sys/netinet/sctp_indata.c

   1 /*-
   2  * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_indata.c,v 1.36 2005/03/06 16:04:17 itojun Exp $  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_input.h>
  44 #include <netinet/sctp_indata.h>
  45 #include <netinet/sctp_uio.h>
  46 #include <netinet/sctp_timer.h>
  47
  48
  49 /*
  50  * NOTES: On the outbound side of things I need to check the sack timer to
  51  * see if I should generate a sack into the chunk queue (if I have data to
  52  * send that is and will be sending it .. for bundling.
  53  *
  54  * The callback in sctp_usrreq.c will get called when the socket is read from.
  55  * This will cause sctp_service_queues() to get called on the top entry in
  56  * the list.
  57  */
  58
  59 __inline void
  60 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
  61 {
  62         uint32_t calc, calc_w_oh;
  63
  64         /*
  65          * This is really set wrong with respect to a 1-2-m socket. Since
  66          * the sb_cc is the count that everyone as put up. When we re-write
  67          * sctp_soreceive then we will fix this so that ONLY this
  68          * associations data is taken into account.
  69          */
  70         if (stcb->sctp_socket == NULL)
  71                 return;
  72
  73         if (stcb->asoc.sb_cc == 0 &&
  74             asoc->size_on_reasm_queue == 0 &&
  75             asoc->size_on_all_streams == 0) {
  76                 /* Full rwnd granted */
  77                 asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket),
  78                     SCTP_MINIMAL_RWND);
  79                 return;
  80         }
  81         /* get actual space */
  82         calc = (uint32_t) sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
  83
  84         /*
  85          * take out what has NOT been put on socket queue and we yet hold
  86          * for putting up.
  87          */
  88         calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_reasm_queue);
  89         calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_all_streams);
  90
  91         if (calc == 0) {
  92                 /* out of space */
  93                 asoc->my_rwnd = 0;
  94                 return;
  95         }
  96         /* what is the overhead of all these rwnd's */
  97         calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
  98         asoc->my_rwnd = calc;
  99         if (calc_w_oh == 0) {
 100                 /*
 101                  * If our overhead is greater than the advertised rwnd, we
 102                  * clamp the rwnd to 1. This lets us still accept inbound
 103                  * segments, but hopefully will shut the sender down when he
 104                  * finally gets the message.
 105                  */
 106                 asoc->my_rwnd = 1;
 107         } else {
 108                 /* SWS threshold */
 109                 if (asoc->my_rwnd &&
 110                     (asoc->my_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
 111                         /* SWS engaged, tell peer none left */
 112                         asoc->my_rwnd = 1;
 113                 }
 114         }
 115 }
 116
 117 /* Calculate what the rwnd would be */
 118
 119 __inline uint32_t
 120 sctp_calc_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
 121 {
 122         uint32_t calc = 0, calc_w_oh;
 123
 124         /*
 125          * This is really set wrong with respect to a 1-2-m socket. Since
 126          * the sb_cc is the count that everyone as put up. When we re-write
 127          * sctp_soreceive then we will fix this so that ONLY this
 128          * associations data is taken into account.
 129          */
 130         if (stcb->sctp_socket == NULL)
 131                 return (calc);
 132
 133         if (stcb->asoc.sb_cc == 0 &&
 134             asoc->size_on_reasm_queue == 0 &&
 135             asoc->size_on_all_streams == 0) {
 136                 /* Full rwnd granted */
 137                 calc = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket),
 138                     SCTP_MINIMAL_RWND);
 139                 return (calc);
 140         }
 141         /* get actual space */
 142         calc = (uint32_t) sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
 143
 144         /*
 145          * take out what has NOT been put on socket queue and we yet hold
 146          * for putting up.
 147          */
 148         calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_reasm_queue);
 149         calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_all_streams);
 150
 151         if (calc == 0) {
 152                 /* out of space */
 153                 return (calc);
 154         }
 155         /* what is the overhead of all these rwnd's */
 156         calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
 157         if (calc_w_oh == 0) {
 158                 /*
 159                  * If our overhead is greater than the advertised rwnd, we
 160                  * clamp the rwnd to 1. This lets us still accept inbound
 161                  * segments, but hopefully will shut the sender down when he
 162                  * finally gets the message.
 163                  */
 164                 calc = 1;
 165         } else {
 166                 /* SWS threshold */
 167                 if (calc &&
 168                     (calc < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
 169                         /* SWS engaged, tell peer none left */
 170                         calc = 1;
 171                 }
 172         }
 173         return (calc);
 174 }
 175
 176
 177
 178 /*
 179  * Build out our readq entry based on the incoming packet.
 180  */
 181 struct sctp_queued_to_read *
 182 sctp_build_readq_entry(struct sctp_tcb *stcb,
 183     struct sctp_nets *net,
 184     uint32_t tsn, uint32_t ppid,
 185     uint32_t context, uint16_t stream_no,
 186     uint16_t stream_seq, uint8_t flags,
 187     struct mbuf *dm)
 188 {
 189         struct sctp_queued_to_read *read_queue_e = NULL;
 190
 191         sctp_alloc_a_readq(stcb, read_queue_e);
 192         if (read_queue_e == NULL) {
 193                 goto failed_build;
 194         }
 195         read_queue_e->sinfo_stream = stream_no;
 196         read_queue_e->sinfo_ssn = stream_seq;
 197         read_queue_e->sinfo_flags = (flags << 8);
 198         read_queue_e->sinfo_ppid = ppid;
 199         read_queue_e->sinfo_context = stcb->asoc.context;
 200         read_queue_e->sinfo_timetolive = 0;
 201         read_queue_e->sinfo_tsn = tsn;
 202         read_queue_e->sinfo_cumtsn = tsn;
 203         read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
 204         read_queue_e->whoFrom = net;
 205         read_queue_e->length = 0;
 206         atomic_add_int(&net->ref_count, 1);
 207         read_queue_e->data = dm;
 208         read_queue_e->spec_flags = 0;
 209         read_queue_e->tail_mbuf = NULL;
 210         read_queue_e->stcb = stcb;
 211         read_queue_e->port_from = stcb->rport;
 212         read_queue_e->do_not_ref_stcb = 0;
 213         read_queue_e->end_added = 0;
 214         read_queue_e->pdapi_aborted = 0;
 215 failed_build:
 216         return (read_queue_e);
 217 }
 218
 219
 220 /*
 221  * Build out our readq entry based on the incoming packet.
 222  */
 223 static struct sctp_queued_to_read *
 224 sctp_build_readq_entry_chk(struct sctp_tcb *stcb,
 225     struct sctp_tmit_chunk *chk)
 226 {
 227         struct sctp_queued_to_read *read_queue_e = NULL;
 228
 229         sctp_alloc_a_readq(stcb, read_queue_e);
 230         if (read_queue_e == NULL) {
 231                 goto failed_build;
 232         }
 233         read_queue_e->sinfo_stream = chk->rec.data.stream_number;
 234         read_queue_e->sinfo_ssn = chk->rec.data.stream_seq;
 235         read_queue_e->sinfo_flags = (chk->rec.data.rcv_flags << 8);
 236         read_queue_e->sinfo_ppid = chk->rec.data.payloadtype;
 237         read_queue_e->sinfo_context = stcb->asoc.context;
 238         read_queue_e->sinfo_timetolive = 0;
 239         read_queue_e->sinfo_tsn = chk->rec.data.TSN_seq;
 240         read_queue_e->sinfo_cumtsn = chk->rec.data.TSN_seq;
 241         read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
 242         read_queue_e->whoFrom = chk->whoTo;
 243         read_queue_e->length = 0;
 244         atomic_add_int(&chk->whoTo->ref_count, 1);
 245         read_queue_e->data = chk->data;
 246         read_queue_e->tail_mbuf = NULL;
 247         read_queue_e->stcb = stcb;
 248         read_queue_e->port_from = stcb->rport;
 249         read_queue_e->spec_flags = 0;
 250         read_queue_e->do_not_ref_stcb = 0;
 251         read_queue_e->end_added = 0;
 252         read_queue_e->pdapi_aborted = 0;
 253 failed_build:
 254         return (read_queue_e);
 255 }
 256
 257
 258 struct mbuf *
 259 sctp_build_ctl_nchunk(struct sctp_inpcb *inp,
 260     struct sctp_sndrcvinfo *sinfo)
 261 {
 262         struct sctp_sndrcvinfo *outinfo;
 263         struct cmsghdr *cmh;
 264         struct mbuf *ret;
 265         int len;
 266         int use_extended = 0;
 267
 268         if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
 269                 /* user does not want the sndrcv ctl */
 270                 return (NULL);
 271         }
 272         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
 273                 use_extended = 1;
 274                 len = CMSG_LEN(sizeof(struct sctp_extrcvinfo));
 275         } else {
 276                 len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
 277         }
 278
 279
 280         ret = sctp_get_mbuf_for_msg(len,
 281             0, M_DONTWAIT, 1, MT_DATA);
 282
 283         if (ret == NULL) {
 284                 /* No space */
 285                 return (ret);
 286         }
 287         /* We need a CMSG header followed by the struct  */
 288         cmh = mtod(ret, struct cmsghdr *);
 289         outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
 290         cmh->cmsg_level = IPPROTO_SCTP;
 291         if (use_extended) {
 292                 cmh->cmsg_type = SCTP_EXTRCV;
 293                 cmh->cmsg_len = len;
 294                 memcpy(outinfo, sinfo, len);
 295         } else {
 296                 cmh->cmsg_type = SCTP_SNDRCV;
 297                 cmh->cmsg_len = len;
 298                 *outinfo = *sinfo;
 299         }
 300         SCTP_BUF_LEN(ret) = cmh->cmsg_len;
 301         return (ret);
 302 }
 303
 304
 305 /*
 306  * We are delivering currently from the reassembly queue. We must continue to
 307  * deliver until we either: 1) run out of space. 2) run out of sequential
 308  * TSN's 3) hit the SCTP_DATA_LAST_FRAG flag.
 309  */
 310 static void
 311 sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc)
 312 {
 313         struct sctp_tmit_chunk *chk;
 314         uint16_t nxt_todel;
 315         uint16_t stream_no;
 316         int end = 0;
 317         int cntDel;
 318         struct sctp_queued_to_read *control, *ctl, *ctlat;
 319
 320         cntDel = stream_no = 0;
 321         if (stcb &&
 322             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 323             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET))) {
 324                 /* socket above is long gone */
 325                 asoc->fragmented_delivery_inprogress = 0;
 326                 chk = TAILQ_FIRST(&asoc->reasmqueue);
 327                 while (chk) {
 328                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
 329                         asoc->size_on_reasm_queue -= chk->send_size;
 330                         sctp_ucount_decr(asoc->cnt_on_reasm_queue);
 331                         /*
 332                          * Lose the data pointer, since its in the socket
 333                          * buffer
 334                          */
 335                         if (chk->data) {
 336                                 sctp_m_freem(chk->data);
 337                                 chk->data = NULL;
 338                         }
 339                         /* Now free the address and data */
 340                         sctp_free_remote_addr(chk->whoTo);
 341                         sctp_free_a_chunk(stcb, chk);
 342                         chk = TAILQ_FIRST(&asoc->reasmqueue);
 343                 }
 344                 return;
 345         }
 346         SCTP_TCB_LOCK_ASSERT(stcb);
 347         do {
 348                 chk = TAILQ_FIRST(&asoc->reasmqueue);
 349                 if (chk == NULL) {
 350                         return;
 351                 }
 352                 if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) {
 353                         /* Can't deliver more :< */
 354                         return;
 355                 }
 356                 stream_no = chk->rec.data.stream_number;
 357                 nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1;
 358                 if (nxt_todel != chk->rec.data.stream_seq &&
 359                     (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
 360                         /*
 361                          * Not the next sequence to deliver in its stream OR
 362                          * unordered
 363                          */
 364                         return;
 365                 }
 366                 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 367
 368                         control = sctp_build_readq_entry_chk(stcb, chk);
 369                         if (control == NULL) {
 370                                 /* out of memory? */
 371                                 return;
 372                         }
 373                         /* save it off for our future deliveries */
 374                         stcb->asoc.control_pdapi = control;
 375                         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG)
 376                                 end = 1;
 377                         else
 378                                 end = 0;
 379                         sctp_add_to_readq(stcb->sctp_ep,
 380                             stcb, control, &stcb->sctp_socket->so_rcv, end);
 381                         cntDel++;
 382                 } else {
 383                         if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG)
 384                                 end = 1;
 385                         else
 386                                 end = 0;
 387                         if (sctp_append_to_readq(stcb->sctp_ep, stcb,
 388                             stcb->asoc.control_pdapi,
 389                             chk->data, end, chk->rec.data.TSN_seq,
 390                             &stcb->sctp_socket->so_rcv)) {
 391                                 /*
 392                                  * something is very wrong, either
 393                                  * control_pdapi is NULL, or the tail_mbuf
 394                                  * is corrupt, or there is a EOM already on
 395                                  * the mbuf chain.
 396                                  */
 397                                 if (stcb->asoc.control_pdapi == NULL) {
 398                                         panic("This should not happen control_pdapi NULL?");
 399                                 }
 400                                 if (stcb->asoc.control_pdapi->tail_mbuf == NULL) {
 401                                         panic("This should not happen, tail_mbuf not being maintained?");
 402                                 }
 403                                 /* if we did not panic, it was a EOM */
 404                                 panic("Bad chunking ??");
 405                         }
 406                         cntDel++;
 407                 }
 408                 /* pull it we did it */
 409                 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
 410                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
 411                         asoc->fragmented_delivery_inprogress = 0;
 412                         if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
 413                                 asoc->strmin[stream_no].last_sequence_delivered++;
 414                         }
 415                         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
 416                                 SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
 417                         }
 418                 } else if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 419                         /*
 420                          * turn the flag back on since we just  delivered
 421                          * yet another one.
 422                          */
 423                         asoc->fragmented_delivery_inprogress = 1;
 424                 }
 425                 asoc->tsn_of_pdapi_last_delivered = chk->rec.data.TSN_seq;
 426                 asoc->last_flags_delivered = chk->rec.data.rcv_flags;
 427                 asoc->last_strm_seq_delivered = chk->rec.data.stream_seq;
 428                 asoc->last_strm_no_delivered = chk->rec.data.stream_number;
 429
 430                 asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
 431                 asoc->size_on_reasm_queue -= chk->send_size;
 432                 sctp_ucount_decr(asoc->cnt_on_reasm_queue);
 433                 /* free up the chk */
 434                 chk->data = NULL;
 435                 sctp_free_remote_addr(chk->whoTo);
 436                 sctp_free_a_chunk(stcb, chk);
 437
 438                 if (asoc->fragmented_delivery_inprogress == 0) {
 439                         /*
 440                          * Now lets see if we can deliver the next one on
 441                          * the stream
 442                          */
 443                         uint16_t nxt_todel;
 444                         struct sctp_stream_in *strm;
 445
 446                         strm = &asoc->strmin[stream_no];
 447                         nxt_todel = strm->last_sequence_delivered + 1;
 448                         ctl = TAILQ_FIRST(&strm->inqueue);
 449                         if (ctl && (nxt_todel == ctl->sinfo_ssn)) {
 450                                 while (ctl != NULL) {
 451                                         /* Deliver more if we can. */
 452                                         if (nxt_todel == ctl->sinfo_ssn) {
 453                                                 ctlat = TAILQ_NEXT(ctl, next);
 454                                                 TAILQ_REMOVE(&strm->inqueue, ctl, next);
 455                                                 asoc->size_on_all_streams -= ctl->length;
 456                                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
 457                                                 strm->last_sequence_delivered++;
 458                                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
 459                                                     ctl,
 460                                                     &stcb->sctp_socket->so_rcv, 1);
 461                                                 ctl = ctlat;
 462                                         } else {
 463                                                 break;
 464                                         }
 465                                         nxt_todel = strm->last_sequence_delivered + 1;
 466                                 }
 467                         }
 468                         break;
 469                 }
 470                 chk = TAILQ_FIRST(&asoc->reasmqueue);
 471         } while (chk);
 472 }
 473
 474 /*
 475  * Queue the chunk either right into the socket buffer if it is the next one
 476  * to go OR put it in the correct place in the delivery queue.  If we do
 477  * append to the so_buf, keep doing so until we are out of order. One big
 478  * question still remains, what to do when the socket buffer is FULL??
 479  */
 480 static void
 481 sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc,
 482     struct sctp_queued_to_read *control, int *abort_flag)
 483 {
 484         /*
 485          * FIX-ME maybe? What happens when the ssn wraps? If we are getting
 486          * all the data in one stream this could happen quite rapidly. One
 487          * could use the TSN to keep track of things, but this scheme breaks
 488          * down in the other type of stream useage that could occur. Send a
 489          * single msg to stream 0, send 4Billion messages to stream 1, now
 490          * send a message to stream 0. You have a situation where the TSN
 491          * has wrapped but not in the stream. Is this worth worrying about
 492          * or should we just change our queue sort at the bottom to be by
 493          * TSN.
 494          *
 495          * Could it also be legal for a peer to send ssn 1 with TSN 2 and ssn 2
 496          * with TSN 1? If the peer is doing some sort of funky TSN/SSN
 497          * assignment this could happen... and I don't see how this would be
 498          * a violation. So for now I am undecided an will leave the sort by
 499          * SSN alone. Maybe a hybred approach is the answer
 500          *
 501          */
 502         struct sctp_stream_in *strm;
 503         struct sctp_queued_to_read *at;
 504         int queue_needed;
 505         uint16_t nxt_todel;
 506         struct mbuf *oper;
 507
 508         queue_needed = 1;
 509         asoc->size_on_all_streams += control->length;
 510         sctp_ucount_incr(asoc->cnt_on_all_streams);
 511         strm = &asoc->strmin[control->sinfo_stream];
 512         nxt_todel = strm->last_sequence_delivered + 1;
 513 #ifdef SCTP_STR_LOGGING
 514         sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
 515 #endif
 516 #ifdef SCTP_DEBUG
 517         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 518                 printf("queue to stream called for ssn:%u lastdel:%u nxt:%u\n",
 519                     (uint32_t) control->sinfo_stream,
 520                     (uint32_t) strm->last_sequence_delivered, (uint32_t) nxt_todel);
 521         }
 522 #endif
 523         if (compare_with_wrap(strm->last_sequence_delivered,
 524             control->sinfo_ssn, MAX_SEQ) ||
 525             (strm->last_sequence_delivered == control->sinfo_ssn)) {
 526                 /* The incoming sseq is behind where we last delivered? */
 527 #ifdef SCTP_DEBUG
 528                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 529                         printf("Duplicate S-SEQ:%d delivered:%d from peer, Abort  association\n",
 530                             control->sinfo_ssn,
 531                             strm->last_sequence_delivered);
 532                 }
 533 #endif
 534                 /*
 535                  * throw it in the stream so it gets cleaned up in
 536                  * association destruction
 537                  */
 538                 TAILQ_INSERT_HEAD(&strm->inqueue, control, next);
 539                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
 540                     0, M_DONTWAIT, 1, MT_DATA);
 541                 if (oper) {
 542                         struct sctp_paramhdr *ph;
 543                         uint32_t *ippp;
 544
 545                         SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
 546                             (sizeof(uint32_t) * 3);
 547                         ph = mtod(oper, struct sctp_paramhdr *);
 548                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 549                         ph->param_length = htons(SCTP_BUF_LEN(oper));
 550                         ippp = (uint32_t *) (ph + 1);
 551                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_1);
 552                         ippp++;
 553                         *ippp = control->sinfo_tsn;
 554                         ippp++;
 555                         *ippp = ((control->sinfo_stream << 16) | control->sinfo_ssn);
 556                 }
 557                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_1;
 558                 sctp_abort_an_association(stcb->sctp_ep, stcb,
 559                     SCTP_PEER_FAULTY, oper);
 560
 561                 *abort_flag = 1;
 562                 return;
 563
 564         }
 565         if (nxt_todel == control->sinfo_ssn) {
 566                 /* can be delivered right away? */
 567 #ifdef SCTP_STR_LOGGING
 568                 sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
 569 #endif
 570                 queue_needed = 0;
 571                 asoc->size_on_all_streams -= control->length;
 572                 sctp_ucount_decr(asoc->cnt_on_all_streams);
 573                 strm->last_sequence_delivered++;
 574                 sctp_add_to_readq(stcb->sctp_ep, stcb,
 575                     control,
 576                     &stcb->sctp_socket->so_rcv, 1);
 577                 control = TAILQ_FIRST(&strm->inqueue);
 578                 while (control != NULL) {
 579                         /* all delivered */
 580                         nxt_todel = strm->last_sequence_delivered + 1;
 581                         if (nxt_todel == control->sinfo_ssn) {
 582                                 at = TAILQ_NEXT(control, next);
 583                                 TAILQ_REMOVE(&strm->inqueue, control, next);
 584                                 asoc->size_on_all_streams -= control->length;
 585                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
 586                                 strm->last_sequence_delivered++;
 587                                 /*
 588                                  * We ignore the return of deliver_data here
 589                                  * since we always can hold the chunk on the
 590                                  * d-queue. And we have a finite number that
 591                                  * can be delivered from the strq.
 592                                  */
 593 #ifdef SCTP_STR_LOGGING
 594                                 sctp_log_strm_del(control, NULL,
 595                                     SCTP_STR_LOG_FROM_IMMED_DEL);
 596 #endif
 597                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
 598                                     control,
 599                                     &stcb->sctp_socket->so_rcv, 1);
 600                                 control = at;
 601                                 continue;
 602                         }
 603                         break;
 604                 }
 605         }
 606         if (queue_needed) {
 607                 /*
 608                  * Ok, we did not deliver this guy, find the correct place
 609                  * to put it on the queue.
