sys/netinet/sctp_indata.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <sys/proc.h>
  40 #include <netinet/sctp_var.h>
  41 #include <netinet/sctp_sysctl.h>
  42 #include <netinet/sctp_header.h>
  43 #include <netinet/sctp_pcb.h>
  44 #include <netinet/sctputil.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_auth.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/sctp_asconf.h>
  50 #include <netinet/sctp_indata.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #include <netinet/sctp_input.h>
  53 #include <netinet/sctp_crc32.h>
  54 #include <netinet/sctp_lock_bsd.h>
  55 /*
  56  * NOTES: On the outbound side of things I need to check the sack timer to
  57  * see if I should generate a sack into the chunk queue (if I have data to
  58  * send that is and will be sending it .. for bundling.
  59  *
  60  * The callback in sctp_usrreq.c will get called when the socket is read from.
  61  * This will cause sctp_service_queues() to get called on the top entry in
  62  * the list.
  63  */
  64 static uint32_t
  65 sctp_add_chk_to_control(struct sctp_queued_to_read *control,
  66     struct sctp_stream_in *strm,
  67     struct sctp_tcb *stcb,
  68     struct sctp_association *asoc,
  69     struct sctp_tmit_chunk *chk, int lock_held);
  70
  71
  72 void
  73 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
  74 {
  75         asoc->my_rwnd = sctp_calc_rwnd(stcb, asoc);
  76 }
  77
  78 /* Calculate what the rwnd would be */
  79 uint32_t
  80 sctp_calc_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
  81 {
  82         uint32_t calc = 0;
  83
  84         /*
  85          * This is really set wrong with respect to a 1-2-m socket. Since
  86          * the sb_cc is the count that everyone as put up. When we re-write
  87          * sctp_soreceive then we will fix this so that ONLY this
  88          * associations data is taken into account.
  89          */
  90         if (stcb->sctp_socket == NULL) {
  91                 return (calc);
  92         }
  93         KASSERT(asoc->cnt_on_reasm_queue > 0 || asoc->size_on_reasm_queue == 0,
  94             ("size_on_reasm_queue is %u", asoc->size_on_reasm_queue));
  95         KASSERT(asoc->cnt_on_all_streams > 0 || asoc->size_on_all_streams == 0,
  96             ("size_on_all_streams is %u", asoc->size_on_all_streams));
  97         if (stcb->asoc.sb_cc == 0 &&
  98             asoc->cnt_on_reasm_queue == 0 &&
  99             asoc->cnt_on_all_streams == 0) {
 100                 /* Full rwnd granted */
 101                 calc = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket), SCTP_MINIMAL_RWND);
 102                 return (calc);
 103         }
 104         /* get actual space */
 105         calc = (uint32_t)sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
 106         /*
 107          * take out what has NOT been put on socket queue and we yet hold
 108          * for putting up.
 109          */
 110         calc = sctp_sbspace_sub(calc, (uint32_t)(asoc->size_on_reasm_queue +
 111             asoc->cnt_on_reasm_queue * MSIZE));
 112         calc = sctp_sbspace_sub(calc, (uint32_t)(asoc->size_on_all_streams +
 113             asoc->cnt_on_all_streams * MSIZE));
 114         if (calc == 0) {
 115                 /* out of space */
 116                 return (calc);
 117         }
 118         /* what is the overhead of all these rwnd's */
 119         calc = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
 120         /*
 121          * If the window gets too small due to ctrl-stuff, reduce it to 1,
 122          * even it is 0. SWS engaged
 123          */
 124         if (calc < stcb->asoc.my_rwnd_control_len) {
 125                 calc = 1;
 126         }
 127         return (calc);
 128 }
 129
 130
 131
 132 /*
 133  * Build out our readq entry based on the incoming packet.
 134  */
 135 struct sctp_queued_to_read *
 136 sctp_build_readq_entry(struct sctp_tcb *stcb,
 137     struct sctp_nets *net,
 138     uint32_t tsn, uint32_t ppid,
 139     uint32_t context, uint16_t sid,
 140     uint32_t mid, uint8_t flags,
 141     struct mbuf *dm)
 142 {
 143         struct sctp_queued_to_read *read_queue_e = NULL;
 144
 145         sctp_alloc_a_readq(stcb, read_queue_e);
 146         if (read_queue_e == NULL) {
 147                 goto failed_build;
 148         }
 149         memset(read_queue_e, 0, sizeof(struct sctp_queued_to_read));
 150         read_queue_e->sinfo_stream = sid;
 151         read_queue_e->sinfo_flags = (flags << 8);
 152         read_queue_e->sinfo_ppid = ppid;
 153         read_queue_e->sinfo_context = context;
 154         read_queue_e->sinfo_tsn = tsn;
 155         read_queue_e->sinfo_cumtsn = tsn;
 156         read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
 157         read_queue_e->mid = mid;
 158         read_queue_e->top_fsn = read_queue_e->fsn_included = 0xffffffff;
 159         TAILQ_INIT(&read_queue_e->reasm);
 160         read_queue_e->whoFrom = net;
 161         atomic_add_int(&net->ref_count, 1);
 162         read_queue_e->data = dm;
 163         read_queue_e->stcb = stcb;
 164         read_queue_e->port_from = stcb->rport;
 165 failed_build:
 166         return (read_queue_e);
 167 }
 168
 169 struct mbuf *
 170 sctp_build_ctl_nchunk(struct sctp_inpcb *inp, struct sctp_sndrcvinfo *sinfo)
 171 {
 172         struct sctp_extrcvinfo *seinfo;
 173         struct sctp_sndrcvinfo *outinfo;
 174         struct sctp_rcvinfo *rcvinfo;
 175         struct sctp_nxtinfo *nxtinfo;
 176         struct cmsghdr *cmh;
 177         struct mbuf *ret;
 178         int len;
 179         int use_extended;
 180         int provide_nxt;
 181
 182         if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
 183             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
 184             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
 185                 /* user does not want any ancillary data */
 186                 return (NULL);
 187         }
 188         len = 0;
 189         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) {
 190                 len += CMSG_SPACE(sizeof(struct sctp_rcvinfo));
 191         }
 192         seinfo = (struct sctp_extrcvinfo *)sinfo;
 193         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO) &&
 194             (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_AVAIL)) {
 195                 provide_nxt = 1;
 196                 len += CMSG_SPACE(sizeof(struct sctp_nxtinfo));
 197         } else {
 198                 provide_nxt = 0;
 199         }
 200         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
 201                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
 202                         use_extended = 1;
 203                         len += CMSG_SPACE(sizeof(struct sctp_extrcvinfo));
 204                 } else {
 205                         use_extended = 0;
 206                         len += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
 207                 }
 208         } else {
 209                 use_extended = 0;
 210         }
 211
 212         ret = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
 213         if (ret == NULL) {
 214                 /* No space */
 215                 return (ret);
 216         }
 217         SCTP_BUF_LEN(ret) = 0;
 218
 219         /* We need a CMSG header followed by the struct */
 220         cmh = mtod(ret, struct cmsghdr *);
 221         /*
 222          * Make sure that there is no un-initialized padding between the
 223          * cmsg header and cmsg data and after the cmsg data.
 224          */
 225         memset(cmh, 0, len);
 226         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) {
 227                 cmh->cmsg_level = IPPROTO_SCTP;
 228                 cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo));
 229                 cmh->cmsg_type = SCTP_RCVINFO;
 230                 rcvinfo = (struct sctp_rcvinfo *)CMSG_DATA(cmh);
 231                 rcvinfo->rcv_sid = sinfo->sinfo_stream;
 232                 rcvinfo->rcv_ssn = sinfo->sinfo_ssn;
 233                 rcvinfo->rcv_flags = sinfo->sinfo_flags;
 234                 rcvinfo->rcv_ppid = sinfo->sinfo_ppid;
 235                 rcvinfo->rcv_tsn = sinfo->sinfo_tsn;
 236                 rcvinfo->rcv_cumtsn = sinfo->sinfo_cumtsn;
 237                 rcvinfo->rcv_context = sinfo->sinfo_context;
 238                 rcvinfo->rcv_assoc_id = sinfo->sinfo_assoc_id;
 239                 cmh = (struct cmsghdr *)((caddr_t)cmh + CMSG_SPACE(sizeof(struct sctp_rcvinfo)));
 240                 SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_rcvinfo));
 241         }
 242         if (provide_nxt) {
 243                 cmh->cmsg_level = IPPROTO_SCTP;
 244                 cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_nxtinfo));
 245                 cmh->cmsg_type = SCTP_NXTINFO;
 246                 nxtinfo = (struct sctp_nxtinfo *)CMSG_DATA(cmh);
 247                 nxtinfo->nxt_sid = seinfo->serinfo_next_stream;
 248                 nxtinfo->nxt_flags = 0;
 249                 if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_IS_UNORDERED) {
 250                         nxtinfo->nxt_flags |= SCTP_UNORDERED;
 251                 }
 252                 if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_IS_NOTIFICATION) {
 253                         nxtinfo->nxt_flags |= SCTP_NOTIFICATION;
 254                 }
 255                 if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_ISCOMPLETE) {
 256                         nxtinfo->nxt_flags |= SCTP_COMPLETE;
 257                 }
 258                 nxtinfo->nxt_ppid = seinfo->serinfo_next_ppid;
 259                 nxtinfo->nxt_length = seinfo->serinfo_next_length;
 260                 nxtinfo->nxt_assoc_id = seinfo->serinfo_next_aid;
 261                 cmh = (struct cmsghdr *)((caddr_t)cmh + CMSG_SPACE(sizeof(struct sctp_nxtinfo)));
 262                 SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_nxtinfo));
 263         }
 264         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
 265                 cmh->cmsg_level = IPPROTO_SCTP;
 266                 outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
 267                 if (use_extended) {
 268                         cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_extrcvinfo));
 269                         cmh->cmsg_type = SCTP_EXTRCV;
 270                         memcpy(outinfo, sinfo, sizeof(struct sctp_extrcvinfo));
 271                         SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_extrcvinfo));
 272                 } else {
 273                         cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 274                         cmh->cmsg_type = SCTP_SNDRCV;
 275                         *outinfo = *sinfo;
 276                         SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
 277                 }
 278         }
 279         return (ret);
 280 }
 281
 282
 283 static void
 284 sctp_mark_non_revokable(struct sctp_association *asoc, uint32_t tsn)
 285 {
 286         uint32_t gap, i, cumackp1;
 287         int fnd = 0;
 288         int in_r = 0, in_nr = 0;
 289
 290         if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
 291                 return;
 292         }
 293         cumackp1 = asoc->cumulative_tsn + 1;
 294         if (SCTP_TSN_GT(cumackp1, tsn)) {
 295                 /*
 296                  * this tsn is behind the cum ack and thus we don't need to
 297                  * worry about it being moved from one to the other.
 298                  */
 299                 return;
 300         }
 301         SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
 302         in_r = SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap);
 303         in_nr = SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, gap);
 304         if ((in_r == 0) && (in_nr == 0)) {
 305 #ifdef INVARIANTS
 306                 panic("Things are really messed up now");
 307 #else
 308                 SCTP_PRINTF("gap:%x tsn:%x\n", gap, tsn);
 309                 sctp_print_mapping_array(asoc);
 310 #endif
 311         }
 312         if (in_nr == 0)
 313                 SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
 314         if (in_r)
 315                 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
 316         if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
 317                 asoc->highest_tsn_inside_nr_map = tsn;
 318         }
 319         if (tsn == asoc->highest_tsn_inside_map) {
 320                 /* We must back down to see what the new highest is */
 321                 for (i = tsn - 1; SCTP_TSN_GE(i, asoc->mapping_array_base_tsn); i--) {
 322                         SCTP_CALC_TSN_TO_GAP(gap, i, asoc->mapping_array_base_tsn);
 323                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
 324                                 asoc->highest_tsn_inside_map = i;
 325                                 fnd = 1;
 326                                 break;
 327                         }
 328                 }
 329                 if (!fnd) {
 330                         asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn - 1;
 331                 }
 332         }
 333 }
 334
 335 static int
 336 sctp_place_control_in_stream(struct sctp_stream_in *strm,
 337     struct sctp_association *asoc,
 338     struct sctp_queued_to_read *control)
 339 {
 340         struct sctp_queued_to_read *at;
 341         struct sctp_readhead *q;
 342         uint8_t flags, unordered;
 343
 344         flags = (control->sinfo_flags >> 8);
 345         unordered = flags & SCTP_DATA_UNORDERED;
 346         if (unordered) {
 347                 q = &strm->uno_inqueue;
 348                 if (asoc->idata_supported == 0) {
 349                         if (!TAILQ_EMPTY(q)) {
 350                                 /*
 351                                  * Only one stream can be here in old style
 352                                  * -- abort
 353                                  */
 354                                 return (-1);
 355                         }
 356                         TAILQ_INSERT_TAIL(q, control, next_instrm);
 357                         control->on_strm_q = SCTP_ON_UNORDERED;
 358                         return (0);
 359                 }
 360         } else {
 361                 q = &strm->inqueue;
 362         }
 363         if ((flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
 364                 control->end_added = 1;
 365                 control->first_frag_seen = 1;
 366                 control->last_frag_seen = 1;
 367         }
 368         if (TAILQ_EMPTY(q)) {
 369                 /* Empty queue */
 370                 TAILQ_INSERT_HEAD(q, control, next_instrm);
 371                 if (unordered) {
 372                         control->on_strm_q = SCTP_ON_UNORDERED;
 373                 } else {
 374                         control->on_strm_q = SCTP_ON_ORDERED;
 375                 }
 376                 return (0);
 377         } else {
 378                 TAILQ_FOREACH(at, q, next_instrm) {
 379                         if (SCTP_MID_GT(asoc->idata_supported, at->mid, control->mid)) {
 380                                 /*
 381                                  * one in queue is bigger than the new one,
 382                                  * insert before this one
 383                                  */
 384                                 TAILQ_INSERT_BEFORE(at, control, next_instrm);
 385                                 if (unordered) {
 386                                         control->on_strm_q = SCTP_ON_UNORDERED;
 387                                 } else {
 388                                         control->on_strm_q = SCTP_ON_ORDERED;
 389                                 }
 390                                 break;
 391                         } else if (SCTP_MID_EQ(asoc->idata_supported, at->mid, control->mid)) {
 392                                 /*
 393                                  * Gak, He sent me a duplicate msg id
 394                                  * number?? return -1 to abort.
 395                                  */
 396                                 return (-1);
 397                         } else {
 398                                 if (TAILQ_NEXT(at, next_instrm) == NULL) {
 399                                         /*
 400                                          * We are at the end, insert it
 401                                          * after this one
 402                                          */
 403                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
 404                                                 sctp_log_strm_del(control, at,
 405                                                     SCTP_STR_LOG_FROM_INSERT_TL);
 406                                         }
 407                                         TAILQ_INSERT_AFTER(q, at, control, next_instrm);
 408                                         if (unordered) {
 409                                                 control->on_strm_q = SCTP_ON_UNORDERED;
 410                                         } else {
 411                                                 control->on_strm_q = SCTP_ON_ORDERED;
 412                                         }
 413                                         break;
 414                                 }
 415                         }
 416                 }
 417         }
 418         return (0);
 419 }
 420
 421 static void
 422 sctp_abort_in_reasm(struct sctp_tcb *stcb,
 423     struct sctp_queued_to_read *control,
 424     struct sctp_tmit_chunk *chk,
 425     int *abort_flag, int opspot)
 426 {
 427         char msg[SCTP_DIAG_INFO_LEN];
 428         struct mbuf *oper;
 429
 430         if (stcb->asoc.idata_supported) {
 431                 snprintf(msg, sizeof(msg),
 432                     "Reass %x,CF:%x,TSN=%8.8x,SID=%4.4x,FSN=%8.8x,MID:%8.8x",
 433                     opspot,
 434                     control->fsn_included,
 435                     chk->rec.data.tsn,
 436                     chk->rec.data.sid,
 437                     chk->rec.data.fsn, chk->rec.data.mid);
 438         } else {
 439                 snprintf(msg, sizeof(msg),
 440                     "Reass %x,CI:%x,TSN=%8.8x,SID=%4.4x,FSN=%4.4x,SSN:%4.4x",
 441                     opspot,
 442                     control->fsn_included,
 443                     chk->rec.data.tsn,
 444                     chk->rec.data.sid,
 445                     chk->rec.data.fsn,
 446                     (uint16_t)chk->rec.data.mid);
 447         }
 448         oper = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
 449         sctp_m_freem(chk->data);
 450         chk->data = NULL;
 451         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 452         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_1;
 453         sctp_abort_an_association(stcb->sctp_ep, stcb, oper, SCTP_SO_NOT_LOCKED);
 454         *abort_flag = 1;
 455 }
 456
 457 static void
 458 sctp_clean_up_control(struct sctp_tcb *stcb, struct sctp_queued_to_read *control)
 459 {
 460         /*
 461          * The control could not be placed and must be cleaned.
 462          */
 463         struct sctp_tmit_chunk *chk, *nchk;
 464
 465         TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
 466                 TAILQ_REMOVE(&control->reasm, chk, sctp_next);
 467                 if (chk->data)
 468                         sctp_m_freem(chk->data);
 469                 chk->data = NULL;
 470                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 471         }
 472         sctp_free_a_readq(stcb, control);
 473 }
 474
 475 /*
 476  * Queue the chunk either right into the socket buffer if it is the next one
 477  * to go OR put it in the correct place in the delivery queue.  If we do
 478  * append to the so_buf, keep doing so until we are out of order as
 479  * long as the control's entered are non-fragmented.
 480  */
 481 static void
 482 sctp_queue_data_to_stream(struct sctp_tcb *stcb,
 483     struct sctp_association *asoc,
 484     struct sctp_queued_to_read *control, int *abort_flag, int *need_reasm)
 485 {
 486         /*
 487          * FIX-ME maybe? What happens when the ssn wraps? If we are getting
 488          * all the data in one stream this could happen quite rapidly. One
 489          * could use the TSN to keep track of things, but this scheme breaks
 490          * down in the other type of stream usage that could occur. Send a
 491          * single msg to stream 0, send 4Billion messages to stream 1, now
 492          * send a message to stream 0. You have a situation where the TSN
 493          * has wrapped but not in the stream. Is this worth worrying about
 494          * or should we just change our queue sort at the bottom to be by
 495          * TSN.
 496          *
 497          * Could it also be legal for a peer to send ssn 1 with TSN 2 and
 498          * ssn 2 with TSN 1? If the peer is doing some sort of funky TSN/SSN
 499          * assignment this could happen... and I don't see how this would be
 500          * a violation. So for now I am undecided an will leave the sort by
 501          * SSN alone. Maybe a hybred approach is the answer
 502          *
 503          */
 504         struct sctp_queued_to_read *at;
 505         int queue_needed;
 506         uint32_t nxt_todel;
 507         struct mbuf *op_err;
 508         struct sctp_stream_in *strm;
 509         char msg[SCTP_DIAG_INFO_LEN];
 510
 511         strm = &asoc->strmin[control->sinfo_stream];
 512         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
 513                 sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
 514         }
 515         if (SCTP_MID_GT((asoc->idata_supported), strm->last_mid_delivered, control->mid)) {
 516                 /* The incoming sseq is behind where we last delivered? */
 517                 SCTPDBG(SCTP_DEBUG_INDATA1, "Duplicate S-SEQ: %u delivered: %u from peer, Abort association\n",
 518                     strm->last_mid_delivered, control->mid);
 519                 /*
 520                  * throw it in the stream so it gets cleaned up in
 521                  * association destruction
 522                  */
 523                 TAILQ_INSERT_HEAD(&strm->inqueue, control, next_instrm);
 524                 if (asoc->idata_supported) {
 525                         snprintf(msg, sizeof(msg), "Delivered MID=%8.8x, got TSN=%8.8x, SID=%4.4x, MID=%8.8x",
 526                             strm->last_mid_delivered, control->sinfo_tsn,
 527                             control->sinfo_stream, control->mid);
 528                 } else {
 529                         snprintf(msg, sizeof(msg), "Delivered SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
 530                             (uint16_t)strm->last_mid_delivered,
 531                             control->sinfo_tsn,
 532                             control->sinfo_stream,
 533                             (uint16_t)control->mid);
 534                 }
 535                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
 536                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_2;
 537                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 538                 *abort_flag = 1;
 539                 return;
 540
 541         }
 542         queue_needed = 1;
 543         asoc->size_on_all_streams += control->length;
 544         sctp_ucount_incr(asoc->cnt_on_all_streams);
 545         nxt_todel = strm->last_mid_delivered + 1;
 546         if (SCTP_MID_EQ(asoc->idata_supported, nxt_todel, control->mid)) {
 547 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 548                 struct socket *so;
 549
 550                 so = SCTP_INP_SO(stcb->sctp_ep);
 551                 atomic_add_int(&stcb->asoc.refcnt, 1);
 552                 SCTP_TCB_UNLOCK(stcb);
 553                 SCTP_SOCKET_LOCK(so, 1);
 554                 SCTP_TCB_LOCK(stcb);
 555                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 556                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 557                         SCTP_SOCKET_UNLOCK(so, 1);
 558                         return;
 559                 }
 560 #endif
 561                 /* can be delivered right away? */
 562                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
 563                         sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
 564                 }
 565                 /* EY it wont be queued if it could be delivered directly */
 566                 queue_needed = 0;
 567                 if (asoc->size_on_all_streams >= control->length) {
 568                         asoc->size_on_all_streams -= control->length;
 569                 } else {
 570 #ifdef INVARIANTS
 571                         panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
 572 #else
 573                         asoc->size_on_all_streams = 0;
 574 #endif
 575                 }
 576                 sctp_ucount_decr(asoc->cnt_on_all_streams);
 577                 strm->last_mid_delivered++;
 578                 sctp_mark_non_revokable(asoc, control->sinfo_tsn);
 579                 sctp_add_to_readq(stcb->sctp_ep, stcb,
 580                     control,
 581                     &stcb->sctp_socket->so_rcv, 1,
 582                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_LOCKED);
 583                 TAILQ_FOREACH_SAFE(control, &strm->inqueue, next_instrm, at) {
 584                         /* all delivered */
 585                         nxt_todel = strm->last_mid_delivered + 1;
 586                         if (SCTP_MID_EQ(asoc->idata_supported, nxt_todel, control->mid) &&
 587                             (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG)) {
 588                                 if (control->on_strm_q == SCTP_ON_ORDERED) {
 589                                         TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
 590                                         if (asoc->size_on_all_streams >= control->length) {
 591                                                 asoc->size_on_all_streams -= control->length;
 592                                         } else {
 593 #ifdef INVARIANTS
 594                                                 panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
 595 #else
 596                                                 asoc->size_on_all_streams = 0;
 597 #endif
 598                                         }
 599                                         sctp_ucount_decr(asoc->cnt_on_all_streams);
 600 #ifdef INVARIANTS
 601                                 } else {
 602                                         panic("Huh control: %p is on_strm_q: %d",
 603                                             control, control->on_strm_q);
 604 #endif
 605                                 }
 606                                 control->on_strm_q = 0;
 607                                 strm->last_mid_delivered++;
 608                                 /*
 609                                  * We ignore the return of deliver_data here
 610                                  * since we always can hold the chunk on the
 611                                  * d-queue. And we have a finite number that
 612                                  * can be delivered from the strq.
 613                                  */
 614                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
 615                                         sctp_log_strm_del(control, NULL,
 616                                             SCTP_STR_LOG_FROM_IMMED_DEL);
 617                                 }
 618                                 sctp_mark_non_revokable(asoc, control->sinfo_tsn);
 619                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
 620                                     control,
 621                                     &stcb->sctp_socket->so_rcv, 1,
 622                                     SCTP_READ_LOCK_NOT_HELD,
 623                                     SCTP_SO_LOCKED);
 624                                 continue;
 625                         } else if (SCTP_MID_EQ(asoc->idata_supported, nxt_todel, control->mid)) {
 626                                 *need_reasm = 1;
 627                         }
 628                         break;
 629                 }
 630 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 631                 SCTP_SOCKET_UNLOCK(so, 1);
 632 #endif
 633         }
 634         if (queue_needed) {
 635                 /*
 636                  * Ok, we did not deliver this guy, find the correct place
 637                  * to put it on the queue.
 638                  */
 639                 if (sctp_place_control_in_stream(strm, asoc, control)) {
 640                         snprintf(msg, sizeof(msg),
 641                             "Queue to str MID: %u duplicate",
 642                             control->mid);
 643                         sctp_clean_up_control(stcb, control);
 644                         op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
 645                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_3;
 646                         sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 647                         *abort_flag = 1;
 648                 }
 649         }
 650 }
 651
 652
 653 static void
 654 sctp_setup_tail_pointer(struct sctp_queued_to_read *control)
 655 {
 656         struct mbuf *m, *prev = NULL;
 657         struct sctp_tcb *stcb;
 658
 659         stcb = control->stcb;
 660         control->held_length = 0;
 661         control->length = 0;
 662         m = control->data;
 663         while (m) {
 664                 if (SCTP_BUF_LEN(m) == 0) {
 665                         /* Skip mbufs with NO length */
 666                         if (prev == NULL) {
 667                                 /* First one */
 668                                 control->data = sctp_m_free(m);
 669                                 m = control->data;
 670                         } else {
 671                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
 672                                 m = SCTP_BUF_NEXT(prev);
 673                         }
 674                         if (m == NULL) {
 675                                 control->tail_mbuf = prev;
 676                         }
 677                         continue;
 678                 }
 679                 prev = m;
 680                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
 681                 if (control->on_read_q) {
 682                         /*
 683                          * On read queue so we must increment the SB stuff,
 684                          * we assume caller has done any locks of SB.
 685                          */
 686                         sctp_sballoc(stcb, &stcb->sctp_socket->so_rcv, m);
 687                 }
 688                 m = SCTP_BUF_NEXT(m);
 689         }
 690         if (prev) {
 691                 control->tail_mbuf = prev;
 692         }
 693 }
 694
 695 static void
 696 sctp_add_to_tail_pointer(struct sctp_queued_to_read *control, struct mbuf *m, uint32_t *added)
 697 {
 698         struct mbuf *prev = NULL;
 699         struct sctp_tcb *stcb;
 700
 701         stcb = control->stcb;
 702         if (stcb == NULL) {
 703 #ifdef INVARIANTS
 704                 panic("Control broken");
 705 #else
 706                 return;
 707 #endif
 708         }
 709         if (control->tail_mbuf == NULL) {
 710                 /* TSNH */
 711                 control->data = m;
 712                 sctp_setup_tail_pointer(control);
 713                 return;
 714         }
 715         control->tail_mbuf->m_next = m;
 716         while (m) {
 717                 if (SCTP_BUF_LEN(m) == 0) {
 718                         /* Skip mbufs with NO length */
 719                         if (prev == NULL) {
 720                                 /* First one */
 721                                 control->tail_mbuf->m_next = sctp_m_free(m);
 722                                 m = control->tail_mbuf->m_next;
 723                         } else {
 724                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
 725                                 m = SCTP_BUF_NEXT(prev);
 726                         }
 727                         if (m == NULL) {
 728                                 control->tail_mbuf = prev;
 729                         }
 730                         continue;
 731                 }
 732                 prev = m;
 733                 if (control->on_read_q) {
 734                         /*
 735                          * On read queue so we must increment the SB stuff,
 736                          * we assume caller has done any locks of SB.
