin6_port = sin->sin_port;
 665                                 to = (struct sockaddr *)&sin6;
 666                         }
 667                         /* check and strip embedded scope junk */
 668                         to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
 669                                                                    &lsa6);
 670                         if (((struct sockaddr_in *)to)->sin_port == 0) {
 671                                 kprintf("Huh b, port is %d not net:%p %d?\n",
 672                                        ((struct sockaddr_in *)to)->sin_port,
 673                                        chk->whoTo,
 674                                        (int)(ntohs(stcb->rport)));
 675                                 ((struct sockaddr_in *)to)->sin_port = stcb->rport;
 676                         }
 677                         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) <
 678                             (long)chk->send_size) {
 679                                 if (control) {
 680                                         sctp_m_freem(control);
 681                                         stcb->asoc.my_rwnd_control_len -=
 682                                                 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 683                                 }
 684                                 sctp_sorwakeup(stcb->sctp_ep,
 685                                                stcb->sctp_socket);
 686                                 if (hold_locks == 0)
 687                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 688                                 return;
 689                         }
 690                         lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
 691                         if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv,
 692                                                   to, chk->data, control, stcb->asoc.my_vtag,
 693                                                   stcb->sctp_ep)) {
 694                                 /* Gak not enough room */
 695                                 if (control) {
 696                                         sctp_m_freem(control);
 697                                         stcb->asoc.my_rwnd_control_len -=
 698                                                 CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 699                                 }
 700                                 sctp_sorwakeup(stcb->sctp_ep,
 701                                                stcb->sctp_socket);
 702                                 if (hold_locks == 0)
 703                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 704                                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
 705                                 return;
 706                         }
 707                         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
 708                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
 709                                 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
 710                                         stcb->asoc.my_rwnd_control_len +=
 711                                                 sizeof(struct mbuf);
 712                                 }
 713                         } else {
 714                                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
 715                         }
 716                         cntDel++;
 717                 } else {
 718                         if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >=
 719                             (long)chk->send_size) {
 720                                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
 721                                 ssb_append(&stcb->sctp_socket->so_rcv, chk->data);
 722                                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
 723                                 cntDel++;
 724                         } else {
 725                                 /* out of space in the sb */
 726                                 sctp_sorwakeup(stcb->sctp_ep,
 727                                                stcb->sctp_socket);
 728                                 if (hold_locks == 0)
 729                                         SCTP_INP_WUNLOCK(stcb->sctp_ep);
 730                                 return;
 731                         }
 732                 }
 733                 /* pull it we did it */
 734                 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
 735                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
 736                         asoc->fragmented_delivery_inprogress = 0;
 737                         if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
 738                                 asoc->strmin[stream_no].last_sequence_delivered++;
 739                         }
 740                 }
 741                 asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
 742                 asoc->size_on_reasm_queue -= chk->send_size;
 743                 asoc->cnt_on_reasm_queue--;
 744                 /* free up the chk */
 745                 sctp_free_remote_addr(chk->whoTo);
 746                 chk->data = NULL;
 747                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 748                 sctppcbinfo.ipi_count_chunk--;
 749                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 750                         panic("Chunk count is negative");
 751                 }
 752                 sctppcbinfo.ipi_gencnt_chunk++;
 753                 if (asoc->fragmented_delivery_inprogress == 0) {
 754                         /*
 755                          * Now lets see if we can deliver the next one on the
 756                          * stream
 757                          */
 758                         u_int16_t nxt_todel;
 759                         struct sctp_stream_in *strm;
 760
 761                         strm = &asoc->strmin[stream_no];
 762                         nxt_todel = strm->last_sequence_delivered + 1;
 763                         chk = TAILQ_FIRST(&strm->inqueue);
 764                         if (chk && (nxt_todel == chk->rec.data.stream_seq)) {
 765                                 while (chk != NULL) {
 766                                         /* all delivered */
 767                                         if (nxt_todel ==
 768                                             chk->rec.data.stream_seq) {
 769                                                 at = TAILQ_NEXT(chk, sctp_next);
 770                                                 TAILQ_REMOVE(&strm->inqueue,
 771                                                              chk, sctp_next);
 772                                                 asoc->size_on_all_streams -=
 773                                                         chk->send_size;
 774                                                 asoc->cnt_on_all_streams--;
 775                                                 strm->last_sequence_delivered++;
 776                                                 /*
 777                                                  * We ignore the return of
 778                                                  * deliver_data here since we
 779                                                  * always can hold the chunk on
 780                                                  * the d-queue. And we have a
 781                                                  * finite number that can be
 782                                                  * delivered from the strq.
 783                                                  */
 784                                                 sctp_deliver_data(stcb, asoc, chk, 1);
 785                                                 chk = at;
 786                                         } else {
 787                                                 break;
 788                                         }
 789                                         nxt_todel =
 790                                                 strm->last_sequence_delivered + 1;
 791                                 }
 792                         }
 793                         if (!TAILQ_EMPTY(&asoc->delivery_queue)) {
 794                                 /* Here if deliver_data fails, we must break */
 795                                 if (sctp_deliver_data(stcb, asoc, NULL, 1) == 0)
 796                                         break;
 797                         }
 798                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 799                         if (hold_locks == 0)
 800                                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 801                         return;
 802                 }
 803                 chk = TAILQ_FIRST(&asoc->reasmqueue);
 804         } while (chk);
 805         if (cntDel) {
 806                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 807         }
 808         if (hold_locks == 0)
 809                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 810 }
 811
 812 /*
 813  * Queue the chunk either right into the socket buffer if it is the next one
 814  * to go OR put it in the correct place in the delivery queue.  If we do
 815  * append to the so_buf, keep doing so until we are out of order.
 816  * One big question still remains, what to do when the socket buffer is FULL??
 817  */
 818 static void
 819 sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc,
 820     struct sctp_tmit_chunk *chk, int *abort_flag)
 821 {
 822         struct sctp_stream_in *strm;
 823         struct sctp_tmit_chunk *at;
 824         int queue_needed;
 825         u_int16_t nxt_todel;
 826         struct mbuf *oper;
 827
 828 /*** FIX FIX FIX ???
 829  * Need to add code to deal with 16 bit seq wrap
 830  * without a TSN wrap for ordered delivery (maybe).
 831  * FIX FIX FIX ???
 832  */
 833         queue_needed = 1;
 834         asoc->size_on_all_streams += chk->send_size;
 835         asoc->cnt_on_all_streams++;
 836         strm = &asoc->strmin[chk->rec.data.stream_number];
 837         nxt_todel = strm->last_sequence_delivered + 1;
 838 #ifdef SCTP_STR_LOGGING
 839         sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
 840 #endif
 841 #ifdef SCTP_DEBUG
 842         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 843                 kprintf("queue to stream called for ssn:%u lastdel:%u nxt:%u\n",
 844                     (u_int)chk->rec.data.stream_seq,
 845                     (u_int)strm->last_sequence_delivered, (u_int)nxt_todel);
 846         }
 847 #endif
 848         if (compare_with_wrap(strm->last_sequence_delivered,
 849             chk->rec.data.stream_seq, MAX_SEQ) ||
 850             (strm->last_sequence_delivered == chk->rec.data.stream_seq)) {
 851                 /* The incoming sseq is behind where we last delivered? */
 852 #ifdef SCTP_DEBUG
 853                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 854                         kprintf("Duplicate S-SEQ:%d delivered:%d from peer, Abort  association\n",
 855                             chk->rec.data.stream_seq,
 856                             strm->last_sequence_delivered);
 857                 }
 858 #endif
 859                 /*
 860                  * throw it in the stream so it gets cleaned up in
 861                  * association destruction
 862                  */
 863                 TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next);
 864                 MGET(oper, MB_DONTWAIT, MT_DATA);
 865                 if (oper) {
 866                         struct sctp_paramhdr *ph;
 867                         u_int32_t *ippp;
 868
 869                         oper->m_len = sizeof(struct sctp_paramhdr) +
 870                             sizeof(*ippp);
 871                         ph = mtod(oper, struct sctp_paramhdr *);
 872                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 873                         ph->param_length = htons(oper->m_len);
 874                         ippp = (u_int32_t *)(ph + 1);
 875                         *ippp = htonl(0x00000001);
 876                 }
 877                 sctp_abort_an_association(stcb->sctp_ep, stcb,
 878                     SCTP_PEER_FAULTY, oper);
 879
 880                 *abort_flag = 1;
 881                 return;
 882
 883         }
 884         if (nxt_todel == chk->rec.data.stream_seq) {
 885                 /* can be delivered right away */
 886 #ifdef SCTP_DEBUG
 887                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 888                         kprintf("It's NEXT!\n");
 889                 }
 890 #endif
 891 #ifdef SCTP_STR_LOGGING
 892                 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
 893 #endif
 894                 queue_needed = 0;
 895                 asoc->size_on_all_streams -= chk->send_size;
 896                 asoc->cnt_on_all_streams--;
 897                 strm->last_sequence_delivered++;
 898                 sctp_deliver_data(stcb, asoc, chk, 0);
 899                 chk = TAILQ_FIRST(&strm->inqueue);
 900                 while (chk != NULL) {
 901                         /* all delivered */
 902                         nxt_todel = strm->last_sequence_delivered + 1;
 903                         if (nxt_todel == chk->rec.data.stream_seq) {
 904                                 at = TAILQ_NEXT(chk, sctp_next);
 905                                 TAILQ_REMOVE(&strm->inqueue, chk, sctp_next);
 906                                 asoc->size_on_all_streams -= chk->send_size;
 907                                 asoc->cnt_on_all_streams--;
 908                                 strm->last_sequence_delivered++;
 909                                 /*
 910                                  * We ignore the return of deliver_data here
 911                                  * since we always can hold the chunk on the
 912                                  * d-queue. And we have a finite number that
 913                                  * can be delivered from the strq.
 914                                  */
 915 #ifdef SCTP_STR_LOGGING
 916                                 sctp_log_strm_del(chk, NULL,
 917                                     SCTP_STR_LOG_FROM_IMMED_DEL);
 918 #endif
 919                                 sctp_deliver_data(stcb, asoc, chk, 0);
 920                                 chk = at;
 921                                 continue;
 922                         }
 923                         break;
 924                 }
 925         }
 926         if (queue_needed) {
 927                 /*
 928                  * Ok, we did not deliver this guy, find
 929                  * the correct place to put it on the queue.
 930                  */
 931 #ifdef SCTP_DEBUG
 932                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 933                         kprintf("Queue Needed!\n");
 934                 }
 935 #endif
 936                 if (TAILQ_EMPTY(&strm->inqueue)) {
 937                         /* Empty queue */
 938 #ifdef SCTP_STR_LOGGING
 939                         sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INSERT_HD);
 940 #endif
 941                         TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next);
 942                 } else {
 943                         TAILQ_FOREACH(at, &strm->inqueue, sctp_next) {
 944                                 if (compare_with_wrap(at->rec.data.stream_seq,
 945                                     chk->rec.data.stream_seq, MAX_SEQ)) {
 946                                         /*
 947                                          * one in queue is bigger than the new
 948                                          * one, insert before this one
 949                                          */
 950 #ifdef SCTP_STR_LOGGING
 951                                         sctp_log_strm_del(chk, at,
 952                                             SCTP_STR_LOG_FROM_INSERT_MD);
 953 #endif
 954                                         TAILQ_INSERT_BEFORE(at, chk, sctp_next);
 955                                         break;
 956                                 } else if (at->rec.data.stream_seq ==
 957                                     chk->rec.data.stream_seq) {
 958                                         /*
 959                                          * Gak, He sent me a duplicate str seq
 960                                          * number
 961                                          */
 962                                         /*
 963                                          * foo bar, I guess I will just free
 964                                          * this new guy, should we abort too?
 965                                          * FIX ME MAYBE? Or it COULD be that
 966                                          * the SSN's have wrapped. Maybe I
 967                                          * should compare to TSN somehow...
 968                                          * sigh for now just blow away the
 969                                          * chunk!
 970                                          */
 971
 972                                         if (chk->data)
 973                                                 sctp_m_freem(chk->data);
 974                                         chk->data = NULL;
 975                                         asoc->size_on_all_streams -= chk->send_size;
 976                                         asoc->cnt_on_all_streams--;
 977                                         sctp_pegs[SCTP_DUP_SSN_RCVD]++;
 978                                         sctp_free_remote_addr(chk->whoTo);
 979                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 980                                         sctppcbinfo.ipi_count_chunk--;
 981                                         if ((int)sctppcbinfo.ipi_count_chunk <
 982                                             0) {
 983                                                 panic("Chunk count is negative");
 984                                         }
 985                                         sctppcbinfo.ipi_gencnt_chunk++;
 986                                         return;
 987                                 } else {
 988                                         if (TAILQ_NEXT(at, sctp_next) == NULL) {
 989                                                 /*
 990                                                  * We are at the end, insert it
 991                                                  * after this one
 992                                                  */
 993 #ifdef SCTP_STR_LOGGING
 994                                                 sctp_log_strm_del(chk, at,
 995                                                     SCTP_STR_LOG_FROM_INSERT_TL);
 996 #endif
 997                                                 TAILQ_INSERT_AFTER(&strm->inqueue,
 998                                                     at, chk, sctp_next);
 999                                                 break;
1000                                         }
1001                                 }
1002                         }
1003                 }
1004         } else {
1005                 /* We delivered some chunks, wake them up */
1006
1007 #ifdef SCTP_DEBUG
1008                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1009                         kprintf("Doing WAKEUP!\n");
1010                 }
1011 #endif
1012                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1013         }
1014 }
1015
1016 /*
1017  * Returns two things: You get the total size of the deliverable parts of the
1018  * first fragmented message on the reassembly queue. And you get a 1 back if
1019  * all of the message is ready or a 0 back if the message is still incomplete
1020  */
1021 static int
1022 sctp_is_all_msg_on_reasm(struct sctp_association *asoc, int *t_size)
1023 {
1024         struct sctp_tmit_chunk *chk;
1025         u_int32_t tsn;
1026
1027         *t_size = 0;
1028         chk = TAILQ_FIRST(&asoc->reasmqueue);
1029         if (chk == NULL) {
1030                 /* nothing on the queue */
1031                 return (0);
1032         }
1033         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
1034                 /* Not a first on the queue */
1035                 return (0);
1036         }
1037         tsn = chk->rec.data.TSN_seq;
1038         while (chk) {
1039                 if (tsn != chk->rec.data.TSN_seq) {
1040                         return (0);
1041                 }
1042                 *t_size += chk->send_size;
1043                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1044                         return (1);
1045                 }
1046                 tsn++;
1047                 chk = TAILQ_NEXT(chk, sctp_next);
1048         }
1049         return (0);
1050 }
1051
1052 /*
1053  * Dump onto the re-assembly queue, in its proper place. After dumping on
1054  * the queue, see if anthing can be delivered. If so pull it off (or as much
1055  * as we can. If we run out of space then we must dump what we can and set
1056  * the appropriate flag to say we queued what we could.
1057  */
1058 static void
1059 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
1060     struct sctp_tmit_chunk *chk, int *abort_flag)
1061 {
1062         struct mbuf *oper;
1063         u_int16_t nxt_todel;
1064         u_int32_t cum_ackp1, last_tsn, prev_tsn, post_tsn;
1065         int tsize;
1066         u_char last_flags;
1067         struct sctp_tmit_chunk *at, *prev, *next;
1068
1069         prev = next = NULL;
1070         cum_ackp1 = asoc->tsn_last_delivered + 1;
1071
1072         if (TAILQ_EMPTY(&asoc->reasmqueue)) {
1073                 /* This is the first one on the queue */
1074                 TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next);
1075                 /*
1076                  * we do not check for delivery of anything when
1077                  * only one fragment is here
1078                  */
1079                 asoc->size_on_reasm_queue = chk->send_size;
1080                 asoc->cnt_on_reasm_queue++;
1081                 if (chk->rec.data.TSN_seq == cum_ackp1) {
1082                         if (asoc->fragmented_delivery_inprogress == 0  &&
1083                             (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) !=
1084                             SCTP_DATA_FIRST_FRAG) {
1085                                 /*
1086                                  * An empty queue, no delivery inprogress, we
1087                                  * hit the next one and it does NOT have a
1088                                  * FIRST fragment mark.
1089                                  */
1090 #ifdef SCTP_DEBUG
1091                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1092                                         kprintf("Gak, Evil plot, its not first, no fragmented delivery in progress\n");
1093                                 }
1094 #endif
1095                                 MGET(oper, MB_DONTWAIT, MT_DATA);
1096                                 if (oper) {
1097                                         struct sctp_paramhdr *ph;
1098                                         u_int32_t *ippp;
1099
1100                                         oper->m_len =
1101                                             sizeof(struct sctp_paramhdr) +
1102                                             sizeof(*ippp);
1103                                         ph = mtod(oper, struct sctp_paramhdr *);
1104                                         ph->param_type =
1105                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1106                                         ph->param_length = htons(oper->m_len);
1107                                         ippp = (u_int32_t *)(ph + 1);
1108                                         *ippp = htonl(0x10000001);
1109                                 }
1110                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1111                                     SCTP_PEER_FAULTY, oper);
1112                                 *abort_flag = 1;
1113                         } else if (asoc->fragmented_delivery_inprogress &&
1114                             (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
1115                                 /*
1116                                  * We are doing a partial delivery and the NEXT
1117                                  * chunk MUST be either the LAST or MIDDLE
1118                                  * fragment NOT a FIRST
1119                                  */
1120 #ifdef SCTP_DEBUG
1121                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1122                                         kprintf("Gak, Evil plot, it IS a first and fragmented delivery in progress\n");
1123                                 }
1124 #endif
1125                                 MGET(oper, MB_DONTWAIT, MT_DATA);
1126                                 if (oper) {
1127                                         struct sctp_paramhdr *ph;
1128                                         u_int32_t *ippp;
1129
1130                                         oper->m_len =
1131                                             sizeof(struct sctp_paramhdr) +
1132                                             sizeof(*ippp);
1133                                         ph = mtod(oper, struct sctp_paramhdr *);
1134                                         ph->param_type =
1135                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1136                                         ph->param_length = htons(oper->m_len);
1137                                         ippp = (u_int32_t *)(ph + 1);
1138                                         *ippp = htonl(0x10000002);
1139                                 }
1140                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1141                                     SCTP_PEER_FAULTY, oper);
1142                                 *abort_flag = 1;
1143                         } else if (asoc->fragmented_delivery_inprogress) {
1144                                 /* Here we are ok with a MIDDLE or LAST piece */
1145                                 if (chk->rec.data.stream_number !=
1146                                     asoc->str_of_pdapi) {
1147                                         /* Got to be the right STR No */
1148 #ifdef SCTP_DEBUG
1149                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1150                                                 kprintf("Gak, Evil plot, it IS not same stream number %d vs %d\n",
1151                                                     chk->rec.data.stream_number,
1152                                                     asoc->str_of_pdapi);
1153                                         }
1154 #endif
1155                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1156                                         if (oper) {
1157                                                 struct sctp_paramhdr *ph;
1158                                                 u_int32_t *ippp;
1159                                                 oper->m_len =
1160                                                     sizeof(struct sctp_paramhdr) +
1161                                                     sizeof(*ippp);
1162                                                 ph = mtod(oper,
1163                                                     struct sctp_paramhdr *);
1164                                                 ph->param_type =
1165                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1166                                                 ph->param_length =
1167                                                     htons(oper->m_len);
1168                                                 ippp = (u_int32_t *)(ph + 1);
1169                                                 *ippp = htonl(0x10000003);
1170                                         }
1171                                         sctp_abort_an_association(stcb->sctp_ep,
1172                                             stcb, SCTP_PEER_FAULTY, oper);
1173                                         *abort_flag = 1;
1174                                 } else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) !=
1175                                     SCTP_DATA_UNORDERED &&
1176                                     chk->rec.data.stream_seq !=
1177                                     asoc->ssn_of_pdapi) {
1178                                         /* Got to be the right STR Seq */
1179 #ifdef SCTP_DEBUG
1180                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1181                                                 kprintf("Gak, Evil plot, it IS not same stream seq %d vs %d\n",
1182                                                     chk->rec.data.stream_seq,
1183                                                     asoc->ssn_of_pdapi);
1184                                         }
1185 #endif
1186                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1187                                         if (oper) {
1188                                                 struct sctp_paramhdr *ph;
1189                                                 u_int32_t *ippp;
1190                                                 oper->m_len =
1191                                                     sizeof(struct sctp_paramhdr) +
1192                                                     sizeof(*ippp);
1193                                                 ph = mtod(oper,
1194                                                     struct sctp_paramhdr *);
1195                                                 ph->param_type =
1196                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1197                                                 ph->param_length =
1198                                                     htons(oper->m_len);
1199                                                 ippp = (u_int32_t *)(ph + 1);
1200                                                 *ippp = htonl(0x10000004);
1201                                         }
1202                                         sctp_abort_an_association(stcb->sctp_ep,
1203                                             stcb, SCTP_PEER_FAULTY, oper);
1204                                         *abort_flag = 1;
1205                                 }
1206                         }
1207                 }
1208                 return;
1209         }
1210         /* Find its place */
1211         at = TAILQ_FIRST(&asoc->reasmqueue);
1212
1213         /* Grab the top flags */
1214         TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1215                 if (compare_with_wrap(at->rec.data.TSN_seq,
1216                     chk->rec.data.TSN_seq, MAX_TSN)) {
1217                         /*
1218                          * one in queue is bigger than the new one, insert
1219                          * before this one
1220                          */
1221                         /* A check */
1222                         asoc->size_on_reasm_queue += chk->send_size;
1223                         asoc->cnt_on_reasm_queue++;
1224                         next = at;
1225                         TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1226                         break;
1227                 } else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) {
1228                         /* Gak, He sent me a duplicate str seq number */
1229                         /*
1230                          * foo bar, I guess I will just free this new guy,
1231                          * should we abort too? FIX ME MAYBE? Or it COULD be
1232                          * that the SSN's have wrapped. Maybe I should compare
1233                          * to TSN somehow... sigh for now just blow away the
1234                          * chunk!