 610                  */
 611                 if (TAILQ_EMPTY(&strm->inqueue)) {
 612                         /* Empty queue */
 613 #ifdef SCTP_STR_LOGGING
 614                         sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INSERT_HD);
 615 #endif
 616                         TAILQ_INSERT_HEAD(&strm->inqueue, control, next);
 617                 } else {
 618                         TAILQ_FOREACH(at, &strm->inqueue, next) {
 619                                 if (compare_with_wrap(at->sinfo_ssn,
 620                                     control->sinfo_ssn, MAX_SEQ)) {
 621                                         /*
 622                                          * one in queue is bigger than the
 623                                          * new one, insert before this one
 624                                          */
 625 #ifdef SCTP_STR_LOGGING
 626                                         sctp_log_strm_del(control, at,
 627                                             SCTP_STR_LOG_FROM_INSERT_MD);
 628 #endif
 629                                         TAILQ_INSERT_BEFORE(at, control, next);
 630                                         break;
 631                                 } else if (at->sinfo_ssn == control->sinfo_ssn) {
 632                                         /*
 633                                          * Gak, He sent me a duplicate str
 634                                          * seq number
 635                                          */
 636                                         /*
 637                                          * foo bar, I guess I will just free
 638                                          * this new guy, should we abort
 639                                          * too? FIX ME MAYBE? Or it COULD be
 640                                          * that the SSN's have wrapped.
 641                                          * Maybe I should compare to TSN
 642                                          * somehow... sigh for now just blow
 643                                          * away the chunk!
 644                                          */
 645
 646                                         if (control->data)
 647                                                 sctp_m_freem(control->data);
 648                                         control->data = NULL;
 649                                         asoc->size_on_all_streams -= control->length;
 650                                         sctp_ucount_decr(asoc->cnt_on_all_streams);
 651                                         sctp_free_remote_addr(control->whoFrom);
 652                                         sctp_free_a_readq(stcb, control);
 653                                         return;
 654                                 } else {
 655                                         if (TAILQ_NEXT(at, next) == NULL) {
 656                                                 /*
 657                                                  * We are at the end, insert
 658                                                  * it after this one
 659                                                  */
 660 #ifdef SCTP_STR_LOGGING
 661                                                 sctp_log_strm_del(control, at,
 662                                                     SCTP_STR_LOG_FROM_INSERT_TL);
 663 #endif
 664                                                 TAILQ_INSERT_AFTER(&strm->inqueue,
 665                                                     at, control, next);
 666                                                 break;
 667                                         }
 668                                 }
 669                         }
 670                 }
 671         }
 672 }
 673
 674 /*
 675  * Returns two things: You get the total size of the deliverable parts of the
 676  * first fragmented message on the reassembly queue. And you get a 1 back if
 677  * all of the message is ready or a 0 back if the message is still incomplete
 678  */
 679 static int
 680 sctp_is_all_msg_on_reasm(struct sctp_association *asoc, uint32_t * t_size)
 681 {
 682         struct sctp_tmit_chunk *chk;
 683         uint32_t tsn;
 684
 685         *t_size = 0;
 686         chk = TAILQ_FIRST(&asoc->reasmqueue);
 687         if (chk == NULL) {
 688                 /* nothing on the queue */
 689                 return (0);
 690         }
 691         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
 692                 /* Not a first on the queue */
 693                 return (0);
 694         }
 695         tsn = chk->rec.data.TSN_seq;
 696         while (chk) {
 697                 if (tsn != chk->rec.data.TSN_seq) {
 698                         return (0);
 699                 }
 700                 *t_size += chk->send_size;
 701                 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
 702                         return (1);
 703                 }
 704                 tsn++;
 705                 chk = TAILQ_NEXT(chk, sctp_next);
 706         }
 707         return (0);
 708 }
 709
 710 static void
 711 sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc)
 712 {
 713         struct sctp_tmit_chunk *chk;
 714         uint16_t nxt_todel;
 715         uint32_t tsize;
 716
 717 doit_again:
 718         chk = TAILQ_FIRST(&asoc->reasmqueue);
 719         if (chk == NULL) {
 720                 /* Huh? */
 721                 asoc->size_on_reasm_queue = 0;
 722                 asoc->cnt_on_reasm_queue = 0;
 723                 return;
 724         }
 725         if (asoc->fragmented_delivery_inprogress == 0) {
 726                 nxt_todel =
 727                     asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
 728                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
 729                     (nxt_todel == chk->rec.data.stream_seq ||
 730                     (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
 731                         /*
 732                          * Yep the first one is here and its ok to deliver
 733                          * but should we?
 734                          */
 735                         if ((sctp_is_all_msg_on_reasm(asoc, &tsize) ||
 736                             (tsize > stcb->sctp_ep->partial_delivery_point))) {
 737
 738                                 /*
 739                                  * Yes, we setup to start reception, by
 740                                  * backing down the TSN just in case we
 741                                  * can't deliver. If we
 742                                  */
 743                                 asoc->fragmented_delivery_inprogress = 1;
 744                                 asoc->tsn_last_delivered =
 745                                     chk->rec.data.TSN_seq - 1;
 746                                 asoc->str_of_pdapi =
 747                                     chk->rec.data.stream_number;
 748                                 asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
 749                                 asoc->pdapi_ppid = chk->rec.data.payloadtype;
 750                                 asoc->fragment_flags = chk->rec.data.rcv_flags;
 751                                 sctp_service_reassembly(stcb, asoc);
 752                         }
 753                 }
 754         } else {
 755                 /*
 756                  * Service re-assembly will deliver stream data queued at
 757                  * the end of fragmented delivery.. but it wont know to go
 758                  * back and call itself again... we do that here with the
 759                  * got doit_again
 760                  */
 761                 sctp_service_reassembly(stcb, asoc);
 762                 if (asoc->fragmented_delivery_inprogress == 0) {
 763                         /*
 764                          * finished our Fragmented delivery, could be more
 765                          * waiting?
 766                          */
 767                         goto doit_again;
 768                 }
 769         }
 770 }
 771
 772 /*
 773  * Dump onto the re-assembly queue, in its proper place. After dumping on the
 774  * queue, see if anthing can be delivered. If so pull it off (or as much as
 775  * we can. If we run out of space then we must dump what we can and set the
 776  * appropriate flag to say we queued what we could.
 777  */
 778 static void
 779 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
 780     struct sctp_tmit_chunk *chk, int *abort_flag)
 781 {
 782         struct mbuf *oper;
 783         uint32_t cum_ackp1, last_tsn, prev_tsn, post_tsn;
 784         u_char last_flags;
 785         struct sctp_tmit_chunk *at, *prev, *next;
 786
 787         prev = next = NULL;
 788         cum_ackp1 = asoc->tsn_last_delivered + 1;
 789         if (TAILQ_EMPTY(&asoc->reasmqueue)) {
 790                 /* This is the first one on the queue */
 791                 TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next);
 792                 /*
 793                  * we do not check for delivery of anything when only one
 794                  * fragment is here
 795                  */
 796                 asoc->size_on_reasm_queue = chk->send_size;
 797                 sctp_ucount_incr(asoc->cnt_on_reasm_queue);
 798                 if (chk->rec.data.TSN_seq == cum_ackp1) {
 799                         if (asoc->fragmented_delivery_inprogress == 0 &&
 800                             (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) !=
 801                             SCTP_DATA_FIRST_FRAG) {
 802                                 /*
 803                                  * An empty queue, no delivery inprogress,
 804                                  * we hit the next one and it does NOT have
 805                                  * a FIRST fragment mark.
 806                                  */
 807 #ifdef SCTP_DEBUG
 808                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 809                                         printf("Gak, Evil plot, its not first, no fragmented delivery in progress\n");
 810                                 }
 811 #endif
 812                                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
 813                                     0, M_DONTWAIT, 1, MT_DATA);
 814
 815                                 if (oper) {
 816                                         struct sctp_paramhdr *ph;
 817                                         uint32_t *ippp;
 818
 819                                         SCTP_BUF_LEN(oper) =
 820                                             sizeof(struct sctp_paramhdr) +
 821                                             (sizeof(uint32_t) * 3);
 822                                         ph = mtod(oper, struct sctp_paramhdr *);
 823                                         ph->param_type =
 824                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 825                                         ph->param_length = htons(SCTP_BUF_LEN(oper));
 826                                         ippp = (uint32_t *) (ph + 1);
 827                                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_2);
 828                                         ippp++;
 829                                         *ippp = chk->rec.data.TSN_seq;
 830                                         ippp++;
 831                                         *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
 832
 833                                 }
 834                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_2;
 835                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
 836                                     SCTP_PEER_FAULTY, oper);
 837                                 *abort_flag = 1;
 838                         } else if (asoc->fragmented_delivery_inprogress &&
 839                             (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
 840                                 /*
 841                                  * We are doing a partial delivery and the
 842                                  * NEXT chunk MUST be either the LAST or
 843                                  * MIDDLE fragment NOT a FIRST
 844                                  */
 845 #ifdef SCTP_DEBUG
 846                                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 847                                         printf("Gak, Evil plot, it IS a first and fragmented delivery in progress\n");
 848                                 }
 849 #endif
 850                                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
 851                                     0, M_DONTWAIT, 1, MT_DATA);
 852                                 if (oper) {
 853                                         struct sctp_paramhdr *ph;
 854                                         uint32_t *ippp;
 855
 856                                         SCTP_BUF_LEN(oper) =
 857                                             sizeof(struct sctp_paramhdr) +
 858                                             (3 * sizeof(uint32_t));
 859                                         ph = mtod(oper, struct sctp_paramhdr *);
 860                                         ph->param_type =
 861                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 862                                         ph->param_length = htons(SCTP_BUF_LEN(oper));
 863                                         ippp = (uint32_t *) (ph + 1);
 864                                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_3);
 865                                         ippp++;
 866                                         *ippp = chk->rec.data.TSN_seq;
 867                                         ippp++;
 868                                         *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
 869                                 }
 870                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_3;
 871                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
 872                                     SCTP_PEER_FAULTY, oper);
 873                                 *abort_flag = 1;
 874                         } else if (asoc->fragmented_delivery_inprogress) {
 875                                 /*
 876                                  * Here we are ok with a MIDDLE or LAST
 877                                  * piece
 878                                  */
 879                                 if (chk->rec.data.stream_number !=
 880                                     asoc->str_of_pdapi) {
 881                                         /* Got to be the right STR No */
 882 #ifdef SCTP_DEBUG
 883                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 884                                                 printf("Gak, Evil plot, it IS not same stream number %d vs %d\n",
 885                                                     chk->rec.data.stream_number,
 886                                                     asoc->str_of_pdapi);
 887                                         }
 888 #endif
 889                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
 890                                             0, M_DONTWAIT, 1, MT_DATA);
 891                                         if (oper) {
 892                                                 struct sctp_paramhdr *ph;
 893                                                 uint32_t *ippp;
 894
 895                                                 SCTP_BUF_LEN(oper) =
 896                                                     sizeof(struct sctp_paramhdr) +
 897                                                     (sizeof(uint32_t) * 3);
 898                                                 ph = mtod(oper,
 899                                                     struct sctp_paramhdr *);
 900                                                 ph->param_type =
 901                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 902                                                 ph->param_length =
 903                                                     htons(SCTP_BUF_LEN(oper));
 904                                                 ippp = (uint32_t *) (ph + 1);
 905                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_4);
 906                                                 ippp++;
 907                                                 *ippp = chk->rec.data.TSN_seq;
 908                                                 ippp++;
 909                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
 910                                         }
 911                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_4;
 912                                         sctp_abort_an_association(stcb->sctp_ep,
 913                                             stcb, SCTP_PEER_FAULTY, oper);
 914                                         *abort_flag = 1;
 915                                 } else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) !=
 916                                             SCTP_DATA_UNORDERED &&
 917                                             chk->rec.data.stream_seq !=
 918                                     asoc->ssn_of_pdapi) {
 919                                         /* Got to be the right STR Seq */
 920 #ifdef SCTP_DEBUG
 921                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
 922                                                 printf("Gak, Evil plot, it IS not same stream seq %d vs %d\n",
 923                                                     chk->rec.data.stream_seq,
 924                                                     asoc->ssn_of_pdapi);
 925                                         }
 926 #endif
 927                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
 928                                             0, M_DONTWAIT, 1, MT_DATA);
 929                                         if (oper) {
 930                                                 struct sctp_paramhdr *ph;
 931                                                 uint32_t *ippp;
 932
 933                                                 SCTP_BUF_LEN(oper) =
 934                                                     sizeof(struct sctp_paramhdr) +
 935                                                     (3 * sizeof(uint32_t));
 936                                                 ph = mtod(oper,
 937                                                     struct sctp_paramhdr *);
 938                                                 ph->param_type =
 939                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 940                                                 ph->param_length =
 941                                                     htons(SCTP_BUF_LEN(oper));
 942                                                 ippp = (uint32_t *) (ph + 1);
 943                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_5);
 944                                                 ippp++;
 945                                                 *ippp = chk->rec.data.TSN_seq;
 946                                                 ippp++;
 947                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
 948
 949                                         }
 950                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_5;
 951                                         sctp_abort_an_association(stcb->sctp_ep,
 952                                             stcb, SCTP_PEER_FAULTY, oper);
 953                                         *abort_flag = 1;
 954                                 }
 955                         }
 956                 }
 957                 return;
 958         }
 959         /* Find its place */
 960         TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
 961                 if (compare_with_wrap(at->rec.data.TSN_seq,
 962                     chk->rec.data.TSN_seq, MAX_TSN)) {
 963                         /*
 964                          * one in queue is bigger than the new one, insert
 965                          * before this one
 966                          */
 967                         /* A check */
 968                         asoc->size_on_reasm_queue += chk->send_size;
 969                         sctp_ucount_incr(asoc->cnt_on_reasm_queue);
 970                         next = at;
 971                         TAILQ_INSERT_BEFORE(at, chk, sctp_next);
 972                         break;
 973                 } else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) {
 974                         /* Gak, He sent me a duplicate str seq number */
 975                         /*
 976                          * foo bar, I guess I will just free this new guy,
 977                          * should we abort too? FIX ME MAYBE? Or it COULD be
 978                          * that the SSN's have wrapped. Maybe I should
 979                          * compare to TSN somehow... sigh for now just blow
 980                          * away the chunk!
 981                          */
 982                         if (chk->data) {
 983                                 sctp_m_freem(chk->data);
 984                                 chk->data = NULL;
 985                         }
 986                         sctp_free_remote_addr(chk->whoTo);
 987                         sctp_free_a_chunk(stcb, chk);
 988                         return;
 989                 } else {
 990                         last_flags = at->rec.data.rcv_flags;
 991                         last_tsn = at->rec.data.TSN_seq;
 992                         prev = at;
 993                         if (TAILQ_NEXT(at, sctp_next) == NULL) {
 994                                 /*
 995                                  * We are at the end, insert it after this
 996                                  * one
 997                                  */
 998                                 /* check it first */
 999                                 asoc->size_on_reasm_queue += chk->send_size;
1000                                 sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1001                                 TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next);
1002                                 break;
1003                         }
1004                 }
1005         }
1006         /* Now the audits */
1007         if (prev) {
1008                 prev_tsn = chk->rec.data.TSN_seq - 1;
1009                 if (prev_tsn == prev->rec.data.TSN_seq) {
1010                         /*
1011                          * Ok the one I am dropping onto the end is the
1012                          * NEXT. A bit of valdiation here.
1013                          */
1014                         if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1015                             SCTP_DATA_FIRST_FRAG ||
1016                             (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1017                             SCTP_DATA_MIDDLE_FRAG) {
1018                                 /*
1019                                  * Insert chk MUST be a MIDDLE or LAST
1020                                  * fragment
1021                                  */
1022                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1023                                     SCTP_DATA_FIRST_FRAG) {
1024 #ifdef SCTP_DEBUG
1025                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1026                                                 printf("Prev check - It can be a midlle or last but not a first\n");
1027                                                 printf("Gak, Evil plot, it's a FIRST!\n");
1028                                         }
1029 #endif
1030                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1031                                             0, M_DONTWAIT, 1, MT_DATA);
1032                                         if (oper) {
1033                                                 struct sctp_paramhdr *ph;
1034                                                 uint32_t *ippp;
1035
1036                                                 SCTP_BUF_LEN(oper) =
1037                                                     sizeof(struct sctp_paramhdr) +
1038                                                     (3 * sizeof(uint32_t));
1039                                                 ph = mtod(oper,
1040                                                     struct sctp_paramhdr *);
1041                                                 ph->param_type =
1042                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1043                                                 ph->param_length =
1044                                                     htons(SCTP_BUF_LEN(oper));
1045                                                 ippp = (uint32_t *) (ph + 1);
1046                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_6);
1047                                                 ippp++;
1048                                                 *ippp = chk->rec.data.TSN_seq;
1049                                                 ippp++;
1050                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1051
1052                                         }
1053                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_6;
1054                                         sctp_abort_an_association(stcb->sctp_ep,
1055                                             stcb, SCTP_PEER_FAULTY, oper);
1056                                         *abort_flag = 1;
1057                                         return;
1058                                 }
1059                                 if (chk->rec.data.stream_number !=
1060                                     prev->rec.data.stream_number) {
1061                                         /*
1062                                          * Huh, need the correct STR here,
1063                                          * they must be the same.
1064                                          */
1065 #ifdef SCTP_DEBUG
1066                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1067                                                 printf("Prev check - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1068                                                     chk->rec.data.stream_number,
1069                                                     prev->rec.data.stream_number);
1070                                         }
1071 #endif
1072                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1073                                             0, M_DONTWAIT, 1, MT_DATA);
1074                                         if (oper) {
1075                                                 struct sctp_paramhdr *ph;
1076                                                 uint32_t *ippp;
1077
1078                                                 SCTP_BUF_LEN(oper) =
1079                                                     sizeof(struct sctp_paramhdr) +
1080                                                     (3 * sizeof(uint32_t));
1081                                                 ph = mtod(oper,
1082                                                     struct sctp_paramhdr *);
1083                                                 ph->param_type =
1084                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1085                                                 ph->param_length =
1086                                                     htons(SCTP_BUF_LEN(oper));
1087                                                 ippp = (uint32_t *) (ph + 1);
1088                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_7);
1089                                                 ippp++;
1090                                                 *ippp = chk->rec.data.TSN_seq;
1091                                                 ippp++;
1092                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1093                                         }
1094                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_7;
1095                                         sctp_abort_an_association(stcb->sctp_ep,
1096                                             stcb, SCTP_PEER_FAULTY, oper);
1097
1098                                         *abort_flag = 1;
1099                                         return;
1100                                 }
1101                                 if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1102                                     chk->rec.data.stream_seq !=
1103                                     prev->rec.data.stream_seq) {
1104                                         /*
1105                                          * Huh, need the correct STR here,
1106                                          * they must be the same.
1107                                          */
1108 #ifdef SCTP_DEBUG
1109                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1110                                                 printf("Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1111                                                     chk->rec.data.stream_seq,
1112                                                     prev->rec.data.stream_seq);
1113                                         }
1114 #endif
1115                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1116                                             0, M_DONTWAIT, 1, MT_DATA);
1117                                         if (oper) {
1118                                                 struct sctp_paramhdr *ph;
1119                                                 uint32_t *ippp;
1120
1121                                                 SCTP_BUF_LEN(oper) =
1122                                                     sizeof(struct sctp_paramhdr) +
1123                                                     (3 * sizeof(uint32_t));
1124                                                 ph = mtod(oper,
1125                                                     struct sctp_paramhdr *);
1126                                                 ph->param_type =
1127                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1128                                                 ph->param_length =
1129                                                     htons(SCTP_BUF_LEN(oper));
1130                                                 ippp = (uint32_t *) (ph + 1);
1131                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_8);
1132                                                 ippp++;
1133                                                 *ippp = chk->rec.data.TSN_seq;
1134                                                 ippp++;
1135                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1136                                         }
1137                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_8;
1138                                         sctp_abort_an_association(stcb->sctp_ep,
1139                                             stcb, SCTP_PEER_FAULTY, oper);
1140
1141                                         *abort_flag = 1;
1142                                         return;
1143                                 }
1144                         } else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1145                             SCTP_DATA_LAST_FRAG) {
1146                                 /* Insert chk MUST be a FIRST */
1147                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1148                                     SCTP_DATA_FIRST_FRAG) {
1149 #ifdef SCTP_DEBUG
1150                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1151                                                 printf("Prev check - Gak, evil plot, its not FIRST and it must be!\n");
1152                                         }
1153 #endif
1154                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1155                                             0, M_DONTWAIT, 1, MT_DATA);
1156                                         if (oper) {
1157                                                 struct sctp_paramhdr *ph;
1158                                                 uint32_t *ippp;
1159
1160                                                 SCTP_BUF_LEN(oper) =
1161                                                     sizeof(struct sctp_paramhdr) +
1162                                                     (3 * sizeof(uint32_t));
1163                                                 ph = mtod(oper,
1164                                                     struct sctp_paramhdr *);
1165                                                 ph->param_type =
1166                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1167                                                 ph->param_length =
1168                                                     htons(SCTP_BUF_LEN(oper));
1169                                                 ippp = (uint32_t *) (ph + 1);
1170                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
1171                                                 ippp++;
1172                                                 *ippp = chk->rec.data.TSN_seq;
1173                                                 ippp++;
1174                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1175
1176                                         }
1177                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_9;
1178                                         sctp_abort_an_association(stcb->sctp_ep,
1179                                             stcb, SCTP_PEER_FAULTY, oper);
1180
1181                                         *abort_flag = 1;
1182                                         return;
1183                                 }
1184                         }
1185                 }
1186         }
1187         if (next) {
1188                 post_tsn = chk->rec.data.TSN_seq + 1;
1189                 if (post_tsn == next->rec.data.TSN_seq) {
1190                         /*
1191                          * Ok the one I am inserting ahead of is my NEXT
1192                          * one. A bit of valdiation here.