 737                          */
 738                         sctp_sballoc(stcb, &stcb->sctp_socket->so_rcv, m);
 739                 }
 740                 *added += SCTP_BUF_LEN(m);
 741                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
 742                 m = SCTP_BUF_NEXT(m);
 743         }
 744         if (prev) {
 745                 control->tail_mbuf = prev;
 746         }
 747 }
 748
 749 static void
 750 sctp_build_readq_entry_from_ctl(struct sctp_queued_to_read *nc, struct sctp_queued_to_read *control)
 751 {
 752         memset(nc, 0, sizeof(struct sctp_queued_to_read));
 753         nc->sinfo_stream = control->sinfo_stream;
 754         nc->mid = control->mid;
 755         TAILQ_INIT(&nc->reasm);
 756         nc->top_fsn = control->top_fsn;
 757         nc->mid = control->mid;
 758         nc->sinfo_flags = control->sinfo_flags;
 759         nc->sinfo_ppid = control->sinfo_ppid;
 760         nc->sinfo_context = control->sinfo_context;
 761         nc->fsn_included = 0xffffffff;
 762         nc->sinfo_tsn = control->sinfo_tsn;
 763         nc->sinfo_cumtsn = control->sinfo_cumtsn;
 764         nc->sinfo_assoc_id = control->sinfo_assoc_id;
 765         nc->whoFrom = control->whoFrom;
 766         atomic_add_int(&nc->whoFrom->ref_count, 1);
 767         nc->stcb = control->stcb;
 768         nc->port_from = control->port_from;
 769 }
 770
 771 static void
 772 sctp_reset_a_control(struct sctp_queued_to_read *control,
 773     struct sctp_inpcb *inp, uint32_t tsn)
 774 {
 775         control->fsn_included = tsn;
 776         if (control->on_read_q) {
 777                 /*
 778                  * We have to purge it from there, hopefully this will work
 779                  * :-)
 780                  */
 781                 TAILQ_REMOVE(&inp->read_queue, control, next);
 782                 control->on_read_q = 0;
 783         }
 784 }
 785
 786 static int
 787 sctp_handle_old_unordered_data(struct sctp_tcb *stcb,
 788     struct sctp_association *asoc,
 789     struct sctp_stream_in *strm,
 790     struct sctp_queued_to_read *control,
 791     uint32_t pd_point,
 792     int inp_read_lock_held)
 793 {
 794         /*
 795          * Special handling for the old un-ordered data chunk. All the
 796          * chunks/TSN's go to mid 0. So we have to do the old style watching
 797          * to see if we have it all. If you return one, no other control
 798          * entries on the un-ordered queue will be looked at. In theory
 799          * there should be no others entries in reality, unless the guy is
 800          * sending both unordered NDATA and unordered DATA...
 801          */
 802         struct sctp_tmit_chunk *chk, *lchk, *tchk;
 803         uint32_t fsn;
 804         struct sctp_queued_to_read *nc;
 805         int cnt_added;
 806
 807         if (control->first_frag_seen == 0) {
 808                 /* Nothing we can do, we have not seen the first piece yet */
 809                 return (1);
 810         }
 811         /* Collapse any we can */
 812         cnt_added = 0;
 813 restart:
 814         fsn = control->fsn_included + 1;
 815         /* Now what can we add? */
 816         TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, lchk) {
 817                 if (chk->rec.data.fsn == fsn) {
 818                         /* Ok lets add it */
 819                         sctp_alloc_a_readq(stcb, nc);
 820                         if (nc == NULL) {
 821                                 break;
 822                         }
 823                         memset(nc, 0, sizeof(struct sctp_queued_to_read));
 824                         TAILQ_REMOVE(&control->reasm, chk, sctp_next);
 825                         sctp_add_chk_to_control(control, strm, stcb, asoc, chk, SCTP_READ_LOCK_NOT_HELD);
 826                         fsn++;
 827                         cnt_added++;
 828                         chk = NULL;
 829                         if (control->end_added) {
 830                                 /* We are done */
 831                                 if (!TAILQ_EMPTY(&control->reasm)) {
 832                                         /*
 833                                          * Ok we have to move anything left
 834                                          * on the control queue to a new
 835                                          * control.
 836                                          */
 837                                         sctp_build_readq_entry_from_ctl(nc, control);
 838                                         tchk = TAILQ_FIRST(&control->reasm);
 839                                         if (tchk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 840                                                 TAILQ_REMOVE(&control->reasm, tchk, sctp_next);
 841                                                 if (asoc->size_on_reasm_queue >= tchk->send_size) {
 842                                                         asoc->size_on_reasm_queue -= tchk->send_size;
 843                                                 } else {
 844 #ifdef INVARIANTS
 845                                                         panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, tchk->send_size);
 846 #else
 847                                                         asoc->size_on_reasm_queue = 0;
 848 #endif
 849                                                 }
 850                                                 sctp_ucount_decr(asoc->cnt_on_reasm_queue);
 851                                                 nc->first_frag_seen = 1;
 852                                                 nc->fsn_included = tchk->rec.data.fsn;
 853                                                 nc->data = tchk->data;
 854                                                 nc->sinfo_ppid = tchk->rec.data.ppid;
 855                                                 nc->sinfo_tsn = tchk->rec.data.tsn;
 856                                                 sctp_mark_non_revokable(asoc, tchk->rec.data.tsn);
 857                                                 tchk->data = NULL;
 858                                                 sctp_free_a_chunk(stcb, tchk, SCTP_SO_NOT_LOCKED);
 859                                                 sctp_setup_tail_pointer(nc);
 860                                                 tchk = TAILQ_FIRST(&control->reasm);
 861                                         }
 862                                         /* Spin the rest onto the queue */
 863                                         while (tchk) {
 864                                                 TAILQ_REMOVE(&control->reasm, tchk, sctp_next);
 865                                                 TAILQ_INSERT_TAIL(&nc->reasm, tchk, sctp_next);
 866                                                 tchk = TAILQ_FIRST(&control->reasm);
 867                                         }
 868                                         /*
 869                                          * Now lets add it to the queue
 870                                          * after removing control
 871                                          */
 872                                         TAILQ_INSERT_TAIL(&strm->uno_inqueue, nc, next_instrm);
 873                                         nc->on_strm_q = SCTP_ON_UNORDERED;
 874                                         if (control->on_strm_q) {
 875                                                 TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
 876                                                 control->on_strm_q = 0;
 877                                         }
 878                                 }
 879                                 if (control->pdapi_started) {
 880                                         strm->pd_api_started = 0;
 881                                         control->pdapi_started = 0;
 882                                 }
 883                                 if (control->on_strm_q) {
 884                                         TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
 885                                         control->on_strm_q = 0;
 886                                         SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
 887                                 }
 888                                 if (control->on_read_q == 0) {
 889                                         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
 890                                             &stcb->sctp_socket->so_rcv, control->end_added,
 891                                             inp_read_lock_held, SCTP_SO_NOT_LOCKED);
 892                                 }
 893                                 sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 894                                 if ((nc->first_frag_seen) && !TAILQ_EMPTY(&nc->reasm)) {
 895                                         /*
 896                                          * Switch to the new guy and
 897                                          * continue
 898                                          */
 899                                         control = nc;
 900                                         goto restart;
 901                                 } else {
 902                                         if (nc->on_strm_q == 0) {
 903                                                 sctp_free_a_readq(stcb, nc);
 904                                         }
 905                                 }
 906                                 return (1);
 907                         } else {
 908                                 sctp_free_a_readq(stcb, nc);
 909                         }
 910                 } else {
 911                         /* Can't add more */
 912                         break;
 913                 }
 914         }
 915         if ((control->length > pd_point) && (strm->pd_api_started == 0)) {
 916                 strm->pd_api_started = 1;
 917                 control->pdapi_started = 1;
 918                 sctp_add_to_readq(stcb->sctp_ep, stcb, control,
 919                     &stcb->sctp_socket->so_rcv, control->end_added,
 920                     inp_read_lock_held, SCTP_SO_NOT_LOCKED);
 921                 sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 922                 return (0);
 923         } else {
 924                 return (1);
 925         }
 926 }
 927
 928 static void
 929 sctp_inject_old_unordered_data(struct sctp_tcb *stcb,
 930     struct sctp_association *asoc,
 931     struct sctp_queued_to_read *control,
 932     struct sctp_tmit_chunk *chk,
 933     int *abort_flag)
 934 {
 935         struct sctp_tmit_chunk *at;
 936         int inserted;
 937
 938         /*
 939          * Here we need to place the chunk into the control structure sorted
 940          * in the correct order.
 941          */
 942         if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 943                 /* Its the very first one. */
 944                 SCTPDBG(SCTP_DEBUG_XXX,
 945                     "chunk is a first fsn: %u becomes fsn_included\n",
 946                     chk->rec.data.fsn);
 947                 if (control->first_frag_seen) {
 948                         /*
 949                          * In old un-ordered we can reassembly on one
 950                          * control multiple messages. As long as the next
 951                          * FIRST is greater then the old first (TSN i.e. FSN
 952                          * wise)
 953                          */
 954                         struct mbuf *tdata;
 955                         uint32_t tmp;
 956
 957                         if (SCTP_TSN_GT(chk->rec.data.fsn, control->fsn_included)) {
 958                                 /*
 959                                  * Easy way the start of a new guy beyond
 960                                  * the lowest
 961                                  */
 962                                 goto place_chunk;
 963                         }
 964                         if ((chk->rec.data.fsn == control->fsn_included) ||
 965                             (control->pdapi_started)) {
 966                                 /*
 967                                  * Ok this should not happen, if it does we
 968                                  * started the pd-api on the higher TSN
 969                                  * (since the equals part is a TSN failure
 970                                  * it must be that).
 971                                  *
 972                                  * We are completly hosed in that case since
 973                                  * I have no way to recover. This really
 974                                  * will only happen if we can get more TSN's
 975                                  * higher before the pd-api-point.
 976                                  */
 977                                 sctp_abort_in_reasm(stcb, control, chk,
 978                                     abort_flag,
 979                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_4);
 980
 981                                 return;
 982                         }
 983                         /*
 984                          * Ok we have two firsts and the one we just got is
 985                          * smaller than the one we previously placed.. yuck!
 986                          * We must swap them out.
 987                          */
 988                         /* swap the mbufs */
 989                         tdata = control->data;
 990                         control->data = chk->data;
 991                         chk->data = tdata;
 992                         /* Save the lengths */
 993                         chk->send_size = control->length;
 994                         /* Recompute length of control and tail pointer */
 995                         sctp_setup_tail_pointer(control);
 996                         /* Fix the FSN included */
 997                         tmp = control->fsn_included;
 998                         control->fsn_included = chk->rec.data.fsn;
 999                         chk->rec.data.fsn = tmp;
1000                         /* Fix the TSN included */
1001                         tmp = control->sinfo_tsn;
1002                         control->sinfo_tsn = chk->rec.data.tsn;
1003                         chk->rec.data.tsn = tmp;
1004                         /* Fix the PPID included */
1005                         tmp = control->sinfo_ppid;
1006                         control->sinfo_ppid = chk->rec.data.ppid;
1007                         chk->rec.data.ppid = tmp;
1008                         /* Fix tail pointer */
1009                         goto place_chunk;
1010                 }
1011                 control->first_frag_seen = 1;
1012                 control->fsn_included = chk->rec.data.fsn;
1013                 control->top_fsn = chk->rec.data.fsn;
1014                 control->sinfo_tsn = chk->rec.data.tsn;
1015                 control->sinfo_ppid = chk->rec.data.ppid;
1016                 control->data = chk->data;
1017                 sctp_mark_non_revokable(asoc, chk->rec.data.tsn);
1018                 chk->data = NULL;
1019                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
1020                 sctp_setup_tail_pointer(control);
1021                 return;
1022         }
1023 place_chunk:
1024         inserted = 0;
1025         TAILQ_FOREACH(at, &control->reasm, sctp_next) {
1026                 if (SCTP_TSN_GT(at->rec.data.fsn, chk->rec.data.fsn)) {
1027                         /*
1028                          * This one in queue is bigger than the new one,
1029                          * insert the new one before at.
1030                          */
1031                         asoc->size_on_reasm_queue += chk->send_size;
1032                         sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1033                         inserted = 1;
1034                         TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1035                         break;
1036                 } else if (at->rec.data.fsn == chk->rec.data.fsn) {
1037                         /*
1038                          * They sent a duplicate fsn number. This really
1039                          * should not happen since the FSN is a TSN and it
1040                          * should have been dropped earlier.
1041                          */
1042                         sctp_abort_in_reasm(stcb, control, chk,
1043                             abort_flag,
1044                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_5);
1045                         return;
1046                 }
1047         }
1048         if (inserted == 0) {
1049                 /* Its at the end */
1050                 asoc->size_on_reasm_queue += chk->send_size;
1051                 sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1052                 control->top_fsn = chk->rec.data.fsn;
1053                 TAILQ_INSERT_TAIL(&control->reasm, chk, sctp_next);
1054         }
1055 }
1056
1057 static int
1058 sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc,
1059     struct sctp_stream_in *strm, int inp_read_lock_held)
1060 {
1061         /*
1062          * Given a stream, strm, see if any of the SSN's on it that are
1063          * fragmented are ready to deliver. If so go ahead and place them on
1064          * the read queue. In so placing if we have hit the end, then we
1065          * need to remove them from the stream's queue.
1066          */
1067         struct sctp_queued_to_read *control, *nctl = NULL;
1068         uint32_t next_to_del;
1069         uint32_t pd_point;
1070         int ret = 0;
1071
1072         if (stcb->sctp_socket) {
1073                 pd_point = min(SCTP_SB_LIMIT_RCV(stcb->sctp_socket) >> SCTP_PARTIAL_DELIVERY_SHIFT,
1074                     stcb->sctp_ep->partial_delivery_point);
1075         } else {
1076                 pd_point = stcb->sctp_ep->partial_delivery_point;
1077         }
1078         control = TAILQ_FIRST(&strm->uno_inqueue);
1079
1080         if ((control != NULL) &&
1081             (asoc->idata_supported == 0)) {
1082                 /* Special handling needed for "old" data format */
1083                 if (sctp_handle_old_unordered_data(stcb, asoc, strm, control, pd_point, inp_read_lock_held)) {
1084                         goto done_un;
1085                 }
1086         }
1087         if (strm->pd_api_started) {
1088                 /* Can't add more */
1089                 return (0);
1090         }
1091         while (control) {
1092                 SCTPDBG(SCTP_DEBUG_XXX, "Looking at control: %p e(%d) ssn: %u top_fsn: %u inc_fsn: %u -uo\n",
1093                     control, control->end_added, control->mid, control->top_fsn, control->fsn_included);
1094                 nctl = TAILQ_NEXT(control, next_instrm);
1095                 if (control->end_added) {
1096                         /* We just put the last bit on */
1097                         if (control->on_strm_q) {
1098 #ifdef INVARIANTS
1099                                 if (control->on_strm_q != SCTP_ON_UNORDERED) {
1100                                         panic("Huh control: %p on_q: %d -- not unordered?",
1101                                             control, control->on_strm_q);
1102                                 }
1103 #endif
1104                                 SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
1105                                 TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
1106                                 control->on_strm_q = 0;
1107                         }
1108                         if (control->on_read_q == 0) {
1109                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
1110                                     control,
1111                                     &stcb->sctp_socket->so_rcv, control->end_added,
1112                                     inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1113                         }
1114                 } else {
1115                         /* Can we do a PD-API for this un-ordered guy? */
1116                         if ((control->length >= pd_point) && (strm->pd_api_started == 0)) {
1117                                 strm->pd_api_started = 1;
1118                                 control->pdapi_started = 1;
1119                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
1120                                     control,
1121                                     &stcb->sctp_socket->so_rcv, control->end_added,
1122                                     inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1123
1124                                 break;
1125                         }
1126                 }
1127                 control = nctl;
1128         }
1129 done_un:
1130         control = TAILQ_FIRST(&strm->inqueue);
1131         if (strm->pd_api_started) {
1132                 /* Can't add more */
1133                 return (0);
1134         }
1135         if (control == NULL) {
1136                 return (ret);
1137         }
1138         if (SCTP_MID_EQ(asoc->idata_supported, strm->last_mid_delivered, control->mid)) {
1139                 /*
1140                  * Ok the guy at the top was being partially delivered
1141                  * completed, so we remove it. Note the pd_api flag was
1142                  * taken off when the chunk was merged on in
1143                  * sctp_queue_data_for_reasm below.
1144                  */
1145                 nctl = TAILQ_NEXT(control, next_instrm);
1146                 SCTPDBG(SCTP_DEBUG_XXX,
1147                     "Looking at control: %p e(%d) ssn: %u top_fsn: %u inc_fsn: %u (lastdel: %u)- o\n",
1148                     control, control->end_added, control->mid,
1149                     control->top_fsn, control->fsn_included,
1150                     strm->last_mid_delivered);
1151                 if (control->end_added) {
1152                         if (control->on_strm_q) {
1153 #ifdef INVARIANTS
1154                                 if (control->on_strm_q != SCTP_ON_ORDERED) {
1155                                         panic("Huh control: %p on_q: %d -- not ordered?",
1156                                             control, control->on_strm_q);
1157                                 }
1158 #endif
1159                                 SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
1160                                 TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
1161                                 if (asoc->size_on_all_streams >= control->length) {
1162                                         asoc->size_on_all_streams -= control->length;
1163                                 } else {
1164 #ifdef INVARIANTS
1165                                         panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1166 #else
1167                                         asoc->size_on_all_streams = 0;
1168 #endif
1169                                 }
1170                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
1171                                 control->on_strm_q = 0;
1172                         }
1173                         if (strm->pd_api_started && control->pdapi_started) {
1174                                 control->pdapi_started = 0;
1175                                 strm->pd_api_started = 0;
1176                         }
1177                         if (control->on_read_q == 0) {
1178                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
1179                                     control,
1180                                     &stcb->sctp_socket->so_rcv, control->end_added,
1181                                     inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1182                         }
1183                         control = nctl;
1184                 }
1185         }
1186         if (strm->pd_api_started) {
1187                 /*
1188                  * Can't add more must have gotten an un-ordered above being
1189                  * partially delivered.
1190                  */
1191                 return (0);
1192         }
1193 deliver_more:
1194         next_to_del = strm->last_mid_delivered + 1;
1195         if (control) {
1196                 SCTPDBG(SCTP_DEBUG_XXX,
1197                     "Looking at control: %p e(%d) ssn: %u top_fsn: %u inc_fsn: %u (nxtdel: %u)- o\n",
1198                     control, control->end_added, control->mid, control->top_fsn, control->fsn_included,
1199                     next_to_del);
1200                 nctl = TAILQ_NEXT(control, next_instrm);
1201                 if (SCTP_MID_EQ(asoc->idata_supported, control->mid, next_to_del) &&
1202                     (control->first_frag_seen)) {
1203                         int done;
1204
1205                         /* Ok we can deliver it onto the stream. */
1206                         if (control->end_added) {
1207                                 /* We are done with it afterwards */
1208                                 if (control->on_strm_q) {
1209 #ifdef INVARIANTS
1210                                         if (control->on_strm_q != SCTP_ON_ORDERED) {
1211                                                 panic("Huh control: %p on_q: %d -- not ordered?",
1212                                                     control, control->on_strm_q);
1213                                         }
1214 #endif
1215                                         SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
1216                                         TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
1217                                         if (asoc->size_on_all_streams >= control->length) {
1218                                                 asoc->size_on_all_streams -= control->length;
1219                                         } else {
1220 #ifdef INVARIANTS
1221                                                 panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1222 #else
1223                                                 asoc->size_on_all_streams = 0;
1224 #endif
1225                                         }
1226                                         sctp_ucount_decr(asoc->cnt_on_all_streams);
1227                                         control->on_strm_q = 0;
1228                                 }
1229                                 ret++;
1230                         }
1231                         if (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
1232                                 /*
1233                                  * A singleton now slipping through - mark
1234                                  * it non-revokable too
1235                                  */
1236                                 sctp_mark_non_revokable(asoc, control->sinfo_tsn);
1237                         } else if (control->end_added == 0) {
1238                                 /*
1239                                  * Check if we can defer adding until its
1240                                  * all there
1241                                  */
1242                                 if ((control->length < pd_point) || (strm->pd_api_started)) {
1243                                         /*
1244                                          * Don't need it or cannot add more
1245                                          * (one being delivered that way)
1246                                          */
1247                                         goto out;
1248                                 }
1249                         }
1250                         done = (control->end_added) && (control->last_frag_seen);
1251                         if (control->on_read_q == 0) {
1252                                 if (!done) {
1253                                         if (asoc->size_on_all_streams >= control->length) {
1254                                                 asoc->size_on_all_streams -= control->length;
1255                                         } else {
1256 #ifdef INVARIANTS
1257                                                 panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1258 #else
1259                                                 asoc->size_on_all_streams = 0;
1260 #endif
1261                                         }
1262                                         strm->pd_api_started = 1;
1263                                         control->pdapi_started = 1;
1264                                 }
1265                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
1266                                     control,
1267                                     &stcb->sctp_socket->so_rcv, control->end_added,
1268                                     inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1269                         }
1270                         strm->last_mid_delivered = next_to_del;
1271                         if (done) {
1272                                 control = nctl;
1273                                 goto deliver_more;
1274                         }
1275                 }
1276         }
1277 out:
1278         return (ret);
1279 }
1280
1281
1282 uint32_t
1283 sctp_add_chk_to_control(struct sctp_queued_to_read *control,
1284     struct sctp_stream_in *strm,
1285     struct sctp_tcb *stcb, struct sctp_association *asoc,
1286     struct sctp_tmit_chunk *chk, int hold_rlock)
1287 {
1288         /*
1289          * Given a control and a chunk, merge the data from the chk onto the
1290          * control and free up the chunk resources.
1291          */
1292         uint32_t added = 0;
1293         int i_locked = 0;
1294
1295         if (control->on_read_q && (hold_rlock == 0)) {
1296                 /*
1297                  * Its being pd-api'd so we must do some locks.
1298                  */
1299                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
1300                 i_locked = 1;
1301         }
1302         if (control->data == NULL) {
1303                 control->data = chk->data;
1304                 sctp_setup_tail_pointer(control);
1305         } else {
1306                 sctp_add_to_tail_pointer(control, chk->data, &added);
1307         }
1308         control->fsn_included = chk->rec.data.fsn;
1309         asoc->size_on_reasm_queue -= chk->send_size;
1310         sctp_ucount_decr(asoc->cnt_on_reasm_queue);
1311         sctp_mark_non_revokable(asoc, chk->rec.data.tsn);
1312         chk->data = NULL;
1313         if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1314                 control->first_frag_seen = 1;
1315                 control->sinfo_tsn = chk->rec.data.tsn;
1316                 control->sinfo_ppid = chk->rec.data.ppid;
1317         }
1318         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1319                 /* Its complete */
1320                 if ((control->on_strm_q) && (control->on_read_q)) {
1321                         if (control->pdapi_started) {
1322                                 control->pdapi_started = 0;
1323                                 strm->pd_api_started = 0;
1324                         }
1325                         if (control->on_strm_q == SCTP_ON_UNORDERED) {
1326                                 /* Unordered */
1327                                 TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
1328                                 control->on_strm_q = 0;
1329                         } else if (control->on_strm_q == SCTP_ON_ORDERED) {
1330                                 /* Ordered */
1331                                 TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
1332                                 /*
1333                                  * Don't need to decrement
1334                                  * size_on_all_streams, since control is on
1335                                  * the read queue.
1336                                  */
1337                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
1338                                 control->on_strm_q = 0;
1339 #ifdef INVARIANTS
1340                         } else if (control->on_strm_q) {
1341                                 panic("Unknown state on ctrl: %p on_strm_q: %d", control,
1342                                     control->on_strm_q);
1343 #endif
1344                         }
1345                 }
1346                 control->end_added = 1;
1347                 control->last_frag_seen = 1;
1348         }
1349         if (i_locked) {
1350                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1351         }
1352         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
1353         return (added);
1354 }
1355
1356 /*
1357  * Dump onto the re-assembly queue, in its proper place. After dumping on the
1358  * queue, see if anthing can be delivered. If so pull it off (or as much as
1359  * we can. If we run out of space then we must dump what we can and set the
1360  * appropriate flag to say we queued what we could.
1361  */
1362 static void
1363 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
1364     struct sctp_queued_to_read *control,
1365     struct sctp_tmit_chunk *chk,
1366     int created_control,
1367     int *abort_flag, uint32_t tsn)
1368 {
1369         uint32_t next_fsn;
1370         struct sctp_tmit_chunk *at, *nat;
1371         struct sctp_stream_in *strm;
1372         int do_wakeup, unordered;
1373         uint32_t lenadded;
1374
1375         strm = &asoc->strmin[control->sinfo_stream];
1376         /*
1377          * For old un-ordered data chunks.
1378          */
1379         if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
1380                 unordered = 1;
1381         } else {
1382                 unordered = 0;
1383         }
1384         /* Must be added to the stream-in queue */
1385         if (created_control) {
1386                 if (unordered == 0) {
1387                         sctp_ucount_incr(asoc->cnt_on_all_streams);
1388                 }
1389                 if (sctp_place_control_in_stream(strm, asoc, control)) {
1390                         /* Duplicate SSN? */
1391                         sctp_abort_in_reasm(stcb, control, chk,
1392                             abort_flag,
1393                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_6);
1394                         sctp_clean_up_control(stcb, control);
1395                         return;
1396                 }
1397                 if ((tsn == (asoc->cumulative_tsn + 1) && (asoc->idata_supported == 0))) {
1398                         /*
1399                          * Ok we created this control and now lets validate
1400                          * that its legal i.e. there is a B bit set, if not
1401                          * and we have up to the cum-ack then its invalid.
1402                          */
1403                         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
1404                                 sctp_abort_in_reasm(stcb, control, chk,
1405                                     abort_flag,
1406                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_7);
1407                                 return;
1408                         }
1409                 }
1410         }
1411         if ((asoc->idata_supported == 0) && (unordered == 1)) {
1412                 sctp_inject_old_unordered_data(stcb, asoc, control, chk, abort_flag);
1413                 return;
1414         }
1415         /*
1416          * Ok we must queue the chunk into the reasembly portion: o if its
1417          * the first it goes to the control mbuf. o if its not first but the
1418          * next in sequence it goes to the control, and each succeeding one
1419          * in order also goes. o if its not in order we place it on the list
1420          * in its place.
1421          */
1422         if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1423                 /* Its the very first one. */
1424                 SCTPDBG(SCTP_DEBUG_XXX,
1425                     "chunk is a first fsn: %u becomes fsn_included\n",
1426                     chk->rec.data.fsn);
1427                 if (control->first_frag_seen) {
1428                         /*
1429                          * Error on senders part, they either sent us two
1430                          * data chunks with FIRST, or they sent two
1431                          * un-ordered chunks that were fragmented at the
1432                          * same time in the same stream.
1433                          */
1434                         sctp_abort_in_reasm(stcb, control, chk,
1435                             abort_flag,
1436                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_8);
1437                         return;
1438                 }
1439                 control->first_frag_seen = 1;
1440                 control->sinfo_ppid = chk->rec.data.ppid;
1441                 control->sinfo_tsn = chk->rec.data.tsn;
1442                 control->fsn_included = chk->rec.data.fsn;
1443                 control->data = chk->data;
1444                 sctp_mark_non_revokable(asoc, chk->rec.data.tsn);
1445                 chk->data = NULL;
1446                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
1447                 sctp_setup_tail_pointer(control);
1448                 asoc->size_on_all_streams += control->length;
1449         } else {
1450                 /* Place the chunk in our list */
1451                 int inserted = 0;
1452
1453                 if (control->last_frag_seen == 0) {
1454                         /* Still willing to raise highest FSN seen */
1455                         if (SCTP_TSN_GT(chk->rec.data.fsn, control->top_fsn)) {
1456                                 SCTPDBG(SCTP_DEBUG_XXX,
1457                                     "We have a new top_fsn: %u\n",
1458                                     chk->rec.data.fsn);
1459                                 control->top_fsn = chk->rec.data.fsn;
1460                         }
1461                         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1462                                 SCTPDBG(SCTP_DEBUG_XXX,
1463                                     "The last fsn is now in place fsn: %u\n",
1464                                     chk->rec.data.fsn);
1465                                 control->last_frag_seen = 1;
1466                         }
1467                         if (asoc->idata_supported || control->first_frag_seen) {
1468                                 /*
1469                                  * For IDATA we always check since we know
1470                                  * that the first fragment is 0. For old
1471                                  * DATA we have to receive the first before
1472                                  * we know the first FSN (which is the TSN).