1235                          */
1236                         if (chk->data)
1237                                 sctp_m_freem(chk->data);
1238                         chk->data = NULL;
1239                         sctp_free_remote_addr(chk->whoTo);
1240                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
1241                         sctppcbinfo.ipi_count_chunk--;
1242                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
1243                                 panic("Chunk count is negative");
1244                         }
1245                         sctppcbinfo.ipi_gencnt_chunk++;
1246                         return;
1247                 } else {
1248                         last_flags = at->rec.data.rcv_flags;
1249                         last_tsn = at->rec.data.TSN_seq;
1250                         prev = at;
1251                         if (TAILQ_NEXT(at, sctp_next) == NULL) {
1252                                 /*
1253                                  * We are at the end, insert it after this one
1254                                  */
1255                                 /* check it first */
1256                                 asoc->size_on_reasm_queue += chk->send_size;
1257                                 asoc->cnt_on_reasm_queue++;
1258                                 TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next);
1259                                 break;
1260                         }
1261                 }
1262         }
1263         /* Now the audits */
1264         if (prev) {
1265                 prev_tsn = chk->rec.data.TSN_seq - 1;
1266                 if (prev_tsn == prev->rec.data.TSN_seq) {
1267                         /*
1268                          * Ok the one I am dropping onto the end
1269                          * is the NEXT. A bit of valdiation here.
1270                          */
1271                         if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1272                             SCTP_DATA_FIRST_FRAG ||
1273                             (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1274                             SCTP_DATA_MIDDLE_FRAG) {
1275                                 /*
1276                                  * Insert chk MUST be a MIDDLE or LAST fragment
1277                                  */
1278                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1279                                     SCTP_DATA_FIRST_FRAG) {
1280 #ifdef SCTP_DEBUG
1281                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1282                                                 kprintf("Prev check - It can be a midlle or last but not a first\n");
1283                                                 kprintf("Gak, Evil plot, it's a FIRST!\n");
1284                                         }
1285 #endif
1286                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1287                                         if (oper) {
1288                                                 struct sctp_paramhdr *ph;
1289                                                 u_int32_t *ippp;
1290
1291                                                 oper->m_len =
1292                                                     sizeof(struct sctp_paramhdr) +
1293                                                     sizeof(*ippp);
1294                                                 ph = mtod(oper,
1295                                                     struct sctp_paramhdr *);
1296                                                 ph->param_type =
1297                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1298                                                 ph->param_length =
1299                                                     htons(oper->m_len);
1300
1301                                                 ippp = (u_int32_t *)(ph + 1);
1302                                                 *ippp = htonl(0x10000005);
1303                                         }
1304                                         sctp_abort_an_association(stcb->sctp_ep,
1305                                             stcb, SCTP_PEER_FAULTY, oper);
1306                                         *abort_flag = 1;
1307                                         return;
1308                                 }
1309                                 if (chk->rec.data.stream_number !=
1310                                     prev->rec.data.stream_number) {
1311                                         /*
1312                                          * Huh, need the correct STR here, they
1313                                          * must be the same.
1314                                          */
1315 #ifdef SCTP_DEBUG
1316                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1317                                                 kprintf("Prev check - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1318                                                     chk->rec.data.stream_number,
1319                                                     prev->rec.data.stream_number);
1320                                         }
1321 #endif
1322                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1323                                         if (oper) {
1324                                                 struct sctp_paramhdr *ph;
1325                                                 u_int32_t *ippp;
1326
1327                                                 oper->m_len =
1328                                                     sizeof(struct sctp_paramhdr) +
1329                                                     sizeof(*ippp);
1330                                                 ph = mtod(oper,
1331                                                     struct sctp_paramhdr *);
1332                                                 ph->param_type =
1333                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1334                                                 ph->param_length =
1335                                                     htons(oper->m_len);
1336                                                 ippp = (u_int32_t *)(ph + 1);
1337                                                 *ippp = htonl(0x10000006);
1338                                         }
1339
1340                                         sctp_abort_an_association(stcb->sctp_ep,
1341                                             stcb, SCTP_PEER_FAULTY, oper);
1342
1343                                         *abort_flag = 1;
1344                                         return;
1345                                 }
1346                                 if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1347                                     chk->rec.data.stream_seq !=
1348                                     prev->rec.data.stream_seq) {
1349                                         /*
1350                                          * Huh, need the correct STR here, they
1351                                          * must be the same.
1352                                          */
1353 #ifdef SCTP_DEBUG
1354                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1355                                                 kprintf("Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1356                                                     chk->rec.data.stream_seq,
1357                                                     prev->rec.data.stream_seq);
1358                                         }
1359 #endif
1360                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1361                                         if (oper) {
1362                                                 struct sctp_paramhdr *ph;
1363                                                 u_int32_t *ippp;
1364
1365                                                 oper->m_len =
1366                                                     sizeof(struct sctp_paramhdr) +
1367                                                     sizeof(*ippp);
1368                                                 ph = mtod(oper,
1369                                                     struct sctp_paramhdr *);
1370                                                 ph->param_type =
1371                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1372                                                 ph->param_length =
1373                                                     htons(oper->m_len);
1374                                                 ippp = (u_int32_t *)(ph + 1);
1375                                                 *ippp = htonl(0x10000007);
1376                                         }
1377
1378                                         sctp_abort_an_association(stcb->sctp_ep,
1379                                             stcb, SCTP_PEER_FAULTY, oper);
1380
1381                                         *abort_flag = 1;
1382                                         return;
1383                                 }
1384                         } else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1385                             SCTP_DATA_LAST_FRAG) {
1386                                 /* Insert chk MUST be a FIRST */
1387                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1388                                     SCTP_DATA_FIRST_FRAG) {
1389 #ifdef SCTP_DEBUG
1390                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1391                                                 kprintf("Prev check - Gak, evil plot, its not FIRST and it must be!\n");
1392                                         }
1393 #endif
1394                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1395                                         if (oper) {
1396                                                 struct sctp_paramhdr *ph;
1397                                                 u_int32_t *ippp;
1398
1399                                                 oper->m_len =
1400                                                     sizeof(struct sctp_paramhdr) +
1401                                                     sizeof(*ippp);
1402                                                 ph = mtod(oper,
1403                                                     struct sctp_paramhdr *);
1404                                                 ph->param_type =
1405                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1406                                                 ph->param_length =
1407                                                     htons(oper->m_len);
1408                                                 ippp = (u_int32_t *)(ph + 1);
1409                                                 *ippp = htonl(0x10000008);
1410                                         }
1411
1412                                         sctp_abort_an_association(stcb->sctp_ep,
1413                                             stcb, SCTP_PEER_FAULTY, oper);
1414
1415                                         *abort_flag = 1;
1416                                         return;
1417                                 }
1418                         }
1419                 }
1420         }
1421
1422         if (next) {
1423                 post_tsn = chk->rec.data.TSN_seq + 1;
1424                 if (post_tsn == next->rec.data.TSN_seq) {
1425                         /*
1426                          * Ok the one I am inserting ahead of
1427                          * is my NEXT one. A bit of valdiation here.
1428                          */
1429                         if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1430                                 /* Insert chk MUST be a last fragment */
1431                                 if ((chk->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK)
1432                                    != SCTP_DATA_LAST_FRAG) {
1433 #ifdef SCTP_DEBUG
1434                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1435                                                 kprintf("Next chk - Next is FIRST, we must be LAST\n");
1436                                                 kprintf("Gak, Evil plot, its not a last!\n");
1437                                         }
1438 #endif
1439                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1440                                         if (oper) {
1441                                                 struct sctp_paramhdr *ph;
1442                                                 u_int32_t *ippp;
1443
1444                                                 oper->m_len =
1445                                                     sizeof(struct sctp_paramhdr) +
1446                                                     sizeof(*ippp);
1447                                                 ph = mtod(oper,
1448                                                     struct sctp_paramhdr *);
1449                                                 ph->param_type =
1450                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1451                                                 ph->param_length =
1452                                                     htons(oper->m_len);
1453                                                 ippp = (u_int32_t *)(ph + 1);
1454                                                 *ippp = htonl(0x10000009);
1455                                         }
1456
1457                                         sctp_abort_an_association(stcb->sctp_ep,
1458                                             stcb, SCTP_PEER_FAULTY, oper);
1459
1460                                         *abort_flag = 1;
1461                                         return;
1462                                 }
1463                         } else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1464                             SCTP_DATA_MIDDLE_FRAG ||
1465                             (next->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK) ==
1466                             SCTP_DATA_LAST_FRAG) {
1467                                 /* Insert chk CAN be MIDDLE or FIRST NOT LAST */
1468                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1469                                     SCTP_DATA_LAST_FRAG) {
1470 #ifdef SCTP_DEBUG
1471                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1472                                                 kprintf("Next chk - Next is a MIDDLE/LAST\n");
1473                                                 kprintf("Gak, Evil plot, new prev chunk is a LAST\n");
1474                                         }
1475 #endif
1476                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1477                                         if (oper) {
1478                                                 struct sctp_paramhdr *ph;
1479                                                 u_int32_t *ippp;
1480
1481                                                 oper->m_len =
1482                                                     sizeof(struct sctp_paramhdr) +
1483                                                     sizeof(*ippp);
1484                                                 ph = mtod(oper,
1485                                                     struct sctp_paramhdr *);
1486                                                 ph->param_type =
1487                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1488                                                 ph->param_length =
1489                                                     htons(oper->m_len);
1490                                                 ippp = (u_int32_t *)(ph + 1);
1491                                                 *ippp = htonl(0x1000000a);
1492                                         }
1493                                         sctp_abort_an_association(stcb->sctp_ep,
1494                                             stcb, SCTP_PEER_FAULTY, oper);
1495
1496                                         *abort_flag = 1;
1497                                         return;
1498                                 }
1499                                 if (chk->rec.data.stream_number !=
1500                                     next->rec.data.stream_number) {
1501                                         /*
1502                                          * Huh, need the correct STR here, they
1503                                          * must be the same.
1504                                          */
1505 #ifdef SCTP_DEBUG
1506                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1507                                                 kprintf("Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1508                                                     chk->rec.data.stream_number,
1509                                                     next->rec.data.stream_number);
1510                                         }
1511 #endif
1512                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1513                                         if (oper) {
1514                                                 struct sctp_paramhdr *ph;
1515                                                 u_int32_t *ippp;
1516
1517                                                 oper->m_len =
1518                                                     sizeof(struct sctp_paramhdr) +
1519                                                     sizeof(*ippp);
1520                                                 ph = mtod(oper,
1521                                                     struct sctp_paramhdr *);
1522                                                 ph->param_type =
1523                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1524                                                 ph->param_length =
1525                                                     htons(oper->m_len);
1526                                                 ippp = (u_int32_t *)(ph + 1);
1527                                                 *ippp = htonl(0x1000000b);
1528                                         }
1529
1530                                         sctp_abort_an_association(stcb->sctp_ep,
1531                                             stcb, SCTP_PEER_FAULTY, oper);
1532
1533                                         *abort_flag = 1;
1534                                         return;
1535                                 }
1536                                 if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1537                                     chk->rec.data.stream_seq !=
1538                                     next->rec.data.stream_seq) {
1539                                         /*
1540                                          * Huh, need the correct STR here, they
1541                                          * must be the same.
1542                                          */
1543 #ifdef SCTP_DEBUG
1544                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1545                                                 kprintf("Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1546                                                     chk->rec.data.stream_seq,
1547                                                     next->rec.data.stream_seq);
1548                                         }
1549 #endif
1550                                         MGET(oper, MB_DONTWAIT, MT_DATA);
1551                                         if (oper) {
1552                                                 struct sctp_paramhdr *ph;
1553                                                 u_int32_t *ippp;
1554
1555                                                 oper->m_len =
1556                                                     sizeof(struct sctp_paramhdr) +
1557                                                     sizeof(*ippp);
1558                                                 ph = mtod(oper,
1559                                                     struct sctp_paramhdr *);
1560                                                 ph->param_type =
1561                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1562                                                 ph->param_length =
1563                                                     htons(oper->m_len);
1564                                                 ippp = (u_int32_t *)(ph + 1);
1565                                                 *ippp = htonl(0x1000000c);
1566                                         }
1567
1568                                         sctp_abort_an_association(stcb->sctp_ep,
1569                                             stcb, SCTP_PEER_FAULTY, oper);
1570
1571                                         *abort_flag = 1;
1572                                         return;
1573
1574                                 }
1575                         }
1576                 }
1577         }
1578         /*
1579          * now that we have all in there place we must check a number of
1580          * things to see if we can send data to the ULP.
1581          */
1582         /* we need to do some delivery, if we can */
1583         chk = TAILQ_FIRST(&asoc->reasmqueue);
1584         if (chk == NULL) {
1585                 /* Huh? */
1586                 asoc->size_on_reasm_queue = 0;
1587                 asoc->cnt_on_reasm_queue = 0;
1588                 return;
1589         }
1590         if (asoc->fragmented_delivery_inprogress == 0) {
1591                 nxt_todel =
1592                     asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
1593                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
1594                     (nxt_todel == chk->rec.data.stream_seq ||
1595                      (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
1596                         /*
1597                          * Yep the first one is here and its
1598                          * ok to deliver but should we?
1599                          */
1600                         if (TAILQ_EMPTY(&asoc->delivery_queue) &&
1601                             (sctp_is_all_msg_on_reasm(asoc, &tsize) ||
1602                              (asoc->size_on_reasm_queue >=
1603                               (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) &&
1604                               tsize))) {
1605                                 /*
1606                                  * Yes, we setup to
1607                                  * start reception, by backing down the TSN
1608                                  * just in case we can't deliver. If we
1609                                  */
1610                                 asoc->fragmented_delivery_inprogress = 1;
1611                                 asoc->tsn_last_delivered =
1612                                     chk->rec.data.TSN_seq - 1;
1613                                 asoc->str_of_pdapi =
1614                                     chk->rec.data.stream_number;
1615                                 asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
1616                                 asoc->fragment_flags = chk->rec.data.rcv_flags;
1617                                 sctp_service_reassembly(stcb, asoc, 0);
1618                         }
1619                 }
1620         } else {
1621                 sctp_service_reassembly(stcb, asoc, 0);
1622         }
1623 }
1624
1625 /*
1626  * This is an unfortunate routine. It checks to make sure a evil guy is not
1627  * stuffing us full of bad packet fragments. A broken peer could also do this
1628  * but this is doubtful. It is to bad I must worry about evil crackers sigh
1629  * :< more cycles.
1630  */
1631 static int
1632 sctp_does_chk_belong_to_reasm(struct sctp_association *asoc,
1633     struct sctp_tmit_chunk *chk)
1634 {
1635         struct sctp_tmit_chunk *at;
1636         u_int32_t tsn_est;
1637
1638         TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1639                 if (compare_with_wrap(chk->rec.data.TSN_seq,
1640                     at->rec.data.TSN_seq, MAX_TSN)) {
1641                         /* is it one bigger? */
1642                         tsn_est = at->rec.data.TSN_seq + 1;
1643                         if (tsn_est == chk->rec.data.TSN_seq) {
1644                                 /* yep. It better be a last then*/
1645                                 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1646                                     SCTP_DATA_LAST_FRAG) {
1647                                         /*
1648                                          * Ok this guy belongs next to a guy
1649                                          * that is NOT last, it should be a
1650                                          * middle/last, not a complete chunk.
1651                                          */
1652                                         return (1);
1653                                 } else {
1654                                         /*
1655                                          * This guy is ok since its a LAST and
1656                                          * the new chunk is a fully self-
1657                                          * contained one.
1658                                          */
1659                                         return (0);
1660                                 }
1661                         }
1662                 } else if (chk->rec.data.TSN_seq == at->rec.data.TSN_seq) {
1663                         /* Software error since I have a dup? */
1664                         return (1);
1665                 } else {
1666                         /*
1667                          * Ok, 'at' is larger than new chunk but does it
1668                          * need to be right before it.
1669                          */
1670                         tsn_est = chk->rec.data.TSN_seq + 1;
1671                         if (tsn_est == at->rec.data.TSN_seq) {
1672                                 /* Yep, It better be a first */
1673                                 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1674                                     SCTP_DATA_FIRST_FRAG) {
1675                                         return (1);
1676                                 } else {
1677                                         return (0);
1678                                 }
1679                         }
1680                 }
1681         }
1682         return (0);
1683 }
1684
1685 extern unsigned int sctp_max_chunks_on_queue;
1686 static int
1687 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1688     struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length,
1689     struct sctp_nets *net, u_int32_t *high_tsn, int *abort_flag,
1690     int *break_flag, int last_chunk)
1691 {
1692         /* Process a data chunk */
1693         /*  struct sctp_tmit_chunk *chk;*/
1694         struct sctp_tmit_chunk *chk;
1695         u_int32_t tsn, gap;
1696         struct mbuf *dmbuf;
1697         int indx, the_len;
1698         u_int16_t strmno, strmseq;
1699         struct mbuf *oper;
1700
1701         chk = NULL;
1702         tsn = ntohl(ch->dp.tsn);
1703 #ifdef SCTP_MAP_LOGGING
1704         sctp_log_map(0, tsn, asoc->cumulative_tsn, SCTP_MAP_PREPARE_SLIDE);
1705 #endif
1706         if (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN) ||
1707             asoc->cumulative_tsn == tsn) {
1708                 /* It is a duplicate */
1709                 sctp_pegs[SCTP_DUPTSN_RECVD]++;
1710                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1711                         /* Record a dup for the next outbound sack */
1712                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1713                         asoc->numduptsns++;
1714                 }
1715                 return (0);
1716         }
1717         /* Calculate the number of TSN's between the base and this TSN */
1718         if (tsn >= asoc->mapping_array_base_tsn) {
1719                 gap  = tsn - asoc->mapping_array_base_tsn;
1720         } else {
1721                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + tsn + 1;
1722         }
1723         if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1724                 /* Can't hold the bit in the mapping at max array, toss it */
1725                 return (0);
1726         }
1727         if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) {
1728                 if (sctp_expand_mapping_array(asoc)) {
1729                         /* Can't expand, drop it */
1730                         return (0);
1731                 }
1732         }
1733         if (compare_with_wrap(tsn, *high_tsn, MAX_TSN)) {
1734                 *high_tsn = tsn;
1735         }
1736         /* See if we have received this one already */
1737         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
1738                 sctp_pegs[SCTP_DUPTSN_RECVD]++;
1739                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1740                         /* Record a dup for the next outbound sack */
1741                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1742                         asoc->numduptsns++;
1743                 }
1744                 if (!callout_pending(&asoc->dack_timer.timer)) {
1745                         /*
1746                          * By starting the timer we assure that we
1747                          * WILL sack at the end of the packet
1748                          * when sctp_sack_check gets called.