1193                          */
1194                         if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1195                                 /* Insert chk MUST be a last fragment */
1196                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK)
1197                                     != SCTP_DATA_LAST_FRAG) {
1198 #ifdef SCTP_DEBUG
1199                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1200                                                 printf("Next chk - Next is FIRST, we must be LAST\n");
1201                                                 printf("Gak, Evil plot, its not a last!\n");
1202                                         }
1203 #endif
1204                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1205                                             0, M_DONTWAIT, 1, MT_DATA);
1206                                         if (oper) {
1207                                                 struct sctp_paramhdr *ph;
1208                                                 uint32_t *ippp;
1209
1210                                                 SCTP_BUF_LEN(oper) =
1211                                                     sizeof(struct sctp_paramhdr) +
1212                                                     (3 * sizeof(uint32_t));
1213                                                 ph = mtod(oper,
1214                                                     struct sctp_paramhdr *);
1215                                                 ph->param_type =
1216                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1217                                                 ph->param_length =
1218                                                     htons(SCTP_BUF_LEN(oper));
1219                                                 ippp = (uint32_t *) (ph + 1);
1220                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
1221                                                 ippp++;
1222                                                 *ippp = chk->rec.data.TSN_seq;
1223                                                 ippp++;
1224                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1225                                         }
1226                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_10;
1227                                         sctp_abort_an_association(stcb->sctp_ep,
1228                                             stcb, SCTP_PEER_FAULTY, oper);
1229
1230                                         *abort_flag = 1;
1231                                         return;
1232                                 }
1233                         } else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1234                                     SCTP_DATA_MIDDLE_FRAG ||
1235                                     (next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1236                             SCTP_DATA_LAST_FRAG) {
1237                                 /*
1238                                  * Insert chk CAN be MIDDLE or FIRST NOT
1239                                  * LAST
1240                                  */
1241                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1242                                     SCTP_DATA_LAST_FRAG) {
1243 #ifdef SCTP_DEBUG
1244                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1245                                                 printf("Next chk - Next is a MIDDLE/LAST\n");
1246                                                 printf("Gak, Evil plot, new prev chunk is a LAST\n");
1247                                         }
1248 #endif
1249                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1250                                             0, M_DONTWAIT, 1, MT_DATA);
1251                                         if (oper) {
1252                                                 struct sctp_paramhdr *ph;
1253                                                 uint32_t *ippp;
1254
1255                                                 SCTP_BUF_LEN(oper) =
1256                                                     sizeof(struct sctp_paramhdr) +
1257                                                     (3 * sizeof(uint32_t));
1258                                                 ph = mtod(oper,
1259                                                     struct sctp_paramhdr *);
1260                                                 ph->param_type =
1261                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1262                                                 ph->param_length =
1263                                                     htons(SCTP_BUF_LEN(oper));
1264                                                 ippp = (uint32_t *) (ph + 1);
1265                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
1266                                                 ippp++;
1267                                                 *ippp = chk->rec.data.TSN_seq;
1268                                                 ippp++;
1269                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1270
1271                                         }
1272                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_11;
1273                                         sctp_abort_an_association(stcb->sctp_ep,
1274                                             stcb, SCTP_PEER_FAULTY, oper);
1275
1276                                         *abort_flag = 1;
1277                                         return;
1278                                 }
1279                                 if (chk->rec.data.stream_number !=
1280                                     next->rec.data.stream_number) {
1281                                         /*
1282                                          * Huh, need the correct STR here,
1283                                          * they must be the same.
1284                                          */
1285 #ifdef SCTP_DEBUG
1286                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1287                                                 printf("Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1288                                                     chk->rec.data.stream_number,
1289                                                     next->rec.data.stream_number);
1290                                         }
1291 #endif
1292                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1293                                             0, M_DONTWAIT, 1, MT_DATA);
1294                                         if (oper) {
1295                                                 struct sctp_paramhdr *ph;
1296                                                 uint32_t *ippp;
1297
1298                                                 SCTP_BUF_LEN(oper) =
1299                                                     sizeof(struct sctp_paramhdr) +
1300                                                     (3 * sizeof(uint32_t));
1301                                                 ph = mtod(oper,
1302                                                     struct sctp_paramhdr *);
1303                                                 ph->param_type =
1304                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1305                                                 ph->param_length =
1306                                                     htons(SCTP_BUF_LEN(oper));
1307                                                 ippp = (uint32_t *) (ph + 1);
1308                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
1309                                                 ippp++;
1310                                                 *ippp = chk->rec.data.TSN_seq;
1311                                                 ippp++;
1312                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1313
1314                                         }
1315                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_12;
1316                                         sctp_abort_an_association(stcb->sctp_ep,
1317                                             stcb, SCTP_PEER_FAULTY, oper);
1318
1319                                         *abort_flag = 1;
1320                                         return;
1321                                 }
1322                                 if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1323                                     chk->rec.data.stream_seq !=
1324                                     next->rec.data.stream_seq) {
1325                                         /*
1326                                          * Huh, need the correct STR here,
1327                                          * they must be the same.
1328                                          */
1329 #ifdef SCTP_DEBUG
1330                                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1331                                                 printf("Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1332                                                     chk->rec.data.stream_seq,
1333                                                     next->rec.data.stream_seq);
1334                                         }
1335 #endif
1336                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1337                                             0, M_DONTWAIT, 1, MT_DATA);
1338                                         if (oper) {
1339                                                 struct sctp_paramhdr *ph;
1340                                                 uint32_t *ippp;
1341
1342                                                 SCTP_BUF_LEN(oper) =
1343                                                     sizeof(struct sctp_paramhdr) +
1344                                                     (3 * sizeof(uint32_t));
1345                                                 ph = mtod(oper,
1346                                                     struct sctp_paramhdr *);
1347                                                 ph->param_type =
1348                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1349                                                 ph->param_length =
1350                                                     htons(SCTP_BUF_LEN(oper));
1351                                                 ippp = (uint32_t *) (ph + 1);
1352                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
1353                                                 ippp++;
1354                                                 *ippp = chk->rec.data.TSN_seq;
1355                                                 ippp++;
1356                                                 *ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1357                                         }
1358                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_13;
1359                                         sctp_abort_an_association(stcb->sctp_ep,
1360                                             stcb, SCTP_PEER_FAULTY, oper);
1361
1362                                         *abort_flag = 1;
1363                                         return;
1364
1365                                 }
1366                         }
1367                 }
1368         }
1369         /* Do we need to do some delivery? check */
1370         sctp_deliver_reasm_check(stcb, asoc);
1371 }
1372
1373 /*
1374  * This is an unfortunate routine. It checks to make sure a evil guy is not
1375  * stuffing us full of bad packet fragments. A broken peer could also do this
1376  * but this is doubtful. It is to bad I must worry about evil crackers sigh
1377  * :< more cycles.
1378  */
1379 static int
1380 sctp_does_tsn_belong_to_reasm(struct sctp_association *asoc,
1381     uint32_t TSN_seq)
1382 {
1383         struct sctp_tmit_chunk *at;
1384         uint32_t tsn_est;
1385
1386         TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1387                 if (compare_with_wrap(TSN_seq,
1388                     at->rec.data.TSN_seq, MAX_TSN)) {
1389                         /* is it one bigger? */
1390                         tsn_est = at->rec.data.TSN_seq + 1;
1391                         if (tsn_est == TSN_seq) {
1392                                 /* yep. It better be a last then */
1393                                 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1394                                     SCTP_DATA_LAST_FRAG) {
1395                                         /*
1396                                          * Ok this guy belongs next to a guy
1397                                          * that is NOT last, it should be a
1398                                          * middle/last, not a complete
1399                                          * chunk.
1400                                          */
1401                                         return (1);
1402                                 } else {
1403                                         /*
1404                                          * This guy is ok since its a LAST
1405                                          * and the new chunk is a fully
1406                                          * self- contained one.
1407                                          */
1408                                         return (0);
1409                                 }
1410                         }
1411                 } else if (TSN_seq == at->rec.data.TSN_seq) {
1412                         /* Software error since I have a dup? */
1413                         return (1);
1414                 } else {
1415                         /*
1416                          * Ok, 'at' is larger than new chunk but does it
1417                          * need to be right before it.
1418                          */
1419                         tsn_est = TSN_seq + 1;
1420                         if (tsn_est == at->rec.data.TSN_seq) {
1421                                 /* Yep, It better be a first */
1422                                 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1423                                     SCTP_DATA_FIRST_FRAG) {
1424                                         return (1);
1425                                 } else {
1426                                         return (0);
1427                                 }
1428                         }
1429                 }
1430         }
1431         return (0);
1432 }
1433
1434
1435 static int
1436 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1437     struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length,
1438     struct sctp_nets *net, uint32_t * high_tsn, int *abort_flag,
1439     int *break_flag, int last_chunk)
1440 {
1441         /* Process a data chunk */
1442         /* struct sctp_tmit_chunk *chk; */
1443         struct sctp_tmit_chunk *chk;
1444         uint32_t tsn, gap;
1445         struct mbuf *dmbuf;
1446         int indx, the_len;
1447         int need_reasm_check = 0;
1448         uint16_t strmno, strmseq;
1449         struct mbuf *oper;
1450         struct sctp_queued_to_read *control;
1451         int ordered;
1452         uint32_t protocol_id;
1453         uint8_t chunk_flags;
1454
1455         chk = NULL;
1456         tsn = ntohl(ch->dp.tsn);
1457         chunk_flags = ch->ch.chunk_flags;
1458         protocol_id = ch->dp.protocol_id;
1459         ordered = ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0);
1460 #ifdef SCTP_MAP_LOGGING
1461         sctp_log_map(0, tsn, asoc->cumulative_tsn, SCTP_MAP_PREPARE_SLIDE);
1462 #endif
1463         if (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN) ||
1464             asoc->cumulative_tsn == tsn) {
1465                 /* It is a duplicate */
1466                 SCTP_STAT_INCR(sctps_recvdupdata);
1467                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1468                         /* Record a dup for the next outbound sack */
1469                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1470                         asoc->numduptsns++;
1471                 }
1472                 return (0);
1473         }
1474         /* Calculate the number of TSN's between the base and this TSN */
1475         if (tsn >= asoc->mapping_array_base_tsn) {
1476                 gap = tsn - asoc->mapping_array_base_tsn;
1477         } else {
1478                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + tsn + 1;
1479         }
1480         if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1481                 /* Can't hold the bit in the mapping at max array, toss it */
1482                 return (0);
1483         }
1484         if (gap >= (uint32_t) (asoc->mapping_array_size << 3)) {
1485                 if (sctp_expand_mapping_array(asoc)) {
1486                         /* Can't expand, drop it */
1487                         return (0);
1488                 }
1489         }
1490         if (compare_with_wrap(tsn, *high_tsn, MAX_TSN)) {
1491                 *high_tsn = tsn;
1492         }
1493         /* See if we have received this one already */
1494         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
1495                 SCTP_STAT_INCR(sctps_recvdupdata);
1496                 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1497                         /* Record a dup for the next outbound sack */
1498                         asoc->dup_tsns[asoc->numduptsns] = tsn;
1499                         asoc->numduptsns++;
1500                 }
1501                 asoc->send_sack = 1;
1502                 return (0);
1503         }
1504         /*
1505          * Check to see about the GONE flag, duplicates would cause a sack
1506          * to be sent up above
1507          */
1508         if (stcb && ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
1509             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
1510             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET))
1511             ) {
1512                 /*
1513                  * wait a minute, this guy is gone, there is no longer a
1514                  * receiver. Send peer an ABORT!
1515                  */
1516                 struct mbuf *op_err;
1517
1518                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1519                 sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
1520                 *abort_flag = 1;
1521                 return (0);
1522         }
1523         /*
1524          * Now before going further we see if there is room. If NOT then we
1525          * MAY let one through only IF this TSN is the one we are waiting
1526          * for on a partial delivery API.
1527          */
1528
1529         /* now do the tests */
1530         if (((asoc->cnt_on_all_streams +
1531             asoc->cnt_on_reasm_queue +
1532             asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) ||
1533             (((int)asoc->my_rwnd) <= 0)) {
1534                 /*
1535                  * When we have NO room in the rwnd we check to make sure
1536                  * the reader is doing its job...
1537                  */
1538                 if (stcb->sctp_socket->so_rcv.sb_cc) {
1539                         /* some to read, wake-up */
1540                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1541                 }
1542                 /* now is it in the mapping array of what we have accepted? */
1543                 if (compare_with_wrap(tsn,
1544                     asoc->highest_tsn_inside_map, MAX_TSN)) {
1545
1546                         /* Nope not in the valid range dump it */
1547 #ifdef SCTP_DEBUG
1548                         if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1549                                 printf("My rwnd overrun1:tsn:%lx rwnd %lu sbspace:%ld\n",
1550                                     (u_long)tsn, (u_long)asoc->my_rwnd,
1551                                     sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv));
1552
1553                         }
1554 #endif
1555                         sctp_set_rwnd(stcb, asoc);
1556                         if ((asoc->cnt_on_all_streams +
1557                             asoc->cnt_on_reasm_queue +
1558                             asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) {
1559                                 SCTP_STAT_INCR(sctps_datadropchklmt);
1560                         } else {
1561                                 SCTP_STAT_INCR(sctps_datadroprwnd);
1562                         }
1563                         indx = *break_flag;
1564                         *break_flag = 1;
1565                         return (0);
1566                 }
1567         }
1568         strmno = ntohs(ch->dp.stream_id);
1569         if (strmno >= asoc->streamincnt) {
1570                 struct sctp_paramhdr *phdr;
1571                 struct mbuf *mb;
1572
1573                 mb = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) * 2),
1574                     0, M_DONTWAIT, 1, MT_DATA);
1575                 if (mb != NULL) {
1576                         /* add some space up front so prepend will work well */
1577                         SCTP_BUF_RESV_UF(mb, sizeof(struct sctp_chunkhdr));
1578                         phdr = mtod(mb, struct sctp_paramhdr *);
1579                         /*
1580                          * Error causes are just param's and this one has
1581                          * two back to back phdr, one with the error type
1582                          * and size, the other with the streamid and a rsvd
1583                          */
1584                         SCTP_BUF_LEN(mb) = (sizeof(struct sctp_paramhdr) * 2);
1585                         phdr->param_type = htons(SCTP_CAUSE_INVALID_STREAM);
1586                         phdr->param_length =
1587                             htons(sizeof(struct sctp_paramhdr) * 2);
1588                         phdr++;
1589                         /* We insert the stream in the type field */
1590                         phdr->param_type = ch->dp.stream_id;
1591                         /* And set the length to 0 for the rsvd field */
1592                         phdr->param_length = 0;
1593                         sctp_queue_op_err(stcb, mb);
1594                 }
1595                 SCTP_STAT_INCR(sctps_badsid);
1596                 return (0);
1597         }
1598         /*
1599          * Before we continue lets validate that we are not being fooled by
1600          * an evil attacker. We can only have 4k chunks based on our TSN
1601          * spread allowed by the mapping array 512 * 8 bits, so there is no
1602          * way our stream sequence numbers could have wrapped. We of course
1603          * only validate the FIRST fragment so the bit must be set.
1604          */
1605         strmseq = ntohs(ch->dp.stream_sequence);
1606
1607 #ifdef SCTP_ASOCLOG_OF_TSNS
1608         asoc->in_tsnlog[asoc->tsn_in_at].tsn = tsn;
1609         asoc->in_tsnlog[asoc->tsn_in_at].strm = strmno;
1610         asoc->in_tsnlog[asoc->tsn_in_at].seq = strmseq;
1611         asoc->tsn_in_at++;
1612         if (asoc->tsn_in_at >= SCTP_TSN_LOG_SIZE) {
1613                 asoc->tsn_in_at = 0;
1614         }
1615 #endif
1616         if ((chunk_flags & SCTP_DATA_FIRST_FRAG) &&
1617             (chunk_flags & SCTP_DATA_UNORDERED) == 0 &&
1618             (compare_with_wrap(asoc->strmin[strmno].last_sequence_delivered,
1619             strmseq, MAX_SEQ) ||
1620             asoc->strmin[strmno].last_sequence_delivered == strmseq)) {
1621                 /* The incoming sseq is behind where we last delivered? */
1622 #ifdef SCTP_DEBUG
1623                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
1624                         printf("EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n",
1625                             strmseq,
1626                             asoc->strmin[strmno].last_sequence_delivered);
1627                 }
1628 #endif
1629                 /*
1630                  * throw it in the stream so it gets cleaned up in
1631                  * association destruction
1632                  */
1633                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1634                     0, M_DONTWAIT, 1, MT_DATA);
1635                 if (oper) {
1636                         struct sctp_paramhdr *ph;
1637                         uint32_t *ippp;
1638
1639                         SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
1640                             (3 * sizeof(uint32_t));
1641                         ph = mtod(oper, struct sctp_paramhdr *);
1642                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1643                         ph->param_length = htons(SCTP_BUF_LEN(oper));
1644                         ippp = (uint32_t *) (ph + 1);
1645                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_14);
1646                         ippp++;
1647                         *ippp = tsn;
1648                         ippp++;
1649                         *ippp = ((strmno << 16) | strmseq);
1650
1651                 }
1652                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_14;
1653                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1654                     SCTP_PEER_FAULTY, oper);
1655                 *abort_flag = 1;
1656                 return (0);
1657         }
1658         /************************************
1659          * From here down we may find ch-> invalid
1660          * so its a good idea NOT to use it.
1661          *************************************/
1662
1663         the_len = (chk_length - sizeof(struct sctp_data_chunk));
1664         if (last_chunk == 0) {
1665                 dmbuf = SCTP_M_COPYM(*m,
1666                     (offset + sizeof(struct sctp_data_chunk)),
1667                     the_len, M_DONTWAIT);
1668 #ifdef SCTP_MBUF_LOGGING
1669                 {
1670                         struct mbuf *mat;
1671
1672                         mat = dmbuf;
1673                         while (mat) {
1674                                 if (SCTP_BUF_IS_EXTENDED(mat)) {
1675                                         sctp_log_mb(mat, SCTP_MBUF_ICOPY);
1676                                 }
1677                                 mat = SCTP_BUF_NEXT(mat);
1678                         }
1679                 }
1680 #endif
1681         } else {
1682                 /* We can steal the last chunk */
1683                 int l_len;
1684
1685                 dmbuf = *m;
1686                 /* lop off the top part */
1687                 m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
1688                 if (SCTP_BUF_NEXT(dmbuf) == NULL) {
1689                         l_len = SCTP_BUF_LEN(dmbuf);
1690                 } else {
1691                         /*
1692                          * need to count up the size hopefully does not hit
1693                          * this to often :-0
1694                          */
1695                         struct mbuf *lat;
1696
1697                         l_len = 0;
1698                         lat = dmbuf;
1699                         while (lat) {
1700                                 l_len += SCTP_BUF_LEN(lat);
1701                                 lat = SCTP_BUF_NEXT(lat);
1702                         }
1703                 }
1704                 if (l_len > the_len) {
1705                         /* Trim the end round bytes off  too */
1706                         m_adj(dmbuf, -(l_len - the_len));
1707                 }
1708         }
1709         if (dmbuf == NULL) {
1710                 SCTP_STAT_INCR(sctps_nomem);
1711                 return (0);
1712         }
1713         if ((chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
1714             asoc->fragmented_delivery_inprogress == 0 &&
1715             TAILQ_EMPTY(&asoc->resetHead) &&
1716             ((ordered == 0) ||
1717             ((asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq &&
1718             TAILQ_EMPTY(&asoc->strmin[strmno].inqueue)))) {
1719                 /* Candidate for express delivery */
1720                 /*
1721                  * Its not fragmented, No PD-API is up, Nothing in the
1722                  * delivery queue, Its un-ordered OR ordered and the next to
1723                  * deliver AND nothing else is stuck on the stream queue,
1724                  * And there is room for it in the socket buffer. Lets just
1725                  * stuff it up the buffer....
1726                  */
1727
1728                 /* It would be nice to avoid this copy if we could :< */
1729                 sctp_alloc_a_readq(stcb, control);
1730                 sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
1731                     protocol_id,
1732                     stcb->asoc.context,
1733                     strmno, strmseq,
1734                     chunk_flags,
1735                     dmbuf);
1736                 if (control == NULL) {
1737                         goto failed_express_del;
1738                 }
1739                 sctp_add_to_readq(stcb->sctp_ep, stcb, control, &stcb->sctp_socket->so_rcv, 1);
1740                 if ((chunk_flags & SCTP_DATA_UNORDERED) == 0) {
1741                         /* for ordered, bump what we delivered */
1742                         asoc->strmin[strmno].last_sequence_delivered++;
1743                 }
1744                 SCTP_STAT_INCR(sctps_recvexpress);
1745 #ifdef SCTP_STR_LOGGING
1746                 sctp_log_strm_del_alt(stcb, tsn, strmseq, strmno,
1747                     SCTP_STR_LOG_FROM_EXPRS_DEL);
1748 #endif
1749                 control = NULL;
1750                 goto finish_express_del;
1751         }
1752 failed_express_del:
1753         /* If we reach here this is a new chunk */
1754         chk = NULL;
1755         control = NULL;
1756         /* Express for fragmented delivery? */
1757         if ((asoc->fragmented_delivery_inprogress) &&
1758             (stcb->asoc.control_pdapi) &&
1759             (asoc->str_of_pdapi == strmno) &&
1760             (asoc->ssn_of_pdapi == strmseq)
1761             ) {
1762                 control = stcb->asoc.control_pdapi;
1763                 if ((chunk_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
1764                         /* Can't be another first? */
1765                         goto failed_pdapi_express_del;
1766                 }
1767                 if (tsn == (control->sinfo_tsn + 1)) {
1768                         /* Yep, we can add it on */
1769                         int end = 0;
1770                         uint32_t cumack;
1771
1772                         if (chunk_flags & SCTP_DATA_LAST_FRAG) {
1773                                 end = 1;
1774                         }
1775                         cumack = asoc->cumulative_tsn;
1776                         if ((cumack + 1) == tsn)
1777                                 cumack = tsn;
1778
1779                         if (sctp_append_to_readq(stcb->sctp_ep, stcb, control, dmbuf, end,
1780                             tsn,
1781                             &stcb->sctp_socket->so_rcv)) {
1782                                 printf("Append fails end:%d\n", end);
1783                                 goto failed_pdapi_express_del;
1784                         }
1785                         SCTP_STAT_INCR(sctps_recvexpressm);
1786                         control->sinfo_tsn = tsn;
1787                         asoc->tsn_last_delivered = tsn;
1788                         asoc->fragment_flags = chunk_flags;
1789                         asoc->tsn_of_pdapi_last_delivered = tsn;
1790                         asoc->last_flags_delivered = chunk_flags;
1791                         asoc->last_strm_seq_delivered = strmseq;
1792                         asoc->last_strm_no_delivered = strmno;
1793                         if (end) {
1794                                 /* clean up the flags and such */
1795                                 asoc->fragmented_delivery_inprogress = 0;
1796                                 if ((chunk_flags & SCTP_DATA_UNORDERED) == 0) {
1797                                         asoc->strmin[strmno].last_sequence_delivered++;
1798                                 }
1799                                 stcb->asoc.control_pdapi = NULL;
1800                                 if (TAILQ_EMPTY(&asoc->reasmqueue) == 0) {
1801                                         /*
1802                                          * There could be another message
1803                                          * ready
1804                                          */
1805                                         need_reasm_check = 1;
1806                                 }
1807                         }
1808                         control = NULL;
1809                         goto finish_express_del;
1810                 }
1811         }
1812 failed_pdapi_express_del:
1813         control = NULL;
1814         if ((chunk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
1815                 sctp_alloc_a_chunk(stcb, chk);
1816                 if (chk == NULL) {
1817                         /* No memory so we drop the chunk */
1818                         SCTP_STAT_INCR(sctps_nomem);
1819                         if (last_chunk == 0) {
1820                                 /* we copied it, free the copy */
1821                                 sctp_m_freem(dmbuf);
1822                         }
1823                         return (0);
1824                 }
1825                 chk->rec.data.TSN_seq = tsn;
1826                 chk->no_fr_allowed = 0;
1827                 chk->rec.data.stream_seq = strmseq;
1828                 chk->rec.data.stream_number = strmno;
1829                 chk->rec.data.payloadtype = protocol_id;
1830                 chk->rec.data.context = stcb->asoc.context;
1831                 chk->rec.data.doing_fast_retransmit = 0;
1832                 chk->rec.data.rcv_flags = chunk_flags;
1833                 chk->asoc = asoc;
1834                 chk->send_size = the_len;
1835                 chk->whoTo = net;
1836                 atomic_add_int(&net->ref_count, 1);
1837                 chk->data = dmbuf;
1838         } else {
1839                 sctp_alloc_a_readq(stcb, control);
1840                 sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
1841                     protocol_id,
1842                     stcb->asoc.context,
1843                     strmno, strmseq,
1844                     chunk_flags,
1845                     dmbuf);
1846                 if (control == NULL) {
1847                         /* No memory so we drop the chunk */
1848                         SCTP_STAT_INCR(sctps_nomem);
1849                         if (last_chunk == 0) {
1850                                 /* we copied it, free the copy */
1851                                 sctp_m_freem(dmbuf);
1852                         }
1853                         return (0);
1854                 }
1855                 control->length = the_len;
1856         }
1857
1858         /* Mark it as received */
1859         /* Now queue it where it belongs */
1860         if (control != NULL) {
1861                 /* First a sanity check */
1862                 if (asoc->fragmented_delivery_inprogress) {
1863                         /*
1864                          * Ok, we have a fragmented delivery in progress if
1865                          * this chunk is next to deliver OR belongs in our
1866                          * view to the reassembly, the peer is evil or
1867                          * broken.