1473                                  */
1474                                 if (SCTP_TSN_GE(control->fsn_included, chk->rec.data.fsn)) {
1475                                         /*
1476                                          * We have already delivered up to
1477                                          * this so its a dup
1478                                          */
1479                                         sctp_abort_in_reasm(stcb, control, chk,
1480                                             abort_flag,
1481                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
1482                                         return;
1483                                 }
1484                         }
1485                 } else {
1486                         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1487                                 /* Second last? huh? */
1488                                 SCTPDBG(SCTP_DEBUG_XXX,
1489                                     "Duplicate last fsn: %u (top: %u) -- abort\n",
1490                                     chk->rec.data.fsn, control->top_fsn);
1491                                 sctp_abort_in_reasm(stcb, control,
1492                                     chk, abort_flag,
1493                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
1494                                 return;
1495                         }
1496                         if (asoc->idata_supported || control->first_frag_seen) {
1497                                 /*
1498                                  * For IDATA we always check since we know
1499                                  * that the first fragment is 0. For old
1500                                  * DATA we have to receive the first before
1501                                  * we know the first FSN (which is the TSN).
1502                                  */
1503
1504                                 if (SCTP_TSN_GE(control->fsn_included, chk->rec.data.fsn)) {
1505                                         /*
1506                                          * We have already delivered up to
1507                                          * this so its a dup
1508                                          */
1509                                         SCTPDBG(SCTP_DEBUG_XXX,
1510                                             "New fsn: %u is already seen in included_fsn: %u -- abort\n",
1511                                             chk->rec.data.fsn, control->fsn_included);
1512                                         sctp_abort_in_reasm(stcb, control, chk,
1513                                             abort_flag,
1514                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
1515                                         return;
1516                                 }
1517                         }
1518                         /*
1519                          * validate not beyond top FSN if we have seen last
1520                          * one
1521                          */
1522                         if (SCTP_TSN_GT(chk->rec.data.fsn, control->top_fsn)) {
1523                                 SCTPDBG(SCTP_DEBUG_XXX,
1524                                     "New fsn: %u is beyond or at top_fsn: %u -- abort\n",
1525                                     chk->rec.data.fsn,
1526                                     control->top_fsn);
1527                                 sctp_abort_in_reasm(stcb, control, chk,
1528                                     abort_flag,
1529                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
1530                                 return;
1531                         }
1532                 }
1533                 /*
1534                  * If we reach here, we need to place the new chunk in the
1535                  * reassembly for this control.
1536                  */
1537                 SCTPDBG(SCTP_DEBUG_XXX,
1538                     "chunk is a not first fsn: %u needs to be inserted\n",
1539                     chk->rec.data.fsn);
1540                 TAILQ_FOREACH(at, &control->reasm, sctp_next) {
1541                         if (SCTP_TSN_GT(at->rec.data.fsn, chk->rec.data.fsn)) {
1542                                 /*
1543                                  * This one in queue is bigger than the new
1544                                  * one, insert the new one before at.
1545                                  */
1546                                 SCTPDBG(SCTP_DEBUG_XXX,
1547                                     "Insert it before fsn: %u\n",
1548                                     at->rec.data.fsn);
1549                                 asoc->size_on_reasm_queue += chk->send_size;
1550                                 sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1551                                 TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1552                                 inserted = 1;
1553                                 break;
1554                         } else if (at->rec.data.fsn == chk->rec.data.fsn) {
1555                                 /*
1556                                  * Gak, He sent me a duplicate str seq
1557                                  * number
1558                                  */
1559                                 /*
1560                                  * foo bar, I guess I will just free this
1561                                  * new guy, should we abort too? FIX ME
1562                                  * MAYBE? Or it COULD be that the SSN's have
1563                                  * wrapped. Maybe I should compare to TSN
1564                                  * somehow... sigh for now just blow away
1565                                  * the chunk!
1566                                  */
1567                                 SCTPDBG(SCTP_DEBUG_XXX,
1568                                     "Duplicate to fsn: %u -- abort\n",
1569                                     at->rec.data.fsn);
1570                                 sctp_abort_in_reasm(stcb, control,
1571                                     chk, abort_flag,
1572                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
1573                                 return;
1574                         }
1575                 }
1576                 if (inserted == 0) {
1577                         /* Goes on the end */
1578                         SCTPDBG(SCTP_DEBUG_XXX, "Inserting at tail of list fsn: %u\n",
1579                             chk->rec.data.fsn);
1580                         asoc->size_on_reasm_queue += chk->send_size;
1581                         sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1582                         TAILQ_INSERT_TAIL(&control->reasm, chk, sctp_next);
1583                 }
1584         }
1585         /*
1586          * Ok lets see if we can suck any up into the control structure that
1587          * are in seq if it makes sense.
1588          */
1589         do_wakeup = 0;
1590         /*
1591          * If the first fragment has not been seen there is no sense in
1592          * looking.
1593          */
1594         if (control->first_frag_seen) {
1595                 next_fsn = control->fsn_included + 1;
1596                 TAILQ_FOREACH_SAFE(at, &control->reasm, sctp_next, nat) {
1597                         if (at->rec.data.fsn == next_fsn) {
1598                                 /* We can add this one now to the control */
1599                                 SCTPDBG(SCTP_DEBUG_XXX,
1600                                     "Adding more to control: %p at: %p fsn: %u next_fsn: %u included: %u\n",
1601                                     control, at,
1602                                     at->rec.data.fsn,
1603                                     next_fsn, control->fsn_included);
1604                                 TAILQ_REMOVE(&control->reasm, at, sctp_next);
1605                                 lenadded = sctp_add_chk_to_control(control, strm, stcb, asoc, at, SCTP_READ_LOCK_NOT_HELD);
1606                                 if (control->on_read_q) {
1607                                         do_wakeup = 1;
1608                                 } else {
1609                                         /*
1610                                          * We only add to the
1611                                          * size-on-all-streams if its not on
1612                                          * the read q. The read q flag will
1613                                          * cause a sballoc so its accounted
1614                                          * for there.
1615                                          */
1616                                         asoc->size_on_all_streams += lenadded;
1617                                 }
1618                                 next_fsn++;
1619                                 if (control->end_added && control->pdapi_started) {
1620                                         if (strm->pd_api_started) {
1621                                                 strm->pd_api_started = 0;
1622                                                 control->pdapi_started = 0;
1623                                         }
1624                                         if (control->on_read_q == 0) {
1625                                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
1626                                                     control,
1627                                                     &stcb->sctp_socket->so_rcv, control->end_added,
1628                                                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
1629                                         }
1630                                         break;
1631                                 }
1632                         } else {
1633                                 break;
1634                         }
1635                 }
1636         }
1637         if (do_wakeup) {
1638                 /* Need to wakeup the reader */
1639                 sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1640         }
1641 }
1642
1643 static struct sctp_queued_to_read *
1644 sctp_find_reasm_entry(struct sctp_stream_in *strm, uint32_t mid, int ordered, int idata_supported)
1645 {
1646         struct sctp_queued_to_read *control;
1647
1648         if (ordered) {
1649                 TAILQ_FOREACH(control, &strm->inqueue, next_instrm) {
1650                         if (SCTP_MID_EQ(idata_supported, control->mid, mid)) {
1651                                 break;
1652                         }
1653                 }
1654         } else {
1655                 if (idata_supported) {
1656                         TAILQ_FOREACH(control, &strm->uno_inqueue, next_instrm) {
1657                                 if (SCTP_MID_EQ(idata_supported, control->mid, mid)) {
1658                                         break;
1659                                 }
1660                         }
1661                 } else {
1662                         control = TAILQ_FIRST(&strm->uno_inqueue);
1663                 }
1664         }
1665         return (control);
1666 }
1667
1668 static int
1669 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1670     struct mbuf **m, int offset, int chk_length,
1671     struct sctp_nets *net, uint32_t *high_tsn, int *abort_flag,
1672     int *break_flag, int last_chunk, uint8_t chk_type)
1673 {
1674         /* Process a data chunk */
1675         /* struct sctp_tmit_chunk *chk; */
1676         struct sctp_tmit_chunk *chk;
1677         uint32_t tsn, fsn, gap, mid;
1678         struct mbuf *dmbuf;
1679         int the_len;
1680         int need_reasm_check = 0;
1681         uint16_t sid;
1682         struct mbuf *op_err;
1683         char msg[SCTP_DIAG_INFO_LEN];
1684         struct sctp_queued_to_read *control, *ncontrol;
1685         uint32_t ppid;
1686         uint8_t chk_flags;
1687         struct sctp_stream_reset_list *liste;
1688         int ordered;
1689         size_t clen;
1690         int created_control = 0;
1691
1692         if (chk_type == SCTP_IDATA) {
1693                 struct sctp_idata_chunk *chunk, chunk_buf;
1694
1695                 chunk = (struct sctp_idata_chunk *)sctp_m_getptr(*m, offset,
1696                     sizeof(struct sctp_idata_chunk), (uint8_t *)&chunk_buf);
1697                 chk_flags = chunk->ch.chunk_flags;
1698                 clen = sizeof(struct sctp_idata_chunk);
1699                 tsn = ntohl(chunk->dp.tsn);
1700                 sid = ntohs(chunk->dp.sid);
1701                 mid = ntohl(chunk->dp.mid);
1702                 if (chk_flags & SCTP_DATA_FIRST_FRAG) {
1703                         fsn = 0;
1704                         ppid = chunk->dp.ppid_fsn.ppid;
1705                 } else {
1706                         fsn = ntohl(chunk->dp.ppid_fsn.fsn);
1707                         ppid = 0xffffffff;      /* Use as an invalid value. */
1708                 }
1709         } else {
1710                 struct sctp_data_chunk *chunk, chunk_buf;
1711
1712                 chunk = (struct sctp_data_chunk *)sctp_m_getptr(*m, offset,
1713                     sizeof(struct sctp_data_chunk), (uint8_t *)&chunk_buf);
1714                 chk_flags = chunk->ch.chunk_flags;
1715                 clen = sizeof(struct sctp_data_chunk);
1716                 tsn = ntohl(chunk->dp.tsn);
1717                 sid = ntohs(chunk->dp.sid);
1718                 mid = (uint32_t)(ntohs(chunk->dp.ssn));
1719                 fsn = tsn;
1720                 ppid = chunk->dp.ppid;
1721         }
1722         if ((size_t)chk_length == clen) {
1723                 /*
1724                  * Need to send an abort since we had a empty data chunk.
1725                  */
1726                 op_err = sctp_generate_no_user_data_cause(tsn);
1727                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_14;
1728                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1729                 *abort_flag = 1;
1730                 return (0);
1731         }
1732         if ((chk_flags & SCTP_DATA_SACK_IMMEDIATELY) == SCTP_DATA_SACK_IMMEDIATELY) {
1733                 asoc->send_sack = 1;
1734         }
1735         ordered = ((chk_flags & SCTP_DATA_UNORDERED) == 0);
1736         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
1737                 sctp_log_map(tsn, asoc->cumulative_tsn, asoc->highest_tsn_inside_map, SCTP_MAP_TSN_ENTERS);
1738         }
1739         if (stcb == NULL) {
1740                 return (0);
1741         }
1742         SCTP_LTRACE_CHK(stcb->sctp_ep, stcb, chk_type, tsn);
1743         if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
1744                 /* It is a duplicate */
1745                 SCTP_STAT_INCR(sctps_recvdupdata);
1746                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1747                         /* Record a dup for the next outbound sack */
1748                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1749                         asoc->numduptsns++;
1750                 }
1751                 asoc->send_sack = 1;
1752                 return (0);
1753         }
1754         /* Calculate the number of TSN's between the base and this TSN */
1755         SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
1756         if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1757                 /* Can't hold the bit in the mapping at max array, toss it */
1758                 return (0);
1759         }
1760         if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) {
1761                 SCTP_TCB_LOCK_ASSERT(stcb);
1762                 if (sctp_expand_mapping_array(asoc, gap)) {
1763                         /* Can't expand, drop it */
1764                         return (0);
1765                 }
1766         }
1767         if (SCTP_TSN_GT(tsn, *high_tsn)) {
1768                 *high_tsn = tsn;
1769         }
1770         /* See if we have received this one already */
1771         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap) ||
1772             SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, gap)) {
1773                 SCTP_STAT_INCR(sctps_recvdupdata);
1774                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1775                         /* Record a dup for the next outbound sack */
1776                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1777                         asoc->numduptsns++;
1778                 }
1779                 asoc->send_sack = 1;
1780                 return (0);
1781         }
1782         /*
1783          * Check to see about the GONE flag, duplicates would cause a sack
1784          * to be sent up above
1785          */
1786         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
1787             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
1788             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET))) {
1789                 /*
1790                  * wait a minute, this guy is gone, there is no longer a
1791                  * receiver. Send peer an ABORT!
1792                  */
1793                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
1794                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1795                 *abort_flag = 1;
1796                 return (0);
1797         }
1798         /*
1799          * Now before going further we see if there is room. If NOT then we
1800          * MAY let one through only IF this TSN is the one we are waiting
1801          * for on a partial delivery API.
1802          */
1803
1804         /* Is the stream valid? */
1805         if (sid >= asoc->streamincnt) {
1806                 struct sctp_error_invalid_stream *cause;
1807
1808                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_invalid_stream),
1809                     0, M_NOWAIT, 1, MT_DATA);
1810                 if (op_err != NULL) {
1811                         /* add some space up front so prepend will work well */
1812                         SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1813                         cause = mtod(op_err, struct sctp_error_invalid_stream *);
1814                         /*
1815                          * Error causes are just param's and this one has
1816                          * two back to back phdr, one with the error type
1817                          * and size, the other with the streamid and a rsvd
1818                          */
1819                         SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_invalid_stream);
1820                         cause->cause.code = htons(SCTP_CAUSE_INVALID_STREAM);
1821                         cause->cause.length = htons(sizeof(struct sctp_error_invalid_stream));
1822                         cause->stream_id = htons(sid);
1823                         cause->reserved = htons(0);
1824                         sctp_queue_op_err(stcb, op_err);
1825                 }
1826                 SCTP_STAT_INCR(sctps_badsid);
1827                 SCTP_TCB_LOCK_ASSERT(stcb);
1828                 SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
1829                 if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1830                         asoc->highest_tsn_inside_nr_map = tsn;
1831                 }
1832                 if (tsn == (asoc->cumulative_tsn + 1)) {
1833                         /* Update cum-ack */
1834                         asoc->cumulative_tsn = tsn;
1835                 }
1836                 return (0);
1837         }
1838         /*
1839          * If its a fragmented message, lets see if we can find the control
1840          * on the reassembly queues.
1841          */
1842         if ((chk_type == SCTP_IDATA) &&
1843             ((chk_flags & SCTP_DATA_FIRST_FRAG) == 0) &&
1844             (fsn == 0)) {
1845                 /*
1846                  * The first *must* be fsn 0, and other (middle/end) pieces
1847                  * can *not* be fsn 0. XXX: This can happen in case of a
1848                  * wrap around. Ignore is for now.
1849                  */
1850                 snprintf(msg, sizeof(msg), "FSN zero for MID=%8.8x, but flags=%2.2x",
1851                     mid, chk_flags);
1852                 goto err_out;
1853         }
1854         control = sctp_find_reasm_entry(&asoc->strmin[sid], mid, ordered, asoc->idata_supported);
1855         SCTPDBG(SCTP_DEBUG_XXX, "chunk_flags:0x%x look for control on queues %p\n",
1856             chk_flags, control);
1857         if ((chk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
1858                 /* See if we can find the re-assembly entity */
1859                 if (control != NULL) {
1860                         /* We found something, does it belong? */
1861                         if (ordered && (mid != control->mid)) {
1862                                 snprintf(msg, sizeof(msg), "Reassembly problem (MID=%8.8x)", mid);
1863                 err_out:
1864                                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1865                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_15;
1866                                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1867                                 *abort_flag = 1;
1868                                 return (0);
1869                         }
1870                         if (ordered && ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED)) {
1871                                 /*
1872                                  * We can't have a switched order with an
1873                                  * unordered chunk
1874                                  */
1875                                 snprintf(msg, sizeof(msg), "All fragments of a user message must be ordered or unordered (TSN=%8.8x)",
1876                                     tsn);
1877                                 goto err_out;
1878                         }
1879                         if (!ordered && (((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) == 0)) {
1880                                 /*
1881                                  * We can't have a switched unordered with a
1882                                  * ordered chunk
1883                                  */
1884                                 snprintf(msg, sizeof(msg), "All fragments of a user message must be ordered or unordered (TSN=%8.8x)",
1885                                     tsn);
1886                                 goto err_out;
1887                         }
1888                 }
1889         } else {
1890                 /*
1891                  * Its a complete segment. Lets validate we don't have a
1892                  * re-assembly going on with the same Stream/Seq (for
1893                  * ordered) or in the same Stream for unordered.
1894                  */
1895                 if (control != NULL) {
1896                         if (ordered || asoc->idata_supported) {
1897                                 SCTPDBG(SCTP_DEBUG_XXX, "chunk_flags: 0x%x dup detected on MID: %u\n",
1898                                     chk_flags, mid);
1899                                 snprintf(msg, sizeof(msg), "Duplicate MID=%8.8x detected.", mid);
1900                                 goto err_out;
1901                         } else {
1902                                 if ((tsn == control->fsn_included + 1) &&
1903                                     (control->end_added == 0)) {
1904                                         snprintf(msg, sizeof(msg), "Illegal message sequence, missing end for MID: %8.8x", control->fsn_included);
1905                                         goto err_out;
1906                                 } else {
1907                                         control = NULL;
1908                                 }
1909                         }
1910                 }
1911         }
1912         /* now do the tests */
1913         if (((asoc->cnt_on_all_streams +
1914             asoc->cnt_on_reasm_queue +
1915             asoc->cnt_msg_on_sb) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)) ||
1916             (((int)asoc->my_rwnd) <= 0)) {
1917                 /*
1918                  * When we have NO room in the rwnd we check to make sure
1919                  * the reader is doing its job...
1920                  */
1921                 if (stcb->sctp_socket->so_rcv.sb_cc) {
1922                         /* some to read, wake-up */
1923 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1924                         struct socket *so;
1925
1926                         so = SCTP_INP_SO(stcb->sctp_ep);
1927                         atomic_add_int(&stcb->asoc.refcnt, 1);
1928                         SCTP_TCB_UNLOCK(stcb);
1929                         SCTP_SOCKET_LOCK(so, 1);
1930                         SCTP_TCB_LOCK(stcb);
1931                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1932                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1933                                 /* assoc was freed while we were unlocked */
1934                                 SCTP_SOCKET_UNLOCK(so, 1);
1935                                 return (0);
1936                         }
1937 #endif
1938                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1939 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1940                         SCTP_SOCKET_UNLOCK(so, 1);
1941 #endif
1942                 }
1943                 /* now is it in the mapping array of what we have accepted? */
1944                 if (chk_type == SCTP_DATA) {
1945                         if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_map) &&
1946                             SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1947                                 /* Nope not in the valid range dump it */
1948                 dump_packet:
1949                                 sctp_set_rwnd(stcb, asoc);
1950                                 if ((asoc->cnt_on_all_streams +
1951                                     asoc->cnt_on_reasm_queue +
1952                                     asoc->cnt_msg_on_sb) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)) {
1953                                         SCTP_STAT_INCR(sctps_datadropchklmt);
1954                                 } else {
1955                                         SCTP_STAT_INCR(sctps_datadroprwnd);
1956                                 }
1957                                 *break_flag = 1;
1958                                 return (0);
1959                         }
1960                 } else {
1961                         if (control == NULL) {
1962                                 goto dump_packet;
1963                         }
1964                         if (SCTP_TSN_GT(fsn, control->top_fsn)) {
1965                                 goto dump_packet;
1966                         }
1967                 }
1968         }
1969 #ifdef SCTP_ASOCLOG_OF_TSNS
1970         SCTP_TCB_LOCK_ASSERT(stcb);
1971         if (asoc->tsn_in_at >= SCTP_TSN_LOG_SIZE) {
1972                 asoc->tsn_in_at = 0;
1973                 asoc->tsn_in_wrapped = 1;
1974         }
1975         asoc->in_tsnlog[asoc->tsn_in_at].tsn = tsn;
1976         asoc->in_tsnlog[asoc->tsn_in_at].strm = sid;
1977         asoc->in_tsnlog[asoc->tsn_in_at].seq = mid;
1978         asoc->in_tsnlog[asoc->tsn_in_at].sz = chk_length;
1979         asoc->in_tsnlog[asoc->tsn_in_at].flgs = chunk_flags;
1980         asoc->in_tsnlog[asoc->tsn_in_at].stcb = (void *)stcb;
1981         asoc->in_tsnlog[asoc->tsn_in_at].in_pos = asoc->tsn_in_at;
1982         asoc->in_tsnlog[asoc->tsn_in_at].in_out = 1;
1983         asoc->tsn_in_at++;
1984 #endif
1985         /*
1986          * Before we continue lets validate that we are not being fooled by
1987          * an evil attacker. We can only have Nk chunks based on our TSN
1988          * spread allowed by the mapping array N * 8 bits, so there is no
1989          * way our stream sequence numbers could have wrapped. We of course
1990          * only validate the FIRST fragment so the bit must be set.
1991          */
1992         if ((chk_flags & SCTP_DATA_FIRST_FRAG) &&
1993             (TAILQ_EMPTY(&asoc->resetHead)) &&
1994             (chk_flags & SCTP_DATA_UNORDERED) == 0 &&
1995             SCTP_MID_GE(asoc->idata_supported, asoc->strmin[sid].last_mid_delivered, mid)) {
1996                 /* The incoming sseq is behind where we last delivered? */
1997                 SCTPDBG(SCTP_DEBUG_INDATA1, "EVIL/Broken-Dup S-SEQ: %u delivered: %u from peer, Abort!\n",
1998                     mid, asoc->strmin[sid].last_mid_delivered);
1999
2000                 if (asoc->idata_supported) {
2001                         snprintf(msg, sizeof(msg), "Delivered MID=%8.8x, got TSN=%8.8x, SID=%4.4x, MID=%8.8x",
2002                             asoc->strmin[sid].last_mid_delivered,
2003                             tsn,
2004                             sid,
2005                             mid);
2006                 } else {
2007                         snprintf(msg, sizeof(msg), "Delivered SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
2008                             (uint16_t)asoc->strmin[sid].last_mid_delivered,
2009                             tsn,
2010                             sid,
2011                             (uint16_t)mid);
2012                 }
2013                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2014                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
2015                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
2016                 *abort_flag = 1;
2017                 return (0);
2018         }
2019         if (chk_type == SCTP_IDATA) {
2020                 the_len = (chk_length - sizeof(struct sctp_idata_chunk));
2021         } else {
2022                 the_len = (chk_length - sizeof(struct sctp_data_chunk));
2023         }
2024         if (last_chunk == 0) {
2025                 if (chk_type == SCTP_IDATA) {
2026                         dmbuf = SCTP_M_COPYM(*m,
2027                             (offset + sizeof(struct sctp_idata_chunk)),
2028                             the_len, M_NOWAIT);
2029                 } else {
2030                         dmbuf = SCTP_M_COPYM(*m,
2031                             (offset + sizeof(struct sctp_data_chunk)),
2032                             the_len, M_NOWAIT);
2033                 }
2034 #ifdef SCTP_MBUF_LOGGING
2035                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2036                         sctp_log_mbc(dmbuf, SCTP_MBUF_ICOPY);
2037                 }
2038 #endif
2039         } else {
2040                 /* We can steal the last chunk */
2041                 int l_len;
2042
2043                 dmbuf = *m;
2044                 /* lop off the top part */
2045                 if (chk_type == SCTP_IDATA) {
2046                         m_adj(dmbuf, (offset + sizeof(struct sctp_idata_chunk)));
2047                 } else {
2048                         m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
2049                 }
2050                 if (SCTP_BUF_NEXT(dmbuf) == NULL) {
2051                         l_len = SCTP_BUF_LEN(dmbuf);
2052                 } else {
2053                         /*
2054                          * need to count up the size hopefully does not hit
2055                          * this to often :-0
2056                          */
2057                         struct mbuf *lat;
2058
2059                         l_len = 0;
2060                         for (lat = dmbuf; lat; lat = SCTP_BUF_NEXT(lat)) {
2061                                 l_len += SCTP_BUF_LEN(lat);
2062                         }
2063                 }
2064                 if (l_len > the_len) {
2065                         /* Trim the end round bytes off  too */
2066                         m_adj(dmbuf, -(l_len - the_len));
2067                 }
2068         }
2069         if (dmbuf == NULL) {
2070                 SCTP_STAT_INCR(sctps_nomem);
2071                 return (0);
2072         }
2073         /*
2074          * Now no matter what, we need a control, get one if we don't have
2075          * one (we may have gotten it above when we found the message was
2076          * fragmented
2077          */
2078         if (control == NULL) {
2079                 sctp_alloc_a_readq(stcb, control);
2080                 sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
2081                     ppid,
2082                     sid,
2083                     chk_flags,
2084                     NULL, fsn, mid);
2085                 if (control == NULL) {
2086                         SCTP_STAT_INCR(sctps_nomem);
2087                         return (0);
2088                 }
2089                 if ((chk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
2090                         struct mbuf *mm;
2091
2092                         control->data = dmbuf;
2093                         for (mm = control->data; mm; mm = mm->m_next) {
2094                                 control->length += SCTP_BUF_LEN(mm);
2095                         }
2096                         control->tail_mbuf = NULL;
2097                         control->end_added = 1;
2098                         control->last_frag_seen = 1;
2099                         control->first_frag_seen = 1;
2100                         control->fsn_included = fsn;
2101                         control->top_fsn = fsn;
2102                 }
2103                 created_control = 1;
2104         }
2105         SCTPDBG(SCTP_DEBUG_XXX, "chunk_flags: 0x%x ordered: %d MID: %u control: %p\n",
2106             chk_flags, ordered, mid, control);
2107         if ((chk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
2108             TAILQ_EMPTY(&asoc->resetHead) &&
2109             ((ordered == 0) ||
2110             (SCTP_MID_EQ(asoc->idata_supported, asoc->strmin[sid].last_mid_delivered + 1, mid) &&
2111             TAILQ_EMPTY(&asoc->strmin[sid].inqueue)))) {
2112                 /* Candidate for express delivery */
2113                 /*
2114                  * Its not fragmented, No PD-API is up, Nothing in the
2115                  * delivery queue, Its un-ordered OR ordered and the next to
2116                  * deliver AND nothing else is stuck on the stream queue,
2117                  * And there is room for it in the socket buffer. Lets just
2118                  * stuff it up the buffer....
2119                  */
2120                 SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
2121                 if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
2122                         asoc->highest_tsn_inside_nr_map = tsn;
2123                 }
2124                 SCTPDBG(SCTP_DEBUG_XXX, "Injecting control: %p to be read (MID: %u)\n",
2125                     control, mid);
2126
2127                 sctp_add_to_readq(stcb->sctp_ep, stcb,
2128                     control, &stcb->sctp_socket->so_rcv,
2129                     1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
2130
2131                 if ((chk_flags & SCTP_DATA_UNORDERED) == 0) {
2132                         /* for ordered, bump what we delivered */
2133                         asoc->strmin[sid].last_mid_delivered++;
2134                 }
2135                 SCTP_STAT_INCR(sctps_recvexpress);
2136                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
2137                         sctp_log_strm_del_alt(stcb, tsn, mid, sid,
2138                             SCTP_STR_LOG_FROM_EXPRS_DEL);
2139                 }
2140                 control = NULL;
2141                 goto finish_express_del;
2142         }
2143         /* Now will we need a chunk too? */
2144         if ((chk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
2145                 sctp_alloc_a_chunk(stcb, chk);
2146                 if (chk == NULL) {
2147                         /* No memory so we drop the chunk */
2148                         SCTP_STAT_INCR(sctps_nomem);
2149                         if (last_chunk == 0) {
2150                                 /* we copied it, free the copy */
2151                                 sctp_m_freem(dmbuf);
2152                         }
2153                         return (0);
2154                 }
2155                 chk->rec.data.tsn = tsn;
2156                 chk->no_fr_allowed = 0;
2157                 chk->rec.data.fsn = fsn;
2158                 chk->rec.data.mid = mid;
2159                 chk->rec.data.sid = sid;
2160                 chk->rec.data.ppid = ppid;
2161                 chk->rec.data.context = stcb->asoc.context;
2162                 chk->rec.data.doing_fast_retransmit = 0;
2163                 chk->rec.data.rcv_flags = chk_flags;
2164                 chk->asoc = asoc;
2165                 chk->send_size = the_len;
2166                 chk->whoTo = net;
2167                 SCTPDBG(SCTP_DEBUG_XXX, "Building ck: %p for control: %p to be read (MID: %u)\n",
2168                     chk,
2169                     control, mid);
2170                 atomic_add_int(&net->ref_count, 1);
2171                 chk->data = dmbuf;
2172         }
2173         /* Set the appropriate TSN mark */
2174         if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
2175                 SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
2176                 if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
2177                         asoc->highest_tsn_inside_nr_map = tsn;
2178                 }
2179         } else {
2180                 SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
2181                 if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_map)) {
2182                         asoc->highest_tsn_inside_map = tsn;
2183                 }
2184         }
2185         /* Now is it complete (i.e. not fragmented)? */
2186         if ((chk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
2187                 /*
2188                  * Special check for when streams are resetting. We could be
2189                  * more smart about this and check the actual stream to see
2190                  * if it is not being reset.. that way we would not create a
2191                  * HOLB when amongst streams being reset and those not being
2192                  * reset.