1749                          */
1750                         sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep,
1751                             stcb, NULL);
1752                 }
1753                 return (0);
1754         }
1755         /*
1756          * Check to see about the GONE flag, duplicates would cause
1757          * a sack to be sent up above
1758          */
1759         if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
1760                 /*
1761                  * wait a minute, this guy is gone, there is no
1762                  * longer a receiver. Send peer an ABORT!
1763                  */
1764                 struct mbuf *op_err;
1765                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1766                 sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
1767                 *abort_flag = 1;
1768                 return (0);
1769         }
1770         /*
1771          * Now before going further we see if there is room. If NOT then
1772          * we MAY let one through only IF this TSN is the one we are
1773          * waiting for on a partial delivery API.
1774          */
1775
1776         /* now do the tests */
1777         if (((asoc->cnt_on_all_streams +
1778          asoc->cnt_on_delivery_queue +
1779          asoc->cnt_on_reasm_queue +
1780           asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) ||
1781            (((int)asoc->my_rwnd) <= 0)) {
1782                 /*
1783                  * When we have NO room in the rwnd we check
1784                  * to make sure the reader is doing its job...
1785                  */
1786                 if (stcb->sctp_socket->so_rcv.ssb_cc) {
1787                         /* some to read, wake-up */
1788                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1789                 }
1790                 /* now is it in the mapping array of what we have accepted? */
1791                 if (compare_with_wrap(tsn,
1792                     asoc->highest_tsn_inside_map, MAX_TSN)) {
1793
1794                         /* Nope not in the valid range dump it */
1795 #ifdef SCTP_DEBUG
1796                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1797                                 kprintf("My rwnd overrun1:tsn:%lx rwnd %lu sbspace:%ld delq:%d!\n",
1798                                     (u_long)tsn, (u_long)asoc->my_rwnd,
1799                                     sctp_sbspace(&stcb->sctp_socket->so_rcv),
1800                                     stcb->asoc.cnt_on_delivery_queue);
1801                         }
1802 #endif
1803                         sctp_set_rwnd(stcb, asoc);
1804                         if ((asoc->cnt_on_all_streams +
1805                             asoc->cnt_on_delivery_queue +
1806                             asoc->cnt_on_reasm_queue +
1807                             asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) {
1808                                 sctp_pegs[SCTP_MSGC_DROP]++;
1809                         } else {
1810                                 sctp_pegs[SCTP_RWND_DROPS]++;
1811                         }
1812                         indx = *break_flag;
1813                         *break_flag = 1;
1814                         return (0);
1815                 }
1816         }
1817         strmno = ntohs(ch->dp.stream_id);
1818         if (strmno >= asoc->streamincnt) {
1819                 struct sctp_paramhdr *phdr;
1820                 struct mbuf *mb;
1821
1822                 MGETHDR(mb, MB_DONTWAIT, MT_DATA);
1823                 if (mb != NULL) {
1824                         /* add some space up front so prepend will work well */
1825                         mb->m_data += sizeof(struct sctp_chunkhdr);
1826                         phdr = mtod(mb, struct sctp_paramhdr *);
1827                         /*
1828                          * Error causes are just param's and this one has
1829                          * two back to back phdr, one with the error type
1830                          * and size, the other with the streamid and a rsvd
1831                          */
1832                         mb->m_pkthdr.len = mb->m_len =
1833                             (sizeof(struct sctp_paramhdr) * 2);
1834                         phdr->param_type = htons(SCTP_CAUSE_INV_STRM);
1835                         phdr->param_length =
1836                             htons(sizeof(struct sctp_paramhdr) * 2);
1837                         phdr++;
1838                         /* We insert the stream in the type field */
1839                         phdr->param_type = ch->dp.stream_id;
1840                         /* And set the length to 0 for the rsvd field */
1841                         phdr->param_length = 0;
1842                         sctp_queue_op_err(stcb, mb);
1843                 }
1844                 sctp_pegs[SCTP_BAD_STRMNO]++;
1845                 return (0);
1846         }
1847         /*
1848          * Before we continue lets validate that we are not
1849          * being fooled by an evil attacker. We can only
1850          * have 4k chunks based on our TSN spread allowed
1851          * by the mapping array 512 * 8 bits, so there is
1852          * no way our stream sequence numbers could have wrapped.
1853          * We of course only validate the FIRST fragment so the
1854          * bit must be set.
1855          */
1856         strmseq = ntohs(ch->dp.stream_sequence);
1857         if ((ch->ch.chunk_flags & SCTP_DATA_FIRST_FRAG) &&
1858             (ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0 &&
1859             (compare_with_wrap(asoc->strmin[strmno].last_sequence_delivered,
1860              strmseq, MAX_SEQ) ||
1861              asoc->strmin[strmno].last_sequence_delivered == strmseq)) {
1862                 /* The incoming sseq is behind where we last delivered? */
1863 #ifdef SCTP_DEBUG
1864                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1865                         kprintf("EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n",
1866                             strmseq,
1867                             asoc->strmin[strmno].last_sequence_delivered);
1868                 }
1869 #endif
1870                 /*
1871                  * throw it in the stream so it gets cleaned up in
1872                  * association destruction
1873                  */
1874                 MGET(oper, MB_DONTWAIT, MT_DATA);
1875                 if (oper) {
1876                         struct sctp_paramhdr *ph;
1877                         u_int32_t *ippp;
1878
1879                         oper->m_len = sizeof(struct sctp_paramhdr) +
1880                             sizeof(*ippp);
1881                         ph = mtod(oper, struct sctp_paramhdr *);
1882                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1883                         ph->param_length = htons(oper->m_len);
1884                         ippp = (u_int32_t *)(ph + 1);
1885                         *ippp = htonl(0x20000001);
1886                 }
1887                 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY,
1888                     oper);
1889                 sctp_pegs[SCTP_BAD_SSN_WRAP]++;
1890                 *abort_flag = 1;
1891                 return (0);
1892         }
1893
1894         the_len = (chk_length-sizeof(struct sctp_data_chunk));
1895         if (last_chunk == 0) {
1896                 dmbuf = sctp_m_copym(*m,
1897                     (offset + sizeof(struct sctp_data_chunk)),
1898                     the_len, MB_DONTWAIT);
1899         } else {
1900                 /* We can steal the last chunk */
1901                 dmbuf = *m;
1902                 /* lop off the top part */
1903                 m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
1904                 if (dmbuf->m_pkthdr.len > the_len) {
1905                         /* Trim the end round bytes off  too */
1906                         m_adj(dmbuf, -(dmbuf->m_pkthdr.len-the_len));
1907                 }
1908                 sctp_pegs[SCTP_NO_COPY_IN]++;
1909         }
1910         if (dmbuf == NULL) {
1911                 sctp_pegs[SCTP_DROP_NOMEMORY]++;
1912                 return (0);
1913         }
1914         if ((ch->ch.chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
1915             asoc->fragmented_delivery_inprogress == 0 &&
1916             TAILQ_EMPTY(&asoc->delivery_queue) &&
1917             ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) ||
1918              ((asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq &&
1919               TAILQ_EMPTY(&asoc->strmin[strmno].inqueue))) &&
1920             ((long)(stcb->sctp_socket->so_rcv.ssb_hiwat -
1921                     stcb->sctp_socket->so_rcv.ssb_cc) >= (long)the_len)) {
1922                 /* Candidate for express delivery */
1923                 /*
1924                  * Its not fragmented,
1925                  * No PD-API is up,
1926                  * Nothing in the delivery queue,
1927                  * Its un-ordered OR ordered and the next to deliver AND
1928                  * nothing else is stuck on the stream queue,
1929                  * And there is room for it in the socket buffer.
1930                  * Lets just stuff it up the buffer....
1931                  */
1932
1933                 struct mbuf *control, *mmm;
1934                 struct sockaddr_in6 sin6;
1935                 struct sockaddr_in6 lsa6;
1936                 struct sockaddr *to;
1937
1938                 /* It would be nice to avoid this copy if we could :< */
1939                 control = sctp_build_ctl_nchunk(stcb, tsn,
1940                     ch->dp.protocol_id, 0, strmno, strmseq,
1941                     ch->ch.chunk_flags);
1942                 /* XXX need to append PKTHDR to the socket buffer first */
1943
1944                 if ((dmbuf->m_flags & M_PKTHDR) == 0) {
1945                         struct mbuf *tmp;
1946                         MGETHDR(tmp, MB_DONTWAIT, MT_DATA);
1947                         if (tmp == NULL) {
1948
1949                                 /* no room! */
1950                                 if (control) {
1951                                         sctp_m_freem(control);
1952                                         stcb->asoc.my_rwnd_control_len -=
1953                                             CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
1954                                 }
1955
1956                                 goto failed_express_del;
1957                         }
1958                         tmp->m_pkthdr.len = the_len;
1959                         tmp->m_len = 0;
1960                         tmp->m_next = dmbuf;
1961                         dmbuf = tmp;
1962                 }
1963                 to = (struct sockaddr *)&net->ro._l_addr;
1964                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
1965                     to->sa_family == AF_INET) {
1966                         struct sockaddr_in *sin;
1967
1968                         sin = (struct sockaddr_in *)to;
1969                         bzero(&sin6, sizeof(sin6));
1970                         sin6.sin6_family = AF_INET6;
1971                         sin6.sin6_len = sizeof(struct sockaddr_in6);
1972                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
1973                         bcopy(&sin->sin_addr,
1974                             &sin6.sin6_addr.s6_addr16[3],
1975                             sizeof(sin6.sin6_addr.s6_addr16[3]));
1976                         sin6.sin6_port = sin->sin_port;
1977                         to = (struct sockaddr *)&sin6;
1978                 }
1979
1980                 /* check and strip embedded scope junk */
1981                 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to,
1982                     &lsa6);
1983                 if (((struct sockaddr_in *)to)->sin_port == 0) {
1984                         kprintf("Huh c, port is %d not net:%p %d?\n",
1985                                ((struct sockaddr_in *)to)->sin_port,
1986                                net,
1987                                (int)(ntohs(stcb->rport)));
1988                         ((struct sockaddr_in *)to)->sin_port = stcb->rport;
1989                 }
1990
1991                 mmm = dmbuf;
1992                 /* Mark the EOR */
1993                 while (mmm->m_next != NULL) {
1994                         mmm = mmm->m_next;
1995                 }
1996                 mmm->m_flags |= M_EOR;
1997                 if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
1998                         /* we have a new high score */
1999                         asoc->highest_tsn_inside_map = tsn;
2000 #ifdef SCTP_MAP_LOGGING
2001                         sctp_log_map(0, 1, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2002 #endif
2003                 }
2004                 SCTP_TCB_UNLOCK(stcb);
2005                 SCTP_INP_WLOCK(stcb->sctp_ep);
2006                 SCTP_TCB_LOCK(stcb);
2007                 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token);
2008                 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to, dmbuf,
2009                     control, stcb->asoc.my_vtag, stcb->sctp_ep)) {
2010                         if (control) {
2011                                 sctp_m_freem(control);
2012                                 stcb->asoc.my_rwnd_control_len -=
2013                                     CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
2014                         }
2015                         sctp_m_freem(dmbuf);
2016                         lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2017                         goto failed_express_del;
2018                 }
2019                 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token);
2020                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
2021                         if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) {
2022                                 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2023                         }
2024                 } else {
2025                         stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf);
2026                 }
2027                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2028                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2029                 if ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0) {
2030
2031                         /* for ordered, bump what we delivered */
2032                         asoc->strmin[strmno].last_sequence_delivered++;
2033                 }
2034                 sctp_pegs[SCTP_EXPRESS_ROUTE]++;
2035 #ifdef SCTP_STR_LOGGING
2036                 sctp_log_strm_del_alt(tsn, strmseq,
2037                     SCTP_STR_LOG_FROM_EXPRS_DEL);
2038 #endif
2039 #ifdef SCTP_DEBUG
2040                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
2041                         kprintf("Express Delivery succeeds\n");
2042                 }
2043 #endif
2044                 goto finish_express_del;
2045         }
2046
2047  failed_express_del:
2048         /* If we reach here this is a new chunk */
2049         chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk);
2050         if (chk == NULL) {
2051                 /* No memory so we drop the chunk */
2052                 sctp_pegs[SCTP_DROP_NOMEMORY]++;
2053                 if (last_chunk == 0) {
2054                         /* we copied it, free the copy */
2055                         sctp_m_freem(dmbuf);
2056                 }
2057                 return (0);
2058         }
2059         sctppcbinfo.ipi_count_chunk++;
2060         sctppcbinfo.ipi_gencnt_chunk++;
2061         chk->rec.data.TSN_seq = tsn;
2062         chk->rec.data.stream_seq = strmseq;
2063         chk->rec.data.stream_number = strmno;
2064         chk->rec.data.payloadtype = ch->dp.protocol_id;
2065         chk->rec.data.context = 0;
2066         chk->rec.data.doing_fast_retransmit = 0;
2067         chk->rec.data.rcv_flags = ch->ch.chunk_flags;
2068         chk->asoc = asoc;
2069         chk->send_size = the_len;
2070         chk->whoTo = net;
2071         net->ref_count++;
2072         chk->data = dmbuf;
2073
2074
2075         /* Mark it as received */
2076         /* Now queue it where it belongs */
2077         if ((chk->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
2078             SCTP_DATA_NOT_FRAG) {
2079                 /* First a sanity check */
2080                 if (asoc->fragmented_delivery_inprogress) {
2081                         /*
2082                          * Ok, we have a fragmented delivery in progress
2083                          * if this chunk is next to deliver OR belongs in
2084                          * our view to the reassembly, the peer is evil
2085                          * or broken.
2086                          */
2087                         u_int32_t estimate_tsn;
2088                         estimate_tsn = asoc->tsn_last_delivered + 1;
2089                         if (TAILQ_EMPTY(&asoc->reasmqueue) &&
2090                             (estimate_tsn == chk->rec.data.TSN_seq)) {
2091                                 /* Evil/Broke peer */
2092                                 MGET(oper, MB_DONTWAIT, MT_DATA);
2093                                 if (oper) {
2094                                         struct sctp_paramhdr *ph;
2095                                         u_int32_t *ippp;
2096
2097                                         oper->m_len =
2098                                             sizeof(struct sctp_paramhdr) +
2099                                             sizeof(*ippp);
2100                                         ph = mtod(oper, struct sctp_paramhdr *);
2101                                         ph->param_type =
2102                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2103                                         ph->param_length = htons(oper->m_len);
2104                                         ippp = (u_int32_t *)(ph + 1);
2105                                         *ippp = htonl(0x20000002);
2106                                 }
2107                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
2108                                     SCTP_PEER_FAULTY, oper);
2109
2110                                 *abort_flag = 1;
2111                                 sctp_pegs[SCTP_DROP_FRAG]++;
2112                                 return (0);
2113                         } else {
2114                                 if (sctp_does_chk_belong_to_reasm(asoc, chk)) {
2115                                         MGET(oper, MB_DONTWAIT, MT_DATA);
2116                                         if (oper) {
2117                                                 struct sctp_paramhdr *ph;
2118                                                 u_int32_t *ippp;
2119
2120                                                 oper->m_len =
2121                                                     sizeof(struct sctp_paramhdr) +
2122                                                     sizeof(*ippp);
2123                                                 ph = mtod(oper,
2124                                                     struct sctp_paramhdr *);
2125                                                 ph->param_type =
2126                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2127                                                 ph->param_length =
2128                                                     htons(oper->m_len);
2129                                                 ippp = (u_int32_t *)(ph + 1);
2130                                                 *ippp = htonl(0x20000003);
2131                                         }
2132                                         sctp_abort_an_association(stcb->sctp_ep,
2133                                             stcb, SCTP_PEER_FAULTY, oper);
2134
2135                                         *abort_flag = 1;
2136                                         sctp_pegs[SCTP_DROP_FRAG]++;
2137                                         return (0);
2138                                 }
2139                         }
2140                 } else {
2141                         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
2142                                 /*
2143                                  * Reassembly queue is NOT empty
2144                                  * validate that this chk does not need to
2145                                  * be in reasembly queue. If it does then
2146                                  * our peer is broken or evil.
2147                                  */
2148                                 if (sctp_does_chk_belong_to_reasm(asoc, chk)) {
2149                                         MGET(oper, MB_DONTWAIT, MT_DATA);
2150                                         if (oper) {
2151                                                 struct sctp_paramhdr *ph;
2152                                                 u_int32_t *ippp;
2153
2154                                                 oper->m_len =
2155                                                     sizeof(struct sctp_paramhdr) +
2156                                                     sizeof(*ippp);
2157                                                 ph = mtod(oper,
2158                                                     struct sctp_paramhdr *);
2159                                                 ph->param_type =
2160                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2161                                                 ph->param_length =
2162                                                     htons(oper->m_len);
2163                                                 ippp = (u_int32_t *)(ph + 1);
2164                                                 *ippp = htonl(0x20000004);
2165                                         }
2166                                         sctp_abort_an_association(stcb->sctp_ep,
2167                                             stcb, SCTP_PEER_FAULTY, oper);
2168
2169                                         *abort_flag = 1;
2170                                         sctp_pegs[SCTP_DROP_FRAG]++;
2171                                         return (0);
2172                                 }
2173                         }
2174                 }
2175                 if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) {
2176                         /* queue directly into socket buffer */
2177                         sctp_deliver_data(stcb, asoc, chk, 0);
2178                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2179                 } else {
2180                         /* Special check for when streams are resetting.
2181                          * We could be more smart about this and check the
2182                          * actual stream to see if it is not being reset.. that
2183                          * way we would not create a HOLB when amongst streams
2184                          * being reset and those not being reset.
2185                          *
2186                          * We take complete messages that have a stream reset
2187                          * intervening (aka the TSN is after where our cum-ack needs
2188                          * to be) off and put them on a pending_reply_queue. The
2189                          * reassembly ones we do not have to worry about since
2190                          * they are all sorted and proceessed by TSN order. It
2191                          * is only the singletons I must worry about.
2192                          */
2193                         if ((asoc->pending_reply) &&
2194                            ((compare_with_wrap(tsn, ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) ||
2195                             (tsn == ntohl(asoc->pending_reply->reset_at_tsn)))
2196                                 ) {
2197                                 /* yep its past where we need to reset... go ahead and
2198                                  * queue it.
2199                                  */
2200                                 TAILQ_INSERT_TAIL(&asoc->pending_reply_queue , chk, sctp_next);
2201                         }  else {
2202                                 sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag);
2203                         }
2204                 }
2205         } else {
2206                 /* Into the re-assembly queue */
2207                 sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag);
2208                 if (*abort_flag) {
2209                         sctp_pegs[SCTP_DROP_FRAG]++;
2210                         return (0);
2211                 }
2212         }
2213         if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
2214                 /* we have a new high score */
2215                 asoc->highest_tsn_inside_map = tsn;
2216 #ifdef SCTP_MAP_LOGGING
2217                 sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2218 #endif
2219         }
2220  finish_express_del:
2221         if (last_chunk) {
2222                 *m = NULL;
2223         }
2224         sctp_pegs[SCTP_PEG_TSNS_RCVD]++;
2225         /* Set it present please */
2226 #ifdef SCTP_STR_LOGGING
2227         sctp_log_strm_del_alt(tsn, strmseq, SCTP_STR_LOG_FROM_MARK_TSN);
2228 #endif
2229 #ifdef SCTP_MAP_LOGGING
2230         sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2231                      asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2232 #endif
2233         SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
2234         return (1);
2235 }
2236
2237 void
2238 sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort_flag)
2239 {
2240         /*
2241          * Now we also need to check the mapping array in a couple of ways.