1868                          */
1869                         uint32_t estimate_tsn;
1870
1871                         estimate_tsn = asoc->tsn_last_delivered + 1;
1872                         if (TAILQ_EMPTY(&asoc->reasmqueue) &&
1873                             (estimate_tsn == control->sinfo_tsn)) {
1874                                 /* Evil/Broke peer */
1875                                 sctp_m_freem(control->data);
1876                                 control->data = NULL;
1877                                 sctp_free_remote_addr(control->whoFrom);
1878                                 sctp_free_a_readq(stcb, control);
1879                                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1880                                     0, M_DONTWAIT, 1, MT_DATA);
1881                                 if (oper) {
1882                                         struct sctp_paramhdr *ph;
1883                                         uint32_t *ippp;
1884
1885                                         SCTP_BUF_LEN(oper) =
1886                                             sizeof(struct sctp_paramhdr) +
1887                                             (3 * sizeof(uint32_t));
1888                                         ph = mtod(oper, struct sctp_paramhdr *);
1889                                         ph->param_type =
1890                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1891                                         ph->param_length = htons(SCTP_BUF_LEN(oper));
1892                                         ippp = (uint32_t *) (ph + 1);
1893                                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_15);
1894                                         ippp++;
1895                                         *ippp = tsn;
1896                                         ippp++;
1897                                         *ippp = ((strmno << 16) | strmseq);
1898                                 }
1899                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_15;
1900                                 sctp_abort_an_association(stcb->sctp_ep, stcb,
1901                                     SCTP_PEER_FAULTY, oper);
1902
1903                                 *abort_flag = 1;
1904                                 return (0);
1905                         } else {
1906                                 if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
1907                                         sctp_m_freem(control->data);
1908                                         control->data = NULL;
1909                                         sctp_free_remote_addr(control->whoFrom);
1910                                         sctp_free_a_readq(stcb, control);
1911
1912                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1913                                             0, M_DONTWAIT, 1, MT_DATA);
1914                                         if (oper) {
1915                                                 struct sctp_paramhdr *ph;
1916                                                 uint32_t *ippp;
1917
1918                                                 SCTP_BUF_LEN(oper) =
1919                                                     sizeof(struct sctp_paramhdr) +
1920                                                     (3 * sizeof(uint32_t));
1921                                                 ph = mtod(oper,
1922                                                     struct sctp_paramhdr *);
1923                                                 ph->param_type =
1924                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1925                                                 ph->param_length =
1926                                                     htons(SCTP_BUF_LEN(oper));
1927                                                 ippp = (uint32_t *) (ph + 1);
1928                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_16);
1929                                                 ippp++;
1930                                                 *ippp = tsn;
1931                                                 ippp++;
1932                                                 *ippp = ((strmno << 16) | strmseq);
1933                                         }
1934                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
1935                                         sctp_abort_an_association(stcb->sctp_ep,
1936                                             stcb, SCTP_PEER_FAULTY, oper);
1937
1938                                         *abort_flag = 1;
1939                                         return (0);
1940                                 }
1941                         }
1942                 } else {
1943                         /* No PDAPI running */
1944                         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
1945                                 /*
1946                                  * Reassembly queue is NOT empty validate
1947                                  * that this tsn does not need to be in
1948                                  * reasembly queue. If it does then our peer
1949                                  * is broken or evil.
1950                                  */
1951                                 if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
1952                                         sctp_m_freem(control->data);
1953                                         control->data = NULL;
1954                                         sctp_free_remote_addr(control->whoFrom);
1955                                         sctp_free_a_readq(stcb, control);
1956                                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1957                                             0, M_DONTWAIT, 1, MT_DATA);
1958                                         if (oper) {
1959                                                 struct sctp_paramhdr *ph;
1960                                                 uint32_t *ippp;
1961
1962                                                 SCTP_BUF_LEN(oper) =
1963                                                     sizeof(struct sctp_paramhdr) +
1964                                                     (3 * sizeof(uint32_t));
1965                                                 ph = mtod(oper,
1966                                                     struct sctp_paramhdr *);
1967                                                 ph->param_type =
1968                                                     htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1969                                                 ph->param_length =
1970                                                     htons(SCTP_BUF_LEN(oper));
1971                                                 ippp = (uint32_t *) (ph + 1);
1972                                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_17);
1973                                                 ippp++;
1974                                                 *ippp = tsn;
1975                                                 ippp++;
1976                                                 *ippp = ((strmno << 16) | strmseq);
1977                                         }
1978                                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_17;
1979                                         sctp_abort_an_association(stcb->sctp_ep,
1980                                             stcb, SCTP_PEER_FAULTY, oper);
1981
1982                                         *abort_flag = 1;
1983                                         return (0);
1984                                 }
1985                         }
1986                 }
1987                 /* ok, if we reach here we have passed the sanity checks */
1988                 if (chunk_flags & SCTP_DATA_UNORDERED) {
1989                         /* queue directly into socket buffer */
1990                         sctp_add_to_readq(stcb->sctp_ep, stcb,
1991                             control,
1992                             &stcb->sctp_socket->so_rcv, 1);
1993                 } else {
1994                         /*
1995                          * Special check for when streams are resetting. We
1996                          * could be more smart about this and check the
1997                          * actual stream to see if it is not being reset..
1998                          * that way we would not create a HOLB when amongst
1999                          * streams being reset and those not being reset.
2000                          *
2001                          * We take complete messages that have a stream reset
2002                          * intervening (aka the TSN is after where our
2003                          * cum-ack needs to be) off and put them on a
2004                          * pending_reply_queue. The reassembly ones we do
2005                          * not have to worry about since they are all sorted
2006                          * and proceessed by TSN order. It is only the
2007                          * singletons I must worry about.
2008                          */
2009                         struct sctp_stream_reset_list *liste;
2010
2011                         if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2012                             ((compare_with_wrap(tsn, liste->tsn, MAX_TSN)) ||
2013                             (tsn == ntohl(liste->tsn)))
2014                             ) {
2015                                 /*
2016                                  * yep its past where we need to reset... go
2017                                  * ahead and queue it.
2018                                  */
2019                                 if (TAILQ_EMPTY(&asoc->pending_reply_queue)) {
2020                                         /* first one on */
2021                                         TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2022                                 } else {
2023                                         struct sctp_queued_to_read *ctlOn;
2024                                         unsigned char inserted = 0;
2025
2026                                         ctlOn = TAILQ_FIRST(&asoc->pending_reply_queue);
2027                                         while (ctlOn) {
2028                                                 if (compare_with_wrap(control->sinfo_tsn,
2029                                                     ctlOn->sinfo_tsn, MAX_TSN)) {
2030                                                         ctlOn = TAILQ_NEXT(ctlOn, next);
2031                                                 } else {
2032                                                         /* found it */
2033                                                         TAILQ_INSERT_BEFORE(ctlOn, control, next);
2034                                                         inserted = 1;
2035                                                         break;
2036                                                 }
2037                                         }
2038                                         if (inserted == 0) {
2039                                                 /*
2040                                                  * must be put at end, use
2041                                                  * prevP (all setup from
2042                                                  * loop) to setup nextP.
2043                                                  */
2044                                                 TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2045                                         }
2046                                 }
2047                         } else {
2048                                 sctp_queue_data_to_stream(stcb, asoc, control, abort_flag);
2049                                 if (*abort_flag) {
2050                                         return (0);
2051                                 }
2052                         }
2053                 }
2054         } else {
2055                 /* Into the re-assembly queue */
2056                 sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag);
2057                 if (*abort_flag) {
2058                         /*
2059                          * the assoc is now gone and chk was put onto the
2060                          * reasm queue, which has all been freed.
2061                          */
2062                         *m = NULL;
2063                         return (0);
2064                 }
2065         }
2066 finish_express_del:
2067         if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
2068                 /* we have a new high score */
2069                 asoc->highest_tsn_inside_map = tsn;
2070 #ifdef SCTP_MAP_LOGGING
2071                 sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2072 #endif
2073         }
2074         if (tsn == (asoc->cumulative_tsn + 1)) {
2075                 /* Update cum-ack */
2076                 asoc->cumulative_tsn = tsn;
2077         }
2078         if (last_chunk) {
2079                 *m = NULL;
2080         }
2081         if (ordered) {
2082                 SCTP_STAT_INCR_COUNTER64(sctps_inorderchunks);
2083         } else {
2084                 SCTP_STAT_INCR_COUNTER64(sctps_inunorderchunks);
2085         }
2086         SCTP_STAT_INCR(sctps_recvdata);
2087         /* Set it present please */
2088 #ifdef SCTP_STR_LOGGING
2089         sctp_log_strm_del_alt(stcb, tsn, strmseq, strmno, SCTP_STR_LOG_FROM_MARK_TSN);
2090 #endif
2091 #ifdef SCTP_MAP_LOGGING
2092         sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2093             asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2094 #endif
2095         SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
2096         if (need_reasm_check) {
2097                 /* Another one waits ? */
2098                 sctp_deliver_reasm_check(stcb, asoc);
2099         }
2100         return (1);
2101 }
2102
2103 int8_t sctp_map_lookup_tab[256] = {
2104         -1, 0, -1, 1, -1, 0, -1, 2,
2105         -1, 0, -1, 1, -1, 0, -1, 3,
2106         -1, 0, -1, 1, -1, 0, -1, 2,
2107         -1, 0, -1, 1, -1, 0, -1, 4,
2108         -1, 0, -1, 1, -1, 0, -1, 2,
2109         -1, 0, -1, 1, -1, 0, -1, 3,
2110         -1, 0, -1, 1, -1, 0, -1, 2,
2111         -1, 0, -1, 1, -1, 0, -1, 5,
2112         -1, 0, -1, 1, -1, 0, -1, 2,
2113         -1, 0, -1, 1, -1, 0, -1, 3,
2114         -1, 0, -1, 1, -1, 0, -1, 2,
2115         -1, 0, -1, 1, -1, 0, -1, 4,
2116         -1, 0, -1, 1, -1, 0, -1, 2,
2117         -1, 0, -1, 1, -1, 0, -1, 3,
2118         -1, 0, -1, 1, -1, 0, -1, 2,
2119         -1, 0, -1, 1, -1, 0, -1, 6,
2120         -1, 0, -1, 1, -1, 0, -1, 2,
2121         -1, 0, -1, 1, -1, 0, -1, 3,
2122         -1, 0, -1, 1, -1, 0, -1, 2,
2123         -1, 0, -1, 1, -1, 0, -1, 4,
2124         -1, 0, -1, 1, -1, 0, -1, 2,
2125         -1, 0, -1, 1, -1, 0, -1, 3,
2126         -1, 0, -1, 1, -1, 0, -1, 2,
2127         -1, 0, -1, 1, -1, 0, -1, 5,
2128         -1, 0, -1, 1, -1, 0, -1, 2,
2129         -1, 0, -1, 1, -1, 0, -1, 3,
2130         -1, 0, -1, 1, -1, 0, -1, 2,
2131         -1, 0, -1, 1, -1, 0, -1, 4,
2132         -1, 0, -1, 1, -1, 0, -1, 2,
2133         -1, 0, -1, 1, -1, 0, -1, 3,
2134         -1, 0, -1, 1, -1, 0, -1, 2,
2135         -1, 0, -1, 1, -1, 0, -1, 7,
2136 };
2137
2138
2139 void
2140 sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort_flag)
2141 {
2142         /*
2143          * Now we also need to check the mapping array in a couple of ways.
2144          * 1) Did we move the cum-ack point?
2145          */
2146         struct sctp_association *asoc;
2147         int i, at;
2148         int all_ones, last_all_ones = 0;
2149         int slide_from, slide_end, lgap, distance;
2150
2151 #ifdef SCTP_MAP_LOGGING
2152         uint32_t old_cumack, old_base, old_highest;
2153         unsigned char aux_array[64];
2154
2155 #endif
2156         struct sctp_stream_reset_list *liste;
2157
2158         asoc = &stcb->asoc;
2159         at = 0;
2160
2161 #ifdef SCTP_MAP_LOGGING
2162         old_cumack = asoc->cumulative_tsn;
2163         old_base = asoc->mapping_array_base_tsn;
2164         old_highest = asoc->highest_tsn_inside_map;
2165         if (asoc->mapping_array_size < 64)
2166                 memcpy(aux_array, asoc->mapping_array,
2167                     asoc->mapping_array_size);
2168         else
2169                 memcpy(aux_array, asoc->mapping_array, 64);
2170 #endif
2171
2172         /*
2173          * We could probably improve this a small bit by calculating the
2174          * offset of the current cum-ack as the starting point.
2175          */
2176         all_ones = 1;
2177         at = 0;
2178         for (i = 0; i < stcb->asoc.mapping_array_size; i++) {
2179                 if (asoc->mapping_array[i] == 0xff) {
2180                         at += 8;
2181                         last_all_ones = 1;
2182                 } else {
2183                         /* there is a 0 bit */
2184                         all_ones = 0;
2185                         at += sctp_map_lookup_tab[asoc->mapping_array[i]];
2186                         last_all_ones = 0;
2187                         break;
2188                 }
2189         }
2190         asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - last_all_ones);
2191         /* at is one off, since in the table a embedded -1 is present */
2192         at++;
2193
2194         if (compare_with_wrap(asoc->cumulative_tsn,
2195             asoc->highest_tsn_inside_map,
2196             MAX_TSN)) {
2197 #ifdef INVARIANTS
2198                 panic("huh, cumack greater than high-tsn in map");
2199 #else
2200                 printf("huh, cumack greater than high-tsn in map - should panic?\n");
2201                 asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2202 #endif
2203         }
2204         if (all_ones ||
2205             (asoc->cumulative_tsn == asoc->highest_tsn_inside_map && at >= 8)) {
2206                 /* The complete array was completed by a single FR */
2207                 /* higest becomes the cum-ack */
2208                 int clr;
2209
2210                 asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
2211                 /* clear the array */
2212                 if (all_ones)
2213                         clr = asoc->mapping_array_size;
2214                 else {
2215                         clr = (at >> 3) + 1;
2216                         /*
2217                          * this should be the allones case but just in case
2218                          * :>
2219                          */
2220                         if (clr > asoc->mapping_array_size)
2221                                 clr = asoc->mapping_array_size;
2222                 }
2223                 memset(asoc->mapping_array, 0, clr);
2224                 /* base becomes one ahead of the cum-ack */
2225                 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2226 #ifdef SCTP_MAP_LOGGING
2227                 sctp_log_map(old_base, old_cumack, old_highest,
2228                     SCTP_MAP_PREPARE_SLIDE);
2229                 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2230                     asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_CLEARED);
2231 #endif
2232         } else if (at >= 8) {
2233                 /* we can slide the mapping array down */
2234                 /* Calculate the new byte postion we can move down */
2235                 slide_from = at >> 3;
2236                 /*
2237                  * now calculate the ceiling of the move using our highest
2238                  * TSN value
2239                  */
2240                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
2241                         lgap = asoc->highest_tsn_inside_map -
2242                             asoc->mapping_array_base_tsn;
2243                 } else {
2244                         lgap = (MAX_TSN - asoc->mapping_array_base_tsn) +
2245                             asoc->highest_tsn_inside_map + 1;
2246                 }
2247                 slide_end = lgap >> 3;
2248                 if (slide_end < slide_from) {
2249                         panic("impossible slide");
2250                 }
2251                 distance = (slide_end - slide_from) + 1;
2252 #ifdef SCTP_MAP_LOGGING
2253                 sctp_log_map(old_base, old_cumack, old_highest,
2254                     SCTP_MAP_PREPARE_SLIDE);
2255                 sctp_log_map((uint32_t) slide_from, (uint32_t) slide_end,
2256                     (uint32_t) lgap, SCTP_MAP_SLIDE_FROM);
2257 #endif
2258                 if (distance + slide_from > asoc->mapping_array_size ||
2259                     distance < 0) {
2260                         /*
2261                          * Here we do NOT slide forward the array so that
2262                          * hopefully when more data comes in to fill it up
2263                          * we will be able to slide it forward. Really I
2264                          * don't think this should happen :-0
2265                          */
2266
2267 #ifdef SCTP_MAP_LOGGING
2268                         sctp_log_map((uint32_t) distance, (uint32_t) slide_from,
2269                             (uint32_t) asoc->mapping_array_size,
2270                             SCTP_MAP_SLIDE_NONE);
2271 #endif
2272                 } else {
2273                         int ii;
2274
2275                         for (ii = 0; ii < distance; ii++) {
2276                                 asoc->mapping_array[ii] =
2277                                     asoc->mapping_array[slide_from + ii];
2278                         }
2279                         for (ii = distance; ii <= slide_end; ii++) {
2280                                 asoc->mapping_array[ii] = 0;
2281                         }
2282                         asoc->mapping_array_base_tsn += (slide_from << 3);
2283 #ifdef SCTP_MAP_LOGGING
2284                         sctp_log_map(asoc->mapping_array_base_tsn,
2285                             asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2286                             SCTP_MAP_SLIDE_RESULT);
2287 #endif
2288                 }
2289         }
2290         /* check the special flag for stream resets */
2291         if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2292             ((compare_with_wrap(asoc->cumulative_tsn, liste->tsn, MAX_TSN)) ||
2293             (asoc->cumulative_tsn == liste->tsn))
2294             ) {
2295                 /*
2296                  * we have finished working through the backlogged TSN's now
2297                  * time to reset streams. 1: call reset function. 2: free
2298                  * pending_reply space 3: distribute any chunks in
2299                  * pending_reply_queue.
2300                  */
2301                 struct sctp_queued_to_read *ctl;
2302
2303                 sctp_reset_in_stream(stcb, liste->number_entries, liste->req.list_of_streams);
2304                 TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
2305                 SCTP_FREE(liste);
2306                 liste = TAILQ_FIRST(&asoc->resetHead);
2307                 ctl = TAILQ_FIRST(&asoc->pending_reply_queue);
2308                 if (ctl && (liste == NULL)) {
2309                         /* All can be removed */
2310                         while (ctl) {
2311                                 TAILQ_REMOVE(&asoc->pending_reply_queue, ctl, next);
2312                                 sctp_queue_data_to_stream(stcb, asoc, ctl, abort_flag);
2313                                 if (*abort_flag) {
2314                                         return;
2315                                 }
2316                                 ctl = TAILQ_FIRST(&asoc->pending_reply_queue);
2317                         }
2318                 } else if (ctl) {
2319                         /* more than one in queue */
2320                         while (!compare_with_wrap(ctl->sinfo_tsn, liste->tsn, MAX_TSN)) {
2321                                 /*
2322                                  * if ctl->sinfo_tsn is <= liste->tsn we can
2323                                  * process it which is the NOT of
2324                                  * ctl->sinfo_tsn > liste->tsn
2325                                  */
2326                                 TAILQ_REMOVE(&asoc->pending_reply_queue, ctl, next);
2327                                 sctp_queue_data_to_stream(stcb, asoc, ctl, abort_flag);
2328                                 if (*abort_flag) {
2329                                         return;
2330                                 }
2331                                 ctl = TAILQ_FIRST(&asoc->pending_reply_queue);
2332                         }
2333                 }
2334                 /*
2335                  * Now service re-assembly to pick up anything that has been
2336                  * held on reassembly queue?
2337                  */
2338                 sctp_deliver_reasm_check(stcb, asoc);
2339         }
2340         /*
2341          * Now we need to see if we need to queue a sack or just start the
2342          * timer (if allowed).