2193                  *
2194                  */
2195                 if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2196                     SCTP_TSN_GT(tsn, liste->tsn)) {
2197                         /*
2198                          * yep its past where we need to reset... go ahead
2199                          * and queue it.
2200                          */
2201                         if (TAILQ_EMPTY(&asoc->pending_reply_queue)) {
2202                                 /* first one on */
2203                                 TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2204                         } else {
2205                                 struct sctp_queued_to_read *lcontrol, *nlcontrol;
2206                                 unsigned char inserted = 0;
2207
2208                                 TAILQ_FOREACH_SAFE(lcontrol, &asoc->pending_reply_queue, next, nlcontrol) {
2209                                         if (SCTP_TSN_GT(control->sinfo_tsn, lcontrol->sinfo_tsn)) {
2210
2211                                                 continue;
2212                                         } else {
2213                                                 /* found it */
2214                                                 TAILQ_INSERT_BEFORE(lcontrol, control, next);
2215                                                 inserted = 1;
2216                                                 break;
2217                                         }
2218                                 }
2219                                 if (inserted == 0) {
2220                                         /*
2221                                          * must be put at end, use prevP
2222                                          * (all setup from loop) to setup
2223                                          * nextP.
2224                                          */
2225                                         TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2226                                 }
2227                         }
2228                         goto finish_express_del;
2229                 }
2230                 if (chk_flags & SCTP_DATA_UNORDERED) {
2231                         /* queue directly into socket buffer */
2232                         SCTPDBG(SCTP_DEBUG_XXX, "Unordered data to be read control: %p MID: %u\n",
2233                             control, mid);
2234                         sctp_mark_non_revokable(asoc, control->sinfo_tsn);
2235                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2236                             control,
2237                             &stcb->sctp_socket->so_rcv, 1,
2238                             SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
2239
2240                 } else {
2241                         SCTPDBG(SCTP_DEBUG_XXX, "Queue control: %p for reordering MID: %u\n", control,
2242                             mid);
2243                         sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
2244                         if (*abort_flag) {
2245                                 if (last_chunk) {
2246                                         *m = NULL;
2247                                 }
2248                                 return (0);
2249                         }
2250                 }
2251                 goto finish_express_del;
2252         }
2253         /* If we reach here its a reassembly */
2254         need_reasm_check = 1;
2255         SCTPDBG(SCTP_DEBUG_XXX,
2256             "Queue data to stream for reasm control: %p MID: %u\n",
2257             control, mid);
2258         sctp_queue_data_for_reasm(stcb, asoc, control, chk, created_control, abort_flag, tsn);
2259         if (*abort_flag) {
2260                 /*
2261                  * the assoc is now gone and chk was put onto the reasm
2262                  * queue, which has all been freed.
2263                  */
2264                 if (last_chunk) {
2265                         *m = NULL;
2266                 }
2267                 return (0);
2268         }
2269 finish_express_del:
2270         /* Here we tidy up things */
2271         if (tsn == (asoc->cumulative_tsn + 1)) {
2272                 /* Update cum-ack */
2273                 asoc->cumulative_tsn = tsn;
2274         }
2275         if (last_chunk) {
2276                 *m = NULL;
2277         }
2278         if (ordered) {
2279                 SCTP_STAT_INCR_COUNTER64(sctps_inorderchunks);
2280         } else {
2281                 SCTP_STAT_INCR_COUNTER64(sctps_inunorderchunks);
2282         }
2283         SCTP_STAT_INCR(sctps_recvdata);
2284         /* Set it present please */
2285         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
2286                 sctp_log_strm_del_alt(stcb, tsn, mid, sid, SCTP_STR_LOG_FROM_MARK_TSN);
2287         }
2288         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2289                 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2290                     asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2291         }
2292         if (need_reasm_check) {
2293                 (void)sctp_deliver_reasm_check(stcb, asoc, &asoc->strmin[sid], SCTP_READ_LOCK_NOT_HELD);
2294                 need_reasm_check = 0;
2295         }
2296         /* check the special flag for stream resets */
2297         if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2298             SCTP_TSN_GE(asoc->cumulative_tsn, liste->tsn)) {
2299                 /*
2300                  * we have finished working through the backlogged TSN's now
2301                  * time to reset streams. 1: call reset function. 2: free
2302                  * pending_reply space 3: distribute any chunks in
2303                  * pending_reply_queue.
2304                  */
2305                 sctp_reset_in_stream(stcb, liste->number_entries, liste->list_of_streams);
2306                 TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
2307                 sctp_send_deferred_reset_response(stcb, liste, SCTP_STREAM_RESET_RESULT_PERFORMED);
2308                 SCTP_FREE(liste, SCTP_M_STRESET);
2309                 /* sa_ignore FREED_MEMORY */
2310                 liste = TAILQ_FIRST(&asoc->resetHead);
2311                 if (TAILQ_EMPTY(&asoc->resetHead)) {
2312                         /* All can be removed */
2313                         TAILQ_FOREACH_SAFE(control, &asoc->pending_reply_queue, next, ncontrol) {
2314                                 TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
2315                                 sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
2316                                 if (*abort_flag) {
2317                                         return (0);
2318                                 }
2319                                 if (need_reasm_check) {
2320                                         (void)sctp_deliver_reasm_check(stcb, asoc, &asoc->strmin[control->sinfo_stream], SCTP_READ_LOCK_NOT_HELD);
2321                                         need_reasm_check = 0;
2322                                 }
2323                         }
2324                 } else {
2325                         TAILQ_FOREACH_SAFE(control, &asoc->pending_reply_queue, next, ncontrol) {
2326                                 if (SCTP_TSN_GT(control->sinfo_tsn, liste->tsn)) {
2327                                         break;
2328                                 }
2329                                 /*
2330                                  * if control->sinfo_tsn is <= liste->tsn we
2331                                  * can process it which is the NOT of
2332                                  * control->sinfo_tsn > liste->tsn
2333                                  */
2334                                 TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
2335                                 sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
2336                                 if (*abort_flag) {
2337                                         return (0);
2338                                 }
2339                                 if (need_reasm_check) {
2340                                         (void)sctp_deliver_reasm_check(stcb, asoc, &asoc->strmin[control->sinfo_stream], SCTP_READ_LOCK_NOT_HELD);
2341                                         need_reasm_check = 0;
2342                                 }
2343                         }
2344                 }
2345         }
2346         return (1);
2347 }
2348
2349 static const int8_t sctp_map_lookup_tab[256] = {
2350         0, 1, 0, 2, 0, 1, 0, 3,
2351         0, 1, 0, 2, 0, 1, 0, 4,
2352         0, 1, 0, 2, 0, 1, 0, 3,
2353         0, 1, 0, 2, 0, 1, 0, 5,
2354         0, 1, 0, 2, 0, 1, 0, 3,
2355         0, 1, 0, 2, 0, 1, 0, 4,
2356         0, 1, 0, 2, 0, 1, 0, 3,
2357         0, 1, 0, 2, 0, 1, 0, 6,
2358         0, 1, 0, 2, 0, 1, 0, 3,
2359         0, 1, 0, 2, 0, 1, 0, 4,
2360         0, 1, 0, 2, 0, 1, 0, 3,
2361         0, 1, 0, 2, 0, 1, 0, 5,
2362         0, 1, 0, 2, 0, 1, 0, 3,
2363         0, 1, 0, 2, 0, 1, 0, 4,
2364         0, 1, 0, 2, 0, 1, 0, 3,
2365         0, 1, 0, 2, 0, 1, 0, 7,
2366         0, 1, 0, 2, 0, 1, 0, 3,
2367         0, 1, 0, 2, 0, 1, 0, 4,
2368         0, 1, 0, 2, 0, 1, 0, 3,
2369         0, 1, 0, 2, 0, 1, 0, 5,
2370         0, 1, 0, 2, 0, 1, 0, 3,
2371         0, 1, 0, 2, 0, 1, 0, 4,
2372         0, 1, 0, 2, 0, 1, 0, 3,
2373         0, 1, 0, 2, 0, 1, 0, 6,
2374         0, 1, 0, 2, 0, 1, 0, 3,
2375         0, 1, 0, 2, 0, 1, 0, 4,
2376         0, 1, 0, 2, 0, 1, 0, 3,
2377         0, 1, 0, 2, 0, 1, 0, 5,
2378         0, 1, 0, 2, 0, 1, 0, 3,
2379         0, 1, 0, 2, 0, 1, 0, 4,
2380         0, 1, 0, 2, 0, 1, 0, 3,
2381         0, 1, 0, 2, 0, 1, 0, 8
2382 };
2383
2384
2385 void
2386 sctp_slide_mapping_arrays(struct sctp_tcb *stcb)
2387 {
2388         /*
2389          * Now we also need to check the mapping array in a couple of ways.
2390          * 1) Did we move the cum-ack point?
2391          *
2392          * When you first glance at this you might think that all entries
2393          * that make up the position of the cum-ack would be in the
2394          * nr-mapping array only.. i.e. things up to the cum-ack are always
2395          * deliverable. Thats true with one exception, when its a fragmented
2396          * message we may not deliver the data until some threshold (or all
2397          * of it) is in place. So we must OR the nr_mapping_array and
2398          * mapping_array to get a true picture of the cum-ack.
2399          */
2400         struct sctp_association *asoc;
2401         int at;
2402         uint8_t val;
2403         int slide_from, slide_end, lgap, distance;
2404         uint32_t old_cumack, old_base, old_highest, highest_tsn;
2405
2406         asoc = &stcb->asoc;
2407
2408         old_cumack = asoc->cumulative_tsn;
2409         old_base = asoc->mapping_array_base_tsn;
2410         old_highest = asoc->highest_tsn_inside_map;
2411         /*
2412          * We could probably improve this a small bit by calculating the
2413          * offset of the current cum-ack as the starting point.
2414          */
2415         at = 0;
2416         for (slide_from = 0; slide_from < stcb->asoc.mapping_array_size; slide_from++) {
2417                 val = asoc->nr_mapping_array[slide_from] | asoc->mapping_array[slide_from];
2418                 if (val == 0xff) {
2419                         at += 8;
2420                 } else {
2421                         /* there is a 0 bit */
2422                         at += sctp_map_lookup_tab[val];
2423                         break;
2424                 }
2425         }
2426         asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - 1);
2427
2428         if (SCTP_TSN_GT(asoc->cumulative_tsn, asoc->highest_tsn_inside_map) &&
2429             SCTP_TSN_GT(asoc->cumulative_tsn, asoc->highest_tsn_inside_nr_map)) {
2430 #ifdef INVARIANTS
2431                 panic("huh, cumack 0x%x greater than high-tsn 0x%x in map",
2432                     asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
2433 #else
2434                 SCTP_PRINTF("huh, cumack 0x%x greater than high-tsn 0x%x in map - should panic?\n",
2435                     asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
2436                 sctp_print_mapping_array(asoc);
2437                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2438                         sctp_log_map(0, 6, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2439                 }
2440                 asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2441                 asoc->highest_tsn_inside_nr_map = asoc->cumulative_tsn;
2442 #endif
2443         }
2444         if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2445                 highest_tsn = asoc->highest_tsn_inside_nr_map;
2446         } else {
2447                 highest_tsn = asoc->highest_tsn_inside_map;
2448         }
2449         if ((asoc->cumulative_tsn == highest_tsn) && (at >= 8)) {
2450                 /* The complete array was completed by a single FR */
2451                 /* highest becomes the cum-ack */
2452                 int clr;
2453 #ifdef INVARIANTS
2454                 unsigned int i;
2455 #endif
2456
2457                 /* clear the array */
2458                 clr = ((at + 7) >> 3);
2459                 if (clr > asoc->mapping_array_size) {
2460                         clr = asoc->mapping_array_size;
2461                 }
2462                 memset(asoc->mapping_array, 0, clr);
2463                 memset(asoc->nr_mapping_array, 0, clr);
2464 #ifdef INVARIANTS
2465                 for (i = 0; i < asoc->mapping_array_size; i++) {
2466                         if ((asoc->mapping_array[i]) || (asoc->nr_mapping_array[i])) {
2467                                 SCTP_PRINTF("Error Mapping array's not clean at clear\n");
2468                                 sctp_print_mapping_array(asoc);
2469                         }
2470                 }
2471 #endif
2472                 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2473                 asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2474         } else if (at >= 8) {
2475                 /* we can slide the mapping array down */
2476                 /* slide_from holds where we hit the first NON 0xff byte */
2477
2478                 /*
2479                  * now calculate the ceiling of the move using our highest
2480                  * TSN value
2481                  */
2482                 SCTP_CALC_TSN_TO_GAP(lgap, highest_tsn, asoc->mapping_array_base_tsn);
2483                 slide_end = (lgap >> 3);
2484                 if (slide_end < slide_from) {
2485                         sctp_print_mapping_array(asoc);
2486 #ifdef INVARIANTS
2487                         panic("impossible slide");
2488 #else
2489                         SCTP_PRINTF("impossible slide lgap: %x slide_end: %x slide_from: %x? at: %d\n",
2490                             lgap, slide_end, slide_from, at);
2491                         return;
2492 #endif
2493                 }
2494                 if (slide_end > asoc->mapping_array_size) {
2495 #ifdef INVARIANTS
2496                         panic("would overrun buffer");
2497 #else
2498                         SCTP_PRINTF("Gak, would have overrun map end: %d slide_end: %d\n",
2499                             asoc->mapping_array_size, slide_end);
2500                         slide_end = asoc->mapping_array_size;
2501 #endif
2502                 }
2503                 distance = (slide_end - slide_from) + 1;
2504                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2505                         sctp_log_map(old_base, old_cumack, old_highest,
2506                             SCTP_MAP_PREPARE_SLIDE);
2507                         sctp_log_map((uint32_t)slide_from, (uint32_t)slide_end,
2508                             (uint32_t)lgap, SCTP_MAP_SLIDE_FROM);
2509                 }
2510                 if (distance + slide_from > asoc->mapping_array_size ||
2511                     distance < 0) {
2512                         /*
2513                          * Here we do NOT slide forward the array so that
2514                          * hopefully when more data comes in to fill it up
2515                          * we will be able to slide it forward. Really I
2516                          * don't think this should happen :-0
2517                          */
2518
2519                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2520                                 sctp_log_map((uint32_t)distance, (uint32_t)slide_from,
2521                                     (uint32_t)asoc->mapping_array_size,
2522                                     SCTP_MAP_SLIDE_NONE);
2523                         }
2524                 } else {
2525                         int ii;
2526
2527                         for (ii = 0; ii < distance; ii++) {
2528                                 asoc->mapping_array[ii] = asoc->mapping_array[slide_from + ii];
2529                                 asoc->nr_mapping_array[ii] = asoc->nr_mapping_array[slide_from + ii];
2530
2531                         }
2532                         for (ii = distance; ii < asoc->mapping_array_size; ii++) {
2533                                 asoc->mapping_array[ii] = 0;
2534                                 asoc->nr_mapping_array[ii] = 0;
2535                         }
2536                         if (asoc->highest_tsn_inside_map + 1 == asoc->mapping_array_base_tsn) {
2537                                 asoc->highest_tsn_inside_map += (slide_from << 3);
2538                         }
2539                         if (asoc->highest_tsn_inside_nr_map + 1 == asoc->mapping_array_base_tsn) {
2540                                 asoc->highest_tsn_inside_nr_map += (slide_from << 3);
2541                         }
2542                         asoc->mapping_array_base_tsn += (slide_from << 3);
2543                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2544                                 sctp_log_map(asoc->mapping_array_base_tsn,
2545                                     asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2546                                     SCTP_MAP_SLIDE_RESULT);
2547                         }
2548                 }
2549         }
2550 }
2551
2552 void
2553 sctp_sack_check(struct sctp_tcb *stcb, int was_a_gap)
2554 {
2555         struct sctp_association *asoc;
2556         uint32_t highest_tsn;
2557         int is_a_gap;
2558
2559         sctp_slide_mapping_arrays(stcb);
2560         asoc = &stcb->asoc;
2561         if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2562                 highest_tsn = asoc->highest_tsn_inside_nr_map;
2563         } else {
2564                 highest_tsn = asoc->highest_tsn_inside_map;
2565         }
2566         /* Is there a gap now? */
2567         is_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
2568
2569         /*
2570          * Now we need to see if we need to queue a sack or just start the
2571          * timer (if allowed).
2572          */
2573         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2574                 /*
2575                  * Ok special case, in SHUTDOWN-SENT case. here we maker
2576                  * sure SACK timer is off and instead send a SHUTDOWN and a
2577                  * SACK
2578                  */
2579                 if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2580                         sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2581                             stcb->sctp_ep, stcb, NULL,
2582                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_17);
2583                 }
2584                 sctp_send_shutdown(stcb,
2585                     ((stcb->asoc.alternate) ? stcb->asoc.alternate : stcb->asoc.primary_destination));
2586                 if (is_a_gap) {
2587                         sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
2588                 }
2589         } else {
2590                 /*
2591                  * CMT DAC algorithm: increase number of packets received
2592                  * since last ack
2593                  */
2594                 stcb->asoc.cmt_dac_pkts_rcvd++;
2595
2596                 if ((stcb->asoc.send_sack == 1) ||      /* We need to send a
2597                                                          * SACK */
2598                     ((was_a_gap) && (is_a_gap == 0)) || /* was a gap, but no
2599                                                          * longer is one */
2600                     (stcb->asoc.numduptsns) ||  /* we have dup's */
2601                     (is_a_gap) ||       /* is still a gap */
2602                     (stcb->asoc.delayed_ack == 0) ||    /* Delayed sack disabled */
2603                     (stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq) /* hit limit of pkts */
2604                     ) {
2605
2606                         if ((stcb->asoc.sctp_cmt_on_off > 0) &&
2607                             (SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) &&
2608                             (stcb->asoc.send_sack == 0) &&
2609                             (stcb->asoc.numduptsns == 0) &&
2610                             (stcb->asoc.delayed_ack) &&
2611                             (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer))) {
2612
2613                                 /*
2614                                  * CMT DAC algorithm: With CMT, delay acks
2615                                  * even in the face of
2616                                  *
2617                                  * reordering. Therefore, if acks that do
2618                                  * not have to be sent because of the above
2619                                  * reasons, will be delayed. That is, acks
2620                                  * that would have been sent due to gap
2621                                  * reports will be delayed with DAC. Start
2622                                  * the delayed ack timer.
2623                                  */
2624                                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2625                                     stcb->sctp_ep, stcb, NULL);
2626                         } else {
2627                                 /*
2628                                  * Ok we must build a SACK since the timer
2629                                  * is pending, we got our first packet OR
2630                                  * there are gaps or duplicates.
2631                                  */
2632                                 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
2633                                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
2634                         }
2635                 } else {
2636                         if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2637                                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2638                                     stcb->sctp_ep, stcb, NULL);
2639                         }
2640                 }
2641         }
2642 }
2643
2644 int
2645 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2646     struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2647     struct sctp_nets *net, uint32_t *high_tsn)
2648 {
2649         struct sctp_chunkhdr *ch, chunk_buf;
2650         struct sctp_association *asoc;
2651         int num_chunks = 0;     /* number of control chunks processed */
2652         int stop_proc = 0;
2653         int break_flag, last_chunk;
2654         int abort_flag = 0, was_a_gap;
2655         struct mbuf *m;
2656         uint32_t highest_tsn;
2657         uint16_t chk_length;
2658
2659         /* set the rwnd */
2660         sctp_set_rwnd(stcb, &stcb->asoc);
2661
2662         m = *mm;
2663         SCTP_TCB_LOCK_ASSERT(stcb);
2664         asoc = &stcb->asoc;
2665         if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2666                 highest_tsn = asoc->highest_tsn_inside_nr_map;
2667         } else {
2668                 highest_tsn = asoc->highest_tsn_inside_map;
2669         }
2670         was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
2671         /*
2672          * setup where we got the last DATA packet from for any SACK that
2673          * may need to go out. Don't bump the net. This is done ONLY when a
2674          * chunk is assigned.
2675          */
2676         asoc->last_data_chunk_from = net;
2677
2678         /*-
2679          * Now before we proceed we must figure out if this is a wasted
2680          * cluster... i.e. it is a small packet sent in and yet the driver
2681          * underneath allocated a full cluster for it. If so we must copy it
2682          * to a smaller mbuf and free up the cluster mbuf. This will help
2683          * with cluster starvation. Note for __Panda__ we don't do this
2684          * since it has clusters all the way down to 64 bytes.
2685          */
2686         if (SCTP_BUF_LEN(m) < (long)MLEN && SCTP_BUF_NEXT(m) == NULL) {
2687                 /* we only handle mbufs that are singletons.. not chains */
2688                 m = sctp_get_mbuf_for_msg(SCTP_BUF_LEN(m), 0, M_NOWAIT, 1, MT_DATA);
2689                 if (m) {
2690                         /* ok lets see if we can copy the data up */
2691                         caddr_t *from, *to;
2692
2693                         /* get the pointers and copy */
2694                         to = mtod(m, caddr_t *);
2695                         from = mtod((*mm), caddr_t *);
2696                         memcpy(to, from, SCTP_BUF_LEN((*mm)));
2697                         /* copy the length and free up the old */
2698                         SCTP_BUF_LEN(m) = SCTP_BUF_LEN((*mm));
2699                         sctp_m_freem(*mm);
2700                         /* success, back copy */
2701                         *mm = m;
2702                 } else {
2703                         /* We are in trouble in the mbuf world .. yikes */
2704                         m = *mm;
2705                 }
2706         }
2707         /* get pointer to the first chunk header */
2708         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
2709             sizeof(struct sctp_chunkhdr),
2710             (uint8_t *)&chunk_buf);
2711         if (ch == NULL) {
2712                 return (1);
2713         }
2714         /*
2715          * process all DATA chunks...
2716          */
2717         *high_tsn = asoc->cumulative_tsn;
2718         break_flag = 0;
2719         asoc->data_pkts_seen++;
2720         while (stop_proc == 0) {
2721                 /* validate chunk length */
2722                 chk_length = ntohs(ch->chunk_length);
2723                 if (length - *offset < chk_length) {
2724                         /* all done, mutulated chunk */
2725                         stop_proc = 1;
2726                         continue;
2727                 }
2728                 if ((asoc->idata_supported == 1) &&
2729                     (ch->chunk_type == SCTP_DATA)) {
2730                         struct mbuf *op_err;
2731                         char msg[SCTP_DIAG_INFO_LEN];
2732
2733                         snprintf(msg, sizeof(msg), "%s", "I-DATA chunk received when DATA was negotiated");
2734                         op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2735                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_18;
2736                         sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2737                         return (2);
2738                 }
2739                 if ((asoc->idata_supported == 0) &&
2740                     (ch->chunk_type == SCTP_IDATA)) {
2741                         struct mbuf *op_err;
2742                         char msg[SCTP_DIAG_INFO_LEN];
2743
2744                         snprintf(msg, sizeof(msg), "%s", "DATA chunk received when I-DATA was negotiated");
2745                         op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2746                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_19;
2747                         sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2748                         return (2);
2749                 }
2750                 if ((ch->chunk_type == SCTP_DATA) ||
2751                     (ch->chunk_type == SCTP_IDATA)) {
2752                         uint16_t clen;
2753
2754                         if (ch->chunk_type == SCTP_DATA) {
2755                                 clen = sizeof(struct sctp_data_chunk);
2756                         } else {
2757                                 clen = sizeof(struct sctp_idata_chunk);
2758                         }
2759                         if (chk_length < clen) {
2760                                 /*
2761                                  * Need to send an abort since we had a
2762                                  * invalid data chunk.
2763                                  */
2764                                 struct mbuf *op_err;
2765                                 char msg[SCTP_DIAG_INFO_LEN];
2766
2767                                 snprintf(msg, sizeof(msg), "%s chunk of length %u",
2768                                     ch->chunk_type == SCTP_DATA ? "DATA" : "I-DATA",
2769                                     chk_length);
2770                                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2771                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_20;
2772                                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2773                                 return (2);
2774                         }
2775 #ifdef SCTP_AUDITING_ENABLED
2776                         sctp_audit_log(0xB1, 0);
2777 #endif
2778                         if (SCTP_SIZE32(chk_length) == (length - *offset)) {
2779                                 last_chunk = 1;
2780                         } else {
2781                                 last_chunk = 0;
2782                         }
2783                         if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset,
2784                             chk_length, net, high_tsn, &abort_flag, &break_flag,
2785                             last_chunk, ch->chunk_type)) {
2786                                 num_chunks++;
2787                         }
2788                         if (abort_flag)
2789                                 return (2);
2790
2791                         if (break_flag) {
2792                                 /*
2793                                  * Set because of out of rwnd space and no
2794                                  * drop rep space left.
2795                                  */
2796                                 stop_proc = 1;
2797                                 continue;
2798                         }
2799                 } else {
2800                         /* not a data chunk in the data region */
2801                         switch (ch->chunk_type) {
2802                         case SCTP_INITIATION:
2803                         case SCTP_INITIATION_ACK:
2804                         case SCTP_SELECTIVE_ACK:
2805                         case SCTP_NR_SELECTIVE_ACK:
2806                         case SCTP_HEARTBEAT_REQUEST:
2807                         case SCTP_HEARTBEAT_ACK:
2808                         case SCTP_ABORT_ASSOCIATION:
2809                         case SCTP_SHUTDOWN:
2810                         case SCTP_SHUTDOWN_ACK:
2811                         case SCTP_OPERATION_ERROR:
2812                         case SCTP_COOKIE_ECHO:
2813                         case SCTP_COOKIE_ACK:
2814                         case SCTP_ECN_ECHO:
2815                         case SCTP_ECN_CWR:
2816                         case SCTP_SHUTDOWN_COMPLETE:
2817                         case SCTP_AUTHENTICATION:
2818                         case SCTP_ASCONF_ACK:
2819                         case SCTP_PACKET_DROPPED:
2820                         case SCTP_STREAM_RESET:
2821                         case SCTP_FORWARD_CUM_TSN:
2822                         case SCTP_ASCONF:
2823                                 {
2824                                         /*
2825                                          * Now, what do we do with KNOWN
2826                                          * chunks that are NOT in the right
2827                                          * place?
2828                                          *
2829                                          * For now, I do nothing but ignore
2830                                          * them. We may later want to add
2831                                          * sysctl stuff to switch out and do
2832                                          * either an ABORT() or possibly
2833                                          * process them.