2242          * 1) Did we move the cum-ack point?
2243          */
2244         struct sctp_association *asoc;
2245         int i, at;
2246         int m_size, all_ones;
2247         int slide_from, slide_end, lgap, distance;
2248 #ifdef SCTP_MAP_LOGGING
2249         uint32_t old_cumack, old_base, old_highest;
2250         unsigned char aux_array[64];
2251 #endif
2252
2253         asoc = &stcb->asoc;
2254         at = 0;
2255
2256 #ifdef SCTP_MAP_LOGGING
2257         old_cumack = asoc->cumulative_tsn;
2258         old_base = asoc->mapping_array_base_tsn;
2259         old_highest = asoc->highest_tsn_inside_map;
2260         if (asoc->mapping_array_size < 64)
2261                 memcpy(aux_array, asoc->mapping_array,
2262                     asoc->mapping_array_size);
2263         else
2264                 memcpy(aux_array, asoc->mapping_array, 64);
2265 #endif
2266
2267         /*
2268          * We could probably improve this a small bit by calculating the
2269          * offset of the current cum-ack as the starting point.
2270          */
2271         all_ones = 1;
2272         m_size = stcb->asoc.mapping_array_size << 3;
2273         for (i = 0; i < m_size; i++) {
2274                 if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) {
2275                         /*
2276                          * Ok we found the first place that we are
2277                          * missing a TSN.
2278                          */
2279                         at = i;
2280                         all_ones = 0;
2281                         asoc->cumulative_tsn = asoc->mapping_array_base_tsn +
2282                             (i - 1);
2283                         break;
2284                 }
2285         }
2286         if (compare_with_wrap(asoc->cumulative_tsn,
2287                               asoc->highest_tsn_inside_map,
2288                               MAX_TSN)) {
2289                 panic("huh, cumack greater than high-tsn in map");
2290         }
2291         if (all_ones ||
2292             (asoc->cumulative_tsn == asoc->highest_tsn_inside_map && at >= 8)) {
2293                 /* The complete array was completed by a single FR */
2294                 /* higest becomes the cum-ack */
2295                 int clr;
2296                 asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
2297                 /* clear the array */
2298                 if (all_ones)
2299                         clr = asoc->mapping_array_size;
2300                 else {
2301                         clr = (at >> 3) + 1;
2302                         /*
2303                          * this should be the allones case
2304                          * but just in case :>
2305                          */
2306                         if (clr > asoc->mapping_array_size)
2307                                 clr = asoc->mapping_array_size;
2308                 }
2309                 memset(asoc->mapping_array, 0, clr);
2310                 /* base becomes one ahead of the cum-ack */
2311                 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2312 #ifdef SCTP_MAP_LOGGING
2313                 sctp_log_map(old_base, old_cumack, old_highest,
2314                     SCTP_MAP_PREPARE_SLIDE);
2315                 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2316                     asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_CLEARED);
2317 #endif
2318         } else if (at >= 8) {
2319                 /* we can slide the mapping array down */
2320                 /* Calculate the new byte postion we can move down */
2321                 slide_from = at >> 3;
2322                 /* now calculate the ceiling of the move using our highest TSN value */
2323                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
2324                         lgap = asoc->highest_tsn_inside_map -
2325                             asoc->mapping_array_base_tsn;
2326                 } else {
2327                         lgap = (MAX_TSN - asoc->mapping_array_base_tsn) +
2328                             asoc->highest_tsn_inside_map + 1;
2329                 }
2330                 slide_end = lgap >> 3;
2331                 if (slide_end < slide_from) {
2332                         panic("impossible slide");
2333                 }
2334                 distance = (slide_end-slide_from) + 1;
2335 #ifdef SCTP_MAP_LOGGING
2336                 sctp_log_map(old_base, old_cumack, old_highest,
2337                     SCTP_MAP_PREPARE_SLIDE);
2338                 sctp_log_map((uint32_t)slide_from, (uint32_t)slide_end,
2339                     (uint32_t)lgap, SCTP_MAP_SLIDE_FROM);
2340 #endif
2341                 if (distance + slide_from > asoc->mapping_array_size ||
2342                     distance < 0) {
2343 #ifdef SCTP_DEBUG
2344                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
2345                                 kprintf("Ugh bad addition.. you can't hrumpp!\n");
2346                         }
2347 #endif
2348                         /*
2349                          * Here we do NOT slide forward the array so that
2350                          * hopefully when more data comes in to fill it up
2351                          * we will be able to slide it forward. Really
2352                          * I don't think this should happen :-0
2353                          */
2354
2355 #ifdef SCTP_MAP_LOGGING
2356                         sctp_log_map((uint32_t)distance, (uint32_t)slide_from,
2357                             (uint32_t)asoc->mapping_array_size,
2358                             SCTP_MAP_SLIDE_NONE);
2359 #endif
2360                 } else {
2361                         int ii;
2362                         for (ii = 0; ii < distance; ii++) {
2363                                 asoc->mapping_array[ii] =
2364                                     asoc->mapping_array[slide_from + ii];
2365                         }
2366                         for (ii = distance;ii <= slide_end; ii++) {
2367                                 asoc->mapping_array[ii] = 0;
2368                         }
2369                         asoc->mapping_array_base_tsn += (slide_from << 3);
2370 #ifdef SCTP_MAP_LOGGING
2371                         sctp_log_map(asoc->mapping_array_base_tsn,
2372                             asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2373                             SCTP_MAP_SLIDE_RESULT);
2374 #endif
2375                 }
2376         }
2377
2378         /* check the special flag for stream resets */
2379         if ((asoc->pending_reply) &&
2380            ((compare_with_wrap((asoc->cumulative_tsn+1), ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) ||
2381             ((asoc->cumulative_tsn+1) ==  ntohl(asoc->pending_reply->reset_at_tsn)))
2382                 ) {
2383                 /* we have finished working through the backlogged TSN's now
2384                  * time to reset streams.
2385                  * 1: call reset function.
2386                  * 2: free pending_reply space
2387                  * 3: distribute any chunks in pending_reply_queue.
2388                  */
2389                 struct sctp_tmit_chunk *chk;
2390                 sctp_handle_stream_reset_response(stcb, asoc->pending_reply);
2391                 FREE(asoc->pending_reply, M_PCB);
2392                 asoc->pending_reply = NULL;
2393                 chk = TAILQ_FIRST(&asoc->pending_reply_queue);
2394                 while (chk) {
2395                         TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next);
2396                         sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag);
2397                         if (*abort_flag) {
2398                                 return;
2399                         }
2400                         chk = TAILQ_FIRST(&asoc->pending_reply_queue);
2401                 }
2402         }
2403         /*
2404          * Now we need to see if we need to queue a sack or just start
2405          * the timer (if allowed).
2406          */
2407         if (ok_to_sack) {
2408                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2409                         /*
2410                          * Ok special case, in SHUTDOWN-SENT case.
2411                          * here we maker sure SACK timer is off and
2412                          * instead send a SHUTDOWN and a SACK
2413                          */
2414                         if (callout_pending(&stcb->asoc.dack_timer.timer)) {
2415                                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2416                                     stcb->sctp_ep, stcb, NULL);
2417                         }
2418 #ifdef SCTP_DEBUG
2419                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
2420                                 kprintf("%s:%d sends a shutdown\n",
2421                                        __FILE__,
2422                                        __LINE__
2423                                        );
2424                         }
2425 #endif
2426                         sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
2427                         sctp_send_sack(stcb);
2428                 } else {
2429                         int is_a_gap;
2430                         /* is there a gap now ? */
2431                         is_a_gap = compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2432                             stcb->asoc.cumulative_tsn, MAX_TSN);
2433                         if ((stcb->asoc.first_ack_sent == 0) || /* First time we send a sack */
2434                             ((was_a_gap) && (is_a_gap == 0)) || /* was a gap, but no longer is one */
2435                             (stcb->asoc.numduptsns) ||          /* we have dup's */
2436                             (is_a_gap) ||                       /* is still a gap */
2437                             (callout_pending(&stcb->asoc.dack_timer.timer)) /* timer was up . second packet */
2438                                 ) {
2439                                 /*
2440                                  * Ok we must build a SACK since the timer
2441                                  * is pending, we got our first packet OR
2442                                  * there are gaps or duplicates.
2443                                  */
2444                                 stcb->asoc.first_ack_sent = 1;
2445                                 sctp_send_sack(stcb);
2446                                 /* The sending will stop the timer */
2447                         } else {
2448                                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2449                                     stcb->sctp_ep, stcb, NULL);
2450                         }
2451                 }
2452         }
2453 }
2454
2455 void
2456 sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks)
2457 {
2458         struct sctp_tmit_chunk *chk;
2459         int tsize, cntDel;
2460         u_int16_t nxt_todel;
2461
2462         cntDel = 0;
2463         if (asoc->fragmented_delivery_inprogress) {
2464                 sctp_service_reassembly(stcb, asoc, hold_locks);
2465         }
2466         /* Can we proceed further, i.e. the PD-API is complete */
2467         if (asoc->fragmented_delivery_inprogress) {
2468                 /* no */
2469                 return;
2470         }
2471
2472         /*
2473          * Yes, reassembly delivery no longer in progress see if we
2474          * have some on the sb hold queue.
2475          */
2476         do {
2477                 if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) {
2478                         if (cntDel == 0)
2479                                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2480                         break;
2481                 }
2482                 /* If deliver_data says no we must stop */
2483                 if (sctp_deliver_data(stcb, asoc, NULL, hold_locks) == 0)
2484                         break;
2485                 cntDel++;
2486                 chk = TAILQ_FIRST(&asoc->delivery_queue);
2487         } while (chk);
2488         if (cntDel) {
2489                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2490         }
2491         /*
2492          * Now is there some other chunk I can deliver
2493          * from the reassembly queue.
2494          */
2495         chk = TAILQ_FIRST(&asoc->reasmqueue);
2496         if (chk == NULL) {
2497                 asoc->size_on_reasm_queue = 0;
2498                 asoc->cnt_on_reasm_queue = 0;
2499                 return;
2500         }
2501         nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
2502         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
2503             ((nxt_todel == chk->rec.data.stream_seq) ||
2504              (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
2505                 /*
2506                  * Yep the first one is here. We setup to
2507                  * start reception, by backing down the TSN
2508                  * just in case we can't deliver.
2509                  */
2510
2511                 /*
2512                  * Before we start though either all of the
2513                  * message should be here or 1/4 the socket buffer
2514                  * max or nothing on the delivery queue and something
2515                  * can be delivered.
2516                  */
2517                 if (TAILQ_EMPTY(&asoc->delivery_queue) &&
2518                     (sctp_is_all_msg_on_reasm(asoc, &tsize) ||
2519                      (asoc->size_on_reasm_queue >=
2520                       (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) && tsize))) {
2521                         asoc->fragmented_delivery_inprogress = 1;
2522                         asoc->tsn_last_delivered = chk->rec.data.TSN_seq-1;
2523                         asoc->str_of_pdapi = chk->rec.data.stream_number;
2524                         asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
2525                         asoc->fragment_flags = chk->rec.data.rcv_flags;
2526                         sctp_service_reassembly(stcb, asoc, hold_locks);
2527                 }
2528         }
2529 }
2530
2531 int
2532 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2533     struct sctphdr *sh, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2534     struct sctp_nets *net, u_int32_t *high_tsn)
2535 {
2536         struct sctp_data_chunk *ch, chunk_buf;
2537         struct sctp_association *asoc;
2538         int num_chunks = 0;     /* number of control chunks processed */
2539         int chk_length, break_flag, last_chunk;
2540         int abort_flag = 0, was_a_gap = 0;
2541         struct mbuf *m;
2542
2543         /* set the rwnd */
2544         sctp_set_rwnd(stcb, &stcb->asoc);
2545
2546         m = *mm;
2547         asoc = &stcb->asoc;
2548         if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2549             stcb->asoc.cumulative_tsn, MAX_TSN)) {
2550                 /* there was a gap before this data was processed */
2551                 was_a_gap = 1;
2552         }
2553         /*
2554          * setup where we got the last DATA packet from for
2555          * any SACK that may need to go out. Don't bump
2556          * the net. This is done ONLY when a chunk
2557          * is assigned.
2558          */
2559         asoc->last_data_chunk_from = net;
2560
2561         /*
2562          * Now before we proceed we must figure out if this
2563          * is a wasted cluster... i.e. it is a small packet
2564          * sent in and yet the driver underneath allocated a
2565          * full cluster for it. If so we must copy it to a
2566          * smaller mbuf and free up the cluster mbuf. This
2567          * will help with cluster starvation.
2568          */
2569         if (m->m_len < (long)MHLEN && m->m_next == NULL) {
2570                 /* we only handle mbufs that are singletons.. not chains */
2571 #ifdef __DragonFly__
2572                 if ((*mm)->m_flags & M_PKTHDR)
2573                         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
2574                 else
2575 #endif
2576                         MGET(m, MB_DONTWAIT, MT_DATA);
2577                 if (m) {
2578                         /* ok lets see if we can copy the data up */
2579                         caddr_t *from, *to;
2580
2581                         if ((*mm)->m_flags & M_PKTHDR) {
2582                                 /* got to copy the header first */
2583 #ifdef __APPLE__
2584                                 M_COPY_PKTHDR(m, (*mm));
2585 #else
2586                                 M_MOVE_PKTHDR(m, (*mm));
2587 #endif
2588                         }
2589                         /* get the pointers and copy */
2590                         to = mtod(m, caddr_t *);
2591                         from = mtod((*mm), caddr_t *);
2592                         memcpy(to, from, (*mm)->m_len);
2593                         /* copy the length and free up the old */
2594                         m->m_len = (*mm)->m_len;
2595                         sctp_m_freem(*mm);
2596                         /* sucess, back copy */
2597                         *mm = m;
2598                 } else {
2599                         /* We are in trouble in the mbuf world .. yikes */
2600                         m = *mm;
2601                 }
2602         }
2603         /* get pointer to the first chunk header */
2604         ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2605             sizeof(chunk_buf), (u_int8_t *)&chunk_buf);
2606         if (ch == NULL) {
2607                 kprintf(" ... its short\n");
2608                 return (1);
2609         }
2610         /*
2611          * process all DATA chunks...
2612          */
2613
2614 #ifdef SCTP_DEBUG
2615         if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2616                 kprintf("In process data off:%d length:%d iphlen:%d ch->type:%d\n",
2617                     *offset, length, iphlen, (int)ch->ch.chunk_type);
2618         }
2619 #endif
2620
2621         *high_tsn = asoc->cumulative_tsn;
2622         break_flag = 0;
2623         while (ch->ch.chunk_type == SCTP_DATA) {
2624                 /* validate chunk length */
2625                 chk_length = ntohs(ch->ch.chunk_length);
2626                 if ((size_t)chk_length < sizeof(struct sctp_data_chunk) + 1 ||
2627                     length - *offset < chk_length) {
2628                         /*
2629                          * Need to send an abort since we had a invalid
2630                          * data chunk.
2631                          */
2632                         struct mbuf *op_err;
2633                         MGET(op_err, MB_DONTWAIT, MT_DATA);
2634                         if (op_err) {
2635                                 struct sctp_paramhdr *ph;
2636                                 u_int32_t *ippp;
2637
2638                                 op_err->m_len = sizeof(struct sctp_paramhdr) +
2639                                     sizeof(*ippp);
2640                                 ph = mtod(op_err, struct sctp_paramhdr *);
2641                                 ph->param_type =
2642                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2643                                 ph->param_length = htons(op_err->m_len);
2644                                 ippp = (u_int32_t *)(ph + 1);
2645                                 *ippp = htonl(0x30000001);
2646                         }
2647                         sctp_abort_association(inp, stcb, m, iphlen, sh,
2648                             op_err);
2649                         return (2);
2650                 }
2651 #ifdef SCTP_DEBUG
2652                 if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2653                         kprintf("A chunk of len:%d to process (tot:%d)\n",
2654                             chk_length, length - *offset);
2655                 }
2656 #endif
2657
2658 #ifdef SCTP_AUDITING_ENABLED
2659                 sctp_audit_log(0xB1, 0);
2660 #endif
2661                 if (SCTP_SIZE32(chk_length) == *offset - length) {
2662                         last_chunk = 1;
2663                 } else {
2664                         last_chunk = 0;
2665                 }
2666                 if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch,
2667                     chk_length, net, high_tsn, &abort_flag, &break_flag,
2668                     last_chunk)) {
2669                         num_chunks++;
2670 #ifdef SCTP_DEBUG
2671                         if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
2672                                 kprintf("Now incr num_chunks to %d\n",
2673                                     num_chunks);
2674                         }
2675 #endif
2676                 }
2677                 if (abort_flag)
2678                         return (2);
2679
2680                 if (break_flag) {
2681                         /*
2682                          * Set because of out of rwnd space and no drop rep
2683                          * space left.
2684                          */
2685                         break;
2686                 }
2687
2688                 *offset += SCTP_SIZE32(chk_length);
2689                 if (*offset >= length) {
2690                         /* no more data left in the mbuf chain */
2691                         break;
2692                 }
2693                 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2694                     sizeof(chunk_buf), (u_int8_t *)&chunk_buf);
2695                 if (ch == NULL) {
2696                         *offset = length;
2697                         break;
2698                 }
2699         } /* while */
2700         if (break_flag) {
2701                 /*
2702                  * we need to report rwnd overrun drops.
2703                  */
2704                 sctp_send_packet_dropped(stcb, net, *mm, iphlen, 0);
2705         }
2706         if (num_chunks) {
2707                 /*
2708                  * Did we get data, if so update the time for
2709                  * auto-close and give peer credit for being
2710                  * alive.
2711                  */
2712                 sctp_pegs[SCTP_DATA_DG_RECV]++;
2713                 stcb->asoc.overall_error_count = 0;
2714                 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2715         }
2716         /* now service all of the reassm queue and delivery queue */
2717         sctp_service_queues(stcb, asoc, 0);
2718         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2719                 /*
2720                  * Assure that we ack right away by making
2721                  * sure that a d-ack timer is running. So the
2722                  * sack_check will send a sack.