2343          */
2344         if (ok_to_sack) {
2345                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2346                         /*
2347                          * Ok special case, in SHUTDOWN-SENT case. here we
2348                          * maker sure SACK timer is off and instead send a
2349                          * SHUTDOWN and a SACK
2350                          */
2351                         if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2352                                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2353                                     stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_INDATA + SCTP_LOC_18);
2354                         }
2355                         sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
2356                         sctp_send_sack(stcb);
2357                 } else {
2358                         int is_a_gap;
2359
2360                         /* is there a gap now ? */
2361                         is_a_gap = compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2362                             stcb->asoc.cumulative_tsn, MAX_TSN);
2363
2364                         /*
2365                          * CMT DAC algorithm: increase number of packets
2366                          * received since last ack
2367                          */
2368                         stcb->asoc.cmt_dac_pkts_rcvd++;
2369
2370                         if ((stcb->asoc.send_sack == 1) ||      /* We need to send a
2371                                                                  * SACK */
2372                             ((was_a_gap) && (is_a_gap == 0)) || /* was a gap, but no
2373                                                                  * longer is one */
2374                             (stcb->asoc.numduptsns) ||  /* we have dup's */
2375                             (is_a_gap) ||       /* is still a gap */
2376                             (stcb->asoc.delayed_ack == 0) ||    /* Delayed sack disabled */
2377                             (stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq) /* hit limit of pkts */
2378                             ) {
2379
2380                                 if ((sctp_cmt_on_off) && (sctp_cmt_use_dac) &&
2381                                     (stcb->asoc.send_sack == 0) &&
2382                                     (stcb->asoc.numduptsns == 0) &&
2383                                     (stcb->asoc.delayed_ack) &&
2384                                     (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer))) {
2385
2386                                         /*
2387                                          * CMT DAC algorithm: With CMT,
2388                                          * delay acks even in the face of
2389                                          *
2390                                          * reordering. Therefore, if acks that
2391                                          * do not have to be sent because of
2392                                          * the above reasons, will be
2393                                          * delayed. That is, acks that would
2394                                          * have been sent due to gap reports
2395                                          * will be delayed with DAC. Start
2396                                          * the delayed ack timer.
2397                                          */
2398                                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2399                                             stcb->sctp_ep, stcb, NULL);
2400                                 } else {
2401                                         /*
2402                                          * Ok we must build a SACK since the
2403                                          * timer is pending, we got our
2404                                          * first packet OR there are gaps or
2405                                          * duplicates.
2406                                          */
2407                                         SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
2408                                         sctp_send_sack(stcb);
2409                                 }
2410                         } else {
2411                                 if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2412                                         sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2413                                             stcb->sctp_ep, stcb, NULL);
2414                                 }
2415                         }
2416                 }
2417         }
2418 }
2419
2420 void
2421 sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc)
2422 {
2423         struct sctp_tmit_chunk *chk;
2424         uint32_t tsize;
2425         uint16_t nxt_todel;
2426
2427         if (asoc->fragmented_delivery_inprogress) {
2428                 sctp_service_reassembly(stcb, asoc);
2429         }
2430         /* Can we proceed further, i.e. the PD-API is complete */
2431         if (asoc->fragmented_delivery_inprogress) {
2432                 /* no */
2433                 return;
2434         }
2435         /*
2436          * Now is there some other chunk I can deliver from the reassembly
2437          * queue.
2438          */
2439 doit_again:
2440         chk = TAILQ_FIRST(&asoc->reasmqueue);
2441         if (chk == NULL) {
2442                 asoc->size_on_reasm_queue = 0;
2443                 asoc->cnt_on_reasm_queue = 0;
2444                 return;
2445         }
2446         nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
2447         if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
2448             ((nxt_todel == chk->rec.data.stream_seq) ||
2449             (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
2450                 /*
2451                  * Yep the first one is here. We setup to start reception,
2452                  * by backing down the TSN just in case we can't deliver.
2453                  */
2454
2455                 /*
2456                  * Before we start though either all of the message should
2457                  * be here or 1/4 the socket buffer max or nothing on the
2458                  * delivery queue and something can be delivered.
2459                  */
2460                 if ((sctp_is_all_msg_on_reasm(asoc, &tsize) ||
2461                     (tsize > stcb->sctp_ep->partial_delivery_point))) {
2462                         asoc->fragmented_delivery_inprogress = 1;
2463                         asoc->tsn_last_delivered = chk->rec.data.TSN_seq - 1;
2464                         asoc->str_of_pdapi = chk->rec.data.stream_number;
2465                         asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
2466                         asoc->pdapi_ppid = chk->rec.data.payloadtype;
2467                         asoc->fragment_flags = chk->rec.data.rcv_flags;
2468                         sctp_service_reassembly(stcb, asoc);
2469                         if (asoc->fragmented_delivery_inprogress == 0) {
2470                                 goto doit_again;
2471                         }
2472                 }
2473         }
2474 }
2475
2476 int
2477 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2478     struct sctphdr *sh, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2479     struct sctp_nets *net, uint32_t * high_tsn)
2480 {
2481         struct sctp_data_chunk *ch, chunk_buf;
2482         struct sctp_association *asoc;
2483         int num_chunks = 0;     /* number of control chunks processed */
2484         int stop_proc = 0;
2485         int chk_length, break_flag, last_chunk;
2486         int abort_flag = 0, was_a_gap = 0;
2487         struct mbuf *m;
2488
2489         /* set the rwnd */
2490         sctp_set_rwnd(stcb, &stcb->asoc);
2491
2492         m = *mm;
2493         SCTP_TCB_LOCK_ASSERT(stcb);
2494         asoc = &stcb->asoc;
2495         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
2496             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
2497             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
2498                 /*
2499                  * wait a minute, this guy is gone, there is no longer a
2500                  * receiver. Send peer an ABORT!
2501                  */
2502                 struct mbuf *op_err;
2503
2504                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2505                 sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
2506                 return (2);
2507         }
2508         if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2509             stcb->asoc.cumulative_tsn, MAX_TSN)) {
2510                 /* there was a gap before this data was processed */
2511                 was_a_gap = 1;
2512         }
2513         /*
2514          * setup where we got the last DATA packet from for any SACK that
2515          * may need to go out. Don't bump the net. This is done ONLY when a
2516          * chunk is assigned.
2517          */
2518         asoc->last_data_chunk_from = net;
2519
2520         /*
2521          * Now before we proceed we must figure out if this is a wasted
2522          * cluster... i.e. it is a small packet sent in and yet the driver
2523          * underneath allocated a full cluster for it. If so we must copy it
2524          * to a smaller mbuf and free up the cluster mbuf. This will help
2525          * with cluster starvation.
2526          */
2527         if (SCTP_BUF_LEN(m) < (long)MLEN && SCTP_BUF_NEXT(m) == NULL) {
2528                 /* we only handle mbufs that are singletons.. not chains */
2529                 m = sctp_get_mbuf_for_msg(SCTP_BUF_LEN(m), 0, M_DONTWAIT, 1, MT_DATA);
2530                 if (m) {
2531                         /* ok lets see if we can copy the data up */
2532                         caddr_t *from, *to;
2533
2534                         /* get the pointers and copy */
2535                         to = mtod(m, caddr_t *);
2536                         from = mtod((*mm), caddr_t *);
2537                         memcpy(to, from, SCTP_BUF_LEN((*mm)));
2538                         /* copy the length and free up the old */
2539                         SCTP_BUF_LEN(m) = SCTP_BUF_LEN((*mm));
2540                         sctp_m_freem(*mm);
2541                         /* sucess, back copy */
2542                         *mm = m;
2543                 } else {
2544                         /* We are in trouble in the mbuf world .. yikes */
2545                         m = *mm;
2546                 }
2547         }
2548         /* get pointer to the first chunk header */
2549         ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2550             sizeof(struct sctp_data_chunk), (uint8_t *) & chunk_buf);
2551         if (ch == NULL) {
2552                 return (1);
2553         }
2554         /*
2555          * process all DATA chunks...
2556          */
2557         *high_tsn = asoc->cumulative_tsn;
2558         break_flag = 0;
2559         asoc->data_pkts_seen++;
2560         while (stop_proc == 0) {
2561                 /* validate chunk length */
2562                 chk_length = ntohs(ch->ch.chunk_length);
2563                 if (length - *offset < chk_length) {
2564                         /* all done, mutulated chunk */
2565                         stop_proc = 1;
2566                         break;
2567                 }
2568                 if (ch->ch.chunk_type == SCTP_DATA) {
2569                         if ((size_t)chk_length < sizeof(struct sctp_data_chunk) + 1) {
2570                                 /*
2571                                  * Need to send an abort since we had a
2572                                  * invalid data chunk.
2573                                  */
2574                                 struct mbuf *op_err;
2575
2576                                 op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 2 * sizeof(uint32_t)),
2577                                     0, M_DONTWAIT, 1, MT_DATA);
2578
2579                                 if (op_err) {
2580                                         struct sctp_paramhdr *ph;
2581                                         uint32_t *ippp;
2582
2583                                         SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr) +
2584                                             (2 * sizeof(uint32_t));
2585                                         ph = mtod(op_err, struct sctp_paramhdr *);
2586                                         ph->param_type =
2587                                             htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2588                                         ph->param_length = htons(SCTP_BUF_LEN(op_err));
2589                                         ippp = (uint32_t *) (ph + 1);
2590                                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_19);
2591                                         ippp++;
2592                                         *ippp = asoc->cumulative_tsn;
2593
2594                                 }
2595                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_19;
2596                                 sctp_abort_association(inp, stcb, m, iphlen, sh,
2597                                     op_err);
2598                                 return (2);
2599                         }
2600 #ifdef SCTP_AUDITING_ENABLED
2601                         sctp_audit_log(0xB1, 0);
2602 #endif
2603                         if (SCTP_SIZE32(chk_length) == (length - *offset)) {
2604                                 last_chunk = 1;
2605                         } else {
2606                                 last_chunk = 0;
2607                         }
2608                         if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch,
2609                             chk_length, net, high_tsn, &abort_flag, &break_flag,
2610                             last_chunk)) {
2611                                 num_chunks++;
2612                         }
2613                         if (abort_flag)
2614                                 return (2);
2615
2616                         if (break_flag) {
2617                                 /*
2618                                  * Set because of out of rwnd space and no
2619                                  * drop rep space left.
2620                                  */
2621                                 stop_proc = 1;
2622                                 break;
2623                         }
2624                 } else {
2625                         /* not a data chunk in the data region */
2626                         switch (ch->ch.chunk_type) {
2627                         case SCTP_INITIATION:
2628                         case SCTP_INITIATION_ACK:
2629                         case SCTP_SELECTIVE_ACK:
2630                         case SCTP_HEARTBEAT_REQUEST:
2631                         case SCTP_HEARTBEAT_ACK:
2632                         case SCTP_ABORT_ASSOCIATION:
2633                         case SCTP_SHUTDOWN:
2634                         case SCTP_SHUTDOWN_ACK:
2635                         case SCTP_OPERATION_ERROR:
2636                         case SCTP_COOKIE_ECHO:
2637                         case SCTP_COOKIE_ACK:
2638                         case SCTP_ECN_ECHO:
2639                         case SCTP_ECN_CWR:
2640                         case SCTP_SHUTDOWN_COMPLETE:
2641                         case SCTP_AUTHENTICATION:
2642                         case SCTP_ASCONF_ACK:
2643                         case SCTP_PACKET_DROPPED:
2644                         case SCTP_STREAM_RESET:
2645                         case SCTP_FORWARD_CUM_TSN:
2646                         case SCTP_ASCONF:
2647                                 /*
2648                                  * Now, what do we do with KNOWN chunks that
2649                                  * are NOT in the right place?
2650                                  *
2651                                  * For now, I do nothing but ignore them. We
2652                                  * may later want to add sysctl stuff to
2653                                  * switch out and do either an ABORT() or
2654                                  * possibly process them.
2655                                  */
2656                                 if (sctp_strict_data_order) {
2657                                         struct mbuf *op_err;
2658
2659                                         op_err = sctp_generate_invmanparam(SCTP_CAUSE_PROTOCOL_VIOLATION);
2660                                         sctp_abort_association(inp, stcb, m, iphlen, sh, op_err);
2661                                         return (2);
2662                                 }
2663                                 break;
2664                         default:
2665                                 /* unknown chunk type, use bit rules */
2666                                 if (ch->ch.chunk_type & 0x40) {
2667                                         /* Add a error report to the queue */
2668                                         struct mbuf *mm;
2669                                         struct sctp_paramhdr *phd;
2670
2671                                         mm = sctp_get_mbuf_for_msg(sizeof(*phd), 0, M_DONTWAIT, 1, MT_DATA);
2672                                         if (mm) {
2673                                                 phd = mtod(mm, struct sctp_paramhdr *);
2674                                                 /*
2675                                                  * We cheat and use param
2676                                                  * type since we did not
2677                                                  * bother to define a error
2678                                                  * cause struct. They are
2679                                                  * the same basic format
2680                                                  * with different names.
2681                                                  */
2682                                                 phd->param_type =
2683                                                     htons(SCTP_CAUSE_UNRECOG_CHUNK);
2684                                                 phd->param_length =
2685                                                     htons(chk_length + sizeof(*phd));
2686                                                 SCTP_BUF_LEN(mm) = sizeof(*phd);
2687                                                 SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset,
2688                                                     SCTP_SIZE32(chk_length),
2689                                                     M_DONTWAIT);
2690                                                 if (SCTP_BUF_NEXT(mm)) {
2691                                                         sctp_queue_op_err(stcb, mm);
2692                                                 } else {
2693                                                         sctp_m_freem(mm);
2694                                                 }
2695                                         }
2696                                 }
2697                                 if ((ch->ch.chunk_type & 0x80) == 0) {
2698                                         /* discard the rest of this packet */
2699                                         stop_proc = 1;
2700                                 }       /* else skip this bad chunk and
2701                                          * continue... */
2702                                 break;
2703                         };      /* switch of chunk type */
2704                 }
2705                 *offset += SCTP_SIZE32(chk_length);
2706                 if ((*offset >= length) || stop_proc) {
2707                         /* no more data left in the mbuf chain */
2708                         stop_proc = 1;
2709                         continue;
2710                 }
2711                 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2712                     sizeof(struct sctp_data_chunk), (uint8_t *) & chunk_buf);
2713                 if (ch == NULL) {
2714                         *offset = length;
2715                         stop_proc = 1;
2716                         break;
2717
2718                 }
2719         }                       /* while */
2720         if (break_flag) {
2721                 /*
2722                  * we need to report rwnd overrun drops.
2723                  */
2724                 sctp_send_packet_dropped(stcb, net, *mm, iphlen, 0);
2725         }
2726         if (num_chunks) {
2727                 /*
2728                  * Did we get data, if so update the time for auto-close and
2729                  * give peer credit for being alive.
2730                  */
2731                 SCTP_STAT_INCR(sctps_recvpktwithdata);
2732                 stcb->asoc.overall_error_count = 0;
2733                 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2734         }
2735         /* now service all of the reassm queue if needed */
2736         if (!(TAILQ_EMPTY(&asoc->reasmqueue)))
2737                 sctp_service_queues(stcb, asoc);
2738
2739         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2740                 /* Assure that we ack right away */
2741                 stcb->asoc.send_sack = 1;
2742         }
2743         /* Start a sack timer or QUEUE a SACK for sending */
2744         if ((stcb->asoc.cumulative_tsn == stcb->asoc.highest_tsn_inside_map) &&
2745             (stcb->asoc.mapping_array[0] != 0xff)) {
2746                 if ((stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq) ||
2747                     (stcb->asoc.delayed_ack == 0) ||
2748                     (stcb->asoc.send_sack == 1)) {
2749                         if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2750                                 SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
2751                         }
2752                         sctp_send_sack(stcb);
2753                 } else {
2754                         if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2755                                 sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2756                                     stcb->sctp_ep, stcb, NULL);
2757                         }
2758                 }
2759         } else {
2760                 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
2761         }
2762         if (abort_flag)
2763                 return (2);
2764
2765         return (0);
2766 }
2767
2768 static void
2769 sctp_handle_segments(struct sctp_tcb *stcb, struct sctp_association *asoc,
2770     struct sctp_sack_chunk *ch, uint32_t last_tsn, uint32_t * biggest_tsn_acked,
2771     uint32_t * biggest_newly_acked_tsn, uint32_t * this_sack_lowest_newack,
2772     int num_seg, int *ecn_seg_sums)
2773 {
2774         /************************************************/
2775         /* process fragments and update sendqueue        */
2776         /************************************************/
2777         struct sctp_sack *sack;
2778         struct sctp_gap_ack_block *frag;
2779         struct sctp_tmit_chunk *tp1;
2780         int i;
2781         unsigned int j;
2782
2783 #ifdef SCTP_FR_LOGGING
2784         int num_frs = 0;
2785
2786 #endif
2787         uint16_t frag_strt, frag_end, primary_flag_set;
2788         u_long last_frag_high;
2789
2790         /*
2791          * @@@ JRI : TODO: This flag is not used anywhere .. remove?
2792          */
2793         if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
2794                 primary_flag_set = 1;
2795         } else {
2796                 primary_flag_set = 0;
2797         }
2798
2799         sack = &ch->sack;
2800         frag = (struct sctp_gap_ack_block *)((caddr_t)sack +
2801             sizeof(struct sctp_sack));
2802         tp1 = NULL;
2803         last_frag_high = 0;
2804         for (i = 0; i < num_seg; i++) {
2805                 frag_strt = ntohs(frag->start);
2806                 frag_end = ntohs(frag->end);
2807                 /* some sanity checks on the fargment offsets */
2808                 if (frag_strt > frag_end) {
2809                         /* this one is malformed, skip */
2810                         frag++;
2811                         continue;
2812                 }
2813                 if (compare_with_wrap((frag_end + last_tsn), *biggest_tsn_acked,
2814                     MAX_TSN))
2815                         *biggest_tsn_acked = frag_end + last_tsn;
2816
2817                 /* mark acked dgs and find out the highestTSN being acked */
2818                 if (tp1 == NULL) {
2819                         tp1 = TAILQ_FIRST(&asoc->sent_queue);
2820
2821                         /* save the locations of the last frags */
2822                         last_frag_high = frag_end + last_tsn;
2823                 } else {
2824                         /*
2825                          * now lets see if we need to reset the queue due to
2826                          * a out-of-order SACK fragment
2827                          */
2828                         if (compare_with_wrap(frag_strt + last_tsn,
2829                             last_frag_high, MAX_TSN)) {
2830                                 /*
2831                                  * if the new frag starts after the last TSN
2832                                  * frag covered, we are ok and this one is
2833                                  * beyond the last one
2834                                  */
2835                                 ;
2836                         } else {
2837                                 /*
2838                                  * ok, they have reset us, so we need to
2839                                  * reset the queue this will cause extra
2840                                  * hunting but hey, they chose the
2841                                  * performance hit when they failed to order
2842                                  * there gaps..
2843                                  */
2844                                 tp1 = TAILQ_FIRST(&asoc->sent_queue);
2845                         }
2846                         last_frag_high = frag_end + last_tsn;
2847                 }
2848                 for (j = frag_strt + last_tsn; j <= frag_end + last_tsn; j++) {
2849                         while (tp1) {
2850 #ifdef SCTP_FR_LOGGING
2851                                 if (tp1->rec.data.doing_fast_retransmit)
2852                                         num_frs++;
2853 #endif
2854
2855                                 /*
2856                                  * CMT: CUCv2 algorithm. For each TSN being
2857                                  * processed from the sent queue, track the
2858                                  * next expected pseudo-cumack, or
2859                                  * rtx_pseudo_cumack, if required. Separate
2860                                  * cumack trackers for first transmissions,
2861                                  * and retransmissions.
2862                                  */
2863                                 if ((tp1->whoTo->find_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) &&
2864                                     (tp1->snd_count == 1)) {
2865                                         tp1->whoTo->pseudo_cumack = tp1->rec.data.TSN_seq;
2866                                         tp1->whoTo->find_pseudo_cumack = 0;
2867                                 }
2868                                 if ((tp1->whoTo->find_rtx_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) &&
2869                                     (tp1->snd_count > 1)) {
2870                                         tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.TSN_seq;
2871                                         tp1->whoTo->find_rtx_pseudo_cumack = 0;
2872                                 }
2873                                 if (tp1->rec.data.TSN_seq == j) {
2874                                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2875                                                 /*
2876                                                  * must be held until
2877                                                  * cum-ack passes
2878                                                  */
2879                                                 /*
2880                                                  * ECN Nonce: Add the nonce
2881                                                  * value to the sender's
2882                                                  * nonce sum
2883                                                  */
2884                                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
2885                                                         /*
2886                                                          * If it is less
2887                                                          * than ACKED, it is
2888                                                          * now no-longer in
2889                                                          * flight. Higher
2890                                                          * values may
2891                                                          * already be set
2892                                                          * via previous Gap
2893                                                          * Ack Blocks...
2894                                                          * i.e. ACKED or
2895                                                          * MARKED.
2896                                                          */
2897                                                         if (compare_with_wrap(tp1->rec.data.TSN_seq,
2898                                                             *biggest_newly_acked_tsn, MAX_TSN)) {
2899                                                                 *biggest_newly_acked_tsn = tp1->rec.data.TSN_seq;
2900                                                         }
2901                                                         /*
2902                                                          * CMT: SFR algo
2903                                                          * (and HTNA) - set
2904                                                          * saw_newack to 1
2905                                                          * for dest being
2906                                                          * newly acked.
2907                                                          * update
2908                                                          * this_sack_highest_
2909                                                          * newack if
2910                                                          * appropriate.
2911                                                          */
2912                                                         if (tp1->rec.data.chunk_was_revoked == 0)
2913                                                                 tp1->whoTo->saw_newack = 1;
2914
2915                                                         if (compare_with_wrap(tp1->rec.data.TSN_seq,
2916                                                             tp1->whoTo->this_sack_highest_newack,
2917                                                             MAX_TSN)) {
2918                                                                 tp1->whoTo->this_sack_highest_newack =
2919                                                                     tp1->rec.data.TSN_seq;
2920                                                         }
2921                                                         /*
2922                                                          * CMT DAC algo:
2923                                                          * also update
2924                                                          * this_sack_lowest_n
2925                                                          * ewack
2926                                                          */
2927                                                         if (*this_sack_lowest_newack == 0) {
2928 #ifdef SCTP_SACK_LOGGING
2929                                                                 sctp_log_sack(*this_sack_lowest_newack,
2930                                                                     last_tsn,
2931                                                                     tp1->rec.data.TSN_seq,
2932                                                                     0,
2933                                                                     0,
2934                                                                     SCTP_LOG_TSN_ACKED);
2935 #endif
2936                                                                 *this_sack_lowest_newack = tp1->rec.data.TSN_seq;
2937                                                         }
2938                                                         /*
2939                                                          * CMT: CUCv2
2940                                                          * algorithm. If
2941                                                          * (rtx-)pseudo-cumac
2942                                                          * k for corresp
2943                                                          * dest is being
2944                                                          * acked, then we
2945                                                          * have a new
2946                                                          * (rtx-)pseudo-cumac
2947                                                          * k. Set
2948                                                          * new_(rtx_)pseudo_c
2949                                                          * umack to TRUE so
2950                                                          * that the cwnd for
2951                                                          * this dest can be
2952                                                          * updated. Also
2953                                                          * trigger search
2954                                                          * for the next
2955                                                          * expected
2956                                                          * (rtx-)pseudo-cumac
2957                                                          * k. Separate
2958                                                          * pseudo_cumack
2959                                                          * trackers for
2960                                                          * first
2961                                                          * transmissions and
2962                                                          * retransmissions.