2834                                          */
2835                                         struct mbuf *op_err;
2836                                         char msg[SCTP_DIAG_INFO_LEN];
2837
2838                                         snprintf(msg, sizeof(msg), "DATA chunk followed by chunk of type %2.2x",
2839                                             ch->chunk_type);
2840                                         op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2841                                         sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2842                                         return (2);
2843                                 }
2844                         default:
2845                                 /*
2846                                  * Unknown chunk type: use bit rules after
2847                                  * checking length
2848                                  */
2849                                 if (chk_length < sizeof(struct sctp_chunkhdr)) {
2850                                         /*
2851                                          * Need to send an abort since we
2852                                          * had a invalid chunk.
2853                                          */
2854                                         struct mbuf *op_err;
2855                                         char msg[SCTP_DIAG_INFO_LEN];
2856
2857                                         snprintf(msg, sizeof(msg), "Chunk of length %u",
2858                                             chk_length);
2859                                         op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2860                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_20;
2861                                         sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2862                                         return (2);
2863                                 }
2864                                 if (ch->chunk_type & 0x40) {
2865                                         /* Add a error report to the queue */
2866                                         struct mbuf *op_err;
2867                                         struct sctp_gen_error_cause *cause;
2868
2869                                         op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
2870                                             0, M_NOWAIT, 1, MT_DATA);
2871                                         if (op_err != NULL) {
2872                                                 cause = mtod(op_err, struct sctp_gen_error_cause *);
2873                                                 cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
2874                                                 cause->length = htons((uint16_t)(chk_length + sizeof(struct sctp_gen_error_cause)));
2875                                                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
2876                                                 SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, chk_length, M_NOWAIT);
2877                                                 if (SCTP_BUF_NEXT(op_err) != NULL) {
2878                                                         sctp_queue_op_err(stcb, op_err);
2879                                                 } else {
2880                                                         sctp_m_freem(op_err);
2881                                                 }
2882                                         }
2883                                 }
2884                                 if ((ch->chunk_type & 0x80) == 0) {
2885                                         /* discard the rest of this packet */
2886                                         stop_proc = 1;
2887                                 }       /* else skip this bad chunk and
2888                                          * continue... */
2889                                 break;
2890                         }       /* switch of chunk type */
2891                 }
2892                 *offset += SCTP_SIZE32(chk_length);
2893                 if ((*offset >= length) || stop_proc) {
2894                         /* no more data left in the mbuf chain */
2895                         stop_proc = 1;
2896                         continue;
2897                 }
2898                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
2899                     sizeof(struct sctp_chunkhdr),
2900                     (uint8_t *)&chunk_buf);
2901                 if (ch == NULL) {
2902                         *offset = length;
2903                         stop_proc = 1;
2904                         continue;
2905                 }
2906         }
2907         if (break_flag) {
2908                 /*
2909                  * we need to report rwnd overrun drops.
2910                  */
2911                 sctp_send_packet_dropped(stcb, net, *mm, length, iphlen, 0);
2912         }
2913         if (num_chunks) {
2914                 /*
2915                  * Did we get data, if so update the time for auto-close and
2916                  * give peer credit for being alive.
2917                  */
2918                 SCTP_STAT_INCR(sctps_recvpktwithdata);
2919                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
2920                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
2921                             stcb->asoc.overall_error_count,
2922                             0,
2923                             SCTP_FROM_SCTP_INDATA,
2924                             __LINE__);
2925                 }
2926                 stcb->asoc.overall_error_count = 0;
2927                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2928         }
2929         /* now service all of the reassm queue if needed */
2930         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2931                 /* Assure that we ack right away */
2932                 stcb->asoc.send_sack = 1;
2933         }
2934         /* Start a sack timer or QUEUE a SACK for sending */
2935         sctp_sack_check(stcb, was_a_gap);
2936         return (0);
2937 }
2938
2939 static int
2940 sctp_process_segment_range(struct sctp_tcb *stcb, struct sctp_tmit_chunk **p_tp1, uint32_t last_tsn,
2941     uint16_t frag_strt, uint16_t frag_end, int nr_sacking,
2942     int *num_frs,
2943     uint32_t *biggest_newly_acked_tsn,
2944     uint32_t *this_sack_lowest_newack,
2945     int *rto_ok)
2946 {
2947         struct sctp_tmit_chunk *tp1;
2948         unsigned int theTSN;
2949         int j, wake_him = 0, circled = 0;
2950
2951         /* Recover the tp1 we last saw */
2952         tp1 = *p_tp1;
2953         if (tp1 == NULL) {
2954                 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2955         }
2956         for (j = frag_strt; j <= frag_end; j++) {
2957                 theTSN = j + last_tsn;
2958                 while (tp1) {
2959                         if (tp1->rec.data.doing_fast_retransmit)
2960                                 (*num_frs) += 1;
2961
2962                         /*-
2963                          * CMT: CUCv2 algorithm. For each TSN being
2964                          * processed from the sent queue, track the
2965                          * next expected pseudo-cumack, or
2966                          * rtx_pseudo_cumack, if required. Separate
2967                          * cumack trackers for first transmissions,
2968                          * and retransmissions.
2969                          */
2970                         if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
2971                             (tp1->whoTo->find_pseudo_cumack == 1) &&
2972                             (tp1->snd_count == 1)) {
2973                                 tp1->whoTo->pseudo_cumack = tp1->rec.data.tsn;
2974                                 tp1->whoTo->find_pseudo_cumack = 0;
2975                         }
2976                         if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
2977                             (tp1->whoTo->find_rtx_pseudo_cumack == 1) &&
2978                             (tp1->snd_count > 1)) {
2979                                 tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.tsn;
2980                                 tp1->whoTo->find_rtx_pseudo_cumack = 0;
2981                         }
2982                         if (tp1->rec.data.tsn == theTSN) {
2983                                 if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2984                                         /*-
2985                                          * must be held until
2986                                          * cum-ack passes
2987                                          */
2988                                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
2989                                                 /*-
2990                                                  * If it is less than RESEND, it is
2991                                                  * now no-longer in flight.
2992                                                  * Higher values may already be set
2993                                                  * via previous Gap Ack Blocks...
2994                                                  * i.e. ACKED or RESEND.
2995                                                  */
2996                                                 if (SCTP_TSN_GT(tp1->rec.data.tsn,
2997                                                     *biggest_newly_acked_tsn)) {
2998                                                         *biggest_newly_acked_tsn = tp1->rec.data.tsn;
2999                                                 }
3000                                                 /*-
3001                                                  * CMT: SFR algo (and HTNA) - set
3002                                                  * saw_newack to 1 for dest being
3003                                                  * newly acked. update
3004                                                  * this_sack_highest_newack if
3005                                                  * appropriate.
3006                                                  */
3007                                                 if (tp1->rec.data.chunk_was_revoked == 0)
3008                                                         tp1->whoTo->saw_newack = 1;
3009
3010                                                 if (SCTP_TSN_GT(tp1->rec.data.tsn,
3011                                                     tp1->whoTo->this_sack_highest_newack)) {
3012                                                         tp1->whoTo->this_sack_highest_newack =
3013                                                             tp1->rec.data.tsn;
3014                                                 }
3015                                                 /*-
3016                                                  * CMT DAC algo: also update
3017                                                  * this_sack_lowest_newack
3018                                                  */
3019                                                 if (*this_sack_lowest_newack == 0) {
3020                                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3021                                                                 sctp_log_sack(*this_sack_lowest_newack,
3022                                                                     last_tsn,
3023                                                                     tp1->rec.data.tsn,
3024                                                                     0,
3025                                                                     0,
3026                                                                     SCTP_LOG_TSN_ACKED);
3027                                                         }
3028                                                         *this_sack_lowest_newack = tp1->rec.data.tsn;
3029                                                 }
3030                                                 /*-
3031                                                  * CMT: CUCv2 algorithm. If (rtx-)pseudo-cumack for corresp
3032                                                  * dest is being acked, then we have a new (rtx-)pseudo-cumack. Set
3033                                                  * new_(rtx_)pseudo_cumack to TRUE so that the cwnd for this dest can be
3034                                                  * updated. Also trigger search for the next expected (rtx-)pseudo-cumack.
3035                                                  * Separate pseudo_cumack trackers for first transmissions and
3036                                                  * retransmissions.
3037                                                  */
3038                                                 if (tp1->rec.data.tsn == tp1->whoTo->pseudo_cumack) {
3039                                                         if (tp1->rec.data.chunk_was_revoked == 0) {
3040                                                                 tp1->whoTo->new_pseudo_cumack = 1;
3041                                                         }
3042                                                         tp1->whoTo->find_pseudo_cumack = 1;
3043                                                 }
3044                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
3045                                                         sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.tsn, SCTP_CWND_LOG_FROM_SACK);
3046                                                 }
3047                                                 if (tp1->rec.data.tsn == tp1->whoTo->rtx_pseudo_cumack) {
3048                                                         if (tp1->rec.data.chunk_was_revoked == 0) {
3049                                                                 tp1->whoTo->new_pseudo_cumack = 1;
3050                                                         }
3051                                                         tp1->whoTo->find_rtx_pseudo_cumack = 1;
3052                                                 }
3053                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3054                                                         sctp_log_sack(*biggest_newly_acked_tsn,
3055                                                             last_tsn,
3056                                                             tp1->rec.data.tsn,
3057                                                             frag_strt,
3058                                                             frag_end,
3059                                                             SCTP_LOG_TSN_ACKED);
3060                                                 }
3061                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3062                                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_GAP,
3063                                                             tp1->whoTo->flight_size,
3064                                                             tp1->book_size,
3065                                                             (uint32_t)(uintptr_t)tp1->whoTo,
3066                                                             tp1->rec.data.tsn);
3067                                                 }
3068                                                 sctp_flight_size_decrease(tp1);
3069                                                 if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3070                                                         (*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3071                                                             tp1);
3072                                                 }
3073                                                 sctp_total_flight_decrease(stcb, tp1);
3074
3075                                                 tp1->whoTo->net_ack += tp1->send_size;
3076                                                 if (tp1->snd_count < 2) {
3077                                                         /*-
3078                                                          * True non-retransmited chunk
3079                                                          */
3080                                                         tp1->whoTo->net_ack2 += tp1->send_size;
3081
3082                                                         /*-
3083                                                          * update RTO too ?
3084                                                          */
3085                                                         if (tp1->do_rtt) {
3086                                                                 if (*rto_ok) {
3087                                                                         tp1->whoTo->RTO =
3088                                                                             sctp_calculate_rto(stcb,
3089                                                                             &stcb->asoc,
3090                                                                             tp1->whoTo,
3091                                                                             &tp1->sent_rcv_time,
3092                                                                             SCTP_RTT_FROM_DATA);
3093                                                                         *rto_ok = 0;
3094                                                                 }
3095                                                                 if (tp1->whoTo->rto_needed == 0) {
3096                                                                         tp1->whoTo->rto_needed = 1;
3097                                                                 }
3098                                                                 tp1->do_rtt = 0;
3099                                                         }
3100                                                 }
3101                                         }
3102                                         if (tp1->sent <= SCTP_DATAGRAM_RESEND) {
3103                                                 if (SCTP_TSN_GT(tp1->rec.data.tsn,
3104                                                     stcb->asoc.this_sack_highest_gap)) {
3105                                                         stcb->asoc.this_sack_highest_gap =
3106                                                             tp1->rec.data.tsn;
3107                                                 }
3108                                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3109                                                         sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt);
3110 #ifdef SCTP_AUDITING_ENABLED
3111                                                         sctp_audit_log(0xB2,
3112                                                             (stcb->asoc.sent_queue_retran_cnt & 0x000000ff));
3113 #endif
3114                                                 }
3115                                         }
3116                                         /*-
3117                                          * All chunks NOT UNSENT fall through here and are marked
3118                                          * (leave PR-SCTP ones that are to skip alone though)
3119                                          */
3120                                         if ((tp1->sent != SCTP_FORWARD_TSN_SKIP) &&
3121                                             (tp1->sent != SCTP_DATAGRAM_NR_ACKED)) {
3122                                                 tp1->sent = SCTP_DATAGRAM_MARKED;
3123                                         }
3124                                         if (tp1->rec.data.chunk_was_revoked) {
3125                                                 /* deflate the cwnd */
3126                                                 tp1->whoTo->cwnd -= tp1->book_size;
3127                                                 tp1->rec.data.chunk_was_revoked = 0;
3128                                         }
3129                                         /* NR Sack code here */
3130                                         if (nr_sacking &&
3131                                             (tp1->sent != SCTP_DATAGRAM_NR_ACKED)) {
3132                                                 if (stcb->asoc.strmout[tp1->rec.data.sid].chunks_on_queues > 0) {
3133                                                         stcb->asoc.strmout[tp1->rec.data.sid].chunks_on_queues--;
3134 #ifdef INVARIANTS
3135                                                 } else {
3136                                                         panic("No chunks on the queues for sid %u.", tp1->rec.data.sid);
3137 #endif
3138                                                 }
3139                                                 if ((stcb->asoc.strmout[tp1->rec.data.sid].chunks_on_queues == 0) &&
3140                                                     (stcb->asoc.strmout[tp1->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
3141                                                     TAILQ_EMPTY(&stcb->asoc.strmout[tp1->rec.data.sid].outqueue)) {
3142                                                         stcb->asoc.trigger_reset = 1;
3143                                                 }
3144                                                 tp1->sent = SCTP_DATAGRAM_NR_ACKED;
3145                                                 if (tp1->data) {
3146                                                         /*
3147                                                          * sa_ignore
3148                                                          * NO_NULL_CHK
3149                                                          */
3150                                                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
3151                                                         sctp_m_freem(tp1->data);
3152                                                         tp1->data = NULL;
3153                                                 }
3154                                                 wake_him++;
3155                                         }
3156                                 }
3157                                 break;
3158                         }       /* if (tp1->tsn == theTSN) */
3159                         if (SCTP_TSN_GT(tp1->rec.data.tsn, theTSN)) {
3160                                 break;
3161                         }
3162                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3163                         if ((tp1 == NULL) && (circled == 0)) {
3164                                 circled++;
3165                                 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
3166                         }
3167                 }               /* end while (tp1) */
3168                 if (tp1 == NULL) {
3169                         circled = 0;
3170                         tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
3171                 }
3172                 /* In case the fragments were not in order we must reset */
3173         }                       /* end for (j = fragStart */
3174         *p_tp1 = tp1;
3175         return (wake_him);      /* Return value only used for nr-sack */
3176 }
3177
3178
3179 static int
3180 sctp_handle_segments(struct mbuf *m, int *offset, struct sctp_tcb *stcb, struct sctp_association *asoc,
3181     uint32_t last_tsn, uint32_t *biggest_tsn_acked,
3182     uint32_t *biggest_newly_acked_tsn, uint32_t *this_sack_lowest_newack,
3183     int num_seg, int num_nr_seg, int *rto_ok)
3184 {
3185         struct sctp_gap_ack_block *frag, block;
3186         struct sctp_tmit_chunk *tp1;
3187         int i;
3188         int num_frs = 0;
3189         int chunk_freed;
3190         int non_revocable;
3191         uint16_t frag_strt, frag_end, prev_frag_end;
3192
3193         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3194         prev_frag_end = 0;
3195         chunk_freed = 0;
3196
3197         for (i = 0; i < (num_seg + num_nr_seg); i++) {
3198                 if (i == num_seg) {
3199                         prev_frag_end = 0;
3200                         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3201                 }
3202                 frag = (struct sctp_gap_ack_block *)sctp_m_getptr(m, *offset,
3203                     sizeof(struct sctp_gap_ack_block), (uint8_t *)&block);
3204                 *offset += sizeof(block);
3205                 if (frag == NULL) {
3206                         return (chunk_freed);
3207                 }
3208                 frag_strt = ntohs(frag->start);
3209                 frag_end = ntohs(frag->end);
3210
3211                 if (frag_strt > frag_end) {
3212                         /* This gap report is malformed, skip it. */
3213                         continue;
3214                 }
3215                 if (frag_strt <= prev_frag_end) {
3216                         /* This gap report is not in order, so restart. */
3217                         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3218                 }
3219                 if (SCTP_TSN_GT((last_tsn + frag_end), *biggest_tsn_acked)) {
3220                         *biggest_tsn_acked = last_tsn + frag_end;
3221                 }
3222                 if (i < num_seg) {
3223                         non_revocable = 0;
3224                 } else {
3225                         non_revocable = 1;
3226                 }
3227                 if (sctp_process_segment_range(stcb, &tp1, last_tsn, frag_strt, frag_end,
3228                     non_revocable, &num_frs, biggest_newly_acked_tsn,
3229                     this_sack_lowest_newack, rto_ok)) {
3230                         chunk_freed = 1;
3231                 }
3232                 prev_frag_end = frag_end;
3233         }
3234         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3235                 if (num_frs)
3236                         sctp_log_fr(*biggest_tsn_acked,
3237                             *biggest_newly_acked_tsn,
3238                             last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
3239         }
3240         return (chunk_freed);
3241 }
3242
3243 static void
3244 sctp_check_for_revoked(struct sctp_tcb *stcb,
3245     struct sctp_association *asoc, uint32_t cumack,
3246     uint32_t biggest_tsn_acked)
3247 {
3248         struct sctp_tmit_chunk *tp1;
3249
3250         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
3251                 if (SCTP_TSN_GT(tp1->rec.data.tsn, cumack)) {
3252                         /*
3253                          * ok this guy is either ACK or MARKED. If it is
3254                          * ACKED it has been previously acked but not this
3255                          * time i.e. revoked.  If it is MARKED it was ACK'ed
3256                          * again.
3257                          */
3258                         if (SCTP_TSN_GT(tp1->rec.data.tsn, biggest_tsn_acked)) {
3259                                 break;
3260                         }
3261                         if (tp1->sent == SCTP_DATAGRAM_ACKED) {
3262                                 /* it has been revoked */
3263                                 tp1->sent = SCTP_DATAGRAM_SENT;
3264                                 tp1->rec.data.chunk_was_revoked = 1;
3265                                 /*
3266                                  * We must add this stuff back in to assure
3267                                  * timers and such get started.
3268                                  */
3269                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3270                                         sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
3271                                             tp1->whoTo->flight_size,
3272                                             tp1->book_size,
3273                                             (uint32_t)(uintptr_t)tp1->whoTo,
3274                                             tp1->rec.data.tsn);
3275                                 }
3276                                 sctp_flight_size_increase(tp1);
3277                                 sctp_total_flight_increase(stcb, tp1);
3278                                 /*
3279                                  * We inflate the cwnd to compensate for our
3280                                  * artificial inflation of the flight_size.
3281                                  */
3282                                 tp1->whoTo->cwnd += tp1->book_size;
3283                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3284                                         sctp_log_sack(asoc->last_acked_seq,
3285                                             cumack,
3286                                             tp1->rec.data.tsn,
3287                                             0,
3288                                             0,
3289                                             SCTP_LOG_TSN_REVOKED);
3290                                 }
3291                         } else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
3292                                 /* it has been re-acked in this SACK */
3293                                 tp1->sent = SCTP_DATAGRAM_ACKED;
3294                         }
3295                 }
3296                 if (tp1->sent == SCTP_DATAGRAM_UNSENT)
3297                         break;
3298         }
3299 }
3300
3301
3302 static void
3303 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
3304     uint32_t biggest_tsn_acked, uint32_t biggest_tsn_newly_acked, uint32_t this_sack_lowest_newack, int accum_moved)
3305 {
3306         struct sctp_tmit_chunk *tp1;
3307         int strike_flag = 0;
3308         struct timeval now;
3309         int tot_retrans = 0;
3310         uint32_t sending_seq;
3311         struct sctp_nets *net;
3312         int num_dests_sacked = 0;
3313
3314         /*
3315          * select the sending_seq, this is either the next thing ready to be
3316          * sent but not transmitted, OR, the next seq we assign.
3317          */
3318         tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3319         if (tp1 == NULL) {
3320                 sending_seq = asoc->sending_seq;
3321         } else {
3322                 sending_seq = tp1->rec.data.tsn;
3323         }
3324
3325         /* CMT DAC algo: finding out if SACK is a mixed SACK */
3326         if ((asoc->sctp_cmt_on_off > 0) &&
3327             SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3328                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3329                         if (net->saw_newack)
3330                                 num_dests_sacked++;
3331                 }
3332         }
3333         if (stcb->asoc.prsctp_supported) {
3334                 (void)SCTP_GETTIME_TIMEVAL(&now);
3335         }
3336         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
3337                 strike_flag = 0;
3338                 if (tp1->no_fr_allowed) {
3339                         /* this one had a timeout or something */
3340                         continue;
3341                 }
3342                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3343                         if (tp1->sent < SCTP_DATAGRAM_RESEND)
3344                                 sctp_log_fr(biggest_tsn_newly_acked,
3345                                     tp1->rec.data.tsn,
3346                                     tp1->sent,
3347                                     SCTP_FR_LOG_CHECK_STRIKE);
3348                 }
3349                 if (SCTP_TSN_GT(tp1->rec.data.tsn, biggest_tsn_acked) ||
3350                     tp1->sent == SCTP_DATAGRAM_UNSENT) {
3351                         /* done */
3352                         break;
3353                 }
3354                 if (stcb->asoc.prsctp_supported) {
3355                         if ((PR_SCTP_TTL_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
3356                                 /* Is it expired? */
3357                                 if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3358                                         /* Yes so drop it */
3359                                         if (tp1->data != NULL) {
3360                                                 (void)sctp_release_pr_sctp_chunk(stcb, tp1, 1,
3361                                                     SCTP_SO_NOT_LOCKED);
3362                                         }
3363                                         continue;
3364                                 }
3365                         }
3366                 }
3367                 if (SCTP_TSN_GT(tp1->rec.data.tsn, asoc->this_sack_highest_gap) &&
3368                     !(accum_moved && asoc->fast_retran_loss_recovery)) {
3369                         /* we are beyond the tsn in the sack  */
3370                         break;
3371                 }
3372                 if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3373                         /* either a RESEND, ACKED, or MARKED */
3374                         /* skip */
3375                         if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3376                                 /* Continue strikin FWD-TSN chunks */
3377                                 tp1->rec.data.fwd_tsn_cnt++;
3378                         }
3379                         continue;
3380                 }
3381                 /*
3382                  * CMT : SFR algo (covers part of DAC and HTNA as well)
3383                  */
3384                 if (tp1->whoTo && tp1->whoTo->saw_newack == 0) {
3385                         /*
3386                          * No new acks were receieved for data sent to this
3387                          * dest. Therefore, according to the SFR algo for
3388                          * CMT, no data sent to this dest can be marked for
3389                          * FR using this SACK.
3390                          */
3391                         continue;
3392                 } else if (tp1->whoTo &&
3393                             SCTP_TSN_GT(tp1->rec.data.tsn,
3394                             tp1->whoTo->this_sack_highest_newack) &&
3395                     !(accum_moved && asoc->fast_retran_loss_recovery)) {
3396                         /*
3397                          * CMT: New acks were receieved for data sent to
3398                          * this dest. But no new acks were seen for data
3399                          * sent after tp1. Therefore, according to the SFR
3400                          * algo for CMT, tp1 cannot be marked for FR using
3401                          * this SACK. This step covers part of the DAC algo
3402                          * and the HTNA algo as well.
3403                          */
3404                         continue;
3405                 }
3406                 /*
3407                  * Here we check to see if we were have already done a FR
3408                  * and if so we see if the biggest TSN we saw in the sack is
3409                  * smaller than the recovery point. If so we don't strike
3410                  * the tsn... otherwise we CAN strike the TSN.
3411                  */
3412                 /*
3413                  * @@@ JRI: Check for CMT if (accum_moved &&
3414                  * asoc->fast_retran_loss_recovery && (sctp_cmt_on_off ==
3415                  * 0)) {
3416                  */
3417                 if (accum_moved && asoc->fast_retran_loss_recovery) {
3418                         /*
3419                          * Strike the TSN if in fast-recovery and cum-ack
3420                          * moved.
3421                          */
3422                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3423                                 sctp_log_fr(biggest_tsn_newly_acked,
3424                                     tp1->rec.data.tsn,
3425                                     tp1->sent,
3426                                     SCTP_FR_LOG_STRIKE_CHUNK);
3427                         }
3428                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3429                                 tp1->sent++;
3430                         }
3431                         if ((asoc->sctp_cmt_on_off > 0) &&
3432                             SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3433                                 /*
3434                                  * CMT DAC algorithm: If SACK flag is set to
3435                                  * 0, then lowest_newack test will not pass
3436                                  * because it would have been set to the
3437                                  * cumack earlier. If not already to be
3438                                  * rtx'd, If not a mixed sack and if tp1 is
3439                                  * not between two sacked TSNs, then mark by
3440                                  * one more. NOTE that we are marking by one
3441                                  * additional time since the SACK DAC flag
3442                                  * indicates that two packets have been
3443                                  * received after this missing TSN.
3444                                  */
3445                                 if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3446                                     SCTP_TSN_GT(this_sack_lowest_newack, tp1->rec.data.tsn)) {
3447                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3448                                                 sctp_log_fr(16 + num_dests_sacked,
3449                                                     tp1->rec.data.tsn,
3450                                                     tp1->sent,
3451                                                     SCTP_FR_LOG_STRIKE_CHUNK);
3452                                         }
3453                                         tp1->sent++;
3454                                 }
3455                         }
3456                 } else if ((tp1->rec.data.doing_fast_retransmit) &&
3457                     (asoc->sctp_cmt_on_off == 0)) {
3458                         /*
3459                          * For those that have done a FR we must take
3460                          * special consideration if we strike. I.e the
3461                          * biggest_newly_acked must be higher than the
3462                          * sending_seq at the time we did the FR.
3463                          */
3464                         if (
3465 #ifdef SCTP_FR_TO_ALTERNATE
3466                         /*
3467                          * If FR's go to new networks, then we must only do
3468                          * this for singly homed asoc's. However if the FR's
3469                          * go to the same network (Armando's work) then its
3470                          * ok to FR multiple times.
3471                          */
3472                             (asoc->numnets < 2)
3473 #else
3474                             (1)
3475 #endif
3476                             ) {
3477
3478                                 if (SCTP_TSN_GE(biggest_tsn_newly_acked,
3479                                     tp1->rec.data.fast_retran_tsn)) {
3480                                         /*
3481                                          * Strike the TSN, since this ack is
3482                                          * beyond where things were when we
3483                                          * did a FR.
3484                                          */
3485                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3486                                                 sctp_log_fr(biggest_tsn_newly_acked,
3487                                                     tp1->rec.data.tsn,
3488                                                     tp1->sent,
3489                                                     SCTP_FR_LOG_STRIKE_CHUNK);
3490                                         }
3491                                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3492                                                 tp1->sent++;
3493                                         }
3494                                         strike_flag = 1;
3495                                         if ((asoc->sctp_cmt_on_off > 0) &&
3496                                             SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3497                                                 /*
3498                                                  * CMT DAC algorithm: If
3499                                                  * SACK flag is set to 0,
3500                                                  * then lowest_newack test
3501                                                  * will not pass because it
3502                                                  * would have been set to
3503                                                  * the cumack earlier. If
3504                                                  * not already to be rtx'd,
3505                                                  * If not a mixed sack and
3506                                                  * if tp1 is not between two
3507                                                  * sacked TSNs, then mark by
3508                                                  * one more. NOTE that we
3509                                                  * are marking by one
3510                                                  * additional time since the
3511                                                  * SACK DAC flag indicates
3512                                                  * that two packets have
3513                                                  * been received after this
3514                                                  * missing TSN.
3515                                                  */
3516                                                 if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
3517                                                     (num_dests_sacked == 1) &&
3518                                                     SCTP_TSN_GT(this_sack_lowest_newack,
3519                                                     tp1->rec.data.tsn)) {
3520                                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3521                                                                 sctp_log_fr(32 + num_dests_sacked,
3522                                                                     tp1->rec.data.tsn,
3523                                                                     tp1->sent,
3524                                                                     SCTP_FR_LOG_STRIKE_CHUNK);
3525                                                         }
3526                                                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3527                                                                 tp1->sent++;
3528                                                         }
3529                                                 }
3530                                         }
3531                                 }
3532                         }
3533                         /*
3534                          * JRI: TODO: remove code for HTNA algo. CMT's SFR
3535                          * algo covers HTNA.