2723                  */
2724                 sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb,
2725                     net);
2726         }
2727         /* Start a sack timer or QUEUE a SACK for sending */
2728         sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
2729         if (abort_flag)
2730                 return (2);
2731
2732         return (0);
2733 }
2734
2735 static void
2736 sctp_handle_segments(struct sctp_tcb *stcb, struct sctp_association *asoc,
2737     struct sctp_sack_chunk *ch, u_long last_tsn, u_long *biggest_tsn_acked,
2738     u_long *biggest_newly_acked_tsn, int num_seg, int *ecn_seg_sums)
2739 {
2740         /************************************************/
2741         /* process fragments and update sendqueue        */
2742         /************************************************/
2743         struct sctp_sack *sack;
2744         struct sctp_gap_ack_block *frag;
2745         struct sctp_tmit_chunk *tp1;
2746         int i;
2747         unsigned int j;
2748 #ifdef SCTP_FR_LOGGING
2749         int num_frs=0;
2750 #endif
2751         uint16_t frag_strt, frag_end, primary_flag_set;
2752         u_long last_frag_high;
2753
2754         if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
2755                 primary_flag_set = 1;
2756         } else {
2757                 primary_flag_set = 0;
2758         }
2759
2760         sack = &ch->sack;
2761         frag = (struct sctp_gap_ack_block *)((caddr_t)sack +
2762             sizeof(struct sctp_sack));
2763         tp1 = NULL;
2764         last_frag_high = 0;
2765         for (i = 0; i < num_seg; i++) {
2766                 frag_strt = ntohs(frag->start);
2767                 frag_end = ntohs(frag->end);
2768                 /* some sanity checks on the fargment offsets */
2769                 if (frag_strt > frag_end) {
2770                         /* this one is malformed, skip */
2771                         frag++;
2772                         continue;
2773                 }
2774                 if (compare_with_wrap((frag_end+last_tsn), *biggest_tsn_acked,
2775                     MAX_TSN))
2776                         *biggest_tsn_acked = frag_end+last_tsn;
2777
2778                 /* mark acked dgs and find out the highestTSN being acked */
2779                 if (tp1 == NULL) {
2780                         tp1 = TAILQ_FIRST(&asoc->sent_queue);
2781
2782                         /* save the locations of the last frags */
2783                         last_frag_high = frag_end + last_tsn;
2784                 } else {
2785                         /*
2786                          * now lets see if we need to reset the queue
2787                          * due to a out-of-order SACK fragment
2788                          */
2789                         if (compare_with_wrap(frag_strt+last_tsn,
2790                             last_frag_high, MAX_TSN)) {
2791                                 /*
2792                                  * if the new frag starts after the last TSN
2793                                  * frag covered, we are ok
2794                                  * and this one is beyond the last one
2795                                  */
2796                                 ;
2797                         } else {
2798                                 /*
2799                                  * ok, they have reset us, so we need to reset
2800                                  * the queue this will cause extra hunting but
2801                                  * hey, they chose the performance
2802                                  * hit when they failed to order there gaps..
2803                                  */
2804                                 tp1 = TAILQ_FIRST(&asoc->sent_queue);
2805                         }
2806                         last_frag_high = frag_end + last_tsn;
2807                 }
2808                 for (j = frag_strt + last_tsn; j <= frag_end + last_tsn; j++) {
2809                         while (tp1) {
2810 #ifdef SCTP_FR_LOGGING
2811                                 if (tp1->rec.data.doing_fast_retransmit)
2812                                         num_frs++;
2813 #endif
2814
2815                                 if (tp1->rec.data.TSN_seq == j) {
2816                                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2817                                                 /* must be held until cum-ack passes */
2818                                                 /* ECN Nonce: Add the nonce value to the sender's nonce sum */
2819                                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
2820                                                         /*
2821                                                          * If it is less than
2822                                                          * ACKED, it is now
2823                                                          * no-longer in flight.
2824                                                          * Higher values may
2825                                                          * already be set via
2826                                                          * previous Gap Ack
2827                                                          * Blocks...
2828                                                          * i.e. ACKED or MARKED.
2829                                                          */
2830                                                         if (compare_with_wrap(tp1->rec.data.TSN_seq,
2831                                                             *biggest_newly_acked_tsn,
2832                                                             MAX_TSN)) {
2833                                                                 *biggest_newly_acked_tsn =
2834                                                                     tp1->rec.data.TSN_seq;
2835                                                         }
2836                                                         tp1->whoTo->flight_size -= tp1->book_size;
2837                                                         if (tp1->whoTo->flight_size < 0) {
2838                                                                 tp1->whoTo->flight_size = 0;
2839                                                         }
2840                                                         asoc->total_flight -=
2841                                                             tp1->book_size;
2842
2843                                                         if (asoc->total_flight < 0) {
2844                                                                 asoc->total_flight = 0;
2845                                                         }
2846
2847                                                         asoc->total_flight_count--;
2848                                                         if (asoc->total_flight_count < 0) {
2849                                                                 asoc->total_flight_count = 0;
2850                                                         }
2851
2852                                                         if (tp1->snd_count < 2) {
2853                                                                 /* True non-retransmited chunk */
2854                                                                 tp1->whoTo->net_ack2 +=
2855                                                                     tp1->send_size;
2856
2857                                                                 /* update RTO too? */
2858                                                                 if (tp1->do_rtt) {
2859                                                                         tp1->whoTo->RTO =
2860                                                                             sctp_calculate_rto(stcb,
2861                                                                             asoc,
2862                                                                             tp1->whoTo,
2863                                                                             &tp1->sent_rcv_time);
2864                                                                         tp1->whoTo->rto_pending = 0;
2865                                                                         tp1->do_rtt = 0;
2866                                                                 }
2867                                                         }
2868                                                 }
2869                                                 if (tp1->sent <= SCTP_DATAGRAM_RESEND &&
2870                                                     tp1->sent != SCTP_DATAGRAM_UNSENT &&
2871                                                     compare_with_wrap(tp1->rec.data.TSN_seq,
2872                                                     asoc->this_sack_highest_gap,
2873                                                     MAX_TSN)) {
2874                                                         asoc->this_sack_highest_gap =
2875                                                             tp1->rec.data.TSN_seq;
2876                                                         if (primary_flag_set) {
2877                                                                 tp1->whoTo->cacc_saw_newack = 1;
2878                                                         }
2879                                                 }
2880                                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
2881 #ifdef SCTP_DEBUG
2882                                                         if (sctp_debug_on &
2883                                                             SCTP_DEBUG_INDATA3) {
2884                                                                 kprintf("Hmm. one that is in RESEND that is now ACKED\n");
2885                                                         }
2886 #endif
2887                                                         asoc->sent_queue_retran_cnt--;
2888 #ifdef SCTP_AUDITING_ENABLED
2889                                                         sctp_audit_log(0xB2,
2890                                                             (asoc->sent_queue_retran_cnt & 0x000000ff));
2891 #endif
2892
2893                                                         if (asoc->sent_queue_retran_cnt < 0) {
2894                                                                 kprintf("huh3 retran went negative?\n");
2895 #ifdef SCTP_AUDITING_ENABLED
2896                                                                 sctp_auditing(30,
2897                                                                     inp, tcb,
2898                                                                     NULL);
2899 #else
2900                                                                 asoc->sent_queue_retran_cnt = 0;
2901 #endif
2902                                                         }
2903                                                 }
2904                                                 (*ecn_seg_sums) += tp1->rec.data.ect_nonce;
2905                                                 (*ecn_seg_sums) &= SCTP_SACK_NONCE_SUM;
2906                                                 tp1->sent = SCTP_DATAGRAM_MARKED;
2907                                         }
2908                                         break;
2909                                 } /* if (tp1->TSN_seq == j) */
2910                                 if (compare_with_wrap(tp1->rec.data.TSN_seq, j,
2911                                     MAX_TSN))
2912                                         break;
2913                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
2914                         }/* end while (tp1) */
2915                 }  /* end for (j = fragStart */
2916                 frag++; /* next one */
2917         }
2918 #ifdef SCTP_FR_LOGGING
2919         if (num_frs)
2920                 sctp_log_fr(*biggest_tsn_acked, *biggest_newly_acked_tsn,
2921                     last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
2922 #endif
2923 }
2924
2925 static void
2926 sctp_check_for_revoked(struct sctp_association *asoc, u_long cum_ack,
2927     u_long biggest_tsn_acked)
2928 {
2929         struct sctp_tmit_chunk *tp1;
2930         int tot_revoked=0;
2931
2932         tp1 = TAILQ_FIRST(&asoc->sent_queue);
2933         while (tp1) {
2934                 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
2935                     MAX_TSN)) {
2936                         /*
2937                          * ok this guy is either ACK or MARKED. If it is ACKED
2938                          * it has been previously acked but not this time i.e.
2939                          * revoked.  If it is MARKED it was ACK'ed again.
2940                          */
2941                         if (tp1->sent == SCTP_DATAGRAM_ACKED) {
2942                                 /* it has been revoked */
2943                                 /*
2944                                  * We do NOT add back to flight size here since
2945                                  * it is really NOT in flight. Resend (when/if
2946                                  * it occurs will add to flight size
2947                                  */
2948                                 tp1->sent = SCTP_DATAGRAM_SENT;
2949                                 tot_revoked++;
2950                         } else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
2951                                 /* it has been re-acked in this SACK */
2952                                 tp1->sent = SCTP_DATAGRAM_ACKED;
2953                         }
2954                 }
2955                 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
2956                     MAX_TSN)) {
2957                         /* above the sack */
2958                         break;
2959                 }
2960                 if (tp1->sent == SCTP_DATAGRAM_UNSENT)
2961                         break;
2962                 tp1 = TAILQ_NEXT(tp1, sctp_next);
2963         }
2964         if (tot_revoked > 0) {
2965                 /* Setup the ecn nonce re-sync point. We
2966                  * do this since once data is revoked
2967                  * we begin to retransmit things, which
2968                  * do NOT have the ECN bits set. This means
2969                  * we are now out of sync and must wait until
2970                  * we get back in sync with the peer to
2971                  * check ECN bits.
2972                  */
2973                 tp1 = TAILQ_FIRST(&asoc->send_queue);
2974                 if (tp1 == NULL) {
2975                         asoc->nonce_resync_tsn = asoc->sending_seq;
2976                 } else {
2977                         asoc->nonce_resync_tsn = tp1->rec.data.TSN_seq;
2978                 }
2979                 asoc->nonce_wait_for_ecne = 0;
2980                 asoc->nonce_sum_check = 0;
2981         }
2982
2983 }
2984
2985 extern int sctp_peer_chunk_oh;
2986
2987 static void
2988 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
2989     u_long biggest_tsn_acked, int strike_enabled,
2990     u_long biggest_tsn_newly_acked, int accum_moved)
2991 {
2992         struct sctp_tmit_chunk *tp1;
2993         int strike_flag=0;
2994         struct timeval now;
2995         int tot_retrans=0;
2996         u_int32_t sending_seq;
2997         int primary_switch_active = 0;
2998         int double_switch_active = 0;
2999
3000         /* select the sending_seq, this is
3001          * either the next thing ready to
3002          * be sent but not transmitted, OR,
3003          * the next seq we assign.
3004          */
3005         tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3006         if (tp1 == NULL) {
3007                 sending_seq = asoc->sending_seq;
3008         } else {
3009                 sending_seq = tp1->rec.data.TSN_seq;
3010         }
3011
3012         if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
3013                 primary_switch_active = 1;
3014         }
3015         if (asoc->primary_destination->dest_state & SCTP_ADDR_DOUBLE_SWITCH) {
3016                 double_switch_active = 1;
3017         }
3018         if (stcb->asoc.peer_supports_prsctp ) {
3019                 SCTP_GETTIME_TIMEVAL(&now);
3020         }
3021         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3022         while (tp1) {
3023                 strike_flag=0;
3024                 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
3025                     MAX_TSN) ||
3026                     tp1->sent == SCTP_DATAGRAM_UNSENT) {
3027                         /* done */
3028                         break;
3029                 }
3030                 if ((tp1->flags & (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) ==
3031                     SCTP_PR_SCTP_ENABLED &&
3032                     tp1->sent < SCTP_DATAGRAM_ACKED) {
3033                         /* Is it expired? */
3034 #ifndef __FreeBSD__
3035                         if (timercmp(&now, &tp1->rec.data.timetodrop, >))
3036 #else
3037                         if (timevalcmp(&now, &tp1->rec.data.timetodrop, >))
3038 #endif
3039                         {
3040                                 /* Yes so drop it */
3041                                 if (tp1->data != NULL) {
3042                                         sctp_release_pr_sctp_chunk(stcb, tp1,
3043                                             (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3044                                             &asoc->sent_queue);
3045                                 }
3046                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3047                                 continue;
3048                         }
3049                 }
3050
3051                 if (compare_with_wrap(tp1->rec.data.TSN_seq,
3052                     asoc->this_sack_highest_gap, MAX_TSN)) {
3053                         /* we are beyond the tsn in the sack  */
3054                         break;
3055                 }
3056                 if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3057                         /* either a RESEND, ACKED, or MARKED */
3058                         /* skip */
3059                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3060                         continue;
3061                 }
3062                 if (primary_switch_active && (strike_enabled == 0)) {
3063                         if (tp1->whoTo != asoc->primary_destination) {
3064                                 /*
3065                                  * We can only strike things on the primary if
3066                                  * the strike_enabled flag is clear
3067                                  */
3068                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3069                                 continue;
3070                         }
3071                 } else if (primary_switch_active) {
3072                         if (tp1->whoTo->cacc_saw_newack == 0) {
3073                                 /*
3074                                  * Only one was received but it was NOT
3075                                  * this one.
3076                                  */
3077                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3078                                 continue;
3079                         }
3080                 }
3081                 if (double_switch_active &&
3082                     (compare_with_wrap(asoc->primary_destination->next_tsn_at_change,
3083                     tp1->rec.data.TSN_seq, MAX_TSN))) {
3084                         /*
3085                          * With a double switch we do NOT mark unless we
3086                          * are beyond the switch point.
3087                          */
3088                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3089                         continue;
3090                 }
3091                 /*
3092                  * Here we check to see if we were have already done a FR
3093                  * and if so we see if the biggest TSN we saw in the sack is
3094                  * smaller than the recovery point. If so we don't strike the
3095                  * tsn... otherwise we CAN strike the TSN.
3096                  */
3097                 if (accum_moved && asoc->fast_retran_loss_recovery) {
3098                         /*
3099                          * Strike the TSN if in fast-recovery and
3100                          * cum-ack moved.
3101                          */
3102                         tp1->sent++;
3103                 } else if (tp1->rec.data.doing_fast_retransmit) {
3104                         /*
3105                          * For those that have done a FR we must
3106                          * take special consideration if we strike. I.e
3107                          * the biggest_newly_acked must be higher
3108                          * than the sending_seq at the time we did
3109                          * the FR.
3110                          */
3111 #ifdef SCTP_FR_TO_ALTERNATE
3112                         /*
3113                          * If FR's go to new networks, then we
3114                          * must only do this for singly homed asoc's. However
3115                          * if the FR's go to the same network (Armando's work)
3116                          * then its ok to FR multiple times.
3117                          */
3118                         if (asoc->numnets < 2)
3119 #else
3120                         if (1)
3121 #endif
3122                         {
3123                                 if ((compare_with_wrap(biggest_tsn_newly_acked,
3124                                     tp1->rec.data.fast_retran_tsn, MAX_TSN)) ||
3125                                     (biggest_tsn_newly_acked ==
3126                                      tp1->rec.data.fast_retran_tsn)) {
3127                                         /*
3128                                          * Strike the TSN, since this ack is
3129                                          * beyond where things were when we did
3130                                          * a FR.
3131                                          */
3132 #ifdef SCTP_FR_LOGGING
3133                                         sctp_log_fr(biggest_tsn_newly_acked,
3134                                             tp1->rec.data.TSN_seq,
3135                                             tp1->rec.data.fast_retran_tsn,
3136                                             SCTP_FR_LOG_STRIKE_CHUNK);
3137 #endif
3138                                         tp1->sent++;
3139                                         strike_flag=1;
3140                                 }
3141                         }
3142                 } else if (compare_with_wrap(tp1->rec.data.TSN_seq,
3143                     biggest_tsn_newly_acked, MAX_TSN)) {
3144                         /*
3145                          * We don't strike these:
3146                          * This is the  HTNA algorithm i.e. we don't strike
3147                          * If our TSN is larger than the Highest TSN Newly
3148                          * Acked.
3149                          */
3150                         ;
3151                 } else {
3152                         /* Strike the TSN */
3153                         tp1->sent++;
3154                 }
3155                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3156                         /* Increment the count to resend */
3157                         struct sctp_nets *alt;
3158
3159 #ifdef SCTP_FR_LOGGING
3160                         sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count,
3161                             0, SCTP_FR_MARKED);
3162 #endif
3163                         if (strike_flag) {
3164                                 /* This is a subsequent FR */
3165                                 sctp_pegs[SCTP_DUP_FR]++;
3166                         }
3167                         asoc->sent_queue_retran_cnt++;
3168 #ifdef SCTP_FR_TO_ALTERNATE
3169                         /* Can we find an alternate? */
3170                         alt = sctp_find_alternate_net(stcb, tp1->whoTo);
3171 #else
3172                         /*
3173                          * default behavior is to NOT retransmit FR's
3174                          * to an alternate. Armando Caro's paper details
3175                          * why.
3176                          */
3177                         alt = tp1->whoTo;
3178 #endif
3179                         tp1->rec.data.doing_fast_retransmit = 1;
3180                         tot_retrans++;
3181                         /* mark the sending seq for possible subsequent FR's */
3182                         if (TAILQ_EMPTY(&asoc->send_queue)) {
3183                                 /*
3184                                  * If the queue of send is empty then its the
3185                                  * next sequence number that will be assigned so
3186                                  * we subtract one from this to get the one we
3187                                  * last sent.
3188                                  */
3189                                 tp1->rec.data.fast_retran_tsn = sending_seq - 1;
3190                         } else {
3191                                 /*
3192                                  * If there are chunks on the send queue
3193                                  * (unsent data that has made it from the
3194                                  * stream queues but not out the door, we take
3195                                  * the first one (which will have the lowest
3196                                  * TSN) and subtract one to get the one we last
3197                                  * sent.
3198                                  */
3199                                 struct sctp_tmit_chunk *ttt;
3200                                 ttt = TAILQ_FIRST(&asoc->send_queue);
3201                                 tp1->rec.data.fast_retran_tsn =
3202                                     ttt->rec.data.TSN_seq - 1;
3203                         }
3204                         if (tp1->do_rtt) {
3205                                 /*
3206                                  * this guy had a RTO calculation pending on it,
3207                                  * cancel it
3208                                  */
3209                                 tp1->whoTo->rto_pending = 0;
3210                                 tp1->do_rtt = 0;
3211                         }
3212                         /* fix counts and things */
3213
3214                         tp1->whoTo->net_ack++;
3215                         tp1->whoTo->flight_size -= tp1->book_size;
3216                         if (tp1->whoTo->flight_size < 0) {
3217                                 tp1->whoTo->flight_size = 0;
3218                         }
3219 #ifdef SCTP_LOG_RWND
3220                         sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3221                                       asoc->peers_rwnd , tp1->send_size, sctp_peer_chunk_oh);
3222 #endif
3223                         /* add back to the rwnd */
3224                         asoc->peers_rwnd += (tp1->send_size + sctp_peer_chunk_oh);
3225
3226                         /* remove from the total flight */
3227                         asoc->total_flight -= tp1->book_size;
3228                         if (asoc->total_flight < 0) {
3229                                 asoc->total_flight = 0;
3230                         }
3231                         asoc->total_flight_count--;
3232                         if (asoc->total_flight_count < 0) {
3233                                 asoc->total_flight_count = 0;
3234                         }
3235                         if (alt != tp1->whoTo) {
3236                                 /* yes, there is an alternate. */
3237                                 sctp_free_remote_addr(tp1->whoTo);
3238                                 tp1->whoTo = alt;
3239                                 alt->ref_count++;
3240                         }
3241                 }
3242                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3243         } /* while (tp1) */
3244
3245         if (tot_retrans > 0) {
3246                 /* Setup the ecn nonce re-sync point. We
3247                  * do this since once we go to FR something
3248                  * we introduce a Karn's rule scenario and
3249                  * won't know the totals for the ECN bits.
3250                  */
3251                 asoc->nonce_resync_tsn = sending_seq;
3252                 asoc->nonce_wait_for_ecne = 0;
3253                 asoc->nonce_sum_check = 0;
3254         }
3255
3256 }
3257
3258 struct sctp_tmit_chunk *
3259 sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3260     struct sctp_association *asoc)
3261 {
3262         struct sctp_tmit_chunk *tp1, *tp2, *a_adv=NULL;
3263         struct timeval now;
3264         int now_filled=0;
3265
3266         if (asoc->peer_supports_prsctp == 0) {
3267                 return (NULL);
3268         }
3269         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3270         while (tp1) {
3271                 if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3272                     tp1->sent != SCTP_DATAGRAM_RESEND) {
3273                         /* no chance to advance, out of here */
3274                         break;
3275                 }
3276                 if ((tp1->flags & SCTP_PR_SCTP_ENABLED) == 0) {
3277                         /*
3278                          * We can't fwd-tsn past any that are reliable
3279                          * aka retransmitted until the asoc fails.