2963                                                          */
2964                                                         if (tp1->rec.data.TSN_seq == tp1->whoTo->pseudo_cumack) {
2965                                                                 if (tp1->rec.data.chunk_was_revoked == 0) {
2966                                                                         tp1->whoTo->new_pseudo_cumack = 1;
2967                                                                 }
2968                                                                 tp1->whoTo->find_pseudo_cumack = 1;
2969                                                         }
2970 #ifdef SCTP_CWND_LOGGING
2971                                                         sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
2972 #endif
2973                                                         if (tp1->rec.data.TSN_seq == tp1->whoTo->rtx_pseudo_cumack) {
2974                                                                 if (tp1->rec.data.chunk_was_revoked == 0) {
2975                                                                         tp1->whoTo->new_pseudo_cumack = 1;
2976                                                                 }
2977                                                                 tp1->whoTo->find_rtx_pseudo_cumack = 1;
2978                                                         }
2979 #ifdef SCTP_SACK_LOGGING
2980                                                         sctp_log_sack(*biggest_newly_acked_tsn,
2981                                                             last_tsn,
2982                                                             tp1->rec.data.TSN_seq,
2983                                                             frag_strt,
2984                                                             frag_end,
2985                                                             SCTP_LOG_TSN_ACKED);
2986 #endif
2987 #ifdef SCTP_FLIGHT_LOGGING
2988                                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN,
2989                                                             tp1->whoTo->flight_size,
2990                                                             tp1->book_size,
2991                                                             (uintptr_t) stcb,
2992                                                             tp1->rec.data.TSN_seq);
2993 #endif
2994                                                         if (tp1->whoTo->flight_size >= tp1->book_size)
2995                                                                 tp1->whoTo->flight_size -= tp1->book_size;
2996                                                         else
2997                                                                 tp1->whoTo->flight_size = 0;
2998
2999                                                         if (asoc->total_flight >= tp1->book_size) {
3000                                                                 asoc->total_flight -= tp1->book_size;
3001                                                                 if (asoc->total_flight_count > 0)
3002                                                                         asoc->total_flight_count--;
3003                                                         } else {
3004                                                                 asoc->total_flight = 0;
3005                                                                 asoc->total_flight_count = 0;
3006                                                         }
3007
3008                                                         tp1->whoTo->net_ack += tp1->send_size;
3009
3010                                                         if (tp1->snd_count < 2) {
3011                                                                 /*
3012                                                                  * True
3013                                                                  * non-retran
3014                                                                  * smited
3015                                                                  * chunk */
3016                                                                 tp1->whoTo->net_ack2 += tp1->send_size;
3017
3018                                                                 /*
3019                                                                  * update RTO
3020                                                                  * too ? */
3021                                                                 if (tp1->do_rtt) {
3022                                                                         tp1->whoTo->RTO =
3023                                                                             sctp_calculate_rto(stcb,
3024                                                                             asoc,
3025                                                                             tp1->whoTo,
3026                                                                             &tp1->sent_rcv_time);
3027                                                                         tp1->do_rtt = 0;
3028                                                                 }
3029                                                         }
3030                                                 }
3031                                                 if (tp1->sent <= SCTP_DATAGRAM_RESEND &&
3032                                                     tp1->sent != SCTP_DATAGRAM_UNSENT &&
3033                                                     compare_with_wrap(tp1->rec.data.TSN_seq,
3034                                                     asoc->this_sack_highest_gap,
3035                                                     MAX_TSN)) {
3036                                                         asoc->this_sack_highest_gap =
3037                                                             tp1->rec.data.TSN_seq;
3038                                                 }
3039                                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3040                                                         sctp_ucount_decr(asoc->sent_queue_retran_cnt);
3041 #ifdef SCTP_AUDITING_ENABLED
3042                                                         sctp_audit_log(0xB2,
3043                                                             (asoc->sent_queue_retran_cnt & 0x000000ff));
3044 #endif
3045
3046                                                 }
3047                                                 (*ecn_seg_sums) += tp1->rec.data.ect_nonce;
3048                                                 (*ecn_seg_sums) &= SCTP_SACK_NONCE_SUM;
3049
3050                                                 tp1->sent = SCTP_DATAGRAM_MARKED;
3051                                                 if (tp1->rec.data.chunk_was_revoked) {
3052                                                         /* deflate the cwnd */
3053                                                         tp1->whoTo->cwnd -= tp1->book_size;
3054                                                         tp1->rec.data.chunk_was_revoked = 0;
3055                                                 }
3056                                         }
3057                                         break;
3058                                 }       /* if (tp1->TSN_seq == j) */
3059                                 if (compare_with_wrap(tp1->rec.data.TSN_seq, j,
3060                                     MAX_TSN))
3061                                         break;
3062
3063                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3064                         }       /* end while (tp1) */
3065                 }               /* end for (j = fragStart */
3066                 frag++;         /* next one */
3067         }
3068 #ifdef SCTP_FR_LOGGING
3069         /*
3070          * if (num_frs) sctp_log_fr(*biggest_tsn_acked,
3071          * *biggest_newly_acked_tsn, last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
3072          */
3073 #endif
3074 }
3075
3076 static void
3077 sctp_check_for_revoked(struct sctp_association *asoc, uint32_t cumack,
3078     u_long biggest_tsn_acked)
3079 {
3080         struct sctp_tmit_chunk *tp1;
3081         int tot_revoked = 0;
3082
3083         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3084         while (tp1) {
3085                 if (compare_with_wrap(tp1->rec.data.TSN_seq, cumack,
3086                     MAX_TSN)) {
3087                         /*
3088                          * ok this guy is either ACK or MARKED. If it is
3089                          * ACKED it has been previously acked but not this
3090                          * time i.e. revoked.  If it is MARKED it was ACK'ed
3091                          * again.
3092                          */
3093                         if (tp1->sent == SCTP_DATAGRAM_ACKED) {
3094                                 /* it has been revoked */
3095                                 tp1->sent = SCTP_DATAGRAM_SENT;
3096                                 tp1->rec.data.chunk_was_revoked = 1;
3097                                 /*
3098                                  * We must add this stuff back in to assure
3099                                  * timers and such get started.
3100                                  */
3101                                 tp1->whoTo->flight_size += tp1->book_size;
3102                                 /*
3103                                  * We inflate the cwnd to compensate for our
3104                                  * artificial inflation of the flight_size.
3105                                  */
3106                                 tp1->whoTo->cwnd += tp1->book_size;
3107                                 asoc->total_flight_count++;
3108                                 asoc->total_flight += tp1->book_size;
3109
3110                                 tot_revoked++;
3111 #ifdef SCTP_SACK_LOGGING
3112                                 sctp_log_sack(asoc->last_acked_seq,
3113                                     cumack,
3114                                     tp1->rec.data.TSN_seq,
3115                                     0,
3116                                     0,
3117                                     SCTP_LOG_TSN_REVOKED);
3118 #endif
3119                         } else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
3120                                 /* it has been re-acked in this SACK */
3121                                 tp1->sent = SCTP_DATAGRAM_ACKED;
3122                         }
3123                 }
3124                 if (tp1->sent == SCTP_DATAGRAM_UNSENT)
3125                         break;
3126                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3127         }
3128         if (tot_revoked > 0) {
3129                 /*
3130                  * Setup the ecn nonce re-sync point. We do this since once
3131                  * data is revoked we begin to retransmit things, which do
3132                  * NOT have the ECN bits set. This means we are now out of
3133                  * sync and must wait until we get back in sync with the
3134                  * peer to check ECN bits.
3135                  */
3136                 tp1 = TAILQ_FIRST(&asoc->send_queue);
3137                 if (tp1 == NULL) {
3138                         asoc->nonce_resync_tsn = asoc->sending_seq;
3139                 } else {
3140                         asoc->nonce_resync_tsn = tp1->rec.data.TSN_seq;
3141                 }
3142                 asoc->nonce_wait_for_ecne = 0;
3143                 asoc->nonce_sum_check = 0;
3144         }
3145 }
3146
3147 static void
3148 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
3149     u_long biggest_tsn_acked, u_long biggest_tsn_newly_acked, u_long this_sack_lowest_newack, int accum_moved)
3150 {
3151         struct sctp_tmit_chunk *tp1;
3152         int strike_flag = 0;
3153         struct timeval now;
3154         int tot_retrans = 0;
3155         uint32_t sending_seq;
3156         struct sctp_nets *net;
3157         int num_dests_sacked = 0;
3158
3159         /*
3160          * select the sending_seq, this is either the next thing ready to be
3161          * sent but not transmitted, OR, the next seq we assign.
3162          */
3163         tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3164         if (tp1 == NULL) {
3165                 sending_seq = asoc->sending_seq;
3166         } else {
3167                 sending_seq = tp1->rec.data.TSN_seq;
3168         }
3169
3170         /* CMT DAC algo: finding out if SACK is a mixed SACK */
3171         if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3172                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3173                         if (net->saw_newack)
3174                                 num_dests_sacked++;
3175                 }
3176         }
3177         if (stcb->asoc.peer_supports_prsctp) {
3178                 SCTP_GETTIME_TIMEVAL(&now);
3179         }
3180         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3181         while (tp1) {
3182                 strike_flag = 0;
3183                 if (tp1->no_fr_allowed) {
3184                         /* this one had a timeout or something */
3185                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3186                         continue;
3187                 }
3188 #ifdef SCTP_FR_LOGGING
3189                 if (tp1->sent < SCTP_DATAGRAM_RESEND)
3190                         sctp_log_fr(biggest_tsn_newly_acked,
3191                             tp1->rec.data.TSN_seq,
3192                             tp1->sent,
3193                             SCTP_FR_LOG_CHECK_STRIKE);
3194 #endif
3195                 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
3196                     MAX_TSN) ||
3197                     tp1->sent == SCTP_DATAGRAM_UNSENT) {
3198                         /* done */
3199                         break;
3200                 }
3201                 if (stcb->asoc.peer_supports_prsctp) {
3202                         if ((PR_SCTP_TTL_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
3203                                 /* Is it expired? */
3204                                 if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3205                                         /* Yes so drop it */
3206                                         if (tp1->data != NULL) {
3207                                                 sctp_release_pr_sctp_chunk(stcb, tp1,
3208                                                     (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3209                                                     &asoc->sent_queue);
3210                                         }
3211                                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3212                                         continue;
3213                                 }
3214                         }
3215                         if ((PR_SCTP_RTX_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
3216                                 /* Has it been retransmitted tv_sec times? */
3217                                 if (tp1->snd_count > tp1->rec.data.timetodrop.tv_sec) {
3218                                         /* Yes, so drop it */
3219                                         if (tp1->data != NULL) {
3220                                                 sctp_release_pr_sctp_chunk(stcb, tp1,
3221                                                     (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3222                                                     &asoc->sent_queue);
3223                                         }
3224                                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3225                                         continue;
3226                                 }
3227                         }
3228                 }
3229                 if (compare_with_wrap(tp1->rec.data.TSN_seq,
3230                     asoc->this_sack_highest_gap, MAX_TSN)) {
3231                         /* we are beyond the tsn in the sack  */
3232                         break;
3233                 }
3234                 if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3235                         /* either a RESEND, ACKED, or MARKED */
3236                         /* skip */
3237                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3238                         continue;
3239                 }
3240                 /*
3241                  * CMT : SFR algo (covers part of DAC and HTNA as well)
3242                  */
3243                 if (tp1->whoTo->saw_newack == 0) {
3244                         /*
3245                          * No new acks were receieved for data sent to this
3246                          * dest. Therefore, according to the SFR algo for
3247                          * CMT, no data sent to this dest can be marked for
3248                          * FR using this SACK. (iyengar@cis.udel.edu,
3249                          * 2005/05/12)
3250                          */
3251                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3252                         continue;
3253                 } else if (compare_with_wrap(tp1->rec.data.TSN_seq,
3254                     tp1->whoTo->this_sack_highest_newack, MAX_TSN)) {
3255                         /*
3256                          * CMT: New acks were receieved for data sent to
3257                          * this dest. But no new acks were seen for data
3258                          * sent after tp1. Therefore, according to the SFR
3259                          * algo for CMT, tp1 cannot be marked for FR using
3260                          * this SACK. This step covers part of the DAC algo
3261                          * and the HTNA algo as well.
3262                          */
3263                         tp1 = TAILQ_NEXT(tp1, sctp_next);
3264                         continue;
3265                 }
3266                 /*
3267                  * Here we check to see if we were have already done a FR
3268                  * and if so we see if the biggest TSN we saw in the sack is
3269                  * smaller than the recovery point. If so we don't strike
3270                  * the tsn... otherwise we CAN strike the TSN.
3271                  */
3272                 /*
3273                  * @@@ JRI: Check for CMT if (accum_moved &&
3274                  * asoc->fast_retran_loss_recovery && (sctp_cmt_on_off ==
3275                  * 0)) {
3276                  */
3277                 if (accum_moved && asoc->fast_retran_loss_recovery) {
3278                         /*
3279                          * Strike the TSN if in fast-recovery and cum-ack
3280                          * moved.
3281                          */
3282 #ifdef SCTP_FR_LOGGING
3283                         sctp_log_fr(biggest_tsn_newly_acked,
3284                             tp1->rec.data.TSN_seq,
3285                             tp1->sent,
3286                             SCTP_FR_LOG_STRIKE_CHUNK);
3287 #endif
3288                         tp1->sent++;
3289                         if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3290                                 /*
3291                                  * CMT DAC algorithm: If SACK flag is set to
3292                                  * 0, then lowest_newack test will not pass
3293                                  * because it would have been set to the
3294                                  * cumack earlier. If not already to be
3295                                  * rtx'd, If not a mixed sack and if tp1 is
3296                                  * not between two sacked TSNs, then mark by
3297                                  * one more.
3298                                  */
3299                                 if ((tp1->sent != SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3300                                     compare_with_wrap(this_sack_lowest_newack, tp1->rec.data.TSN_seq, MAX_TSN)) {
3301 #ifdef SCTP_FR_LOGGING
3302                                         sctp_log_fr(16 + num_dests_sacked,
3303                                             tp1->rec.data.TSN_seq,
3304                                             tp1->sent,
3305                                             SCTP_FR_LOG_STRIKE_CHUNK);
3306 #endif
3307                                         tp1->sent++;
3308                                 }
3309                         }
3310                 } else if (tp1->rec.data.doing_fast_retransmit) {
3311                         /*
3312                          * For those that have done a FR we must take
3313                          * special consideration if we strike. I.e the
3314                          * biggest_newly_acked must be higher than the
3315                          * sending_seq at the time we did the FR.
3316                          */
3317 #ifdef SCTP_FR_TO_ALTERNATE
3318                         /*
3319                          * If FR's go to new networks, then we must only do
3320                          * this for singly homed asoc's. However if the FR's
3321                          * go to the same network (Armando's work) then its
3322                          * ok to FR multiple times.
3323                          */
3324                         if (asoc->numnets < 2)
3325 #else
3326                         if (1)
3327 #endif
3328                         {
3329                                 if ((compare_with_wrap(biggest_tsn_newly_acked,
3330                                     tp1->rec.data.fast_retran_tsn, MAX_TSN)) ||
3331                                     (biggest_tsn_newly_acked ==
3332                                     tp1->rec.data.fast_retran_tsn)) {
3333                                         /*
3334                                          * Strike the TSN, since this ack is
3335                                          * beyond where things were when we
3336                                          * did a FR.
3337                                          */
3338 #ifdef SCTP_FR_LOGGING
3339                                         sctp_log_fr(biggest_tsn_newly_acked,
3340                                             tp1->rec.data.TSN_seq,
3341                                             tp1->sent,
3342                                             SCTP_FR_LOG_STRIKE_CHUNK);
3343 #endif
3344                                         tp1->sent++;
3345                                         strike_flag = 1;
3346                                         if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3347                                                 /*
3348                                                  * CMT DAC algorithm: If
3349                                                  * SACK flag is set to 0,
3350                                                  * then lowest_newack test
3351                                                  * will not pass because it
3352                                                  * would have been set to
3353                                                  * the cumack earlier. If
3354                                                  * not already to be rtx'd,
3355                                                  * If not a mixed sack and
3356                                                  * if tp1 is not between two
3357                                                  * sacked TSNs, then mark by
3358                                                  * one more.
3359                                                  */
3360                                                 if ((tp1->sent != SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3361                                                     compare_with_wrap(this_sack_lowest_newack, tp1->rec.data.TSN_seq, MAX_TSN)) {
3362 #ifdef SCTP_FR_LOGGING
3363                                                         sctp_log_fr(32 + num_dests_sacked,
3364                                                             tp1->rec.data.TSN_seq,
3365                                                             tp1->sent,
3366                                                             SCTP_FR_LOG_STRIKE_CHUNK);
3367 #endif
3368                                                         tp1->sent++;
3369                                                 }
3370                                         }
3371                                 }
3372                         }
3373                         /*
3374                          * JRI: TODO: remove code for HTNA algo. CMT's SFR
3375                          * algo covers HTNA.
3376                          */
3377                 } else if (compare_with_wrap(tp1->rec.data.TSN_seq,
3378                     biggest_tsn_newly_acked, MAX_TSN)) {
3379                         /*
3380                          * We don't strike these: This is the  HTNA
3381                          * algorithm i.e. we don't strike If our TSN is
3382                          * larger than the Highest TSN Newly Acked.
3383                          */
3384                         ;
3385                 } else {
3386                         /* Strike the TSN */
3387 #ifdef SCTP_FR_LOGGING
3388                         sctp_log_fr(biggest_tsn_newly_acked,
3389                             tp1->rec.data.TSN_seq,
3390                             tp1->sent,
3391                             SCTP_FR_LOG_STRIKE_CHUNK);
3392 #endif
3393                         tp1->sent++;
3394                         if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3395                                 /*
3396                                  * CMT DAC algorithm: If SACK flag is set to
3397                                  * 0, then lowest_newack test will not pass
3398                                  * because it would have been set to the
3399                                  * cumack earlier. If not already to be
3400                                  * rtx'd, If not a mixed sack and if tp1 is
3401                                  * not between two sacked TSNs, then mark by
3402                                  * one more.
3403                                  */
3404                                 if ((tp1->sent != SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3405                                     compare_with_wrap(this_sack_lowest_newack, tp1->rec.data.TSN_seq, MAX_TSN)) {
3406 #ifdef SCTP_FR_LOGGING
3407                                         sctp_log_fr(48 + num_dests_sacked,
3408                                             tp1->rec.data.TSN_seq,
3409                                             tp1->sent,
3410                                             SCTP_FR_LOG_STRIKE_CHUNK);
3411 #endif
3412                                         tp1->sent++;
3413                                 }
3414                         }
3415                 }
3416                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3417                         /* Increment the count to resend */
3418                         struct sctp_nets *alt;
3419
3420                         /* printf("OK, we are now ready to FR this guy\n"); */
3421 #ifdef SCTP_FR_LOGGING
3422                         sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count,
3423                             0, SCTP_FR_MARKED);
3424 #endif
3425                         if (strike_flag) {
3426                                 /* This is a subsequent FR */
3427                                 SCTP_STAT_INCR(sctps_sendmultfastretrans);
3428                         }
3429                         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
3430
3431                         if (sctp_cmt_on_off) {
3432                                 /*
3433                                  * CMT: Using RTX_SSTHRESH policy for CMT.
3434                                  * If CMT is being used, then pick dest with
3435                                  * largest ssthresh for any retransmission.
3436                                  */
3437                                 tp1->no_fr_allowed = 1;
3438                                 alt = tp1->whoTo;
3439                                 alt = sctp_find_alternate_net(stcb, alt, 1);
3440                                 /*
3441                                  * CUCv2: If a different dest is picked for
3442                                  * the retransmission, then new
3443                                  * (rtx-)pseudo_cumack needs to be tracked
3444                                  * for orig dest. Let CUCv2 track new (rtx-)
3445                                  * pseudo-cumack always.
3446                                  */
3447                                 tp1->whoTo->find_pseudo_cumack = 1;
3448                                 tp1->whoTo->find_rtx_pseudo_cumack = 1;
3449
3450
3451                         } else {/* CMT is OFF */
3452
3453 #ifdef SCTP_FR_TO_ALTERNATE
3454                                 /* Can we find an alternate? */
3455                                 alt = sctp_find_alternate_net(stcb, tp1->whoTo, 0);
3456 #else
3457                                 /*
3458                                  * default behavior is to NOT retransmit
3459                                  * FR's to an alternate. Armando Caro's
3460                                  * paper details why.
3461                                  */
3462                                 alt = tp1->whoTo;
3463 #endif
3464                         }
3465
3466                         tp1->rec.data.doing_fast_retransmit = 1;
3467                         tot_retrans++;
3468                         /* mark the sending seq for possible subsequent FR's */
3469                         /*
3470                          * printf("Marking TSN for FR new value %x\n",
3471                          * (uint32_t)tpi->rec.data.TSN_seq);
3472                          */
3473                         if (TAILQ_EMPTY(&asoc->send_queue)) {
3474                                 /*
3475                                  * If the queue of send is empty then its
3476                                  * the next sequence number that will be
3477                                  * assigned so we subtract one from this to
3478                                  * get the one we last sent.
3479                                  */
3480                                 tp1->rec.data.fast_retran_tsn = sending_seq;
3481                         } else {
3482                                 /*
3483                                  * If there are chunks on the send queue
3484                                  * (unsent data that has made it from the
3485                                  * stream queues but not out the door, we
3486                                  * take the first one (which will have the
3487                                  * lowest TSN) and subtract one to get the
3488                                  * one we last sent.