3536                          */
3537                 } else if (SCTP_TSN_GT(tp1->rec.data.tsn,
3538                     biggest_tsn_newly_acked)) {
3539                         /*
3540                          * We don't strike these: This is the  HTNA
3541                          * algorithm i.e. we don't strike If our TSN is
3542                          * larger than the Highest TSN Newly Acked.
3543                          */
3544                         ;
3545                 } else {
3546                         /* Strike the TSN */
3547                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3548                                 sctp_log_fr(biggest_tsn_newly_acked,
3549                                     tp1->rec.data.tsn,
3550                                     tp1->sent,
3551                                     SCTP_FR_LOG_STRIKE_CHUNK);
3552                         }
3553                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3554                                 tp1->sent++;
3555                         }
3556                         if ((asoc->sctp_cmt_on_off > 0) &&
3557                             SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3558                                 /*
3559                                  * CMT DAC algorithm: If SACK flag is set to
3560                                  * 0, then lowest_newack test will not pass
3561                                  * because it would have been set to the
3562                                  * cumack earlier. If not already to be
3563                                  * rtx'd, If not a mixed sack and if tp1 is
3564                                  * not between two sacked TSNs, then mark by
3565                                  * one more. NOTE that we are marking by one
3566                                  * additional time since the SACK DAC flag
3567                                  * indicates that two packets have been
3568                                  * received after this missing TSN.
3569                                  */
3570                                 if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3571                                     SCTP_TSN_GT(this_sack_lowest_newack, tp1->rec.data.tsn)) {
3572                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3573                                                 sctp_log_fr(48 + num_dests_sacked,
3574                                                     tp1->rec.data.tsn,
3575                                                     tp1->sent,
3576                                                     SCTP_FR_LOG_STRIKE_CHUNK);
3577                                         }
3578                                         tp1->sent++;
3579                                 }
3580                         }
3581                 }
3582                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3583                         struct sctp_nets *alt;
3584
3585                         /* fix counts and things */
3586                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3587                                 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND,
3588                                     (tp1->whoTo ? (tp1->whoTo->flight_size) : 0),
3589                                     tp1->book_size,
3590                                     (uint32_t)(uintptr_t)tp1->whoTo,
3591                                     tp1->rec.data.tsn);
3592                         }
3593                         if (tp1->whoTo) {
3594                                 tp1->whoTo->net_ack++;
3595                                 sctp_flight_size_decrease(tp1);
3596                                 if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3597                                         (*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3598                                             tp1);
3599                                 }
3600                         }
3601                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
3602                                 sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3603                                     asoc->peers_rwnd, tp1->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
3604                         }
3605                         /* add back to the rwnd */
3606                         asoc->peers_rwnd += (tp1->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
3607
3608                         /* remove from the total flight */
3609                         sctp_total_flight_decrease(stcb, tp1);
3610
3611                         if ((stcb->asoc.prsctp_supported) &&
3612                             (PR_SCTP_RTX_ENABLED(tp1->flags))) {
3613                                 /*
3614                                  * Has it been retransmitted tv_sec times? -
3615                                  * we store the retran count there.
3616                                  */
3617                                 if (tp1->snd_count > tp1->rec.data.timetodrop.tv_sec) {
3618                                         /* Yes, so drop it */
3619                                         if (tp1->data != NULL) {
3620                                                 (void)sctp_release_pr_sctp_chunk(stcb, tp1, 1,
3621                                                     SCTP_SO_NOT_LOCKED);
3622                                         }
3623                                         /* Make sure to flag we had a FR */
3624                                         tp1->whoTo->net_ack++;
3625                                         continue;
3626                                 }
3627                         }
3628                         /*
3629                          * SCTP_PRINTF("OK, we are now ready to FR this
3630                          * guy\n");
3631                          */
3632                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3633                                 sctp_log_fr(tp1->rec.data.tsn, tp1->snd_count,
3634                                     0, SCTP_FR_MARKED);
3635                         }
3636                         if (strike_flag) {
3637                                 /* This is a subsequent FR */
3638                                 SCTP_STAT_INCR(sctps_sendmultfastretrans);
3639                         }
3640                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3641                         if (asoc->sctp_cmt_on_off > 0) {
3642                                 /*
3643                                  * CMT: Using RTX_SSTHRESH policy for CMT.
3644                                  * If CMT is being used, then pick dest with
3645                                  * largest ssthresh for any retransmission.
3646                                  */
3647                                 tp1->no_fr_allowed = 1;
3648                                 alt = tp1->whoTo;
3649                                 /* sa_ignore NO_NULL_CHK */
3650                                 if (asoc->sctp_cmt_pf > 0) {
3651                                         /*
3652                                          * JRS 5/18/07 - If CMT PF is on,
3653                                          * use the PF version of
3654                                          * find_alt_net()
3655                                          */
3656                                         alt = sctp_find_alternate_net(stcb, alt, 2);
3657                                 } else {
3658                                         /*
3659                                          * JRS 5/18/07 - If only CMT is on,
3660                                          * use the CMT version of
3661                                          * find_alt_net()
3662                                          */
3663                                         /* sa_ignore NO_NULL_CHK */
3664                                         alt = sctp_find_alternate_net(stcb, alt, 1);
3665                                 }
3666                                 if (alt == NULL) {
3667                                         alt = tp1->whoTo;
3668                                 }
3669                                 /*
3670                                  * CUCv2: If a different dest is picked for
3671                                  * the retransmission, then new
3672                                  * (rtx-)pseudo_cumack needs to be tracked
3673                                  * for orig dest. Let CUCv2 track new (rtx-)
3674                                  * pseudo-cumack always.
3675                                  */
3676                                 if (tp1->whoTo) {
3677                                         tp1->whoTo->find_pseudo_cumack = 1;
3678                                         tp1->whoTo->find_rtx_pseudo_cumack = 1;
3679                                 }
3680                         } else {        /* CMT is OFF */
3681
3682 #ifdef SCTP_FR_TO_ALTERNATE
3683                                 /* Can we find an alternate? */
3684                                 alt = sctp_find_alternate_net(stcb, tp1->whoTo, 0);
3685 #else
3686                                 /*
3687                                  * default behavior is to NOT retransmit
3688                                  * FR's to an alternate. Armando Caro's
3689                                  * paper details why.
3690                                  */
3691                                 alt = tp1->whoTo;
3692 #endif
3693                         }
3694
3695                         tp1->rec.data.doing_fast_retransmit = 1;
3696                         tot_retrans++;
3697                         /* mark the sending seq for possible subsequent FR's */
3698                         /*
3699                          * SCTP_PRINTF("Marking TSN for FR new value %x\n",
3700                          * (uint32_t)tpi->rec.data.tsn);
3701                          */
3702                         if (TAILQ_EMPTY(&asoc->send_queue)) {
3703                                 /*
3704                                  * If the queue of send is empty then its
3705                                  * the next sequence number that will be
3706                                  * assigned so we subtract one from this to
3707                                  * get the one we last sent.
3708                                  */
3709                                 tp1->rec.data.fast_retran_tsn = sending_seq;
3710                         } else {
3711                                 /*
3712                                  * If there are chunks on the send queue
3713                                  * (unsent data that has made it from the
3714                                  * stream queues but not out the door, we
3715                                  * take the first one (which will have the
3716                                  * lowest TSN) and subtract one to get the
3717                                  * one we last sent.
3718                                  */
3719                                 struct sctp_tmit_chunk *ttt;
3720
3721                                 ttt = TAILQ_FIRST(&asoc->send_queue);
3722                                 tp1->rec.data.fast_retran_tsn =
3723                                     ttt->rec.data.tsn;
3724                         }
3725
3726                         if (tp1->do_rtt) {
3727                                 /*
3728                                  * this guy had a RTO calculation pending on
3729                                  * it, cancel it
3730                                  */
3731                                 if ((tp1->whoTo != NULL) &&
3732                                     (tp1->whoTo->rto_needed == 0)) {
3733                                         tp1->whoTo->rto_needed = 1;
3734                                 }
3735                                 tp1->do_rtt = 0;
3736                         }
3737                         if (alt != tp1->whoTo) {
3738                                 /* yes, there is an alternate. */
3739                                 sctp_free_remote_addr(tp1->whoTo);
3740                                 /* sa_ignore FREED_MEMORY */
3741                                 tp1->whoTo = alt;
3742                                 atomic_add_int(&alt->ref_count, 1);
3743                         }
3744                 }
3745         }
3746 }
3747
3748 struct sctp_tmit_chunk *
3749 sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3750     struct sctp_association *asoc)
3751 {
3752         struct sctp_tmit_chunk *tp1, *tp2, *a_adv = NULL;
3753         struct timeval now;
3754         int now_filled = 0;
3755
3756         if (asoc->prsctp_supported == 0) {
3757                 return (NULL);
3758         }
3759         TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
3760                 if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3761                     tp1->sent != SCTP_DATAGRAM_RESEND &&
3762                     tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
3763                         /* no chance to advance, out of here */
3764                         break;
3765                 }
3766                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) {
3767                         if ((tp1->sent == SCTP_FORWARD_TSN_SKIP) ||
3768                             (tp1->sent == SCTP_DATAGRAM_NR_ACKED)) {
3769                                 sctp_misc_ints(SCTP_FWD_TSN_CHECK,
3770                                     asoc->advanced_peer_ack_point,
3771                                     tp1->rec.data.tsn, 0, 0);
3772                         }
3773                 }
3774                 if (!PR_SCTP_ENABLED(tp1->flags)) {
3775                         /*
3776                          * We can't fwd-tsn past any that are reliable aka
3777                          * retransmitted until the asoc fails.
3778                          */
3779                         break;
3780                 }
3781                 if (!now_filled) {
3782                         (void)SCTP_GETTIME_TIMEVAL(&now);
3783                         now_filled = 1;
3784                 }
3785                 /*
3786                  * now we got a chunk which is marked for another
3787                  * retransmission to a PR-stream but has run out its chances
3788                  * already maybe OR has been marked to skip now. Can we skip
3789                  * it if its a resend?
3790                  */
3791                 if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3792                     (PR_SCTP_TTL_ENABLED(tp1->flags))) {
3793                         /*
3794                          * Now is this one marked for resend and its time is
3795                          * now up?
3796                          */
3797                         if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3798                                 /* Yes so drop it */
3799                                 if (tp1->data) {
3800                                         (void)sctp_release_pr_sctp_chunk(stcb, tp1,
3801                                             1, SCTP_SO_NOT_LOCKED);
3802                                 }
3803                         } else {
3804                                 /*
3805                                  * No, we are done when hit one for resend
3806                                  * whos time as not expired.
3807                                  */
3808                                 break;
3809                         }
3810                 }
3811                 /*
3812                  * Ok now if this chunk is marked to drop it we can clean up
3813                  * the chunk, advance our peer ack point and we can check
3814                  * the next chunk.
3815                  */
3816                 if ((tp1->sent == SCTP_FORWARD_TSN_SKIP) ||
3817                     (tp1->sent == SCTP_DATAGRAM_NR_ACKED)) {
3818                         /* advance PeerAckPoint goes forward */
3819                         if (SCTP_TSN_GT(tp1->rec.data.tsn, asoc->advanced_peer_ack_point)) {
3820                                 asoc->advanced_peer_ack_point = tp1->rec.data.tsn;
3821                                 a_adv = tp1;
3822                         } else if (tp1->rec.data.tsn == asoc->advanced_peer_ack_point) {
3823                                 /* No update but we do save the chk */
3824                                 a_adv = tp1;
3825                         }
3826                 } else {
3827                         /*
3828                          * If it is still in RESEND we can advance no
3829                          * further
3830                          */
3831                         break;
3832                 }
3833         }
3834         return (a_adv);
3835 }
3836
3837 static int
3838 sctp_fs_audit(struct sctp_association *asoc)
3839 {
3840         struct sctp_tmit_chunk *chk;
3841         int inflight = 0, resend = 0, inbetween = 0, acked = 0, above = 0;
3842         int ret;
3843 #ifndef INVARIANTS
3844         int entry_flight, entry_cnt;
3845 #endif
3846
3847         ret = 0;
3848 #ifndef INVARIANTS
3849         entry_flight = asoc->total_flight;
3850         entry_cnt = asoc->total_flight_count;
3851 #endif
3852         if (asoc->pr_sctp_cnt >= asoc->sent_queue_cnt)
3853                 return (0);
3854
3855         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
3856                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
3857                         SCTP_PRINTF("Chk TSN: %u size: %d inflight cnt: %d\n",
3858                             chk->rec.data.tsn,
3859                             chk->send_size,
3860                             chk->snd_count);
3861                         inflight++;
3862                 } else if (chk->sent == SCTP_DATAGRAM_RESEND) {
3863                         resend++;
3864                 } else if (chk->sent < SCTP_DATAGRAM_ACKED) {
3865                         inbetween++;
3866                 } else if (chk->sent > SCTP_DATAGRAM_ACKED) {
3867                         above++;
3868                 } else {
3869                         acked++;
3870                 }
3871         }
3872
3873         if ((inflight > 0) || (inbetween > 0)) {
3874 #ifdef INVARIANTS
3875                 panic("Flight size-express incorrect? \n");
3876 #else
3877                 SCTP_PRINTF("asoc->total_flight: %d cnt: %d\n",
3878                     entry_flight, entry_cnt);
3879
3880                 SCTP_PRINTF("Flight size-express incorrect F: %d I: %d R: %d Ab: %d ACK: %d\n",
3881                     inflight, inbetween, resend, above, acked);
3882                 ret = 1;
3883 #endif
3884         }
3885         return (ret);
3886 }
3887
3888
3889 static void
3890 sctp_window_probe_recovery(struct sctp_tcb *stcb,
3891     struct sctp_association *asoc,
3892     struct sctp_tmit_chunk *tp1)
3893 {
3894         tp1->window_probe = 0;
3895         if ((tp1->sent >= SCTP_DATAGRAM_ACKED) || (tp1->data == NULL)) {
3896                 /* TSN's skipped we do NOT move back. */
3897                 sctp_misc_ints(SCTP_FLIGHT_LOG_DWN_WP_FWD,
3898                     tp1->whoTo ? tp1->whoTo->flight_size : 0,
3899                     tp1->book_size,
3900                     (uint32_t)(uintptr_t)tp1->whoTo,
3901                     tp1->rec.data.tsn);
3902                 return;
3903         }
3904         /* First setup this by shrinking flight */
3905         if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3906                 (*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3907                     tp1);
3908         }
3909         sctp_flight_size_decrease(tp1);
3910         sctp_total_flight_decrease(stcb, tp1);
3911         /* Now mark for resend */
3912         tp1->sent = SCTP_DATAGRAM_RESEND;
3913         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
3914
3915         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3916                 sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_WP,
3917                     tp1->whoTo->flight_size,
3918                     tp1->book_size,
3919                     (uint32_t)(uintptr_t)tp1->whoTo,
3920                     tp1->rec.data.tsn);
3921         }
3922 }
3923
3924 void
3925 sctp_express_handle_sack(struct sctp_tcb *stcb, uint32_t cumack,
3926     uint32_t rwnd, int *abort_now, int ecne_seen)
3927 {
3928         struct sctp_nets *net;
3929         struct sctp_association *asoc;
3930         struct sctp_tmit_chunk *tp1, *tp2;
3931         uint32_t old_rwnd;
3932         int win_probe_recovery = 0;
3933         int win_probe_recovered = 0;
3934         int j, done_once = 0;
3935         int rto_ok = 1;
3936         uint32_t send_s;
3937
3938         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_SACK_ARRIVALS_ENABLE) {
3939                 sctp_misc_ints(SCTP_SACK_LOG_EXPRESS, cumack,
3940                     rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
3941         }
3942         SCTP_TCB_LOCK_ASSERT(stcb);
3943 #ifdef SCTP_ASOCLOG_OF_TSNS
3944         stcb->asoc.cumack_log[stcb->asoc.cumack_log_at] = cumack;
3945         stcb->asoc.cumack_log_at++;
3946         if (stcb->asoc.cumack_log_at > SCTP_TSN_LOG_SIZE) {
3947                 stcb->asoc.cumack_log_at = 0;
3948         }
3949 #endif
3950         asoc = &stcb->asoc;
3951         old_rwnd = asoc->peers_rwnd;
3952         if (SCTP_TSN_GT(asoc->last_acked_seq, cumack)) {
3953                 /* old ack */
3954                 return;
3955         } else if (asoc->last_acked_seq == cumack) {
3956                 /* Window update sack */
3957                 asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
3958                     (uint32_t)(asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
3959                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3960                         /* SWS sender side engages */
3961                         asoc->peers_rwnd = 0;
3962                 }
3963                 if (asoc->peers_rwnd > old_rwnd) {
3964                         goto again;
3965                 }
3966                 return;
3967         }
3968         /* First setup for CC stuff */
3969         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3970                 if (SCTP_TSN_GT(cumack, net->cwr_window_tsn)) {
3971                         /* Drag along the window_tsn for cwr's */
3972                         net->cwr_window_tsn = cumack;
3973                 }
3974                 net->prev_cwnd = net->cwnd;
3975                 net->net_ack = 0;
3976                 net->net_ack2 = 0;
3977
3978                 /*
3979                  * CMT: Reset CUC and Fast recovery algo variables before
3980                  * SACK processing
3981                  */
3982                 net->new_pseudo_cumack = 0;
3983                 net->will_exit_fast_recovery = 0;
3984                 if (stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) {
3985                         (*stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) (stcb, net);
3986                 }
3987         }
3988         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3989                 tp1 = TAILQ_LAST(&asoc->sent_queue,
3990                     sctpchunk_listhead);
3991                 send_s = tp1->rec.data.tsn + 1;
3992         } else {
3993                 send_s = asoc->sending_seq;
3994         }
3995         if (SCTP_TSN_GE(cumack, send_s)) {
3996                 struct mbuf *op_err;
3997                 char msg[SCTP_DIAG_INFO_LEN];
3998
3999                 *abort_now = 1;
4000                 /* XXX */
4001                 snprintf(msg, sizeof(msg), "Cum ack %8.8x greater or equal than TSN %8.8x",
4002                     cumack, send_s);
4003                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
4004                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_21;
4005                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4006                 return;
4007         }
4008         asoc->this_sack_highest_gap = cumack;
4009         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4010                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4011                     stcb->asoc.overall_error_count,
4012                     0,
4013                     SCTP_FROM_SCTP_INDATA,
4014                     __LINE__);
4015         }
4016         stcb->asoc.overall_error_count = 0;
4017         if (SCTP_TSN_GT(cumack, asoc->last_acked_seq)) {
4018                 /* process the new consecutive TSN first */
4019                 TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
4020                         if (SCTP_TSN_GE(cumack, tp1->rec.data.tsn)) {
4021                                 if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
4022                                         SCTP_PRINTF("Warning, an unsent is now acked?\n");
4023                                 }
4024                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4025                                         /*
4026                                          * If it is less than ACKED, it is
4027                                          * now no-longer in flight. Higher
4028                                          * values may occur during marking
4029                                          */
4030                                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4031                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4032                                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4033                                                             tp1->whoTo->flight_size,
4034                                                             tp1->book_size,
4035                                                             (uint32_t)(uintptr_t)tp1->whoTo,
4036                                                             tp1->rec.data.tsn);
4037                                                 }
4038                                                 sctp_flight_size_decrease(tp1);
4039                                                 if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
4040                                                         (*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
4041                                                             tp1);
4042                                                 }
4043                                                 /* sa_ignore NO_NULL_CHK */
4044                                                 sctp_total_flight_decrease(stcb, tp1);
4045                                         }
4046                                         tp1->whoTo->net_ack += tp1->send_size;
4047                                         if (tp1->snd_count < 2) {
4048                                                 /*
4049                                                  * True non-retransmited
4050                                                  * chunk
4051                                                  */
4052                                                 tp1->whoTo->net_ack2 +=
4053                                                     tp1->send_size;
4054
4055                                                 /* update RTO too? */
4056                                                 if (tp1->do_rtt) {
4057                                                         if (rto_ok) {
4058                                                                 tp1->whoTo->RTO =
4059                                                                 /*
4060                                                                  * sa_ignore
4061                                                                  * NO_NULL_CHK
4062                                                                  */
4063                                                                     sctp_calculate_rto(stcb,
4064                                                                     asoc, tp1->whoTo,
4065                                                                     &tp1->sent_rcv_time,
4066                                                                     SCTP_RTT_FROM_DATA);
4067                                                                 rto_ok = 0;
4068                                                         }
4069                                                         if (tp1->whoTo->rto_needed == 0) {
4070                                                                 tp1->whoTo->rto_needed = 1;
4071                                                         }
4072                                                         tp1->do_rtt = 0;
4073                                                 }
4074                                         }
4075                                         /*
4076                                          * CMT: CUCv2 algorithm. From the
4077                                          * cumack'd TSNs, for each TSN being
4078                                          * acked for the first time, set the
4079                                          * following variables for the
4080                                          * corresp destination.
4081                                          * new_pseudo_cumack will trigger a
4082                                          * cwnd update.
4083                                          * find_(rtx_)pseudo_cumack will
4084                                          * trigger search for the next
4085                                          * expected (rtx-)pseudo-cumack.
4086                                          */
4087                                         tp1->whoTo->new_pseudo_cumack = 1;
4088                                         tp1->whoTo->find_pseudo_cumack = 1;
4089                                         tp1->whoTo->find_rtx_pseudo_cumack = 1;
4090
4091                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
4092                                                 /* sa_ignore NO_NULL_CHK */
4093                                                 sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.tsn, SCTP_CWND_LOG_FROM_SACK);
4094                                         }
4095                                 }
4096                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4097                                         sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4098                                 }
4099                                 if (tp1->rec.data.chunk_was_revoked) {
4100                                         /* deflate the cwnd */
4101                                         tp1->whoTo->cwnd -= tp1->book_size;
4102                                         tp1->rec.data.chunk_was_revoked = 0;
4103                                 }
4104                                 if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4105                                         if (asoc->strmout[tp1->rec.data.sid].chunks_on_queues > 0) {
4106                                                 asoc->strmout[tp1->rec.data.sid].chunks_on_queues--;
4107 #ifdef INVARIANTS
4108                                         } else {
4109                                                 panic("No chunks on the queues for sid %u.", tp1->rec.data.sid);
4110 #endif
4111                                         }
4112                                 }
4113                                 if ((asoc->strmout[tp1->rec.data.sid].chunks_on_queues == 0) &&
4114                                     (asoc->strmout[tp1->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
4115                                     TAILQ_EMPTY(&asoc->strmout[tp1->rec.data.sid].outqueue)) {
4116                                         asoc->trigger_reset = 1;
4117                                 }
4118                                 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4119                                 if (tp1->data) {
4120                                         /* sa_ignore NO_NULL_CHK */
4121                                         sctp_free_bufspace(stcb, asoc, tp1, 1);
4122                                         sctp_m_freem(tp1->data);
4123                                         tp1->data = NULL;
4124                                 }
4125                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4126                                         sctp_log_sack(asoc->last_acked_seq,
4127                                             cumack,
4128                                             tp1->rec.data.tsn,
4129                                             0,
4130                                             0,
4131                                             SCTP_LOG_FREE_SENT);
4132                                 }
4133                                 asoc->sent_queue_cnt--;
4134                                 sctp_free_a_chunk(stcb, tp1, SCTP_SO_NOT_LOCKED);
4135                         } else {
4136                                 break;
4137                         }
4138                 }
4139
4140         }
4141         /* sa_ignore NO_NULL_CHK */
4142         if (stcb->sctp_socket) {
4143 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4144                 struct socket *so;
4145
4146 #endif
4147                 SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4148                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4149                         /* sa_ignore NO_NULL_CHK */
4150                         sctp_wakeup_log(stcb, 1, SCTP_WAKESND_FROM_SACK);
4151                 }
4152 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4153                 so = SCTP_INP_SO(stcb->sctp_ep);
4154                 atomic_add_int(&stcb->asoc.refcnt, 1);
4155                 SCTP_TCB_UNLOCK(stcb);
4156                 SCTP_SOCKET_LOCK(so, 1);
4157                 SCTP_TCB_LOCK(stcb);
4158                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4159                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4160                         /* assoc was freed while we were unlocked */
4161                         SCTP_SOCKET_UNLOCK(so, 1);
4162                         return;
4163                 }
4164 #endif
4165                 sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4167                 SCTP_SOCKET_UNLOCK(so, 1);
4168 #endif
4169         } else {
4170                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4171                         sctp_wakeup_log(stcb, 1, SCTP_NOWAKE_FROM_SACK);
4172                 }
4173         }
4174
4175         /* JRS - Use the congestion control given in the CC module */
4176         if ((asoc->last_acked_seq != cumack) && (ecne_seen == 0)) {
4177                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4178                         if (net->net_ack2 > 0) {
4179                                 /*
4180                                  * Karn's rule applies to clearing error
4181                                  * count, this is optional.
4182                                  */
4183                                 net->error_count = 0;
4184                                 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
4185                                         /* addr came good */
4186                                         net->dest_state |= SCTP_ADDR_REACHABLE;
4187                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
4188                                             0, (void *)net, SCTP_SO_NOT_LOCKED);
4189                                 }
4190                                 if (net == stcb->asoc.primary_destination) {
4191                                         if (stcb->asoc.alternate) {
4192                                                 /*
4193                                                  * release the alternate,
4194                                                  * primary is good
4195                                                  */
4196                                                 sctp_free_remote_addr(stcb->asoc.alternate);
4197                                                 stcb->asoc.alternate = NULL;
4198                                         }
4199                                 }
4200                                 if (net->dest_state & SCTP_ADDR_PF) {
4201                                         net->dest_state &= ~SCTP_ADDR_PF;
4202                                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
4203                                             stcb->sctp_ep, stcb, net,
4204                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_22);
4205                                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
4206                                         asoc->cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
4207                                         /* Done with this net */
4208                                         net->net_ack = 0;
4209                                 }
4210                                 /* restore any doubled timers */
4211                                 net->RTO = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
4212                                 if (net->RTO < stcb->asoc.minrto) {
4213                                         net->RTO = stcb->asoc.minrto;
4214                                 }
4215                                 if (net->RTO > stcb->asoc.maxrto) {
4216                                         net->RTO = stcb->asoc.maxrto;
4217                                 }
4218                         }
4219                 }
4220                 asoc->cc_functions.sctp_cwnd_update_after_sack(stcb, asoc, 1, 0, 0);
4221         }
4222         asoc->last_acked_seq = cumack;
4223
4224         if (TAILQ_EMPTY(&asoc->sent_queue)) {
4225                 /* nothing left in-flight */
4226                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4227                         net->flight_size = 0;
4228                         net->partial_bytes_acked = 0;
4229                 }
4230                 asoc->total_flight = 0;
4231                 asoc->total_flight_count = 0;
4232         }
4233         /* RWND update */
4234         asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
4235             (uint32_t)(asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
4236         if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4237                 /* SWS sender side engages */
4238                 asoc->peers_rwnd = 0;
4239         }
4240         if (asoc->peers_rwnd > old_rwnd) {
4241                 win_probe_recovery = 1;
4242         }
4243         /* Now assure a timer where data is queued at */
4244 again:
4245         j = 0;
4246         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4247                 if (win_probe_recovery && (net->window_probe)) {
4248                         win_probe_recovered = 1;
4249                         /*
4250                          * Find first chunk that was used with window probe
4251                          * and clear the sent
4252                          */
4253                         /* sa_ignore FREED_MEMORY */
4254                         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4255                                 if (tp1->window_probe) {
4256                                         /* move back to data send queue */
4257                                         sctp_window_probe_recovery(stcb, asoc, tp1);
4258                                         break;
4259                                 }
4260                         }
4261                 }
4262                 if (net->flight_size) {
4263                         j++;
4264                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net);
4265                         if (net->window_probe) {
4266                                 net->window_probe = 0;
4267                         }
4268                 } else {
4269                         if (net->window_probe) {
4270                                 /*
4271                                  * In window probes we must assure a timer
4272                                  * is still running there
4273                                  */
4274                                 net->window_probe = 0;
4275                                 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4276                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net);
4277                                 }
4278                         } else if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4279                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4280                                     stcb, net,
4281                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_23);
4282                         }
4283                 }
4284         }
4285         if ((j == 0) &&
4286             (!TAILQ_EMPTY(&asoc->sent_queue)) &&
4287             (asoc->sent_queue_retran_cnt == 0) &&
4288             (win_probe_recovered == 0) &&
4289             (done_once == 0)) {
4290                 /*
4291                  * huh, this should not happen unless all packets are
4292                  * PR-SCTP and marked to skip of course.