3280                          */
3281                         break;
3282                 }
3283                 if (!now_filled) {
3284                         SCTP_GETTIME_TIMEVAL(&now);
3285                         now_filled = 1;
3286                 }
3287                 tp2 = TAILQ_NEXT(tp1, sctp_next);
3288                 /*
3289                  * now we got a chunk which is marked for another
3290                  * retransmission to a PR-stream but has run
3291                  * out its chances already maybe OR has been
3292                  * marked to skip now. Can we skip it if its a
3293                  * resend?
3294                  */
3295                 if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3296                     (tp1->flags & SCTP_PR_SCTP_BUFFER) == 0) {
3297                         /*
3298                          * Now is this one marked for resend and its time
3299                          * is now up?
3300                          */
3301 #ifndef __FreeBSD__
3302                         if (timercmp(&now, &tp1->rec.data.timetodrop, >))
3303 #else
3304                         if (timevalcmp(&now, &tp1->rec.data.timetodrop, >))
3305 #endif
3306                         {
3307                                 /* Yes so drop it */
3308                                 if (tp1->data) {
3309                                         sctp_release_pr_sctp_chunk(stcb, tp1,
3310                                             (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3311                                             &asoc->sent_queue);
3312                                 }
3313                         } else {
3314                                 /*
3315                                  * No, we are done when hit one for resend whos
3316                                  * time as not expired.
3317                                  */
3318                                 break;
3319                         }
3320                 }
3321                 /*
3322                  * Ok now if this chunk is marked to drop it
3323                  * we can clean up the chunk, advance our peer ack point
3324                  * and we can check the next chunk.
3325                  */
3326                 if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3327                         /* advance PeerAckPoint goes forward */
3328                         asoc->advanced_peer_ack_point = tp1->rec.data.TSN_seq;
3329                         a_adv = tp1;
3330                         /*
3331                          * we don't want to de-queue it here. Just wait for the
3332                          * next peer SACK to come with a new cumTSN and then
3333                          * the chunk will be droped in the normal fashion.
3334                          */
3335                         if (tp1->data) {
3336                                 sctp_free_bufspace(stcb, asoc, tp1);
3337 #ifdef SCTP_DEBUG
3338                                 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
3339                                         kprintf("--total out:%lu total_mbuf_out:%lu\n",
3340                                             (u_long)asoc->total_output_queue_size,
3341                                             (u_long)asoc->total_output_mbuf_queue_size);
3342                                 }
3343 #endif
3344                                 /*
3345                                  * Maybe there should be another notification
3346                                  * type
3347                                  */
3348                                 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3349                                     (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT),
3350                                     tp1);
3351                                 sctp_m_freem(tp1->data);
3352                                 tp1->data = NULL;
3353                                 sctp_sowwakeup(stcb->sctp_ep,
3354                                     stcb->sctp_socket);
3355                         }
3356                 } else {
3357                         /* If it is still in RESEND we can advance no further */
3358                         break;
3359                 }
3360                 /*
3361                  * If we hit here we just dumped tp1, move to next
3362                  * tsn on sent queue.
3363                  */
3364                 tp1 = tp2;
3365         }
3366         return (a_adv);
3367 }
3368
3369 #ifdef SCTP_HIGH_SPEED
3370 struct sctp_hs_raise_drop {
3371         int32_t cwnd;
3372         int32_t increase;
3373         int32_t drop_percent;
3374 };
3375
3376 #define SCTP_HS_TABLE_SIZE 73
3377
3378 struct sctp_hs_raise_drop sctp_cwnd_adjust[SCTP_HS_TABLE_SIZE] = {
3379         {38,1,50},      /* 0   */
3380         {118,2,44},     /* 1   */
3381         {221,3,41},     /* 2   */
3382         {347,4,38},     /* 3   */
3383         {495,5,37},     /* 4   */
3384         {663,6,35},     /* 5   */
3385         {851,7,34},     /* 6   */
3386         {1058,8,33},    /* 7   */
3387         {1284,9,32},    /* 8   */
3388         {1529,10,31},   /* 9   */
3389         {1793,11,30},   /* 10  */
3390         {2076,12,29},   /* 11  */
3391         {2378,13,28},   /* 12  */
3392         {2699,14,28},   /* 13  */
3393         {3039,15,27},   /* 14  */
3394         {3399,16,27},   /* 15  */
3395         {3778,17,26},   /* 16  */
3396         {4177,18,26},   /* 17  */
3397         {4596,19,25},   /* 18  */
3398         {5036,20,25},   /* 19  */
3399         {5497,21,24},   /* 20  */
3400         {5979,22,24},   /* 21  */
3401         {6483,23,23},   /* 22  */
3402         {7009,24,23},   /* 23  */
3403         {7558,25,22},   /* 24  */
3404         {8130,26,22},   /* 25  */
3405         {8726,27,22},   /* 26  */
3406         {9346,28,21},   /* 27  */
3407         {9991,29,21},   /* 28  */
3408         {10661,30,21},  /* 29  */
3409         {11358,31,20},  /* 30  */
3410         {12082,32,20},  /* 31  */
3411         {12834,33,20},  /* 32  */
3412         {13614,34,19},  /* 33  */
3413         {14424,35,19},  /* 34  */
3414         {15265,36,19},  /* 35  */
3415         {16137,37,19},  /* 36  */
3416         {17042,38,18},  /* 37  */
3417         {17981,39,18},  /* 38  */
3418         {18955,40,18},  /* 39  */
3419         {19965,41,17},  /* 40  */
3420         {21013,42,17},  /* 41  */
3421         {22101,43,17},  /* 42  */
3422         {23230,44,17},  /* 43  */
3423         {24402,45,16},  /* 44  */
3424         {25618,46,16},  /* 45  */
3425         {26881,47,16},  /* 46  */
3426         {28193,48,16},  /* 47  */
3427         {29557,49,15},  /* 48  */
3428         {30975,50,15},  /* 49  */
3429         {32450,51,15},  /* 50  */
3430         {33986,52,15},  /* 51  */
3431         {35586,53,14},  /* 52  */
3432         {37253,54,14},  /* 53  */
3433         {38992,55,14},  /* 54  */
3434         {40808,56,14},  /* 55  */
3435         {42707,57,13},  /* 56  */
3436         {44694,58,13},  /* 57  */
3437         {46776,59,13},  /* 58  */
3438         {48961,60,13},  /* 59  */
3439         {51258,61,13},  /* 60  */
3440         {53677,62,12},  /* 61  */
3441         {56230,63,12},  /* 62  */
3442         {58932,64,12},  /* 63  */
3443         {61799,65,12},  /* 64  */
3444         {64851,66,11},  /* 65  */
3445         {68113,67,11},  /* 66  */
3446         {71617,68,11},  /* 67  */
3447         {75401,69,10},  /* 68  */
3448         {79517,70,10},  /* 69  */
3449         {84035,71,10},  /* 70  */
3450         {89053,72,10},  /* 71  */
3451         {94717,73,9}    /* 72  */
3452 };
3453
3454 static void
3455 sctp_hs_cwnd_increase(struct sctp_nets *net)
3456 {
3457         int cur_val, i, indx, incr;
3458
3459         cur_val = net->cwnd >> 10;
3460         indx = SCTP_HS_TABLE_SIZE - 1;
3461
3462         if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3463                 /* normal mode */
3464                 if (net->net_ack > net->mtu) {
3465                         net->cwnd += net->mtu;
3466 #ifdef SCTP_CWND_LOGGING
3467                         sctp_log_cwnd(net, net->mtu, SCTP_CWND_LOG_FROM_SS);
3468 #endif
3469                 } else {
3470                         net->cwnd += net->net_ack;
3471 #ifdef SCTP_CWND_LOGGING
3472                         sctp_log_cwnd(net, net->net_ack, SCTP_CWND_LOG_FROM_SS);
3473 #endif
3474                 }
3475         } else {
3476                 for (i=net->last_hs_used; i<SCTP_HS_TABLE_SIZE; i++) {
3477                         if (cur_val < sctp_cwnd_adjust[i].cwnd) {
3478                                 indx = i;
3479                                 break;
3480                         }
3481                 }
3482                 net->last_hs_used = indx;
3483                 incr = ((sctp_cwnd_adjust[indx].increase) << 10);
3484                 net->cwnd += incr;
3485 #ifdef SCTP_CWND_LOGGING
3486                 sctp_log_cwnd(net, incr, SCTP_CWND_LOG_FROM_SS);
3487 #endif
3488         }
3489 }
3490
3491 static void
3492 sctp_hs_cwnd_decrease(struct sctp_nets *net)
3493 {
3494         int cur_val, i, indx;
3495 #ifdef SCTP_CWND_LOGGING
3496         int old_cwnd = net->cwnd;
3497 #endif
3498
3499         cur_val = net->cwnd >> 10;
3500         indx = net->last_hs_used;
3501         if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3502                 /* normal mode */
3503                 net->ssthresh = net->cwnd / 2;
3504                 if (net->ssthresh < (net->mtu*2)) {
3505                         net->ssthresh = 2 * net->mtu;
3506                 }
3507                 net->cwnd = net->ssthresh;
3508 #ifdef SCTP_CWND_LOGGING
3509                 sctp_log_cwnd(net, (net->cwnd-old_cwnd), SCTP_CWND_LOG_FROM_FR);
3510 #endif
3511         } else {
3512                 /* drop by the proper amount */
3513                 net->ssthresh = net->cwnd - (int)((net->cwnd / 100) *
3514                     sctp_cwnd_adjust[net->last_hs_used].drop_percent);
3515                 net->cwnd = net->ssthresh;
3516                 /* now where are we */
3517                 indx = net->last_hs_used;
3518                 cur_val = net->cwnd >> 10;
3519                 /* reset where we are in the table */
3520                 if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3521                         /* feel out of hs */
3522                         net->last_hs_used = 0;
3523                 } else {
3524                         for (i = indx; i >= 1; i--) {
3525                                 if (cur_val > sctp_cwnd_adjust[i - 1].cwnd) {
3526                                         break;
3527                                 }
3528                         }
3529                         net->last_hs_used = indx;
3530                 }
3531         }
3532 }
3533 #endif
3534
3535 void
3536 sctp_handle_sack(struct sctp_sack_chunk *ch, struct sctp_tcb *stcb,
3537     struct sctp_nets *net_from, int *abort_now)
3538 {
3539         struct sctp_association *asoc;
3540         struct sctp_sack *sack;
3541         struct sctp_tmit_chunk *tp1, *tp2;
3542         u_long cum_ack, last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked;
3543         uint16_t num_seg;
3544         unsigned int sack_length;
3545         uint32_t send_s;
3546         int some_on_streamwheel;
3547         long j;
3548         int strike_enabled = 0, cnt_of_cacc = 0;
3549         int accum_moved = 0;
3550         int marking_allowed = 1;
3551         int will_exit_fast_recovery=0;
3552         u_int32_t a_rwnd;
3553         struct sctp_nets *net = NULL;
3554         int nonce_sum_flag, ecn_seg_sums=0;
3555         asoc = &stcb->asoc;
3556
3557         /*
3558          * Handle the incoming sack on data I have been sending.
3559          */
3560
3561         /*
3562          * we take any chance we can to service our queues since we
3563          * cannot get awoken when the socket is read from :<
3564          */
3565         asoc->overall_error_count = 0;
3566
3567         if (asoc->sent_queue_retran_cnt) {
3568 #ifdef SCTP_DEBUG
3569                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
3570                         kprintf("Handling SACK for asoc:%p retran:%d\n",
3571                                asoc, asoc->sent_queue_retran_cnt);
3572                 }
3573 #endif
3574         }
3575
3576         sctp_service_queues(stcb, asoc, 0);
3577
3578         /*
3579          * Now perform the actual SACK handling:
3580          * 1) Verify that it is not an old sack, if so discard.
3581          * 2) If there is nothing left in the send queue (cum-ack is equal
3582          *    to last acked) then you have a duplicate too, update any rwnd
3583          *    change and verify no timers are running. then return.
3584          * 3) Process any new consequtive data i.e. cum-ack moved
3585          *    process these first and note that it moved.
3586          * 4) Process any sack blocks.
3587          * 5) Drop any acked from the queue.
3588          * 6) Check for any revoked blocks and mark.
3589          * 7) Update the cwnd.
3590          * 8) Nothing left, sync up flightsizes and things, stop all timers
3591          *    and also check for shutdown_pending state. If so then go ahead
3592          *    and send off the shutdown. If in shutdown recv, send off the
3593          *    shutdown-ack and start that timer, Ret.
3594          * 9) Strike any non-acked things and do FR procedure if needed being
3595          *    sure to set the FR flag.
3596          * 10) Do pr-sctp procedures.
3597          * 11) Apply any FR penalties.
3598          * 12) Assure we will SACK if in shutdown_recv state.
3599          */
3600
3601         j = 0;
3602         sack_length = ntohs(ch->ch.chunk_length);
3603         if (sack_length < sizeof(struct sctp_sack_chunk)) {
3604 #ifdef SCTP_DEBUG
3605                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
3606                         kprintf("Bad size on sack chunk .. to small\n");
3607                 }
3608 #endif
3609                 return;
3610         }
3611         /* ECN Nonce */
3612         nonce_sum_flag = ch->ch.chunk_flags & SCTP_SACK_NONCE_SUM;
3613         sack = &ch->sack;
3614         cum_ack = last_tsn = ntohl(sack->cum_tsn_ack);
3615         num_seg = ntohs(sack->num_gap_ack_blks);
3616
3617         /* reality check */
3618         if (TAILQ_EMPTY(&asoc->send_queue)) {
3619                 send_s = asoc->sending_seq;
3620         } else {
3621                 tp1 = TAILQ_FIRST(&asoc->send_queue);
3622                 send_s = tp1->rec.data.TSN_seq;
3623         }
3624
3625         if (sctp_strict_sacks) {
3626                 if (cum_ack == send_s ||
3627                     compare_with_wrap(cum_ack, send_s, MAX_TSN)) {
3628                         struct mbuf *oper;
3629                         /*
3630                          * no way, we have not even sent this TSN out yet.
3631                          * Peer is hopelessly messed up with us.
3632                          */
3633                 hopeless_peer:
3634                         *abort_now = 1;
3635                         /* XXX */
3636                         MGET(oper, MB_DONTWAIT, MT_DATA);
3637                         if (oper) {
3638                                 struct sctp_paramhdr *ph;
3639                                 u_int32_t *ippp;
3640
3641                                 oper->m_len = sizeof(struct sctp_paramhdr) +
3642                                         sizeof(*ippp);
3643                                 ph = mtod(oper, struct sctp_paramhdr *);
3644                                 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
3645                                 ph->param_length = htons(oper->m_len);
3646                                 ippp = (u_int32_t *)(ph + 1);
3647                                 *ippp = htonl(0x30000002);
3648                         }
3649                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper);
3650                         return;
3651                 }
3652         }
3653         /* update the Rwnd of the peer */
3654         a_rwnd = (u_int32_t)ntohl(sack->a_rwnd);
3655         if (asoc->sent_queue_retran_cnt) {
3656 #ifdef SCTP_DEBUG
3657                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
3658                         kprintf("cum_ack:%lx num_seg:%u last_acked_seq:%x\n",
3659                                cum_ack, (u_int)num_seg, asoc->last_acked_seq);
3660                 }
3661 #endif
3662         }
3663         if (compare_with_wrap(asoc->t3timeout_highest_marked, cum_ack, MAX_TSN)) {
3664                 /* we are not allowed to mark for FR */
3665                 marking_allowed = 0;
3666         }
3667         /**********************/
3668         /* 1) check the range */
3669         /**********************/
3670         if (compare_with_wrap(asoc->last_acked_seq, last_tsn, MAX_TSN)) {
3671                 /* acking something behind */
3672                 if (asoc->sent_queue_retran_cnt) {
3673 #ifdef SCTP_DEBUG
3674                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
3675                                 kprintf("The cum-ack is behind us\n");
3676                         }
3677 #endif
3678                 }
3679                 return;
3680         }
3681
3682         if (TAILQ_EMPTY(&asoc->sent_queue)) {
3683                 /* nothing left on sendqueue.. consider done */
3684 #ifdef SCTP_LOG_RWND
3685                 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
3686                                   asoc->peers_rwnd, 0, 0, a_rwnd);
3687 #endif
3688                 asoc->peers_rwnd = a_rwnd;
3689                 if (asoc->sent_queue_retran_cnt) {
3690 #ifdef SCTP_DEBUG
3691                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
3692                                 kprintf("Huh? retran set but none on queue\n");
3693                         }
3694 #endif
3695                         asoc->sent_queue_retran_cnt = 0;
3696                 }
3697                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3698                         /* SWS sender side engages */
3699                         asoc->peers_rwnd = 0;
3700                 }
3701                 /* stop any timers */
3702                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3703                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3704                                         stcb, net);
3705                         net->partial_bytes_acked = 0;
3706                         net->flight_size = 0;
3707                 }
3708                 asoc->total_flight = 0;
3709                 asoc->total_flight_count = 0;
3710                 return;
3711         }
3712         /*
3713          * We init netAckSz and netAckSz2 to 0. These are used to track 2
3714          * things. The total byte count acked is tracked in netAckSz AND
3715          * netAck2 is used to track the total bytes acked that are un-
3716          * amibguious and were never retransmitted. We track these on a
3717          * per destination address basis.
3718          */
3719         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3720                 net->prev_cwnd = net->cwnd;
3721                 net->net_ack = 0;
3722                 net->net_ack2 = 0;
3723         }
3724         /* process the new consecutive TSN first */
3725         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3726         while (tp1) {
3727                 if (compare_with_wrap(last_tsn, tp1->rec.data.TSN_seq,
3728                                       MAX_TSN) ||
3729                     last_tsn == tp1->rec.data.TSN_seq) {
3730                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
3731                                 /* ECN Nonce: Add the nonce to the sender's nonce sum */
3732                                 asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce;
3733                                 accum_moved = 1;
3734                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
3735                                         /*
3736                                          * If it is less than ACKED, it is now
3737                                          * no-longer in flight. Higher values
3738                                          * may occur during marking
3739                                          */
3740                                         if ((tp1->whoTo->dest_state &
3741                                              SCTP_ADDR_UNCONFIRMED) &&
3742                                             (tp1->snd_count < 2) ) {
3743                                                 /*
3744                                                  * If there was no retran and
3745                                                  * the address is un-confirmed
3746                                                  * and we sent there and are
3747                                                  * now sacked.. its confirmed,
3748                                                  * mark it so.