3489                                  */
3490                                 struct sctp_tmit_chunk *ttt;
3491
3492                                 ttt = TAILQ_FIRST(&asoc->send_queue);
3493                                 tp1->rec.data.fast_retran_tsn =
3494                                     ttt->rec.data.TSN_seq;
3495                         }
3496
3497                         if (tp1->do_rtt) {
3498                                 /*
3499                                  * this guy had a RTO calculation pending on
3500                                  * it, cancel it
3501                                  */
3502                                 tp1->do_rtt = 0;
3503                         }
3504                         /* fix counts and things */
3505 #ifdef SCTP_FLIGHT_LOGGING
3506                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN,
3507                             tp1->whoTo->flight_size,
3508                             tp1->book_size,
3509                             (uintptr_t) stcb,
3510                             tp1->rec.data.TSN_seq);
3511 #endif
3512                         tp1->whoTo->net_ack++;
3513                         if (tp1->whoTo->flight_size >= tp1->book_size)
3514                                 tp1->whoTo->flight_size -= tp1->book_size;
3515                         else
3516                                 tp1->whoTo->flight_size = 0;
3517
3518 #ifdef SCTP_LOG_RWND
3519                         sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3520                             asoc->peers_rwnd, tp1->send_size, sctp_peer_chunk_oh);
3521 #endif
3522                         /* add back to the rwnd */
3523                         asoc->peers_rwnd += (tp1->send_size + sctp_peer_chunk_oh);
3524
3525                         /* remove from the total flight */
3526                         if (asoc->total_flight >= tp1->book_size) {
3527                                 asoc->total_flight -= tp1->book_size;
3528                                 if (asoc->total_flight_count > 0)
3529                                         asoc->total_flight_count--;
3530                         } else {
3531                                 asoc->total_flight = 0;
3532                                 asoc->total_flight_count = 0;
3533                         }
3534
3535
3536                         if (alt != tp1->whoTo) {
3537                                 /* yes, there is an alternate. */
3538                                 sctp_free_remote_addr(tp1->whoTo);
3539                                 tp1->whoTo = alt;
3540                                 atomic_add_int(&alt->ref_count, 1);
3541                         }
3542                 }
3543                 tp1 = TAILQ_NEXT(tp1, sctp_next);
3544         }                       /* while (tp1) */
3545
3546         if (tot_retrans > 0) {
3547                 /*
3548                  * Setup the ecn nonce re-sync point. We do this since once
3549                  * we go to FR something we introduce a Karn's rule scenario
3550                  * and won't know the totals for the ECN bits.
3551                  */
3552                 asoc->nonce_resync_tsn = sending_seq;
3553                 asoc->nonce_wait_for_ecne = 0;
3554                 asoc->nonce_sum_check = 0;
3555         }
3556 }
3557
3558 struct sctp_tmit_chunk *
3559 sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3560     struct sctp_association *asoc)
3561 {
3562         struct sctp_tmit_chunk *tp1, *tp2, *a_adv = NULL;
3563         struct timeval now;
3564         int now_filled = 0;
3565
3566         if (asoc->peer_supports_prsctp == 0) {
3567                 return (NULL);
3568         }
3569         tp1 = TAILQ_FIRST(&asoc->sent_queue);
3570         while (tp1) {
3571                 if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3572                     tp1->sent != SCTP_DATAGRAM_RESEND) {
3573                         /* no chance to advance, out of here */
3574                         break;
3575                 }
3576                 if (!PR_SCTP_ENABLED(tp1->flags)) {
3577                         /*
3578                          * We can't fwd-tsn past any that are reliable aka
3579                          * retransmitted until the asoc fails.
3580                          */
3581                         break;
3582                 }
3583                 if (!now_filled) {
3584                         SCTP_GETTIME_TIMEVAL(&now);
3585                         now_filled = 1;
3586                 }
3587                 tp2 = TAILQ_NEXT(tp1, sctp_next);
3588                 /*
3589                  * now we got a chunk which is marked for another
3590                  * retransmission to a PR-stream but has run out its chances
3591                  * already maybe OR has been marked to skip now. Can we skip
3592                  * it if its a resend?
3593                  */
3594                 if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3595                     (PR_SCTP_TTL_ENABLED(tp1->flags))) {
3596                         /*
3597                          * Now is this one marked for resend and its time is
3598                          * now up?
3599                          */
3600                         if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3601                                 /* Yes so drop it */
3602                                 if (tp1->data) {
3603                                         sctp_release_pr_sctp_chunk(stcb, tp1,
3604                                             (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3605                                             &asoc->sent_queue);
3606                                 }
3607                         } else {
3608                                 /*
3609                                  * No, we are done when hit one for resend
3610                                  * whos time as not expired.
3611                                  */
3612                                 break;
3613                         }
3614                 }
3615                 /*
3616                  * Ok now if this chunk is marked to drop it we can clean up
3617                  * the chunk, advance our peer ack point and we can check
3618                  * the next chunk.
3619                  */
3620                 if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3621                         /* advance PeerAckPoint goes forward */
3622                         asoc->advanced_peer_ack_point = tp1->rec.data.TSN_seq;
3623                         a_adv = tp1;
3624                         /*
3625                          * we don't want to de-queue it here. Just wait for
3626                          * the next peer SACK to come with a new cumTSN and
3627                          * then the chunk will be droped in the normal
3628                          * fashion.
3629                          */
3630                         if (tp1->data) {
3631                                 sctp_free_bufspace(stcb, asoc, tp1, 1);
3632                                 /*
3633                                  * Maybe there should be another
3634                                  * notification type
3635                                  */
3636                                 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3637                                     (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3638                                     tp1);
3639                                 sctp_m_freem(tp1->data);
3640                                 tp1->data = NULL;
3641                                 if (stcb->sctp_socket) {
3642                                         sctp_sowwakeup(stcb->sctp_ep,
3643                                             stcb->sctp_socket);
3644 #ifdef SCTP_WAKE_LOGGING
3645                                         sctp_wakeup_log(stcb, tp1->rec.data.TSN_seq, 1, SCTP_WAKESND_FROM_FWDTSN);
3646 #endif
3647                                 }
3648                         }
3649                 } else {
3650                         /*
3651                          * If it is still in RESEND we can advance no
3652                          * further
3653                          */
3654                         break;
3655                 }
3656                 /*
3657                  * If we hit here we just dumped tp1, move to next tsn on
3658                  * sent queue.
3659                  */
3660                 tp1 = tp2;
3661         }
3662         return (a_adv);
3663 }
3664
3665 #ifdef SCTP_HIGH_SPEED
3666 struct sctp_hs_raise_drop {
3667         int32_t cwnd;
3668         int32_t increase;
3669         int32_t drop_percent;
3670 };
3671
3672 #define SCTP_HS_TABLE_SIZE 73
3673
3674 struct sctp_hs_raise_drop sctp_cwnd_adjust[SCTP_HS_TABLE_SIZE] = {
3675         {38, 1, 50},            /* 0   */
3676         {118, 2, 44},           /* 1   */
3677         {221, 3, 41},           /* 2   */
3678         {347, 4, 38},           /* 3   */
3679         {495, 5, 37},           /* 4   */
3680         {663, 6, 35},           /* 5   */
3681         {851, 7, 34},           /* 6   */
3682         {1058, 8, 33},          /* 7   */
3683         {1284, 9, 32},          /* 8   */
3684         {1529, 10, 31},         /* 9   */
3685         {1793, 11, 30},         /* 10  */
3686         {2076, 12, 29},         /* 11  */
3687         {2378, 13, 28},         /* 12  */
3688         {2699, 14, 28},         /* 13  */
3689         {3039, 15, 27},         /* 14  */
3690         {3399, 16, 27},         /* 15  */
3691         {3778, 17, 26},         /* 16  */
3692         {4177, 18, 26},         /* 17  */
3693         {4596, 19, 25},         /* 18  */
3694         {5036, 20, 25},         /* 19  */
3695         {5497, 21, 24},         /* 20  */
3696         {5979, 22, 24},         /* 21  */
3697         {6483, 23, 23},         /* 22  */
3698         {7009, 24, 23},         /* 23  */
3699         {7558, 25, 22},         /* 24  */
3700         {8130, 26, 22},         /* 25  */
3701         {8726, 27, 22},         /* 26  */
3702         {9346, 28, 21},         /* 27  */
3703         {9991, 29, 21},         /* 28  */
3704         {10661, 30, 21},        /* 29  */
3705         {11358, 31, 20},        /* 30  */
3706         {12082, 32, 20},        /* 31  */
3707         {12834, 33, 20},        /* 32  */
3708         {13614, 34, 19},        /* 33  */
3709         {14424, 35, 19},        /* 34  */
3710         {15265, 36, 19},        /* 35  */
3711         {16137, 37, 19},        /* 36  */
3712         {17042, 38, 18},        /* 37  */
3713         {17981, 39, 18},        /* 38  */
3714         {18955, 40, 18},        /* 39  */
3715         {19965, 41, 17},        /* 40  */
3716         {21013, 42, 17},        /* 41  */
3717         {22101, 43, 17},        /* 42  */
3718         {23230, 44, 17},        /* 43  */
3719         {24402, 45, 16},        /* 44  */
3720         {25618, 46, 16},        /* 45  */
3721         {26881, 47, 16},        /* 46  */
3722         {28193, 48, 16},        /* 47  */
3723         {29557, 49, 15},        /* 48  */
3724         {30975, 50, 15},        /* 49  */
3725         {32450, 51, 15},        /* 50  */
3726         {33986, 52, 15},        /* 51  */
3727         {35586, 53, 14},        /* 52  */
3728         {37253, 54, 14},        /* 53  */
3729         {38992, 55, 14},        /* 54  */
3730         {40808, 56, 14},        /* 55  */
3731         {42707, 57, 13},        /* 56  */
3732         {44694, 58, 13},        /* 57  */
3733         {46776, 59, 13},        /* 58  */
3734         {48961, 60, 13},        /* 59  */
3735         {51258, 61, 13},        /* 60  */
3736         {53677, 62, 12},        /* 61  */
3737         {56230, 63, 12},        /* 62  */
3738         {58932, 64, 12},        /* 63  */
3739         {61799, 65, 12},        /* 64  */
3740         {64851, 66, 11},        /* 65  */
3741         {68113, 67, 11},        /* 66  */
3742         {71617, 68, 11},        /* 67  */
3743         {75401, 69, 10},        /* 68  */
3744         {79517, 70, 10},        /* 69  */
3745         {84035, 71, 10},        /* 70  */
3746         {89053, 72, 10},        /* 71  */
3747         {94717, 73, 9}          /* 72  */
3748 };
3749
3750 static void
3751 sctp_hs_cwnd_increase(struct sctp_tcb *stcb, struct sctp_nets *net)
3752 {
3753         int cur_val, i, indx, incr;
3754
3755         cur_val = net->cwnd >> 10;
3756         indx = SCTP_HS_TABLE_SIZE - 1;
3757
3758         if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3759                 /* normal mode */
3760                 if (net->net_ack > net->mtu) {
3761                         net->cwnd += net->mtu;
3762 #ifdef SCTP_CWND_MONITOR
3763                         sctp_log_cwnd(stcb, net, net->mtu, SCTP_CWND_LOG_FROM_SS);
3764 #endif
3765                 } else {
3766                         net->cwnd += net->net_ack;
3767 #ifdef SCTP_CWND_MONITOR
3768                         sctp_log_cwnd(stcb, net, net->net_ack, SCTP_CWND_LOG_FROM_SS);
3769 #endif
3770                 }
3771         } else {
3772                 for (i = net->last_hs_used; i < SCTP_HS_TABLE_SIZE; i++) {
3773                         if (cur_val < sctp_cwnd_adjust[i].cwnd) {
3774                                 indx = i;
3775                                 break;
3776                         }
3777                 }
3778                 net->last_hs_used = indx;
3779                 incr = ((sctp_cwnd_adjust[indx].increase) << 10);
3780                 net->cwnd += incr;
3781 #ifdef SCTP_CWND_MONITOR
3782                 sctp_log_cwnd(stcb, net, incr, SCTP_CWND_LOG_FROM_SS);
3783 #endif
3784         }
3785 }
3786
3787 static void
3788 sctp_hs_cwnd_decrease(struct sctp_tcb *stcb, struct sctp_nets *net)
3789 {
3790         int cur_val, i, indx;
3791
3792 #ifdef SCTP_CWND_MONITOR
3793         int old_cwnd = net->cwnd;
3794
3795 #endif
3796
3797         cur_val = net->cwnd >> 10;
3798         indx = net->last_hs_used;
3799         if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3800                 /* normal mode */
3801                 net->ssthresh = net->cwnd / 2;
3802                 if (net->ssthresh < (net->mtu * 2)) {
3803                         net->ssthresh = 2 * net->mtu;
3804                 }
3805                 net->cwnd = net->ssthresh;
3806         } else {
3807                 /* drop by the proper amount */
3808                 net->ssthresh = net->cwnd - (int)((net->cwnd / 100) *
3809                     sctp_cwnd_adjust[net->last_hs_used].drop_percent);
3810                 net->cwnd = net->ssthresh;
3811                 /* now where are we */
3812                 indx = net->last_hs_used;
3813                 cur_val = net->cwnd >> 10;
3814                 /* reset where we are in the table */
3815                 if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3816                         /* feel out of hs */
3817                         net->last_hs_used = 0;
3818                 } else {
3819                         for (i = indx; i >= 1; i--) {
3820                                 if (cur_val > sctp_cwnd_adjust[i - 1].cwnd) {
3821                                         break;
3822                                 }
3823                         }
3824                         net->last_hs_used = indx;
3825                 }
3826         }
3827 #ifdef SCTP_CWND_MONITOR
3828         sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_FR);
3829 #endif
3830
3831 }
3832
3833 #endif
3834
3835
3836 static __inline void
3837 sctp_cwnd_update(struct sctp_tcb *stcb,
3838     struct sctp_association *asoc,
3839     int accum_moved, int reneged_all, int will_exit)
3840 {
3841         struct sctp_nets *net;
3842
3843         /******************************/
3844         /* update cwnd and Early FR   */
3845         /******************************/
3846         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3847
3848 #ifdef JANA_CMT_FAST_RECOVERY
3849                 /*
3850                  * CMT fast recovery code. Need to debug.
3851                  */
3852                 if (net->fast_retran_loss_recovery && net->new_pseudo_cumack) {
3853                         if (compare_with_wrap(asoc->last_acked_seq,
3854                             net->fast_recovery_tsn, MAX_TSN) ||
3855                             (asoc->last_acked_seq == net->fast_recovery_tsn) ||
3856                             compare_with_wrap(net->pseudo_cumack, net->fast_recovery_tsn, MAX_TSN) ||
3857                             (net->pseudo_cumack == net->fast_recovery_tsn)) {
3858                                 net->will_exit_fast_recovery = 1;
3859                         }
3860                 }
3861 #endif
3862                 if (sctp_early_fr) {
3863                         /*
3864                          * So, first of all do we need to have a Early FR
3865                          * timer running?
3866                          */
3867                         if (((TAILQ_FIRST(&asoc->sent_queue)) &&
3868                             (net->ref_count > 1) &&
3869                             (net->flight_size < net->cwnd)) ||
3870                             (reneged_all)) {
3871                                 /*
3872                                  * yes, so in this case stop it if its
3873                                  * running, and then restart it. Reneging
3874                                  * all is a special case where we want to
3875                                  * run the Early FR timer and then force the
3876                                  * last few unacked to be sent, causing us
3877                                  * to illicit a sack with gaps to force out
3878                                  * the others.
3879                                  */
3880                                 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
3881                                         SCTP_STAT_INCR(sctps_earlyfrstpidsck2);
3882                                         sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
3883                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_20);
3884                                 }
3885                                 SCTP_STAT_INCR(sctps_earlyfrstrid);
3886                                 sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net);
3887                         } else {
3888                                 /* No, stop it if its running */
3889                                 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
3890                                         SCTP_STAT_INCR(sctps_earlyfrstpidsck3);
3891                                         sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
3892                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_21);
3893                                 }
3894                         }
3895                 }
3896                 /* if nothing was acked on this destination skip it */
3897                 if (net->net_ack == 0) {
3898 #ifdef SCTP_CWND_LOGGING
3899                         sctp_log_cwnd(stcb, net, 0, SCTP_CWND_LOG_FROM_SACK);
3900 #endif
3901                         continue;
3902                 }
3903                 if (net->net_ack2 > 0) {
3904                         /*
3905                          * Karn's rule applies to clearing error count, this
3906                          * is optional.
3907                          */
3908                         net->error_count = 0;
3909                         if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
3910                             SCTP_ADDR_NOT_REACHABLE) {
3911                                 /* addr came good */
3912                                 net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
3913                                 net->dest_state |= SCTP_ADDR_REACHABLE;
3914                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
3915                                     SCTP_RECEIVED_SACK, (void *)net);
3916                                 /* now was it the primary? if so restore */
3917                                 if (net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
3918                                         sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, net);
3919                                 }
3920                         }
3921                 }
3922 #ifdef JANA_CMT_FAST_RECOVERY
3923                 /*
3924                  * CMT fast recovery code
3925                  */
3926                 /*
3927                  * if (sctp_cmt_on_off == 1 &&
3928                  * net->fast_retran_loss_recovery &&
3929                  * net->will_exit_fast_recovery == 0) { // @@@ Do something
3930                  * }       else if (sctp_cmt_on_off == 0 &&
3931                  * asoc->fast_retran_loss_recovery && will_exit == 0) {
3932                  */
3933 #endif
3934
3935                 if (asoc->fast_retran_loss_recovery && will_exit == 0) {
3936                         /*
3937                          * If we are in loss recovery we skip any cwnd
3938                          * update
3939                          */
3940                         goto skip_cwnd_update;
3941                 }
3942                 /*
3943                  * CMT: CUC algorithm. Update cwnd if pseudo-cumack has
3944                  * moved.
3945                  */
3946                 if (accum_moved || (sctp_cmt_on_off && net->new_pseudo_cumack)) {
3947                         /* If the cumulative ack moved we can proceed */
3948                         if (net->cwnd <= net->ssthresh) {
3949                                 /* We are in slow start */
3950                                 if (net->flight_size + net->net_ack >=
3951                                     net->cwnd) {
3952 #ifdef SCTP_HIGH_SPEED
3953                                         sctp_hs_cwnd_increase(stcb, net);
3954 #else
3955                                         if (net->net_ack > (net->mtu * sctp_L2_abc_variable)) {
3956                                                 net->cwnd += (net->mtu * sctp_L2_abc_variable);
3957 #ifdef SCTP_CWND_MONITOR
3958                                                 sctp_log_cwnd(stcb, net, net->mtu,
3959                                                     SCTP_CWND_LOG_FROM_SS);
3960 #endif
3961
3962                                         } else {
3963                                                 net->cwnd += net->net_ack;
3964 #ifdef SCTP_CWND_MONITOR
3965                                                 sctp_log_cwnd(stcb, net, net->net_ack,
3966                                                     SCTP_CWND_LOG_FROM_SS);
3967 #endif
3968
3969                                         }
3970 #endif
3971                                 } else {
3972                                         unsigned int dif;
3973
3974                                         dif = net->cwnd - (net->flight_size +
3975                                             net->net_ack);
3976 #ifdef SCTP_CWND_LOGGING
3977                                         sctp_log_cwnd(stcb, net, net->net_ack,
3978                                             SCTP_CWND_LOG_NOADV_SS);
3979 #endif
3980                                 }
3981                         } else {
3982                                 /* We are in congestion avoidance */
3983                                 if (net->flight_size + net->net_ack >=
3984                                     net->cwnd) {
3985                                         /*
3986                                          * add to pba only if we had a
3987                                          * cwnd's worth (or so) in flight OR
3988                                          * the burst limit was applied.
3989                                          */
3990                                         net->partial_bytes_acked +=
3991                                             net->net_ack;
3992
3993                                         /*
3994                                          * Do we need to increase (if pba is
3995                                          * > cwnd)?
3996                                          */
3997                                         if (net->partial_bytes_acked >=
3998                                             net->cwnd) {
3999                                                 if (net->cwnd <
4000                                                     net->partial_bytes_acked) {
4001                                                         net->partial_bytes_acked -=
4002                                                             net->cwnd;
4003                                                 } else {
4004                                                         net->partial_bytes_acked =
4005                                                             0;
4006                                                 }
4007                                                 net->cwnd += net->mtu;
4008 #ifdef SCTP_CWND_MONITOR
4009                                                 sctp_log_cwnd(stcb, net, net->mtu,
4010                                                     SCTP_CWND_LOG_FROM_CA);
4011 #endif
4012                                         }
4013 #ifdef SCTP_CWND_LOGGING
4014                                         else {
4015                                                 sctp_log_cwnd(stcb, net, net->net_ack,
4016                                                     SCTP_CWND_LOG_NOADV_CA);
4017                                         }
4018 #endif
4019                                 } else {
4020                                         unsigned int dif;
4021
4022 #ifdef SCTP_CWND_LOGGING
4023                                         sctp_log_cwnd(stcb, net, net->net_ack,
4024                                             SCTP_CWND_LOG_NOADV_CA);
4025 #endif
4026                                         dif = net->cwnd - (net->flight_size +
4027                                             net->net_ack);
4028                                 }
4029                         }
4030                 } else {
4031 #ifdef SCTP_CWND_LOGGING
4032                         sctp_log_cwnd(stcb, net, net->mtu,
4033                             SCTP_CWND_LOG_NO_CUMACK);
4034 #endif
4035                 }
4036 skip_cwnd_update:
4037                 /*
4038                  * NOW, according to Karn's rule do we need to restore the
4039                  * RTO timer back? Check our net_ack2. If not set then we
4040                  * have a ambiguity.. i.e. all data ack'd was sent to more
4041                  * than one place.