4293                  */
4294                 if (sctp_fs_audit(asoc)) {
4295                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4296                                 net->flight_size = 0;
4297                         }
4298                         asoc->total_flight = 0;
4299                         asoc->total_flight_count = 0;
4300                         asoc->sent_queue_retran_cnt = 0;
4301                         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4302                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4303                                         sctp_flight_size_increase(tp1);
4304                                         sctp_total_flight_increase(stcb, tp1);
4305                                 } else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4306                                         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
4307                                 }
4308                         }
4309                 }
4310                 done_once = 1;
4311                 goto again;
4312         }
4313         /**********************************/
4314         /* Now what about shutdown issues */
4315         /**********************************/
4316         if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4317                 /* nothing left on sendqueue.. consider done */
4318                 /* clean up */
4319                 if ((asoc->stream_queue_cnt == 1) &&
4320                     ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4321                     (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4322                     ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc))) {
4323                         asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
4324                 }
4325                 if (((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4326                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4327                     (asoc->stream_queue_cnt == 1) &&
4328                     (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
4329                         struct mbuf *op_err;
4330
4331                         *abort_now = 1;
4332                         /* XXX */
4333                         op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
4334                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_24;
4335                         sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4336                         return;
4337                 }
4338                 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
4339                     (asoc->stream_queue_cnt == 0)) {
4340                         struct sctp_nets *netp;
4341
4342                         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
4343                             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4344                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4345                         }
4346                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
4347                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
4348                         sctp_stop_timers_for_shutdown(stcb);
4349                         if (asoc->alternate) {
4350                                 netp = asoc->alternate;
4351                         } else {
4352                                 netp = asoc->primary_destination;
4353                         }
4354                         sctp_send_shutdown(stcb, netp);
4355                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4356                             stcb->sctp_ep, stcb, netp);
4357                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4358                             stcb->sctp_ep, stcb, netp);
4359                 } else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
4360                     (asoc->stream_queue_cnt == 0)) {
4361                         struct sctp_nets *netp;
4362
4363                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4364                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
4365                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
4366                         sctp_stop_timers_for_shutdown(stcb);
4367                         if (asoc->alternate) {
4368                                 netp = asoc->alternate;
4369                         } else {
4370                                 netp = asoc->primary_destination;
4371                         }
4372                         sctp_send_shutdown_ack(stcb, netp);
4373                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4374                             stcb->sctp_ep, stcb, netp);
4375                 }
4376         }
4377         /*********************************************/
4378         /* Here we perform PR-SCTP procedures        */
4379         /* (section 4.2)                             */
4380         /*********************************************/
4381         /* C1. update advancedPeerAckPoint */
4382         if (SCTP_TSN_GT(cumack, asoc->advanced_peer_ack_point)) {
4383                 asoc->advanced_peer_ack_point = cumack;
4384         }
4385         /* PR-Sctp issues need to be addressed too */
4386         if ((asoc->prsctp_supported) && (asoc->pr_sctp_cnt > 0)) {
4387                 struct sctp_tmit_chunk *lchk;
4388                 uint32_t old_adv_peer_ack_point;
4389
4390                 old_adv_peer_ack_point = asoc->advanced_peer_ack_point;
4391                 lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
4392                 /* C3. See if we need to send a Fwd-TSN */
4393                 if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, cumack)) {
4394                         /*
4395                          * ISSUE with ECN, see FWD-TSN processing.
4396                          */
4397                         if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, old_adv_peer_ack_point)) {
4398                                 send_forward_tsn(stcb, asoc);
4399                         } else if (lchk) {
4400                                 /* try to FR fwd-tsn's that get lost too */
4401                                 if (lchk->rec.data.fwd_tsn_cnt >= 3) {
4402                                         send_forward_tsn(stcb, asoc);
4403                                 }
4404                         }
4405                 }
4406                 if (lchk) {
4407                         /* Assure a timer is up */
4408                         sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4409                             stcb->sctp_ep, stcb, lchk->whoTo);
4410                 }
4411         }
4412         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_RWND_LOGGING_ENABLE) {
4413                 sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
4414                     rwnd,
4415                     stcb->asoc.peers_rwnd,
4416                     stcb->asoc.total_flight,
4417                     stcb->asoc.total_output_queue_size);
4418         }
4419 }
4420
4421 void
4422 sctp_handle_sack(struct mbuf *m, int offset_seg, int offset_dup,
4423     struct sctp_tcb *stcb,
4424     uint16_t num_seg, uint16_t num_nr_seg, uint16_t num_dup,
4425     int *abort_now, uint8_t flags,
4426     uint32_t cum_ack, uint32_t rwnd, int ecne_seen)
4427 {
4428         struct sctp_association *asoc;
4429         struct sctp_tmit_chunk *tp1, *tp2;
4430         uint32_t last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked, this_sack_lowest_newack;
4431         uint16_t wake_him = 0;
4432         uint32_t send_s = 0;
4433         long j;
4434         int accum_moved = 0;
4435         int will_exit_fast_recovery = 0;
4436         uint32_t a_rwnd, old_rwnd;
4437         int win_probe_recovery = 0;
4438         int win_probe_recovered = 0;
4439         struct sctp_nets *net = NULL;
4440         int done_once;
4441         int rto_ok = 1;
4442         uint8_t reneged_all = 0;
4443         uint8_t cmt_dac_flag;
4444
4445         /*
4446          * we take any chance we can to service our queues since we cannot
4447          * get awoken when the socket is read from :<
4448          */
4449         /*
4450          * Now perform the actual SACK handling: 1) Verify that it is not an
4451          * old sack, if so discard. 2) If there is nothing left in the send
4452          * queue (cum-ack is equal to last acked) then you have a duplicate
4453          * too, update any rwnd change and verify no timers are running.
4454          * then return. 3) Process any new consequtive data i.e. cum-ack
4455          * moved process these first and note that it moved. 4) Process any
4456          * sack blocks. 5) Drop any acked from the queue. 6) Check for any
4457          * revoked blocks and mark. 7) Update the cwnd. 8) Nothing left,
4458          * sync up flightsizes and things, stop all timers and also check
4459          * for shutdown_pending state. If so then go ahead and send off the
4460          * shutdown. If in shutdown recv, send off the shutdown-ack and
4461          * start that timer, Ret. 9) Strike any non-acked things and do FR
4462          * procedure if needed being sure to set the FR flag. 10) Do pr-sctp
4463          * procedures. 11) Apply any FR penalties. 12) Assure we will SACK
4464          * if in shutdown_recv state.
4465          */
4466         SCTP_TCB_LOCK_ASSERT(stcb);
4467         /* CMT DAC algo */
4468         this_sack_lowest_newack = 0;
4469         SCTP_STAT_INCR(sctps_slowpath_sack);
4470         last_tsn = cum_ack;
4471         cmt_dac_flag = flags & SCTP_SACK_CMT_DAC;
4472 #ifdef SCTP_ASOCLOG_OF_TSNS
4473         stcb->asoc.cumack_log[stcb->asoc.cumack_log_at] = cum_ack;
4474         stcb->asoc.cumack_log_at++;
4475         if (stcb->asoc.cumack_log_at > SCTP_TSN_LOG_SIZE) {
4476                 stcb->asoc.cumack_log_at = 0;
4477         }
4478 #endif
4479         a_rwnd = rwnd;
4480
4481         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_SACK_ARRIVALS_ENABLE) {
4482                 sctp_misc_ints(SCTP_SACK_LOG_NORMAL, cum_ack,
4483                     rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
4484         }
4485         old_rwnd = stcb->asoc.peers_rwnd;
4486         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4487                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4488                     stcb->asoc.overall_error_count,
4489                     0,
4490                     SCTP_FROM_SCTP_INDATA,
4491                     __LINE__);
4492         }
4493         stcb->asoc.overall_error_count = 0;
4494         asoc = &stcb->asoc;
4495         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4496                 sctp_log_sack(asoc->last_acked_seq,
4497                     cum_ack,
4498                     0,
4499                     num_seg,
4500                     num_dup,
4501                     SCTP_LOG_NEW_SACK);
4502         }
4503         if ((num_dup) && (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE)) {
4504                 uint16_t i;
4505                 uint32_t *dupdata, dblock;
4506
4507                 for (i = 0; i < num_dup; i++) {
4508                         dupdata = (uint32_t *)sctp_m_getptr(m, offset_dup + i * sizeof(uint32_t),
4509                             sizeof(uint32_t), (uint8_t *)&dblock);
4510                         if (dupdata == NULL) {
4511                                 break;
4512                         }
4513                         sctp_log_fr(*dupdata, 0, 0, SCTP_FR_DUPED);
4514                 }
4515         }
4516         /* reality check */
4517         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
4518                 tp1 = TAILQ_LAST(&asoc->sent_queue,
4519                     sctpchunk_listhead);
4520                 send_s = tp1->rec.data.tsn + 1;
4521         } else {
4522                 tp1 = NULL;
4523                 send_s = asoc->sending_seq;
4524         }
4525         if (SCTP_TSN_GE(cum_ack, send_s)) {
4526                 struct mbuf *op_err;
4527                 char msg[SCTP_DIAG_INFO_LEN];
4528
4529                 /*
4530                  * no way, we have not even sent this TSN out yet. Peer is
4531                  * hopelessly messed up with us.
4532                  */
4533                 SCTP_PRINTF("NEW cum_ack:%x send_s:%x is smaller or equal\n",
4534                     cum_ack, send_s);
4535                 if (tp1) {
4536                         SCTP_PRINTF("Got send_s from tsn:%x + 1 of tp1: %p\n",
4537                             tp1->rec.data.tsn, (void *)tp1);
4538                 }
4539 hopeless_peer:
4540                 *abort_now = 1;
4541                 /* XXX */
4542                 snprintf(msg, sizeof(msg), "Cum ack %8.8x greater or equal than TSN %8.8x",
4543                     cum_ack, send_s);
4544                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
4545                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_25;
4546                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4547                 return;
4548         }
4549         /**********************/
4550         /* 1) check the range */
4551         /**********************/
4552         if (SCTP_TSN_GT(asoc->last_acked_seq, last_tsn)) {
4553                 /* acking something behind */
4554                 return;
4555         }
4556         /* update the Rwnd of the peer */
4557         if (TAILQ_EMPTY(&asoc->sent_queue) &&
4558             TAILQ_EMPTY(&asoc->send_queue) &&
4559             (asoc->stream_queue_cnt == 0)) {
4560                 /* nothing left on send/sent and strmq */
4561                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4562                         sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4563                             asoc->peers_rwnd, 0, 0, a_rwnd);
4564                 }
4565                 asoc->peers_rwnd = a_rwnd;
4566                 if (asoc->sent_queue_retran_cnt) {
4567                         asoc->sent_queue_retran_cnt = 0;
4568                 }
4569                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4570                         /* SWS sender side engages */
4571                         asoc->peers_rwnd = 0;
4572                 }
4573                 /* stop any timers */
4574                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4575                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4576                             stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_26);
4577                         net->partial_bytes_acked = 0;
4578                         net->flight_size = 0;
4579                 }
4580                 asoc->total_flight = 0;
4581                 asoc->total_flight_count = 0;
4582                 return;
4583         }
4584         /*
4585          * We init netAckSz and netAckSz2 to 0. These are used to track 2
4586          * things. The total byte count acked is tracked in netAckSz AND
4587          * netAck2 is used to track the total bytes acked that are un-
4588          * amibguious and were never retransmitted. We track these on a per
4589          * destination address basis.
4590          */
4591         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4592                 if (SCTP_TSN_GT(cum_ack, net->cwr_window_tsn)) {
4593                         /* Drag along the window_tsn for cwr's */
4594                         net->cwr_window_tsn = cum_ack;
4595                 }
4596                 net->prev_cwnd = net->cwnd;
4597                 net->net_ack = 0;
4598                 net->net_ack2 = 0;
4599
4600                 /*
4601                  * CMT: Reset CUC and Fast recovery algo variables before
4602                  * SACK processing
4603                  */
4604                 net->new_pseudo_cumack = 0;
4605                 net->will_exit_fast_recovery = 0;
4606                 if (stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) {
4607                         (*stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) (stcb, net);
4608                 }
4609                 /*
4610                  * CMT: SFR algo (and HTNA) - this_sack_highest_newack has
4611                  * to be greater than the cumack. Also reset saw_newack to 0
4612                  * for all dests.
4613                  */
4614                 net->saw_newack = 0;
4615                 net->this_sack_highest_newack = last_tsn;
4616         }
4617         /* process the new consecutive TSN first */
4618         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4619                 if (SCTP_TSN_GE(last_tsn, tp1->rec.data.tsn)) {
4620                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4621                                 accum_moved = 1;
4622                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4623                                         /*
4624                                          * If it is less than ACKED, it is
4625                                          * now no-longer in flight. Higher
4626                                          * values may occur during marking
4627                                          */
4628                                         if ((tp1->whoTo->dest_state &
4629                                             SCTP_ADDR_UNCONFIRMED) &&
4630                                             (tp1->snd_count < 2)) {
4631                                                 /*
4632                                                  * If there was no retran
4633                                                  * and the address is
4634                                                  * un-confirmed and we sent
4635                                                  * there and are now
4636                                                  * sacked.. its confirmed,
4637                                                  * mark it so.
4638                                                  */
4639                                                 tp1->whoTo->dest_state &=
4640                                                     ~SCTP_ADDR_UNCONFIRMED;
4641                                         }
4642                                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4643                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4644                                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4645                                                             tp1->whoTo->flight_size,
4646                                                             tp1->book_size,
4647                                                             (uint32_t)(uintptr_t)tp1->whoTo,
4648                                                             tp1->rec.data.tsn);
4649                                                 }
4650                                                 sctp_flight_size_decrease(tp1);
4651                                                 sctp_total_flight_decrease(stcb, tp1);
4652                                                 if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
4653                                                         (*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
4654                                                             tp1);
4655                                                 }
4656                                         }
4657                                         tp1->whoTo->net_ack += tp1->send_size;
4658
4659                                         /* CMT SFR and DAC algos */
4660                                         this_sack_lowest_newack = tp1->rec.data.tsn;
4661                                         tp1->whoTo->saw_newack = 1;
4662
4663                                         if (tp1->snd_count < 2) {
4664                                                 /*
4665                                                  * True non-retransmited
4666                                                  * chunk
4667                                                  */
4668                                                 tp1->whoTo->net_ack2 +=
4669                                                     tp1->send_size;
4670
4671                                                 /* update RTO too? */
4672                                                 if (tp1->do_rtt) {
4673                                                         if (rto_ok) {
4674                                                                 tp1->whoTo->RTO =
4675                                                                     sctp_calculate_rto(stcb,
4676                                                                     asoc, tp1->whoTo,
4677                                                                     &tp1->sent_rcv_time,
4678                                                                     SCTP_RTT_FROM_DATA);
4679                                                                 rto_ok = 0;
4680                                                         }
4681                                                         if (tp1->whoTo->rto_needed == 0) {
4682                                                                 tp1->whoTo->rto_needed = 1;
4683                                                         }
4684                                                         tp1->do_rtt = 0;
4685                                                 }
4686                                         }
4687                                         /*
4688                                          * CMT: CUCv2 algorithm. From the
4689                                          * cumack'd TSNs, for each TSN being
4690                                          * acked for the first time, set the
4691                                          * following variables for the
4692                                          * corresp destination.
4693                                          * new_pseudo_cumack will trigger a
4694                                          * cwnd update.
4695                                          * find_(rtx_)pseudo_cumack will
4696                                          * trigger search for the next
4697                                          * expected (rtx-)pseudo-cumack.
4698                                          */
4699                                         tp1->whoTo->new_pseudo_cumack = 1;
4700                                         tp1->whoTo->find_pseudo_cumack = 1;
4701                                         tp1->whoTo->find_rtx_pseudo_cumack = 1;
4702
4703
4704                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4705                                                 sctp_log_sack(asoc->last_acked_seq,
4706                                                     cum_ack,
4707                                                     tp1->rec.data.tsn,
4708                                                     0,
4709                                                     0,
4710                                                     SCTP_LOG_TSN_ACKED);
4711                                         }
4712                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
4713                                                 sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.tsn, SCTP_CWND_LOG_FROM_SACK);
4714                                         }
4715                                 }
4716                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4717                                         sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4718 #ifdef SCTP_AUDITING_ENABLED
4719                                         sctp_audit_log(0xB3,
4720                                             (asoc->sent_queue_retran_cnt & 0x000000ff));
4721 #endif
4722                                 }
4723                                 if (tp1->rec.data.chunk_was_revoked) {
4724                                         /* deflate the cwnd */
4725                                         tp1->whoTo->cwnd -= tp1->book_size;
4726                                         tp1->rec.data.chunk_was_revoked = 0;
4727                                 }
4728                                 if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4729                                         tp1->sent = SCTP_DATAGRAM_ACKED;
4730                                 }
4731                         }
4732                 } else {
4733                         break;
4734                 }
4735         }
4736         biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
4737         /* always set this up to cum-ack */
4738         asoc->this_sack_highest_gap = last_tsn;
4739
4740         if ((num_seg > 0) || (num_nr_seg > 0)) {
4741
4742                 /*
4743                  * thisSackHighestGap will increase while handling NEW
4744                  * segments this_sack_highest_newack will increase while
4745                  * handling NEWLY ACKED chunks. this_sack_lowest_newack is
4746                  * used for CMT DAC algo. saw_newack will also change.
4747                  */
4748                 if (sctp_handle_segments(m, &offset_seg, stcb, asoc, last_tsn, &biggest_tsn_acked,
4749                     &biggest_tsn_newly_acked, &this_sack_lowest_newack,
4750                     num_seg, num_nr_seg, &rto_ok)) {
4751                         wake_him++;
4752                 }
4753                 /*
4754                  * validate the biggest_tsn_acked in the gap acks if strict
4755                  * adherence is wanted.
4756                  */
4757                 if (SCTP_TSN_GE(biggest_tsn_acked, send_s)) {
4758                         /*
4759                          * peer is either confused or we are under attack.
4760                          * We must abort.
4761                          */
4762                         SCTP_PRINTF("Hopeless peer! biggest_tsn_acked:%x largest seq:%x\n",
4763                             biggest_tsn_acked, send_s);
4764                         goto hopeless_peer;
4765                 }
4766         }
4767         /*******************************************/
4768         /* cancel ALL T3-send timer if accum moved */
4769         /*******************************************/
4770         if (asoc->sctp_cmt_on_off > 0) {
4771                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4772                         if (net->new_pseudo_cumack)
4773                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4774                                     stcb, net,
4775                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_27);
4776
4777                 }
4778         } else {
4779                 if (accum_moved) {
4780                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4781                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4782                                     stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_28);
4783                         }
4784                 }
4785         }
4786         /********************************************/
4787         /* drop the acked chunks from the sentqueue */
4788         /********************************************/
4789         asoc->last_acked_seq = cum_ack;
4790
4791         TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
4792                 if (SCTP_TSN_GT(tp1->rec.data.tsn, cum_ack)) {
4793                         break;
4794                 }
4795                 if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4796                         if (asoc->strmout[tp1->rec.data.sid].chunks_on_queues > 0) {
4797                                 asoc->strmout[tp1->rec.data.sid].chunks_on_queues--;
4798 #ifdef INVARIANTS
4799                         } else {
4800                                 panic("No chunks on the queues for sid %u.", tp1->rec.data.sid);
4801 #endif
4802                         }
4803                 }
4804                 if ((asoc->strmout[tp1->rec.data.sid].chunks_on_queues == 0) &&
4805                     (asoc->strmout[tp1->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
4806                     TAILQ_EMPTY(&asoc->strmout[tp1->rec.data.sid].outqueue)) {
4807                         asoc->trigger_reset = 1;
4808                 }
4809                 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4810                 if (PR_SCTP_ENABLED(tp1->flags)) {
4811                         if (asoc->pr_sctp_cnt != 0)
4812                                 asoc->pr_sctp_cnt--;
4813                 }
4814                 asoc->sent_queue_cnt--;
4815                 if (tp1->data) {
4816                         /* sa_ignore NO_NULL_CHK */
4817                         sctp_free_bufspace(stcb, asoc, tp1, 1);
4818                         sctp_m_freem(tp1->data);
4819                         tp1->data = NULL;
4820                         if (asoc->prsctp_supported && PR_SCTP_BUF_ENABLED(tp1->flags)) {
4821                                 asoc->sent_queue_cnt_removeable--;
4822                         }
4823                 }
4824                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4825                         sctp_log_sack(asoc->last_acked_seq,
4826                             cum_ack,
4827                             tp1->rec.data.tsn,
4828                             0,
4829                             0,
4830                             SCTP_LOG_FREE_SENT);
4831                 }
4832                 sctp_free_a_chunk(stcb, tp1, SCTP_SO_NOT_LOCKED);
4833                 wake_him++;
4834         }
4835         if (TAILQ_EMPTY(&asoc->sent_queue) && (asoc->total_flight > 0)) {
4836 #ifdef INVARIANTS
4837                 panic("Warning flight size is positive and should be 0");
4838 #else
4839                 SCTP_PRINTF("Warning flight size incorrect should be 0 is %d\n",
4840                     asoc->total_flight);
4841 #endif
4842                 asoc->total_flight = 0;
4843         }
4844         /* sa_ignore NO_NULL_CHK */
4845         if ((wake_him) && (stcb->sctp_socket)) {
4846 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4847                 struct socket *so;
4848
4849 #endif
4850                 SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4851                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4852                         sctp_wakeup_log(stcb, wake_him, SCTP_WAKESND_FROM_SACK);
4853                 }
4854 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4855                 so = SCTP_INP_SO(stcb->sctp_ep);
4856                 atomic_add_int(&stcb->asoc.refcnt, 1);
4857                 SCTP_TCB_UNLOCK(stcb);
4858                 SCTP_SOCKET_LOCK(so, 1);
4859                 SCTP_TCB_LOCK(stcb);
4860                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4861                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4862                         /* assoc was freed while we were unlocked */
4863                         SCTP_SOCKET_UNLOCK(so, 1);
4864                         return;
4865                 }
4866 #endif
4867                 sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4868 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4869                 SCTP_SOCKET_UNLOCK(so, 1);
4870 #endif
4871         } else {
4872                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4873                         sctp_wakeup_log(stcb, wake_him, SCTP_NOWAKE_FROM_SACK);
4874                 }
4875         }
4876
4877         if (asoc->fast_retran_loss_recovery && accum_moved) {
4878                 if (SCTP_TSN_GE(asoc->last_acked_seq, asoc->fast_recovery_tsn)) {
4879                         /* Setup so we will exit RFC2582 fast recovery */
4880                         will_exit_fast_recovery = 1;
4881                 }
4882         }
4883         /*
4884          * Check for revoked fragments:
4885          *
4886          * if Previous sack - Had no frags then we can't have any revoked if
4887          * Previous sack - Had frag's then - If we now have frags aka
4888          * num_seg > 0 call sctp_check_for_revoked() to tell if peer revoked
4889          * some of them. else - The peer revoked all ACKED fragments, since
4890          * we had some before and now we have NONE.
4891          */
4892
4893         if (num_seg) {
4894                 sctp_check_for_revoked(stcb, asoc, cum_ack, biggest_tsn_acked);
4895                 asoc->saw_sack_with_frags = 1;
4896         } else if (asoc->saw_sack_with_frags) {
4897                 int cnt_revoked = 0;
4898
4899                 /* Peer revoked all dg's marked or acked */
4900                 TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4901                         if (tp1->sent == SCTP_DATAGRAM_ACKED) {
4902                                 tp1->sent = SCTP_DATAGRAM_SENT;
4903                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4904                                         sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
4905                                             tp1->whoTo->flight_size,
4906                                             tp1->book_size,
4907                                             (uint32_t)(uintptr_t)tp1->whoTo,
4908                                             tp1->rec.data.tsn);
4909                                 }
4910                                 sctp_flight_size_increase(tp1);
4911                                 sctp_total_flight_increase(stcb, tp1);
4912                                 tp1->rec.data.chunk_was_revoked = 1;
4913                                 /*
4914                                  * To ensure that this increase in
4915                                  * flightsize, which is artificial, does not
4916                                  * throttle the sender, we also increase the
4917                                  * cwnd artificially.
4918                                  */
4919                                 tp1->whoTo->cwnd += tp1->book_size;
4920                                 cnt_revoked++;
4921                         }
4922                 }
4923                 if (cnt_revoked) {
4924                         reneged_all = 1;
4925                 }
4926                 asoc->saw_sack_with_frags = 0;
4927         }
4928         if (num_nr_seg > 0)
4929                 asoc->saw_sack_with_nr_frags = 1;
4930         else
4931                 asoc->saw_sack_with_nr_frags = 0;
4932
4933         /* JRS - Use the congestion control given in the CC module */
4934         if (ecne_seen == 0) {
4935                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4936                         if (net->net_ack2 > 0) {
4937                                 /*
4938                                  * Karn's rule applies to clearing error
4939                                  * count, this is optional.
4940                                  */
4941                                 net->error_count = 0;
4942                                 if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
4943                                         /* addr came good */
4944                                         net->dest_state |= SCTP_ADDR_REACHABLE;
4945                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
4946                                             0, (void *)net, SCTP_SO_NOT_LOCKED);
4947                                 }
4948                                 if (net == stcb->asoc.primary_destination) {
4949                                         if (stcb->asoc.alternate) {
4950                                                 /*
4951                                                  * release the alternate,
4952                                                  * primary is good
4953                                                  */
4954                                                 sctp_free_remote_addr(stcb->asoc.alternate);
4955                                                 stcb->asoc.alternate = NULL;
4956                                         }
4957                                 }
4958                                 if (net->dest_state & SCTP_ADDR_PF) {
4959                                         net->dest_state &= ~SCTP_ADDR_PF;
4960                                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
4961                                             stcb->sctp_ep, stcb, net,
4962                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_29);
4963                                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
4964                                         asoc->cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
4965                                         /* Done with this net */
4966                                         net->net_ack = 0;
4967                                 }
4968                                 /* restore any doubled timers */
4969                                 net->RTO = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
4970                                 if (net->RTO < stcb->asoc.minrto) {
4971                                         net->RTO = stcb->asoc.minrto;
4972                                 }
4973                                 if (net->RTO > stcb->asoc.maxrto) {
4974                                         net->RTO = stcb->asoc.maxrto;
4975                                 }
4976                         }
4977                 }
4978                 asoc->cc_functions.sctp_cwnd_update_after_sack(stcb, asoc, accum_moved, reneged_all, will_exit_fast_recovery);
4979         }
4980         if (TAILQ_EMPTY(&asoc->sent_queue)) {
4981                 /* nothing left in-flight */
4982                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4983                         /* stop all timers */
4984                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4985                             stcb, net,
4986                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_30);
4987                         net->flight_size = 0;
4988                         net->partial_bytes_acked = 0;
4989                 }
4990                 asoc->total_flight = 0;
4991                 asoc->total_flight_count = 0;
4992         }
4993         /**********************************/
4994         /* Now what about shutdown issues */
4995         /**********************************/
4996         if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4997                 /* nothing left on sendqueue.. consider done */
4998                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4999                         sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5000                             asoc->peers_rwnd, 0, 0, a_rwnd);
5001                 }
5002                 asoc->peers_rwnd = a_rwnd;
5003                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5004                         /* SWS sender side engages */
5005                         asoc->peers_rwnd = 0;
5006                 }
5007                 /* clean up */
5008                 if ((asoc->stream_queue_cnt == 1) &&
5009                     ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
5010                     (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
5011                     ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc))) {
5012                         asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
5013                 }
5014                 if (((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
5015                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) &&
5016                     (asoc->stream_queue_cnt == 1) &&
5017                     (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
5018                         struct mbuf *op_err;
5019
5020                         *abort_now = 1;
5021                         /* XXX */
5022                         op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
5023                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_24;
5024                         sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
5025                         return;
5026                 }
5027                 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
5028                     (asoc->stream_queue_cnt == 0)) {
5029                         struct sctp_nets *netp;
5030
5031                         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
5032                             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
5033                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5034                         }
5035                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
5036                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
5037                         sctp_stop_timers_for_shutdown(stcb);
5038                         if (asoc->alternate) {
5039                                 netp = asoc->alternate;
5040                         } else {
5041                                 netp = asoc->primary_destination;
5042                         }
5043                         sctp_send_shutdown(stcb, netp);
5044                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
5045                             stcb->sctp_ep, stcb, netp);
5046                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
5047                             stcb->sctp_ep, stcb, netp);
5048                         return;
5049                 } else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
5050                     (asoc->stream_queue_cnt == 0)) {
5051                         struct sctp_nets *netp;
5052
5053                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5054                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
5055                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
5056                         sctp_stop_timers_for_shutdown(stcb);
5057                         if (asoc->alternate) {
5058                                 netp = asoc->alternate;
5059                         } else {
5060                                 netp = asoc->primary_destination;
5061                         }
5062                         sctp_send_shutdown_ack(stcb, netp);
5063                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
5064                             stcb->sctp_ep, stcb, netp);
5065                         return;
5066                 }
5067         }
5068         /*
5069          * Now here we are going to recycle net_ack for a different use...