3749                                                  */
3750                                                 tp1->whoTo->dest_state &=
3751                                                         ~SCTP_ADDR_UNCONFIRMED;
3752                                         }
3753                                         tp1->whoTo->flight_size -=
3754                                                 tp1->book_size;
3755                                         if (tp1->whoTo->flight_size < 0) {
3756                                                 tp1->whoTo->flight_size = 0;
3757                                         }
3758                                         asoc->total_flight -= tp1->book_size;
3759                                         if (asoc->total_flight < 0) {
3760                                                 asoc->total_flight = 0;
3761                                         }
3762                                         asoc->total_flight_count--;
3763                                         if (asoc->total_flight_count < 0) {
3764                                                 asoc->total_flight_count = 0;
3765                                         }
3766                                         tp1->whoTo->net_ack += tp1->send_size;
3767                                         if (tp1->snd_count < 2) {
3768                                                 /* True non-retransmited chunk */
3769                                                 tp1->whoTo->net_ack2 +=
3770                                                         tp1->send_size;
3771                                                 /* update RTO too? */
3772                                                 if (tp1->do_rtt) {
3773                                                         tp1->whoTo->RTO =
3774                                                                 sctp_calculate_rto(stcb,
3775                                                                                    asoc, tp1->whoTo,
3776                                                                                    &tp1->sent_rcv_time);
3777                                                         tp1->whoTo->rto_pending = 0;
3778                                                         tp1->do_rtt = 0;
3779                                                 }
3780                                         }
3781                                 }
3782                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3783 #ifdef SCTP_DEBUG
3784                                         if (sctp_debug_on & SCTP_DEBUG_INDATA3) {
3785                                                 kprintf("Hmm. one that is in RESEND that is now ACKED\n");
3786                                         }
3787 #endif
3788                                         asoc->sent_queue_retran_cnt--;
3789 #ifdef SCTP_AUDITING_ENABLED
3790                                         sctp_audit_log(0xB3,
3791                                                        (asoc->sent_queue_retran_cnt & 0x000000ff));
3792 #endif
3793                                         if (asoc->sent_queue_retran_cnt < 0) {
3794                                                 kprintf("huh4 retran went negative?\n");
3795 #ifdef SCTP_AUDITING_ENABLED
3796                                                 sctp_auditing(31, inp, tcb,
3797                                                               NULL);
3798 #else
3799                                                 asoc->sent_queue_retran_cnt = 0;
3800 #endif
3801                                         }
3802
3803                                 }
3804                                 tp1->sent = SCTP_DATAGRAM_ACKED;
3805                         }
3806                 } else {
3807                         break;
3808                 }
3809                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3810         }
3811         /*******************************************/
3812         /* cancel ALL T3-send timer if accum moved */
3813         /*******************************************/
3814         if (accum_moved) {
3815                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3816                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3817                                         stcb, net);
3818                 }
3819         }
3820         biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
3821         /* always set this up to cum-ack */
3822         asoc->this_sack_highest_gap = last_tsn;
3823
3824         if (((num_seg * sizeof (sizeof(struct sctp_gap_ack_block))) + sizeof(struct sctp_sack_chunk)) > sack_length) {
3825                 /* skip corrupt segments */
3826                 strike_enabled = 0;
3827                 goto skip_segments;
3828         }
3829
3830         if (num_seg > 0) {
3831                 if (asoc->primary_destination->dest_state &
3832                     SCTP_ADDR_SWITCH_PRIMARY) {
3833                         /* clear the nets CACC flags */
3834                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3835                                 net->cacc_saw_newack = 0;
3836                         }
3837                 }
3838                 /*
3839                  * thisSackHighestGap will increase while handling NEW segments
3840                  */
3841
3842                 sctp_handle_segments(stcb, asoc, ch, last_tsn,
3843                     &biggest_tsn_acked, &biggest_tsn_newly_acked,
3844                     num_seg, &ecn_seg_sums);
3845
3846                 if (sctp_strict_sacks) {
3847                         /* validate the biggest_tsn_acked in the gap acks
3848                          * if strict adherence is wanted.
3849                          */
3850                         if ((biggest_tsn_acked == send_s) ||
3851                             (compare_with_wrap(biggest_tsn_acked, send_s, MAX_TSN))) {
3852                                 /*
3853                                  * peer is either confused or we are under
3854                                  * attack. We must abort.
3855                                  */
3856                                 goto hopeless_peer;
3857                         }
3858                 }
3859
3860                 if (asoc->primary_destination->dest_state &
3861                     SCTP_ADDR_SWITCH_PRIMARY) {
3862                         /* clear the nets CACC flags */
3863                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3864                                 if (net->cacc_saw_newack) {
3865                                         cnt_of_cacc++;
3866                                 }
3867                         }
3868                 }
3869
3870         }
3871
3872         if (cnt_of_cacc < 2) {
3873                 strike_enabled = 1;
3874         } else {
3875                 strike_enabled = 0;
3876         }
3877  skip_segments:
3878         /********************************************/
3879         /* drop the acked chunks from the sendqueue */
3880         /********************************************/
3881         asoc->last_acked_seq = cum_ack;
3882         if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
3883                 if ((cum_ack == asoc->primary_destination->next_tsn_at_change) ||
3884                     (compare_with_wrap(cum_ack,
3885                                        asoc->primary_destination->next_tsn_at_change, MAX_TSN))) {
3886                         struct sctp_nets *lnet;
3887                         /* Turn off the switch flag for ALL addresses */
3888                         TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
3889                                 asoc->primary_destination->dest_state &=
3890                                         ~(SCTP_ADDR_SWITCH_PRIMARY|SCTP_ADDR_DOUBLE_SWITCH);
3891                         }
3892                 }
3893         }
3894         /* Drag along the t3 timeout point so we don't have a problem at wrap */
3895         if (marking_allowed) {
3896                 asoc->t3timeout_highest_marked = cum_ack;
3897         }
3898         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3899         do {
3900                 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
3901                                       MAX_TSN)) {
3902                         break;
3903                 }
3904                 if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
3905                         /* no more sent on list */
3906                         break;
3907                 }
3908                 tp2 = TAILQ_NEXT(tp1, sctp_next);
3909                 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
3910                 if (tp1->data) {
3911                         sctp_free_bufspace(stcb, asoc, tp1);
3912 #ifdef SCTP_DEBUG
3913                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) {
3914                                 kprintf("--total out:%lu total_mbuf_out:%lu\n",
3915                                        (u_long)asoc->total_output_queue_size,
3916                                        (u_long)asoc->total_output_mbuf_queue_size);
3917                         }
3918 #endif
3919
3920                         sctp_m_freem(tp1->data);
3921                         if (tp1->flags & SCTP_PR_SCTP_BUFFER) {
3922                                 asoc->sent_queue_cnt_removeable--;
3923                         }
3924
3925                 }
3926                 tp1->data = NULL;
3927                 asoc->sent_queue_cnt--;
3928                 sctp_free_remote_addr(tp1->whoTo);
3929                 sctppcbinfo.ipi_count_chunk--;
3930                 asoc->chunks_on_out_queue--;
3931
3932                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3933                         panic("Chunk count is going negative");
3934                 }
3935                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, tp1);
3936                 sctppcbinfo.ipi_gencnt_chunk++;
3937                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
3938                 tp1 = tp2;
3939         } while (tp1 != NULL);
3940
3941
3942         if (asoc->fast_retran_loss_recovery && accum_moved) {
3943                 if (compare_with_wrap(asoc->last_acked_seq,
3944                                       asoc->fast_recovery_tsn, MAX_TSN) ||
3945                     asoc->last_acked_seq == asoc->fast_recovery_tsn) {
3946                         /* Setup so we will exit RFC2582 fast recovery */
3947                         will_exit_fast_recovery = 1;
3948                 }
3949         }
3950
3951         /* Check for revoked fragments if we hand
3952          * fragments in a previous segment. If we
3953          * had no previous fragments we cannot have
3954          * a revoke issue.
3955          */
3956         if (asoc->saw_sack_with_frags)
3957                 sctp_check_for_revoked(asoc, cum_ack, biggest_tsn_acked);
3958
3959         if (num_seg)
3960                 asoc->saw_sack_with_frags = 1;
3961         else
3962                 asoc->saw_sack_with_frags = 0;
3963
3964         /******************************/
3965         /* update cwnd                */
3966         /******************************/
3967         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3968                 /* if nothing was acked on this destination skip it */
3969                 if (net->net_ack == 0)
3970                         continue;
3971
3972                 if (net->net_ack2 > 0) {
3973                         /*
3974                          * Karn's rule applies to clearing error count,
3975                          * this is optional.
3976                          */
3977                         net->error_count = 0;
3978                         if ((net->dest_state&SCTP_ADDR_NOT_REACHABLE) ==
3979                             SCTP_ADDR_NOT_REACHABLE) {
3980                                 /* addr came good */
3981                                 net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
3982                                 net->dest_state |= SCTP_ADDR_REACHABLE;
3983                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
3984                                                 SCTP_RECEIVED_SACK, (void *)net);
3985                                 /* now was it the primary? if so restore */
3986                                 if (net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
3987                                         sctp_set_primary_addr(stcb, NULL, net);
3988                                 }
3989                         }
3990                 }
3991
3992                 if (asoc->fast_retran_loss_recovery &&
3993                     will_exit_fast_recovery == 0) {
3994                         /* If we are in loss recovery we skip any cwnd update */
3995                         sctp_pegs[SCTP_CWND_SKIP]++;
3996                         goto skip_cwnd_update;
3997                 }
3998                 if (accum_moved) {
3999                         /* If the cumulative ack moved we can proceed */
4000                         if (net->cwnd <= net->ssthresh) {
4001                                 /* We are in slow start */
4002                                 if (net->flight_size + net->net_ack >=
4003                                     net->cwnd ) {
4004 #ifdef SCTP_HIGH_SPEED
4005                                         sctp_hs_cwnd_increase(net);
4006 #else
4007                                         if (net->net_ack > net->mtu) {
4008                                                 net->cwnd += net->mtu;
4009 #ifdef SCTP_CWND_LOGGING
4010                                                 sctp_log_cwnd(net, net->mtu,
4011                                                               SCTP_CWND_LOG_FROM_SS);
4012 #endif
4013
4014                                         } else {
4015                                                 net->cwnd += net->net_ack;
4016 #ifdef SCTP_CWND_LOGGING
4017                                                 sctp_log_cwnd(net, net->net_ack,
4018                                                               SCTP_CWND_LOG_FROM_SS);
4019 #endif
4020
4021                                         }
4022 #endif
4023                                         sctp_pegs[SCTP_CWND_SS]++;
4024                                 } else {
4025                                         unsigned int dif;
4026                                         sctp_pegs[SCTP_CWND_NOUSE_SS]++;
4027                                         dif = net->cwnd - (net->flight_size +
4028                                                            net->net_ack);
4029 #ifdef SCTP_CWND_LOGGING
4030 /*                                      sctp_log_cwnd(net, net->net_ack,
4031                                         SCTP_CWND_LOG_NOADV_SS);*/
4032 #endif
4033                                         if (dif > sctp_pegs[SCTP_CWND_DIFF_SA]) {
4034                                                 sctp_pegs[SCTP_CWND_DIFF_SA] =
4035                                                         dif;
4036                                                 sctp_pegs[SCTP_OQS_AT_SS] =
4037                                                         asoc->total_output_queue_size;
4038                                                 sctp_pegs[SCTP_SQQ_AT_SS] =
4039                                                         asoc->sent_queue_cnt;
4040                                                 sctp_pegs[SCTP_SQC_AT_SS] =
4041                                                         asoc->send_queue_cnt;
4042                                         }
4043                                 }
4044                         } else {
4045                                 /* We are in congestion avoidance */
4046                                 if (net->flight_size + net->net_ack >=
4047                                     net->cwnd) {
4048                                         /*
4049                                          * add to pba only if we had a cwnd's
4050                                          * worth (or so) in flight OR the
4051                                          * burst limit was applied.
4052                                          */
4053                                         net->partial_bytes_acked +=
4054                                                 net->net_ack;
4055
4056                                         /*
4057                                          * Do we need to increase
4058                                          * (if pba is > cwnd)?
4059                                          */
4060                                         if (net->partial_bytes_acked >=
4061                                             net->cwnd) {
4062                                                 if (net->cwnd <
4063                                                     net->partial_bytes_acked) {
4064                                                         net->partial_bytes_acked -=
4065                                                                 net->cwnd;
4066                                                 } else {
4067                                                         net->partial_bytes_acked =
4068                                                                 0;
4069                                                 }
4070                                                 net->cwnd += net->mtu;
4071 #ifdef SCTP_CWND_LOGGING
4072                                                 sctp_log_cwnd(net, net->mtu,
4073                                                               SCTP_CWND_LOG_FROM_CA);
4074 #endif
4075                                                 sctp_pegs[SCTP_CWND_CA]++;
4076                                         }
4077                                 } else {
4078                                         unsigned int dif;
4079                                         sctp_pegs[SCTP_CWND_NOUSE_CA]++;
4080 #ifdef SCTP_CWND_LOGGING
4081 /*                                      sctp_log_cwnd(net, net->net_ack,
4082                                         SCTP_CWND_LOG_NOADV_CA);
4083 */
4084 #endif
4085                                         dif = net->cwnd - (net->flight_size +
4086                                                            net->net_ack);
4087                                         if (dif > sctp_pegs[SCTP_CWND_DIFF_CA]) {
4088                                                 sctp_pegs[SCTP_CWND_DIFF_CA] =
4089                                                         dif;
4090                                                 sctp_pegs[SCTP_OQS_AT_CA] =
4091                                                         asoc->total_output_queue_size;
4092                                                 sctp_pegs[SCTP_SQQ_AT_CA] =
4093                                                         asoc->sent_queue_cnt;
4094                                                 sctp_pegs[SCTP_SQC_AT_CA] =
4095                                                         asoc->send_queue_cnt;
4096
4097                                         }
4098
4099                                 }
4100                         }
4101                 } else {
4102                         sctp_pegs[SCTP_CWND_NOCUM]++;
4103                 }
4104         skip_cwnd_update:
4105                 /*
4106                  * NOW, according to Karn's rule do we need to restore the
4107                  * RTO timer back? Check our net_ack2. If not set then we
4108                  * have a ambiguity.. i.e. all data ack'd was sent to more
4109                  * than one place.
4110                  */
4111
4112                 if (net->net_ack2) {
4113                         /* restore any doubled timers */
4114                         net->RTO = ((net->lastsa >> 2) + net->lastsv) >> 1;
4115                         if (net->RTO < stcb->asoc.minrto) {
4116                                 net->RTO = stcb->asoc.minrto;
4117                         }
4118                         if (net->RTO > stcb->asoc.maxrto) {
4119                                 net->RTO = stcb->asoc.maxrto;
4120                         }
4121                 }
4122                 if (net->cwnd > sctp_pegs[SCTP_MAX_CWND]) {
4123                         sctp_pegs[SCTP_MAX_CWND] = net->cwnd;
4124                 }
4125         }
4126         /**********************************/
4127         /* Now what about shutdown issues */
4128         /**********************************/
4129         some_on_streamwheel = 0;
4130         if (!TAILQ_EMPTY(&asoc->out_wheel)) {
4131                 /* Check to see if some data queued */
4132                 struct sctp_stream_out *outs;
4133                 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
4134                         if (!TAILQ_EMPTY(&outs->outqueue)) {
4135                                 some_on_streamwheel = 1;
4136                                 break;
4137                         }
4138                 }
4139         }
4140         if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue) &&
4141             some_on_streamwheel == 0) {
4142                 /* nothing left on sendqueue.. consider done */
4143                 /* stop all timers */
4144 #ifdef SCTP_LOG_RWND
4145                 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4146                                   asoc->peers_rwnd, 0, 0,  a_rwnd);
4147 #endif
4148                 asoc->peers_rwnd = a_rwnd;
4149                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4150                         /* SWS sender side engages */
4151                         asoc->peers_rwnd = 0;
4152                 }
4153                 /* stop any timers */
4154                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4155                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4156                                         stcb, net);
4157                         net->flight_size = 0;
4158                         net->partial_bytes_acked = 0;
4159                 }
4160                 asoc->total_flight = 0;
4161                 asoc->total_flight_count = 0;
4162                 /* clean up */
4163                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
4164                         asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4165 #ifdef SCTP_DEBUG
4166                         if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) {
4167                                 kprintf("%s:%d sends a shutdown\n",
4168                                        __FILE__,
4169                                        __LINE__
4170                                        );
4171                         }
4172 #endif
4173                         sctp_send_shutdown(stcb,
4174                                            stcb->asoc.primary_destination);
4175                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4176                                          stcb->sctp_ep, stcb, asoc->primary_destination);
4177                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4178                                          stcb->sctp_ep, stcb, asoc->primary_destination);
4179                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) {
4180                         asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
4181
4182                         sctp_send_shutdown_ack(stcb,
4183                                                stcb->asoc.primary_destination);
4184
4185                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4186                                          stcb->sctp_ep, stcb, asoc->primary_destination);
4187                 }
4188                 return;
4189         }
4190         /*
4191          * Now here we are going to recycle net_ack for a different
4192          * use... HEADS UP.
4193          */
4194         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4195                 net->net_ack = 0;
4196         }
4197         if ((num_seg > 0) && marking_allowed) {
4198                 sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked,
4199                                            strike_enabled, biggest_tsn_newly_acked, accum_moved);
4200         }
4201
4202         /*********************************************/
4203         /* Here we perform PR-SCTP procedures        */
4204         /* (section 4.2)                             */
4205         /*********************************************/
4206         /* C1. update advancedPeerAckPoint */
4207         if (compare_with_wrap(cum_ack, asoc->advanced_peer_ack_point, MAX_TSN)) {
4208                 asoc->advanced_peer_ack_point = cum_ack;
4209         }
4210         /* C2. try to further move advancedPeerAckPoint ahead */
4211         if (asoc->peer_supports_prsctp) {
4212                 struct sctp_tmit_chunk *lchk;
4213                 lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
4214                 /* C3. See if we need to send a Fwd-TSN */
4215                 if (compare_with_wrap(asoc->advanced_peer_ack_point, cum_ack,
4216                                       MAX_TSN)) {
4217                         /*
4218                          * ISSUE with ECN, see FWD-TSN processing for notes
4219                          * on issues that will occur when the ECN NONCE stuff
4220                          * is put into SCTP for cross checking.
4221                          */
4222                         send_forward_tsn(stcb, asoc);
4223
4224                         /* ECN Nonce: Disable Nonce Sum check when FWD TSN is sent and store resync tsn*/
4225                         asoc->nonce_sum_check = 0;
4226                         asoc->nonce_resync_tsn = asoc->advanced_peer_ack_point;
4227                         if (lchk) {
4228                                 /* Assure a timer is up */
4229                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4230                                                  stcb->sctp_ep, stcb, lchk->whoTo);
4231                         }
4232                 }
4233         }
4234         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4235                 if (asoc->fast_retran_loss_recovery == 0) {
4236                         /* out of a RFC2582 Fast recovery window? */
4237                         if (net->net_ack > 0) {
4238                                 /*
4239                                  * per section 7.2.3, are there
4240                                  * any destinations that had a fast
4241                                  * retransmit to them. If so what we
4242                                  * need to do is adjust ssthresh and
4243                                  * cwnd.
4244                                  */
4245                                 struct sctp_tmit_chunk *lchk;
4246 #ifdef  SCTP_HIGH_SPEED
4247                                 sctp_hs_cwnd_decrease(net);
4248 #else
4249 #ifdef SCTP_CWND_LOGGING
4250                                 int old_cwnd = net->cwnd;
4251 #endif
4252                                 net->ssthresh = net->cwnd / 2;
4253                                 if (net->ssthresh < (net->mtu*2)) {
4254                                         net->ssthresh = 2 * net->mtu;
4255                                 }
4256                                 net->cwnd = net->ssthresh;
4257 #ifdef SCTP_CWND_LOGGING
4258                                 sctp_log_cwnd(net, (net->cwnd-old_cwnd),
4259                                               SCTP_CWND_LOG_FROM_FR);
4260 #endif
4261 #endif
4262
4263                                 lchk = TAILQ_FIRST(&asoc->send_queue);
4264
4265                                 net->partial_bytes_acked = 0;
4266                                 /* Turn on fast recovery window */
4267                                 asoc->fast_retran_loss_recovery = 1;
4268                                 if (lchk == NULL) {
4269                                         /* Mark end of the window */
4270                                         asoc->fast_recovery_tsn = asoc->sending_seq - 1;
4271                                 } else {
4272                                         asoc->fast_recovery_tsn = lchk->rec.data.TSN_seq - 1;
4273                                 }
4274
4275
4276                                 /* Disable Nonce Sum Checking and store the resync tsn*/
4277                                 asoc->nonce_sum_check = 0;
4278                                 asoc->nonce_resync_tsn = asoc->fast_recovery_tsn + 1;
4279
4280                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND,
4281                                                 stcb->sctp_ep, stcb, net);
4282                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4283                                                  stcb->sctp_ep, stcb, net);
4284                         }
4285                 } else if (net->net_ack > 0) {
4286                         /*
4287                          * Mark a peg that we WOULD have done a cwnd reduction
4288                          * but RFC2582 prevented this action.
4289                          */
4290                         sctp_pegs[SCTP_FR_INAWINDOW]++;
4291                 }
4292         }
4293
4294
4295         /******************************************************************
4296          *  Here we do the stuff with ECN Nonce checking.
4297          *  We basically check to see if the nonce sum flag was incorrect
4298          *  or if resynchronization needs to be done. Also if we catch a
4299          *  misbehaving receiver we give him the kick.
4300          ******************************************************************/
4301
4302         if (asoc->ecn_nonce_allowed) {
4303                 if (asoc->nonce_sum_check) {
4304                         if (nonce_sum_flag != ((asoc->nonce_sum_expect_base + ecn_seg_sums) & SCTP_SACK_NONCE_SUM)) {
4305                                 if (asoc->nonce_wait_for_ecne == 0) {
4306                                         struct sctp_tmit_chunk *lchk;
4307                                         lchk = TAILQ_FIRST(&asoc->send_queue);
4308                                         asoc->nonce_wait_for_ecne = 1;
4309                                         if (lchk) {
4310                                                 asoc->nonce_wait_tsn = lchk->rec.data.TSN_seq;
4311                                         } else {
4312                                                 asoc->nonce_wait_tsn = asoc->sending_seq;
4313                                         }
4314                                 } else {
4315                                         if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_wait_tsn, MAX_TSN) ||
4316                                            (asoc->last_acked_seq == asoc->nonce_wait_tsn)) {
4317                                                 /* Misbehaving peer. We need to react to this guy */
4318                                                 kprintf("Mis-behaving peer detected\n");
4319                                                 asoc->ecn_allowed = 0;
4320                                                 asoc->ecn_nonce_allowed = 0;
4321                                         }
4322                                 }
4323                         }
4324                 } else {
4325                         /* See if Resynchronization Possible */
4326                         if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_resync_tsn, MAX_TSN)) {
4327                                 asoc->nonce_sum_check = 1;
4328                                 /* now we must calculate what the base
4329                                  * is. We do this based on two things, we know
4330                                  * the total's for all the segments gap-acked
4331                                  * in the SACK, its stored in ecn_seg_sums.
4332                                  * We also know the SACK's nonce sum, its
4333                                  * in nonce_sum_flag. So we can build a truth
4334                                  * table to back-calculate the new value of asoc->nonce_sum_expect_base:
4335                                  *
4336                                  *   SACK-flag-Value         Seg-Sums              Base
4337                                  *         0                    0                   0
4338                                  *         1                    0                   1
4339                                  *         0                    1                   1
4340                                  *         1                    1                   0
4341                                  */
4342                                 asoc->nonce_sum_expect_base = (ecn_seg_sums ^ nonce_sum_flag) & SCTP_SACK_NONCE_SUM;
4343                         }
4344                 }
4345         }
4346         /* Now are we exiting loss recovery ? */
4347         if (will_exit_fast_recovery) {
4348                 /* Ok, we must exit fast recovery */
4349                 asoc->fast_retran_loss_recovery = 0;
4350         }
4351         if ((asoc->sat_t3_loss_recovery) &&
4352             ((compare_with_wrap(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn,
4353                                 MAX_TSN) ||
4354               (asoc->last_acked_seq == asoc->sat_t3_recovery_tsn)))) {
4355                 /* end satellite t3 loss recovery */
4356                 asoc->sat_t3_loss_recovery = 0;
4357         }
4358         /* Adjust and set the new rwnd value */
4359 #ifdef SCTP_LOG_RWND
4360         sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4361                           asoc->peers_rwnd,  asoc->total_flight, (asoc->sent_queue_cnt * sctp_peer_chunk_oh), a_rwnd);
4362 #endif
4363
4364         asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd,
4365                                             (u_int32_t)(asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh)));
4366         if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4367                 /* SWS sender side engages */
4368                 asoc->peers_rwnd = 0;
4369         }
4370         /*
4371          * Now we must setup so we have a timer up for anyone with
4372          * outstanding data.
4373          */
4374         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4375                 struct sctp_tmit_chunk *chk;
4376                 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4377                         if (chk->whoTo == net &&
4378                             (chk->sent < SCTP_DATAGRAM_ACKED ||
4379                              chk->sent == SCTP_FORWARD_TSN_SKIP)) {
4380                                 /*
4381                                  * Not ack'ed and still outstanding to this
4382                                  * destination or marked and must be
4383                                  * sacked after fwd-tsn sent.
4384                                  */
4385                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4386                                                  stcb->sctp_ep, stcb, net);
4387                                 break;
4388                         }
4389                 }
4390         }
4391 }
4392
4393 void
4394 sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp,
4395     struct sctp_nets *netp, int *abort_flag)
4396 {
4397         /* Mutate a shutdown into a SACK */
4398         struct sctp_sack_chunk sack;
4399
4400         /* Copy cum-ack */
4401         sack.sack.cum_tsn_ack = cp->cumulative_tsn_ack;
4402         /* Arrange so a_rwnd does NOT change */
4403         sack.ch.chunk_type = SCTP_SELECTIVE_ACK;
4404         sack.ch.chunk_flags = 0;
4405         sack.ch.chunk_length = ntohs(sizeof(struct sctp_sack_chunk));
4406         sack.sack.a_rwnd =
4407             htonl(stcb->asoc.peers_rwnd + stcb->asoc.total_flight);
4408         /*
4409          * no gaps in this one. This may cause a temporal view to reneging,
4410          * but hopefully the second chunk is a true SACK in the packet and
4411          * will correct this view. One will come soon after no matter what
4412          * to fix this.
4413          */
4414         sack.sack.num_gap_ack_blks = 0;
4415         sack.sack.num_dup_tsns = 0;
4416         /* Now call the SACK processor */
4417         sctp_handle_sack(&sack, stcb, netp, abort_flag);
4418 }
4419
4420 static void
4421 sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb,
4422     struct sctp_stream_in *strmin)
4423 {
4424         struct sctp_tmit_chunk *chk, *nchk;
4425         struct sctp_association *asoc;
4426         int tt;
4427
4428         asoc = &stcb->asoc;
4429         tt = strmin->last_sequence_delivered;
4430         /*
4431          * First deliver anything prior to and including the stream no that
4432          * came in
4433          */
4434         chk = TAILQ_FIRST(&strmin->inqueue);
4435         while (chk) {
4436                 nchk = TAILQ_NEXT(chk, sctp_next);
4437                 if (compare_with_wrap(tt, chk->rec.data.stream_seq, MAX_SEQ) ||
4438                     (tt == chk->rec.data.stream_seq)) {
4439                         /* this is deliverable now */
4440                         TAILQ_REMOVE(&strmin->inqueue, chk, sctp_next);
4441                         /* subtract pending on streams */
4442                         asoc->size_on_all_streams -= chk->send_size;
4443                         asoc->cnt_on_all_streams--;
4444                         /* deliver it to at least the delivery-q */
4445                         sctp_deliver_data(stcb, &stcb->asoc, chk, 0);
4446                 } else {
4447                         /* no more delivery now. */
4448                         break;
4449                 }
4450                 chk = nchk;
4451         }
4452         /*
4453          * now we must deliver things in queue the normal way  if any
4454          * are now ready.
4455          */
4456         tt = strmin->last_sequence_delivered + 1;
4457         chk = TAILQ_FIRST(&strmin->inqueue);
4458         while (chk) {
4459                 nchk = TAILQ_NEXT(chk, sctp_next);
4460                 if (tt == chk->rec.data.stream_seq) {
4461                         /* this is deliverable now */
4462                         TAILQ_REMOVE(&strmin->inqueue, chk, sctp_next);
4463                         /* subtract pending on streams */
4464                         asoc->size_on_all_streams -= chk->send_size;
4465                         asoc->cnt_on_all_streams--;
4466                         /* deliver it to at least the delivery-q */
4467                         strmin->last_sequence_delivered =
4468                             chk->rec.data.stream_seq;
4469                         sctp_deliver_data(stcb, &stcb->asoc, chk, 0);
4470                         tt = strmin->last_sequence_delivered + 1;
4471                 } else {
4472                         break;
4473                 }
4474                 chk = nchk;
4475         }
4476
4477 }
4478
4479 void
4480 sctp_handle_forward_tsn(struct sctp_tcb *stcb,
4481     struct sctp_forward_tsn_chunk *fwd, int *abort_flag)
4482 {
4483         /*
4484          * ISSUES that MUST be fixed for ECN! When we are the
4485          * sender of the forward TSN, when the SACK comes back
4486          * that acknowledges the FWD-TSN we must reset the
4487          * NONCE sum to match correctly. This will get quite
4488          * tricky since we may have sent more data interveneing and
4489          * must carefully account for what the SACK says on the
4490          * nonce and any gaps that are reported. This work
4491          * will NOT be done here, but I note it here since
4492          * it is really related to PR-SCTP and FWD-TSN's
4493          */
4494
4495         /* The pr-sctp fwd tsn */
4496         /*
4497          * here we will perform all the data receiver side steps for
4498          * processing FwdTSN, as required in by pr-sctp draft:
4499          *
4500          * Assume we get FwdTSN(x):
4501          *
4502          * 1) update local cumTSN to x
4503          * 2) try to further advance cumTSN to x + others we have
4504          * 3) examine and update re-ordering queue on pr-in-streams
4505          * 4) clean up re-assembly queue
4506          * 5) Send a sack to report where we are.
4507          */
4508         struct sctp_strseq *stseq;
4509         struct sctp_association *asoc;
4510         u_int32_t new_cum_tsn, gap, back_out_htsn;
4511         unsigned int i, cnt_gone, fwd_sz, cumack_set_flag, m_size;
4512         struct sctp_stream_in *strm;
4513         struct sctp_tmit_chunk *chk, *at;
4514
4515         cumack_set_flag = 0;
4516         asoc = &stcb->asoc;
4517         cnt_gone = 0;
4518         if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
4519 #ifdef SCTP_DEBUG
4520                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
4521                         kprintf("Bad size too small/big fwd-tsn\n");
4522                 }
4523 #endif
4524                 return;
4525         }
4526         m_size = (stcb->asoc.mapping_array_size << 3);
4527         /*************************************************************/
4528         /* 1. Here we update local cumTSN and shift the bitmap array */
4529         /*************************************************************/
4530         new_cum_tsn = ntohl(fwd->new_cumulative_tsn);
4531
4532         if (compare_with_wrap(asoc->cumulative_tsn, new_cum_tsn, MAX_TSN) ||
4533             asoc->cumulative_tsn == new_cum_tsn) {
4534                 /* Already got there ... */
4535                 return;
4536         }
4537
4538         back_out_htsn = asoc->highest_tsn_inside_map;
4539         if (compare_with_wrap(new_cum_tsn, asoc->highest_tsn_inside_map,
4540             MAX_TSN)) {
4541                 asoc->highest_tsn_inside_map = new_cum_tsn;
4542 #ifdef SCTP_MAP_LOGGING
4543                         sctp_log_map(0, 0, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
4544 #endif
4545         }
4546         /*
4547          * now we know the new TSN is more advanced, let's find the
4548          * actual gap
4549          */
4550         if ((compare_with_wrap(new_cum_tsn, asoc->mapping_array_base_tsn,
4551                                MAX_TSN)) ||
4552              (new_cum_tsn == asoc->mapping_array_base_tsn)) {
4553                 gap = new_cum_tsn - asoc->mapping_array_base_tsn;
4554         } else {
4555                 /* try to prevent underflow here */
4556                 gap = new_cum_tsn + (MAX_TSN - asoc->mapping_array_base_tsn) + 1;
4557         }
4558
4559         if (gap > m_size  || gap < 0) {
4560                 asoc->highest_tsn_inside_map = back_out_htsn;
4561                 if ((long)gap > sctp_sbspace(&stcb->sctp_socket->so_rcv)) {
4562                         /*
4563                          * out of range (of single byte chunks in the rwnd I
4564                          * give out)
4565                          * too questionable. better to drop it silently
4566                          */
4567                         return;
4568                 }
4569                 if (asoc->highest_tsn_inside_map >
4570                     asoc->mapping_array_base_tsn) {
4571                         gap = asoc->highest_tsn_inside_map -
4572                             asoc->mapping_array_base_tsn;
4573                 } else {
4574                         gap = asoc->highest_tsn_inside_map +
4575                             (MAX_TSN - asoc->mapping_array_base_tsn) + 1;
4576                 }
4577                 cumack_set_flag = 1;
4578         }
4579         for (i = 0; i <= gap; i++) {
4580                 SCTP_SET_TSN_PRESENT(asoc->mapping_array, i);
4581         }
4582         /*
4583          * Now after marking all, slide thing forward but no
4584          * sack please.
4585          */
4586         sctp_sack_check(stcb, 0, 0, abort_flag);
4587         if (*abort_flag)
4588                 return;
4589
4590         if (cumack_set_flag) {
4591                 /*
4592                  * fwd-tsn went outside my gap array - not a
4593                  * common occurance. Do the same thing we
4594                  * do when a cookie-echo arrives.
4595                  */
4596                 asoc->highest_tsn_inside_map =  new_cum_tsn - 1;
4597                 asoc->mapping_array_base_tsn = new_cum_tsn;
4598                 asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
4599 #ifdef SCTP_MAP_LOGGING
4600                 sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
4601 #endif
4602                 asoc->last_echo_tsn = asoc->highest_tsn_inside_map;
4603         }
4604         /*************************************************************/
4605         /* 2. Clear up re-assembly queue                             */
4606         /*************************************************************/
4607
4608         /*
4609          * First service it if pd-api is up, just in case we can
4610          * progress it forward
4611          */
4612         if (asoc->fragmented_delivery_inprogress) {
4613                 sctp_service_reassembly(stcb, asoc, 0);
4614         }
4615         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
4616                 /* For each one on here see if we need to toss it */
4617                 /*
4618                  * For now large messages held on the reasmqueue that are
4619                  * complete will be tossed too. We could in theory do more
4620                  * work to spin through and stop after dumping one msg
4621                  * aka seeing the start of a new msg at the head, and call
4622                  * the delivery function... to see if it can be delivered...
4623                  * But for now we just dump everything on the queue.
4624                  */
4625                 chk = TAILQ_FIRST(&asoc->reasmqueue);
4626                 while (chk) {
4627                         at = TAILQ_NEXT(chk, sctp_next);
4628                         if (compare_with_wrap(asoc->cumulative_tsn,
4629                             chk->rec.data.TSN_seq, MAX_TSN) ||
4630                             asoc->cumulative_tsn == chk->rec.data.TSN_seq) {
4631                                 /* It needs to be tossed */
4632                                 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
4633                                 if (compare_with_wrap(chk->rec.data.TSN_seq,
4634                                     asoc->tsn_last_delivered, MAX_TSN)) {
4635                                         asoc->tsn_last_delivered =
4636                                             chk->rec.data.TSN_seq;
4637                                         asoc->str_of_pdapi =
4638                                             chk->rec.data.stream_number;
4639                                         asoc->ssn_of_pdapi =
4640                                             chk->rec.data.stream_seq;
4641                                         asoc->fragment_flags =
4642                                             chk->rec.data.rcv_flags;
4643                                 }
4644                                 asoc->size_on_reasm_queue -= chk->send_size;
4645                                 asoc->cnt_on_reasm_queue--;
4646                                 cnt_gone++;
4647
4648                                 /* Clear up any stream problem */
4649                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) !=
4650                                     SCTP_DATA_UNORDERED &&
4651                                     (compare_with_wrap(chk->rec.data.stream_seq,
4652                                     asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered,
4653                                     MAX_SEQ))) {
4654                                         /*
4655                                          * We must dump forward this streams
4656                                          * sequence number if the chunk is not
4657                                          * unordered that is being skipped.
4658                                          * There is a chance that if the peer
4659                                          * does not include the last fragment
4660                                          * in its FWD-TSN we WILL have a problem
4661                                          * here since you would have a partial
4662                                          * chunk in queue that may not be
4663                                          * deliverable.
4664                                          * Also if a Partial delivery API as
4665                                          * started the user may get a partial
4666                                          * chunk. The next read returning a new
4667                                          * chunk... really ugly but I see no way
4668                                          * around it! Maybe a notify??
4669                                          */
4670                                         asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered =
4671                                             chk->rec.data.stream_seq;
4672                                 }
4673                                 if (chk->data) {
4674                                         sctp_m_freem(chk->data);
4675                                         chk->data = NULL;
4676                                 }
4677                                 sctp_free_remote_addr(chk->whoTo);
4678                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4679                                 sctppcbinfo.ipi_count_chunk--;
4680                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4681                                         panic("Chunk count is negative");
4682                                 }
4683                                 sctppcbinfo.ipi_gencnt_chunk++;
4684                         } else {
4685                                 /*
4686                                  * Ok we have gone beyond the end of the
4687                                  * fwd-tsn's mark. Some checks...
4688                                  */
4689                                 if ((asoc->fragmented_delivery_inprogress) &&
4690                                     (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4691                                         /* Special case PD-API is up and what we fwd-tsn'
4692                                          * over includes one that had the LAST_FRAG. We
4693                                          * no longer need to do the PD-API.
4694                                          */
4695                                         asoc->fragmented_delivery_inprogress = 0;
4696                                         sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
4697                                             stcb, SCTP_PARTIAL_DELIVERY_ABORTED, NULL);
4698
4699                                 }
4700                                 break;
4701                         }
4702                         chk = at;
4703                 }
4704         }
4705         if (asoc->fragmented_delivery_inprogress) {
4706                 /*
4707                  * Ok we removed cnt_gone chunks in the PD-API queue that
4708                  * were being delivered. So now we must turn off the
4709                  * flag.
4710                  */
4711                 sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
4712                     stcb, SCTP_PARTIAL_DELIVERY_ABORTED, NULL);
4713                 asoc->fragmented_delivery_inprogress = 0;
4714         }
4715         /*************************************************************/
4716         /* 3. Update the PR-stream re-ordering queues                */
4717         /*************************************************************/
4718         stseq = (struct sctp_strseq *)((caddr_t)fwd + sizeof(*fwd));
4719         fwd_sz -= sizeof(*fwd);
4720         {
4721                 /* New method. */
4722                 int num_str, i;
4723                 num_str = fwd_sz/sizeof(struct sctp_strseq);
4724 #ifdef SCTP_DEBUG
4725                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
4726                         kprintf("Using NEW method, %d strseq's reported in FWD-TSN\n",
4727                             num_str);
4728                 }
4729 #endif
4730                 for (i = 0; i < num_str; i++) {
4731                         u_int16_t st;
4732                         unsigned char *xx;
4733                         /* Convert */
4734                         xx = (unsigned char *)&stseq[i];
4735                         st = ntohs(stseq[i].stream);
4736                         stseq[i].stream = st;
4737                         st = ntohs(stseq[i].sequence);
4738                         stseq[i].sequence = st;
4739                         /* now process */
4740                         if (stseq[i].stream > asoc->streamincnt) {
4741 #ifdef SCTP_DEBUG
4742                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
4743                                         kprintf("Bogus stream number %d "
4744                                             "streamincnt is %d\n",
4745                                             stseq[i].stream, asoc->streamincnt);
4746                                 }
4747 #endif
4748                                 /*
4749                                  * It is arguable if we should continue. Since
4750                                  * the peer sent bogus stream info we may be in
4751                                  * deep trouble..
4752                                  * a return may be a better choice?
4753                                  */
4754                                 continue;
4755                         }
4756                         strm = &asoc->strmin[stseq[i].stream];
4757                         if (compare_with_wrap(stseq[i].sequence,
4758                             strm->last_sequence_delivered, MAX_SEQ)) {
4759                                 /* Update the sequence number */
4760                                 strm->last_sequence_delivered =
4761                                     stseq[i].sequence;
4762                         }
4763                         /* now kick the stream the new way */
4764                         sctp_kick_prsctp_reorder_queue(stcb, strm);
4765                 }
4766         }
4767 }