5070          * HEADS UP.
5071          */
5072         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5073                 net->net_ack = 0;
5074         }
5075
5076         /*
5077          * CMT DAC algorithm: If SACK DAC flag was 0, then no extra marking
5078          * to be done. Setting this_sack_lowest_newack to the cum_ack will
5079          * automatically ensure that.
5080          */
5081         if ((asoc->sctp_cmt_on_off > 0) &&
5082             SCTP_BASE_SYSCTL(sctp_cmt_use_dac) &&
5083             (cmt_dac_flag == 0)) {
5084                 this_sack_lowest_newack = cum_ack;
5085         }
5086         if ((num_seg > 0) || (num_nr_seg > 0)) {
5087                 sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked,
5088                     biggest_tsn_newly_acked, this_sack_lowest_newack, accum_moved);
5089         }
5090         /* JRS - Use the congestion control given in the CC module */
5091         asoc->cc_functions.sctp_cwnd_update_after_fr(stcb, asoc);
5092
5093         /* Now are we exiting loss recovery ? */
5094         if (will_exit_fast_recovery) {
5095                 /* Ok, we must exit fast recovery */
5096                 asoc->fast_retran_loss_recovery = 0;
5097         }
5098         if ((asoc->sat_t3_loss_recovery) &&
5099             SCTP_TSN_GE(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn)) {
5100                 /* end satellite t3 loss recovery */
5101                 asoc->sat_t3_loss_recovery = 0;
5102         }
5103         /*
5104          * CMT Fast recovery
5105          */
5106         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5107                 if (net->will_exit_fast_recovery) {
5108                         /* Ok, we must exit fast recovery */
5109                         net->fast_retran_loss_recovery = 0;
5110                 }
5111         }
5112
5113         /* Adjust and set the new rwnd value */
5114         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
5115                 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5116                     asoc->peers_rwnd, asoc->total_flight, (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)), a_rwnd);
5117         }
5118         asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd,
5119             (uint32_t)(asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
5120         if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5121                 /* SWS sender side engages */
5122                 asoc->peers_rwnd = 0;
5123         }
5124         if (asoc->peers_rwnd > old_rwnd) {
5125                 win_probe_recovery = 1;
5126         }
5127         /*
5128          * Now we must setup so we have a timer up for anyone with
5129          * outstanding data.
5130          */
5131         done_once = 0;
5132 again:
5133         j = 0;
5134         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5135                 if (win_probe_recovery && (net->window_probe)) {
5136                         win_probe_recovered = 1;
5137                         /*-
5138                          * Find first chunk that was used with
5139                          * window probe and clear the event. Put
5140                          * it back into the send queue as if has
5141                          * not been sent.
5142                          */
5143                         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5144                                 if (tp1->window_probe) {
5145                                         sctp_window_probe_recovery(stcb, asoc, tp1);
5146                                         break;
5147                                 }
5148                         }
5149                 }
5150                 if (net->flight_size) {
5151                         j++;
5152                         if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5153                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5154                                     stcb->sctp_ep, stcb, net);
5155                         }
5156                         if (net->window_probe) {
5157                                 net->window_probe = 0;
5158                         }
5159                 } else {
5160                         if (net->window_probe) {
5161                                 /*
5162                                  * In window probes we must assure a timer
5163                                  * is still running there
5164                                  */
5165                                 if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5166                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5167                                             stcb->sctp_ep, stcb, net);
5168
5169                                 }
5170                         } else if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5171                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
5172                                     stcb, net,
5173                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_32);
5174                         }
5175                 }
5176         }
5177         if ((j == 0) &&
5178             (!TAILQ_EMPTY(&asoc->sent_queue)) &&
5179             (asoc->sent_queue_retran_cnt == 0) &&
5180             (win_probe_recovered == 0) &&
5181             (done_once == 0)) {
5182                 /*
5183                  * huh, this should not happen unless all packets are
5184                  * PR-SCTP and marked to skip of course.
5185                  */
5186                 if (sctp_fs_audit(asoc)) {
5187                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5188                                 net->flight_size = 0;
5189                         }
5190                         asoc->total_flight = 0;
5191                         asoc->total_flight_count = 0;
5192                         asoc->sent_queue_retran_cnt = 0;
5193                         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5194                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5195                                         sctp_flight_size_increase(tp1);
5196                                         sctp_total_flight_increase(stcb, tp1);
5197                                 } else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
5198                                         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
5199                                 }
5200                         }
5201                 }
5202                 done_once = 1;
5203                 goto again;
5204         }
5205         /*********************************************/
5206         /* Here we perform PR-SCTP procedures        */
5207         /* (section 4.2)                             */
5208         /*********************************************/
5209         /* C1. update advancedPeerAckPoint */
5210         if (SCTP_TSN_GT(cum_ack, asoc->advanced_peer_ack_point)) {
5211                 asoc->advanced_peer_ack_point = cum_ack;
5212         }
5213         /* C2. try to further move advancedPeerAckPoint ahead */
5214         if ((asoc->prsctp_supported) && (asoc->pr_sctp_cnt > 0)) {
5215                 struct sctp_tmit_chunk *lchk;
5216                 uint32_t old_adv_peer_ack_point;
5217
5218                 old_adv_peer_ack_point = asoc->advanced_peer_ack_point;
5219                 lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
5220                 /* C3. See if we need to send a Fwd-TSN */
5221                 if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, cum_ack)) {
5222                         /*
5223                          * ISSUE with ECN, see FWD-TSN processing.
5224                          */
5225                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) {
5226                                 sctp_misc_ints(SCTP_FWD_TSN_CHECK,
5227                                     0xee, cum_ack, asoc->advanced_peer_ack_point,
5228                                     old_adv_peer_ack_point);
5229                         }
5230                         if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, old_adv_peer_ack_point)) {
5231                                 send_forward_tsn(stcb, asoc);
5232                         } else if (lchk) {
5233                                 /* try to FR fwd-tsn's that get lost too */
5234                                 if (lchk->rec.data.fwd_tsn_cnt >= 3) {
5235                                         send_forward_tsn(stcb, asoc);
5236                                 }
5237                         }
5238                 }
5239                 if (lchk) {
5240                         /* Assure a timer is up */
5241                         sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5242                             stcb->sctp_ep, stcb, lchk->whoTo);
5243                 }
5244         }
5245         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_RWND_LOGGING_ENABLE) {
5246                 sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
5247                     a_rwnd,
5248                     stcb->asoc.peers_rwnd,
5249                     stcb->asoc.total_flight,
5250                     stcb->asoc.total_output_queue_size);
5251         }
5252 }
5253
5254 void
5255 sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp, int *abort_flag)
5256 {
5257         /* Copy cum-ack */
5258         uint32_t cum_ack, a_rwnd;
5259
5260         cum_ack = ntohl(cp->cumulative_tsn_ack);
5261         /* Arrange so a_rwnd does NOT change */
5262         a_rwnd = stcb->asoc.peers_rwnd + stcb->asoc.total_flight;
5263
5264         /* Now call the express sack handling */
5265         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, abort_flag, 0);
5266 }
5267
5268 static void
5269 sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb,
5270     struct sctp_stream_in *strmin)
5271 {
5272         struct sctp_queued_to_read *control, *ncontrol;
5273         struct sctp_association *asoc;
5274         uint32_t mid;
5275         int need_reasm_check = 0;
5276
5277         asoc = &stcb->asoc;
5278         mid = strmin->last_mid_delivered;
5279         /*
5280          * First deliver anything prior to and including the stream no that
5281          * came in.
5282          */
5283         TAILQ_FOREACH_SAFE(control, &strmin->inqueue, next_instrm, ncontrol) {
5284                 if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
5285                         /* this is deliverable now */
5286                         if (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
5287                                 if (control->on_strm_q) {
5288                                         if (control->on_strm_q == SCTP_ON_ORDERED) {
5289                                                 TAILQ_REMOVE(&strmin->inqueue, control, next_instrm);
5290                                         } else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5291                                                 TAILQ_REMOVE(&strmin->uno_inqueue, control, next_instrm);
5292 #ifdef INVARIANTS
5293                                         } else {
5294                                                 panic("strmin: %p ctl: %p unknown %d",
5295                                                     strmin, control, control->on_strm_q);
5296 #endif
5297                                         }
5298                                         control->on_strm_q = 0;
5299                                 }
5300                                 /* subtract pending on streams */
5301                                 if (asoc->size_on_all_streams >= control->length) {
5302                                         asoc->size_on_all_streams -= control->length;
5303                                 } else {
5304 #ifdef INVARIANTS
5305                                         panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5306 #else
5307                                         asoc->size_on_all_streams = 0;
5308 #endif
5309                                 }
5310                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
5311                                 /* deliver it to at least the delivery-q */
5312                                 if (stcb->sctp_socket) {
5313                                         sctp_mark_non_revokable(asoc, control->sinfo_tsn);
5314                                         sctp_add_to_readq(stcb->sctp_ep, stcb,
5315                                             control,
5316                                             &stcb->sctp_socket->so_rcv,
5317                                             1, SCTP_READ_LOCK_HELD,
5318                                             SCTP_SO_NOT_LOCKED);
5319                                 }
5320                         } else {
5321                                 /* Its a fragmented message */
5322                                 if (control->first_frag_seen) {
5323                                         /*
5324                                          * Make it so this is next to
5325                                          * deliver, we restore later
5326                                          */
5327                                         strmin->last_mid_delivered = control->mid - 1;
5328                                         need_reasm_check = 1;
5329                                         break;
5330                                 }
5331                         }
5332                 } else {
5333                         /* no more delivery now. */
5334                         break;
5335                 }
5336         }
5337         if (need_reasm_check) {
5338                 int ret;
5339
5340                 ret = sctp_deliver_reasm_check(stcb, &stcb->asoc, strmin, SCTP_READ_LOCK_HELD);
5341                 if (SCTP_MID_GT(asoc->idata_supported, mid, strmin->last_mid_delivered)) {
5342                         /* Restore the next to deliver unless we are ahead */
5343                         strmin->last_mid_delivered = mid;
5344                 }
5345                 if (ret == 0) {
5346                         /* Left the front Partial one on */
5347                         return;
5348                 }
5349                 need_reasm_check = 0;
5350         }
5351         /*
5352          * now we must deliver things in queue the normal way  if any are
5353          * now ready.
5354          */
5355         mid = strmin->last_mid_delivered + 1;
5356         TAILQ_FOREACH_SAFE(control, &strmin->inqueue, next_instrm, ncontrol) {
5357                 if (SCTP_MID_EQ(asoc->idata_supported, mid, control->mid)) {
5358                         if (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
5359                                 /* this is deliverable now */
5360                                 if (control->on_strm_q) {
5361                                         if (control->on_strm_q == SCTP_ON_ORDERED) {
5362                                                 TAILQ_REMOVE(&strmin->inqueue, control, next_instrm);
5363                                         } else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5364                                                 TAILQ_REMOVE(&strmin->uno_inqueue, control, next_instrm);
5365 #ifdef INVARIANTS
5366                                         } else {
5367                                                 panic("strmin: %p ctl: %p unknown %d",
5368                                                     strmin, control, control->on_strm_q);
5369 #endif
5370                                         }
5371                                         control->on_strm_q = 0;
5372                                 }
5373                                 /* subtract pending on streams */
5374                                 if (asoc->size_on_all_streams >= control->length) {
5375                                         asoc->size_on_all_streams -= control->length;
5376                                 } else {
5377 #ifdef INVARIANTS
5378                                         panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5379 #else
5380                                         asoc->size_on_all_streams = 0;
5381 #endif
5382                                 }
5383                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
5384                                 /* deliver it to at least the delivery-q */
5385                                 strmin->last_mid_delivered = control->mid;
5386                                 if (stcb->sctp_socket) {
5387                                         sctp_mark_non_revokable(asoc, control->sinfo_tsn);
5388                                         sctp_add_to_readq(stcb->sctp_ep, stcb,
5389                                             control,
5390                                             &stcb->sctp_socket->so_rcv, 1,
5391                                             SCTP_READ_LOCK_HELD, SCTP_SO_NOT_LOCKED);
5392
5393                                 }
5394                                 mid = strmin->last_mid_delivered + 1;
5395                         } else {
5396                                 /* Its a fragmented message */
5397                                 if (control->first_frag_seen) {
5398                                         /*
5399                                          * Make it so this is next to
5400                                          * deliver
5401                                          */
5402                                         strmin->last_mid_delivered = control->mid - 1;
5403                                         need_reasm_check = 1;
5404                                         break;
5405                                 }
5406                         }
5407                 } else {
5408                         break;
5409                 }
5410         }
5411         if (need_reasm_check) {
5412                 (void)sctp_deliver_reasm_check(stcb, &stcb->asoc, strmin, SCTP_READ_LOCK_HELD);
5413         }
5414 }
5415
5416
5417
5418 static void
5419 sctp_flush_reassm_for_str_seq(struct sctp_tcb *stcb,
5420     struct sctp_association *asoc,
5421     uint16_t stream, uint32_t mid, int ordered, uint32_t cumtsn)
5422 {
5423         struct sctp_queued_to_read *control;
5424         struct sctp_stream_in *strm;
5425         struct sctp_tmit_chunk *chk, *nchk;
5426         int cnt_removed = 0;
5427
5428         /*
5429          * For now large messages held on the stream reasm that are complete
5430          * will be tossed too. We could in theory do more work to spin
5431          * through and stop after dumping one msg aka seeing the start of a
5432          * new msg at the head, and call the delivery function... to see if
5433          * it can be delivered... But for now we just dump everything on the
5434          * queue.
5435          */
5436         strm = &asoc->strmin[stream];
5437         control = sctp_find_reasm_entry(strm, mid, ordered, asoc->idata_supported);
5438         if (control == NULL) {
5439                 /* Not found */
5440                 return;
5441         }
5442         if (!asoc->idata_supported && !ordered && SCTP_TSN_GT(control->fsn_included, cumtsn)) {
5443                 return;
5444         }
5445         TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
5446                 /* Purge hanging chunks */
5447                 if (!asoc->idata_supported && (ordered == 0)) {
5448                         if (SCTP_TSN_GT(chk->rec.data.tsn, cumtsn)) {
5449                                 break;
5450                         }
5451                 }
5452                 cnt_removed++;
5453                 TAILQ_REMOVE(&control->reasm, chk, sctp_next);
5454                 if (asoc->size_on_reasm_queue >= chk->send_size) {
5455                         asoc->size_on_reasm_queue -= chk->send_size;
5456                 } else {
5457 #ifdef INVARIANTS
5458                         panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, chk->send_size);
5459 #else
5460                         asoc->size_on_reasm_queue = 0;
5461 #endif
5462                 }
5463                 sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5464                 if (chk->data) {
5465                         sctp_m_freem(chk->data);
5466                         chk->data = NULL;
5467                 }
5468                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
5469         }
5470         if (!TAILQ_EMPTY(&control->reasm)) {
5471                 /* This has to be old data, unordered */
5472                 if (control->data) {
5473                         sctp_m_freem(control->data);
5474                         control->data = NULL;
5475                 }
5476                 sctp_reset_a_control(control, stcb->sctp_ep, cumtsn);
5477                 chk = TAILQ_FIRST(&control->reasm);
5478                 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
5479                         TAILQ_REMOVE(&control->reasm, chk, sctp_next);
5480                         sctp_add_chk_to_control(control, strm, stcb, asoc,
5481                             chk, SCTP_READ_LOCK_HELD);
5482                 }
5483                 sctp_deliver_reasm_check(stcb, asoc, strm, SCTP_READ_LOCK_HELD);
5484                 return;
5485         }
5486         if (control->on_strm_q == SCTP_ON_ORDERED) {
5487                 TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
5488                 if (asoc->size_on_all_streams >= control->length) {
5489                         asoc->size_on_all_streams -= control->length;
5490                 } else {
5491 #ifdef INVARIANTS
5492                         panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5493 #else
5494                         asoc->size_on_all_streams = 0;
5495 #endif
5496                 }
5497                 sctp_ucount_decr(asoc->cnt_on_all_streams);
5498                 control->on_strm_q = 0;
5499         } else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5500                 TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
5501                 control->on_strm_q = 0;
5502 #ifdef INVARIANTS
5503         } else if (control->on_strm_q) {
5504                 panic("strm: %p ctl: %p unknown %d",
5505                     strm, control, control->on_strm_q);
5506 #endif
5507         }
5508         control->on_strm_q = 0;
5509         if (control->on_read_q == 0) {
5510                 sctp_free_remote_addr(control->whoFrom);
5511                 if (control->data) {
5512                         sctp_m_freem(control->data);
5513                         control->data = NULL;
5514                 }
5515                 sctp_free_a_readq(stcb, control);
5516         }
5517 }
5518
5519 void
5520 sctp_handle_forward_tsn(struct sctp_tcb *stcb,
5521     struct sctp_forward_tsn_chunk *fwd,
5522     int *abort_flag, struct mbuf *m, int offset)
5523 {
5524         /* The pr-sctp fwd tsn */
5525         /*
5526          * here we will perform all the data receiver side steps for
5527          * processing FwdTSN, as required in by pr-sctp draft:
5528          *
5529          * Assume we get FwdTSN(x):
5530          *
5531          * 1) update local cumTSN to x 2) try to further advance cumTSN to x
5532          * + others we have 3) examine and update re-ordering queue on
5533          * pr-in-streams 4) clean up re-assembly queue 5) Send a sack to
5534          * report where we are.
5535          */
5536         struct sctp_association *asoc;
5537         uint32_t new_cum_tsn, gap;
5538         unsigned int i, fwd_sz, m_size;
5539         uint32_t str_seq;
5540         struct sctp_stream_in *strm;
5541         struct sctp_queued_to_read *control, *sv;
5542
5543         asoc = &stcb->asoc;
5544         if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
5545                 SCTPDBG(SCTP_DEBUG_INDATA1,
5546                     "Bad size too small/big fwd-tsn\n");
5547                 return;
5548         }
5549         m_size = (stcb->asoc.mapping_array_size << 3);
5550         /*************************************************************/
5551         /* 1. Here we update local cumTSN and shift the bitmap array */
5552         /*************************************************************/
5553         new_cum_tsn = ntohl(fwd->new_cumulative_tsn);
5554
5555         if (SCTP_TSN_GE(asoc->cumulative_tsn, new_cum_tsn)) {
5556                 /* Already got there ... */
5557                 return;
5558         }
5559         /*
5560          * now we know the new TSN is more advanced, let's find the actual
5561          * gap
5562          */
5563         SCTP_CALC_TSN_TO_GAP(gap, new_cum_tsn, asoc->mapping_array_base_tsn);
5564         asoc->cumulative_tsn = new_cum_tsn;
5565         if (gap >= m_size) {
5566                 if ((long)gap > sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv)) {
5567                         struct mbuf *op_err;
5568                         char msg[SCTP_DIAG_INFO_LEN];
5569
5570                         /*
5571                          * out of range (of single byte chunks in the rwnd I
5572                          * give out). This must be an attacker.
5573                          */
5574                         *abort_flag = 1;
5575                         snprintf(msg, sizeof(msg),
5576                             "New cum ack %8.8x too high, highest TSN %8.8x",
5577                             new_cum_tsn, asoc->highest_tsn_inside_map);
5578                         op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
5579                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_33;
5580                         sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
5581                         return;
5582                 }
5583                 SCTP_STAT_INCR(sctps_fwdtsn_map_over);
5584
5585                 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
5586                 asoc->mapping_array_base_tsn = new_cum_tsn + 1;
5587                 asoc->highest_tsn_inside_map = new_cum_tsn;
5588
5589                 memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
5590                 asoc->highest_tsn_inside_nr_map = new_cum_tsn;
5591
5592                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
5593                         sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5594                 }
5595         } else {
5596                 SCTP_TCB_LOCK_ASSERT(stcb);
5597                 for (i = 0; i <= gap; i++) {
5598                         if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) &&
5599                             !SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, i)) {
5600                                 SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, i);
5601                                 if (SCTP_TSN_GT(asoc->mapping_array_base_tsn + i, asoc->highest_tsn_inside_nr_map)) {
5602                                         asoc->highest_tsn_inside_nr_map = asoc->mapping_array_base_tsn + i;
5603                                 }
5604                         }
5605                 }
5606         }
5607         /*************************************************************/
5608         /* 2. Clear up re-assembly queue                             */
5609         /*************************************************************/
5610
5611         /* This is now done as part of clearing up the stream/seq */
5612         if (asoc->idata_supported == 0) {
5613                 uint16_t sid;
5614
5615                 /* Flush all the un-ordered data based on cum-tsn */
5616                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5617                 for (sid = 0; sid < asoc->streamincnt; sid++) {
5618                         sctp_flush_reassm_for_str_seq(stcb, asoc, sid, 0, 0, new_cum_tsn);
5619                 }
5620                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5621         }
5622         /*******************************************************/
5623         /* 3. Update the PR-stream re-ordering queues and fix  */
5624         /* delivery issues as needed.                       */
5625         /*******************************************************/
5626         fwd_sz -= sizeof(*fwd);
5627         if (m && fwd_sz) {
5628                 /* New method. */
5629                 unsigned int num_str;
5630                 uint32_t mid, cur_mid;
5631                 uint16_t sid;
5632                 uint16_t ordered, flags;
5633                 struct sctp_strseq *stseq, strseqbuf;
5634                 struct sctp_strseq_mid *stseq_m, strseqbuf_m;
5635
5636                 offset += sizeof(*fwd);
5637
5638                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5639                 if (asoc->idata_supported) {
5640                         num_str = fwd_sz / sizeof(struct sctp_strseq_mid);
5641                 } else {
5642                         num_str = fwd_sz / sizeof(struct sctp_strseq);
5643                 }
5644                 for (i = 0; i < num_str; i++) {
5645                         if (asoc->idata_supported) {
5646                                 stseq_m = (struct sctp_strseq_mid *)sctp_m_getptr(m, offset,
5647                                     sizeof(struct sctp_strseq_mid),
5648                                     (uint8_t *)&strseqbuf_m);
5649                                 offset += sizeof(struct sctp_strseq_mid);
5650                                 if (stseq_m == NULL) {
5651                                         break;
5652                                 }
5653                                 sid = ntohs(stseq_m->sid);
5654                                 mid = ntohl(stseq_m->mid);
5655                                 flags = ntohs(stseq_m->flags);
5656                                 if (flags & PR_SCTP_UNORDERED_FLAG) {
5657                                         ordered = 0;
5658                                 } else {
5659                                         ordered = 1;
5660                                 }
5661                         } else {
5662                                 stseq = (struct sctp_strseq *)sctp_m_getptr(m, offset,
5663                                     sizeof(struct sctp_strseq),
5664                                     (uint8_t *)&strseqbuf);
5665                                 offset += sizeof(struct sctp_strseq);
5666                                 if (stseq == NULL) {
5667                                         break;
5668                                 }
5669                                 sid = ntohs(stseq->sid);
5670                                 mid = (uint32_t)ntohs(stseq->ssn);
5671                                 ordered = 1;
5672                         }
5673                         /* Convert */
5674
5675                         /* now process */
5676
5677                         /*
5678                          * Ok we now look for the stream/seq on the read
5679                          * queue where its not all delivered. If we find it
5680                          * we transmute the read entry into a PDI_ABORTED.
5681                          */
5682                         if (sid >= asoc->streamincnt) {
5683                                 /* screwed up streams, stop!  */
5684                                 break;
5685                         }
5686                         if ((asoc->str_of_pdapi == sid) &&
5687                             (asoc->ssn_of_pdapi == mid)) {
5688                                 /*
5689                                  * If this is the one we were partially
5690                                  * delivering now then we no longer are.
5691                                  * Note this will change with the reassembly
5692                                  * re-write.
5693                                  */
5694                                 asoc->fragmented_delivery_inprogress = 0;
5695                         }
5696                         strm = &asoc->strmin[sid];
5697                         for (cur_mid = strm->last_mid_delivered; SCTP_MID_GE(asoc->idata_supported, mid, cur_mid); cur_mid++) {
5698                                 sctp_flush_reassm_for_str_seq(stcb, asoc, sid, cur_mid, ordered, new_cum_tsn);
5699                         }
5700                         TAILQ_FOREACH(control, &stcb->sctp_ep->read_queue, next) {
5701                                 if ((control->sinfo_stream == sid) &&
5702                                     (SCTP_MID_EQ(asoc->idata_supported, control->mid, mid))) {
5703                                         str_seq = (sid << 16) | (0x0000ffff & mid);
5704                                         control->pdapi_aborted = 1;
5705                                         sv = stcb->asoc.control_pdapi;
5706                                         control->end_added = 1;
5707                                         if (control->on_strm_q == SCTP_ON_ORDERED) {
5708                                                 TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
5709                                                 if (asoc->size_on_all_streams >= control->length) {
5710                                                         asoc->size_on_all_streams -= control->length;
5711                                                 } else {
5712 #ifdef INVARIANTS
5713                                                         panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5714 #else
5715                                                         asoc->size_on_all_streams = 0;
5716 #endif
5717                                                 }
5718                                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
5719                                         } else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5720                                                 TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
5721 #ifdef INVARIANTS
5722                                         } else if (control->on_strm_q) {
5723                                                 panic("strm: %p ctl: %p unknown %d",
5724                                                     strm, control, control->on_strm_q);
5725 #endif
5726                                         }
5727                                         control->on_strm_q = 0;
5728                                         stcb->asoc.control_pdapi = control;
5729                                         sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
5730                                             stcb,
5731                                             SCTP_PARTIAL_DELIVERY_ABORTED,
5732                                             (void *)&str_seq,
5733                                             SCTP_SO_NOT_LOCKED);
5734                                         stcb->asoc.control_pdapi = sv;
5735                                         break;
5736                                 } else if ((control->sinfo_stream == sid) &&
5737                                     SCTP_MID_GT(asoc->idata_supported, control->mid, mid)) {
5738                                         /* We are past our victim SSN */
5739                                         break;
5740                                 }
5741                         }
5742                         if (SCTP_MID_GT(asoc->idata_supported, mid, strm->last_mid_delivered)) {
5743                                 /* Update the sequence number */
5744                                 strm->last_mid_delivered = mid;
5745                         }
5746                         /* now kick the stream the new way */
5747                         /* sa_ignore NO_NULL_CHK */
5748                         sctp_kick_prsctp_reorder_queue(stcb, strm);
5749                 }
5750                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5751         }
5752         /*
5753          * Now slide thing forward.
5754          */
5755         sctp_slide_mapping_arrays(stcb);
5756 }