4042                  */
4043                 if (net->net_ack2) {
4044                         /* restore any doubled timers */
4045                         net->RTO = ((net->lastsa >> 2) + net->lastsv) >> 1;
4046                         if (net->RTO < stcb->asoc.minrto) {
4047                                 net->RTO = stcb->asoc.minrto;
4048                         }
4049                         if (net->RTO > stcb->asoc.maxrto) {
4050                                 net->RTO = stcb->asoc.maxrto;
4051                         }
4052                 }
4053         }
4054 }
4055
4056
4057 void
4058 sctp_express_handle_sack(struct sctp_tcb *stcb, uint32_t cumack,
4059     uint32_t rwnd, int nonce_sum_flag, int *abort_now)
4060 {
4061         struct sctp_nets *net;
4062         struct sctp_association *asoc;
4063         struct sctp_tmit_chunk *tp1, *tp2;
4064         int j;
4065
4066         SCTP_TCB_LOCK_ASSERT(stcb);
4067         asoc = &stcb->asoc;
4068         /* First setup for CC stuff */
4069         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4070                 net->prev_cwnd = net->cwnd;
4071                 net->net_ack = 0;
4072                 net->net_ack2 = 0;
4073
4074                 /*
4075                  * CMT: Reset CUC and Fast recovery algo variables before
4076                  * SACK processing
4077                  */
4078                 net->new_pseudo_cumack = 0;
4079                 net->will_exit_fast_recovery = 0;
4080         }
4081         if (sctp_strict_sacks) {
4082                 uint32_t send_s;
4083
4084                 if (TAILQ_EMPTY(&asoc->send_queue)) {
4085                         send_s = asoc->sending_seq;
4086                 } else {
4087                         tp1 = TAILQ_FIRST(&asoc->send_queue);
4088                         send_s = tp1->rec.data.TSN_seq;
4089                 }
4090                 if ((cumack == send_s) ||
4091                     compare_with_wrap(cumack, send_s, MAX_TSN)) {
4092 #ifdef INVARIANTS               /* for testing only */
4093                         panic("Impossible sack 1");
4094 #else
4095                         struct mbuf *oper;
4096
4097                         *abort_now = 1;
4098                         /* XXX */
4099                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
4100                             0, M_DONTWAIT, 1, MT_DATA);
4101                         if (oper) {
4102                                 struct sctp_paramhdr *ph;
4103                                 uint32_t *ippp;
4104
4105                                 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
4106                                     sizeof(uint32_t);
4107                                 ph = mtod(oper, struct sctp_paramhdr *);
4108                                 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
4109                                 ph->param_length = htons(SCTP_BUF_LEN(oper));
4110                                 ippp = (uint32_t *) (ph + 1);
4111                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_25);
4112                         }
4113                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_25;
4114                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper);
4115                         return;
4116 #endif
4117                 }
4118         }
4119         asoc->this_sack_highest_gap = cumack;
4120         stcb->asoc.overall_error_count = 0;
4121         /* process the new consecutive TSN first */
4122         tp1 = TAILQ_FIRST(&asoc->sent_queue);
4123         while (tp1) {
4124                 tp2 = TAILQ_NEXT(tp1, sctp_next);
4125                 if (compare_with_wrap(cumack, tp1->rec.data.TSN_seq,
4126                     MAX_TSN) ||
4127                     cumack == tp1->rec.data.TSN_seq) {
4128                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4129                                 /*
4130                                  * ECN Nonce: Add the nonce to the sender's
4131                                  * nonce sum
4132                                  */
4133                                 asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce;
4134                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4135                                         /*
4136                                          * If it is less than ACKED, it is
4137                                          * now no-longer in flight. Higher
4138                                          * values may occur during marking
4139                                          */
4140 #ifdef SCTP_FLIGHT_LOGGING
4141                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN,
4142                                             tp1->whoTo->flight_size,
4143                                             tp1->book_size,
4144                                             (uintptr_t) stcb,
4145                                             tp1->rec.data.TSN_seq);
4146 #endif
4147
4148                                         if (tp1->whoTo->flight_size >= tp1->book_size) {
4149                                                 tp1->whoTo->flight_size -= tp1->book_size;
4150                                         } else {
4151                                                 tp1->whoTo->flight_size = 0;
4152                                         }
4153
4154                                         if (asoc->total_flight >= tp1->book_size) {
4155                                                 asoc->total_flight -= tp1->book_size;
4156                                                 if (asoc->total_flight_count > 0)
4157                                                         asoc->total_flight_count--;
4158                                         } else {
4159                                                 asoc->total_flight = 0;
4160                                                 asoc->total_flight_count = 0;
4161                                         }
4162                                         tp1->whoTo->net_ack += tp1->send_size;
4163                                         if (tp1->snd_count < 2) {
4164                                                 /*
4165                                                  * True non-retransmited
4166                                                  * chunk
4167                                                  */
4168                                                 tp1->whoTo->net_ack2 +=
4169                                                     tp1->send_size;
4170
4171                                                 /* update RTO too? */
4172                                                 if (tp1->do_rtt) {
4173                                                         tp1->whoTo->RTO =
4174                                                             sctp_calculate_rto(stcb,
4175                                                             asoc, tp1->whoTo,
4176                                                             &tp1->sent_rcv_time);
4177                                                         tp1->do_rtt = 0;
4178                                                 }
4179                                         }
4180                                         /*
4181                                          * CMT: CUCv2 algorithm. From the
4182                                          * cumack'd TSNs, for each TSN being
4183                                          * acked for the first time, set the
4184                                          * following variables for the
4185                                          * corresp destination.
4186                                          * new_pseudo_cumack will trigger a
4187                                          * cwnd update.
4188                                          * find_(rtx_)pseudo_cumack will
4189                                          * trigger search for the next
4190                                          * expected (rtx-)pseudo-cumack.
4191                                          */
4192                                         tp1->whoTo->new_pseudo_cumack = 1;
4193                                         tp1->whoTo->find_pseudo_cumack = 1;
4194                                         tp1->whoTo->find_rtx_pseudo_cumack = 1;
4195
4196 #ifdef SCTP_CWND_LOGGING
4197                                         sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
4198 #endif
4199                                 }
4200                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4201                                         sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4202                                 }
4203                                 if (tp1->rec.data.chunk_was_revoked) {
4204                                         /* deflate the cwnd */
4205                                         tp1->whoTo->cwnd -= tp1->book_size;
4206                                         tp1->rec.data.chunk_was_revoked = 0;
4207                                 }
4208                                 tp1->sent = SCTP_DATAGRAM_ACKED;
4209                         }
4210                 } else {
4211                         break;
4212                 }
4213                 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4214                 if (tp1->data) {
4215                         sctp_free_bufspace(stcb, asoc, tp1, 1);
4216                         sctp_m_freem(tp1->data);
4217                 }
4218 #ifdef SCTP_SACK_LOGGING
4219                 sctp_log_sack(asoc->last_acked_seq,
4220                     cumack,
4221                     tp1->rec.data.TSN_seq,
4222                     0,
4223                     0,
4224                     SCTP_LOG_FREE_SENT);
4225 #endif
4226                 tp1->data = NULL;
4227                 asoc->sent_queue_cnt--;
4228                 sctp_free_remote_addr(tp1->whoTo);
4229                 sctp_free_a_chunk(stcb, tp1);
4230                 tp1 = tp2;
4231         }
4232         if (stcb->sctp_socket) {
4233                 SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4234 #ifdef SCTP_WAKE_LOGGING
4235                 sctp_wakeup_log(stcb, cumack, 1, SCTP_WAKESND_FROM_SACK);
4236 #endif
4237                 sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4238 #ifdef SCTP_WAKE_LOGGING
4239         } else {
4240                 sctp_wakeup_log(stcb, cumack, 1, SCTP_NOWAKE_FROM_SACK);
4241 #endif
4242         }
4243
4244         if (asoc->last_acked_seq != cumack)
4245                 sctp_cwnd_update(stcb, asoc, 1, 0, 0);
4246         asoc->last_acked_seq = cumack;
4247         if (TAILQ_EMPTY(&asoc->sent_queue)) {
4248                 /* nothing left in-flight */
4249                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4250                         net->flight_size = 0;
4251                         net->partial_bytes_acked = 0;
4252                 }
4253                 asoc->total_flight = 0;
4254                 asoc->total_flight_count = 0;
4255         }
4256         /* Fix up the a-p-a-p for future PR-SCTP sends */
4257         if (compare_with_wrap(cumack, asoc->advanced_peer_ack_point, MAX_TSN)) {
4258                 asoc->advanced_peer_ack_point = cumack;
4259         }
4260         /* ECN Nonce updates */
4261         if (asoc->ecn_nonce_allowed) {
4262                 if (asoc->nonce_sum_check) {
4263                         if (nonce_sum_flag != ((asoc->nonce_sum_expect_base) & SCTP_SACK_NONCE_SUM)) {
4264                                 if (asoc->nonce_wait_for_ecne == 0) {
4265                                         struct sctp_tmit_chunk *lchk;
4266
4267                                         lchk = TAILQ_FIRST(&asoc->send_queue);
4268                                         asoc->nonce_wait_for_ecne = 1;
4269                                         if (lchk) {
4270                                                 asoc->nonce_wait_tsn = lchk->rec.data.TSN_seq;
4271                                         } else {
4272                                                 asoc->nonce_wait_tsn = asoc->sending_seq;
4273                                         }
4274                                 } else {
4275                                         if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_wait_tsn, MAX_TSN) ||
4276                                             (asoc->last_acked_seq == asoc->nonce_wait_tsn)) {
4277                                                 /*
4278                                                  * Misbehaving peer. We need
4279                                                  * to react to this guy
4280                                                  */
4281                                                 asoc->ecn_allowed = 0;
4282                                                 asoc->ecn_nonce_allowed = 0;
4283                                         }
4284                                 }
4285                         }
4286                 } else {
4287                         /* See if Resynchronization Possible */
4288                         if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_resync_tsn, MAX_TSN)) {
4289                                 asoc->nonce_sum_check = 1;
4290                                 /*
4291                                  * now we must calculate what the base is.
4292                                  * We do this based on two things, we know
4293                                  * the total's for all the segments
4294                                  * gap-acked in the SACK (none), We also
4295                                  * know the SACK's nonce sum, its in
4296                                  * nonce_sum_flag. So we can build a truth
4297                                  * table to back-calculate the new value of
4298                                  * asoc->nonce_sum_expect_base:
4299                                  *
4300                                  * SACK-flag-Value         Seg-Sums Base 0 0 0
4301                                  * 1                    0 1 0 1 1 1
4302                                  * 1 0
4303                                  */
4304                                 asoc->nonce_sum_expect_base = (0 ^ nonce_sum_flag) & SCTP_SACK_NONCE_SUM;
4305                         }
4306                 }
4307         }
4308         /* RWND update */
4309         asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
4310             (uint32_t) (asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh)));
4311         if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4312                 /* SWS sender side engages */
4313                 asoc->peers_rwnd = 0;
4314         }
4315         /* Now assure a timer where data is queued at */
4316 again:
4317         j = 0;
4318         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4319                 if (net->flight_size) {
4320                         int to_ticks;
4321
4322                         if (net->RTO == 0) {
4323                                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
4324                         } else {
4325                                 to_ticks = MSEC_TO_TICKS(net->RTO);
4326                         }
4327                         j++;
4328                         SCTP_OS_TIMER_START(&net->rxt_timer.timer, to_ticks,
4329                             sctp_timeout_handler, &net->rxt_timer);
4330                 } else {
4331                         if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4332                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4333                                     stcb, net,
4334                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_22);
4335                         }
4336                         if (sctp_early_fr) {
4337                                 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
4338                                         SCTP_STAT_INCR(sctps_earlyfrstpidsck4);
4339                                         sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
4340                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_23);
4341                                 }
4342                         }
4343                 }
4344         }
4345         if ((j == 0) && (!TAILQ_EMPTY(&asoc->sent_queue)) && (asoc->sent_queue_retran_cnt == 0)) {
4346                 /* huh, this should not happen */
4347 #ifdef INVARIANTS
4348                 panic("Flight size incorrect? fixing??");
4349 #else
4350                 printf("Flight size incorrect?  fixing\n");
4351                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4352                         net->flight_size = 0;
4353                 }
4354                 asoc->total_flight = 0;
4355                 asoc->total_flight_count = 0;
4356                 asoc->sent_queue_retran_cnt = 0;
4357                 TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4358                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4359                                 tp1->whoTo->flight_size += tp1->book_size;
4360                                 asoc->total_flight += tp1->book_size;
4361                                 asoc->total_flight_count++;
4362                         } else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4363                                 asoc->sent_queue_retran_cnt++;
4364                         }
4365                 }
4366 #endif
4367                 goto again;
4368         }
4369         /**********************************/
4370         /* Now what about shutdown issues */
4371         /**********************************/
4372         if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4373                 /* nothing left on sendqueue.. consider done */
4374                 /* clean up */
4375                 if ((asoc->stream_queue_cnt == 1) &&
4376                     ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4377                     (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4378                     (asoc->locked_on_sending)
4379                     ) {
4380                         struct sctp_stream_queue_pending *sp;
4381
4382                         /*
4383                          * I may be in a state where we got all across.. but
4384                          * cannot write more due to a shutdown... we abort
4385                          * since the user did not indicate EOR in this case.
4386                          * The sp will be cleaned during free of the asoc.
4387                          */
4388                         sp = TAILQ_LAST(&((asoc->locked_on_sending)->outqueue),
4389                             sctp_streamhead);
4390                         if ((sp) && (sp->length == 0) && (sp->msg_is_complete == 0)) {
4391                                 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
4392                                 asoc->locked_on_sending = NULL;
4393                                 asoc->stream_queue_cnt--;
4394                         }
4395                 }
4396                 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
4397                     (asoc->stream_queue_cnt == 0)) {
4398                         if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4399                                 /* Need to abort here */
4400                                 struct mbuf *oper;
4401
4402                 abort_out_now:
4403                                 *abort_now = 1;
4404                                 /* XXX */
4405                                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
4406                                     0, M_DONTWAIT, 1, MT_DATA);
4407                                 if (oper) {
4408                                         struct sctp_paramhdr *ph;
4409                                         uint32_t *ippp;
4410
4411                                         SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
4412                                             sizeof(uint32_t);
4413                                         ph = mtod(oper, struct sctp_paramhdr *);
4414                                         ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4415                                         ph->param_length = htons(SCTP_BUF_LEN(oper));
4416                                         ippp = (uint32_t *) (ph + 1);
4417                                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_24);
4418                                 }
4419                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_24;
4420                                 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, oper);
4421                         } else {
4422                                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
4423                                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4424                                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4425                                 }
4426                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4427                                 sctp_stop_timers_for_shutdown(stcb);
4428                                 sctp_send_shutdown(stcb,
4429                                     stcb->asoc.primary_destination);
4430                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4431                                     stcb->sctp_ep, stcb, asoc->primary_destination);
4432                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4433                                     stcb->sctp_ep, stcb, asoc->primary_destination);
4434                         }
4435                 } else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
4436                     (asoc->stream_queue_cnt == 0)) {
4437                         if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4438                                 goto abort_out_now;
4439                         }
4440                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4441                         asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
4442                         sctp_send_shutdown_ack(stcb,
4443                             stcb->asoc.primary_destination);
4444
4445                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4446                             stcb->sctp_ep, stcb, asoc->primary_destination);
4447                 }
4448         }
4449 #ifdef SCTP_SACK_RWND_LOGGING
4450         sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
4451             rwnd,
4452             stcb->asoc.peers_rwnd,
4453             stcb->asoc.total_flight,
4454             stcb->asoc.total_output_queue_size);
4455
4456 #endif
4457 }
4458
4459
4460
4461 void
4462 sctp_handle_sack(struct sctp_sack_chunk *ch, struct sctp_tcb *stcb,
4463     struct sctp_nets *net_from, int *abort_now)
4464 {
4465         struct sctp_association *asoc;
4466         struct sctp_sack *sack;
4467         struct sctp_tmit_chunk *tp1, *tp2;
4468         uint32_t cum_ack, last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked,
4469                  this_sack_lowest_newack;
4470         uint16_t num_seg, num_dup;
4471         uint16_t wake_him = 0;
4472         unsigned int sack_length;
4473         uint32_t send_s;
4474         long j;
4475         int accum_moved = 0;
4476         int will_exit_fast_recovery = 0;
4477         uint32_t a_rwnd;
4478         struct sctp_nets *net = NULL;
4479         int nonce_sum_flag, ecn_seg_sums = 0;
4480         uint8_t reneged_all = 0;
4481         uint8_t cmt_dac_flag;
4482
4483         /*
4484          * we take any chance we can to service our queues since we cannot
4485          * get awoken when the socket is read from :<
4486          */
4487         /*
4488          * Now perform the actual SACK handling: 1) Verify that it is not an
4489          * old sack, if so discard. 2) If there is nothing left in the send
4490          * queue (cum-ack is equal to last acked) then you have a duplicate
4491          * too, update any rwnd change and verify no timers are running.
4492          * then return. 3) Process any new consequtive data i.e. cum-ack
4493          * moved process these first and note that it moved. 4) Process any
4494          * sack blocks. 5) Drop any acked from the queue. 6) Check for any
4495          * revoked blocks and mark. 7) Update the cwnd. 8) Nothing left,
4496          * sync up flightsizes and things, stop all timers and also check
4497          * for shutdown_pending state. If so then go ahead and send off the
4498          * shutdown. If in shutdown recv, send off the shutdown-ack and
4499          * start that timer, Ret. 9) Strike any non-acked things and do FR
4500          * procedure if needed being sure to set the FR flag. 10) Do pr-sctp
4501          * procedures. 11) Apply any FR penalties. 12) Assure we will SACK
4502          * if in shutdown_recv state.
4503          */
4504         SCTP_TCB_LOCK_ASSERT(stcb);
4505         sack = &ch->sack;
4506         /* CMT DAC algo */
4507         this_sack_lowest_newack = 0;
4508         j = 0;
4509         sack_length = ntohs(ch->ch.chunk_length);
4510         if (sack_length < sizeof(struct sctp_sack_chunk)) {
4511 #ifdef SCTP_DEBUG
4512                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
4513                         printf("Bad size on sack chunk .. to small\n");
4514                 }
4515 #endif
4516                 return;
4517         }
4518         /* ECN Nonce */
4519         SCTP_STAT_INCR(sctps_slowpath_sack);
4520         nonce_sum_flag = ch->ch.chunk_flags & SCTP_SACK_NONCE_SUM;
4521         cum_ack = last_tsn = ntohl(sack->cum_tsn_ack);
4522         num_seg = ntohs(sack->num_gap_ack_blks);
4523         a_rwnd = (uint32_t) ntohl(sack->a_rwnd);
4524
4525         /* CMT DAC algo */
4526         cmt_dac_flag = ch->ch.chunk_flags & SCTP_SACK_CMT_DAC;
4527         num_dup = ntohs(sack->num_dup_tsns);
4528
4529
4530         stcb->asoc.overall_error_count = 0;
4531         asoc = &stcb->asoc;
4532 #ifdef SCTP_SACK_LOGGING
4533         sctp_log_sack(asoc->last_acked_seq,
4534             cum_ack,
4535             0,
4536             num_seg,
4537             num_dup,
4538             SCTP_LOG_NEW_SACK);
4539 #endif
4540 #if defined(SCTP_FR_LOGGING) || defined(SCTP_EARLYFR_LOGGING)
4541         if (num_dup) {
4542                 int off_to_dup, iii;
4543                 uint32_t *dupdata;
4544
4545                 off_to_dup = (num_seg * sizeof(struct sctp_gap_ack_block)) + sizeof(struct sctp_sack_chunk);
4546                 if ((off_to_dup + (num_dup * sizeof(uint32_t))) <= sack_length) {
4547                         dupdata = (uint32_t *) ((caddr_t)ch + off_to_dup);
4548                         for (iii = 0; iii < num_dup; iii++) {
4549                                 sctp_log_fr(*dupdata, 0, 0, SCTP_FR_DUPED);
4550                                 dupdata++;
4551
4552                         }
4553                 } else {
4554                         printf("Size invalid offset to dups:%d number dups:%d sack_len:%d num gaps:%d\n",
4555                             off_to_dup, num_dup, sack_length, num_seg);
4556                 }
4557         }
4558 #endif
4559         /* reality check */
4560         if (TAILQ_EMPTY(&asoc->send_queue)) {
4561                 send_s = asoc->sending_seq;
4562         } else {
4563                 tp1 = TAILQ_FIRST(&asoc->send_queue);
4564                 send_s = tp1->rec.data.TSN_seq;
4565         }
4566
4567         if (sctp_strict_sacks) {
4568                 if (cum_ack == send_s ||
4569                     compare_with_wrap(cum_ack, send_s, MAX_TSN)) {
4570 #ifdef INVARIANTS               /* for testing only */
4571         hopeless_peer:
4572                         panic("Impossible sack 1");
4573 #else
4574                         struct mbuf *oper;
4575
4576                         /*
4577                          * no way, we have not even sent this TSN out yet.
4578                          * Peer is hopelessly messed up with us.
4579                          */
4580         hopeless_peer:
4581                         *abort_now = 1;
4582                         /* XXX */
4583                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
4584                             0, M_DONTWAIT, 1, MT_DATA);
4585                         if (oper) {
4586                                 struct sctp_paramhdr *ph;
4587                                 uint32_t *ippp;
4588
4589                                 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
4590                                     sizeof(uint32_t);
4591                                 ph = mtod(oper, struct sctp_paramhdr *);
4592                                 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
4593                                 ph->param_length = htons(SCTP_BUF_LEN(oper));
4594                                 ippp = (uint32_t *) (ph + 1);
4595                                 *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_25);
4596                         }
4597                         stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_25;
4598                         sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper);
4599                         return;
4600 #endif
4601                 }
4602         }
4603         /**********************/
4604         /* 1) check the range */
4605         /**********************/
4606         if (compare_with_wrap(asoc->last_acked_seq, last_tsn, MAX_TSN)) {
4607                 /* acking something behind */
4608                 return;
4609         }
4610         /* update the Rwnd of the peer */
4611         if (TAILQ_EMPTY(&asoc->sent_queue) &&
4612             TAILQ_EMPTY(&asoc->send_queue) &&
4613             (asoc->stream_queue_cnt == 0)
4614             ) {
4615                 /* nothing left on send/sent and strmq */
4616 #ifdef SCTP_LOG_RWND
4617                 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4618                     asoc->peers_rwnd, 0, 0, a_rwnd);
4619 #endif
4620                 asoc->peers_rwnd = a_rwnd;
4621                 if (asoc->sent_queue_retran_cnt) {
4622                         asoc->sent_queue_retran_cnt = 0;
4623                 }
4624                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4625                         /* SWS sender side engages */
4626                         asoc->peers_rwnd = 0;
4627                 }
4628                 /* stop any timers */
4629                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4630                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4631                             stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_26);
4632                         if (sctp_early_fr) {
4633                                 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
4634                                         SCTP_STAT_INCR(sctps_earlyfrstpidsck1);
4635                                         sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
4636                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_26);
4637                                 }
4638                         }
4639                         net->partial_bytes_acked = 0;
4640                         net->flight_size = 0;
4641                 }
4642                 asoc->total_flight = 0;
4643                 asoc->total_flight_count = 0;
4644                 return;
4645         }
4646         /*
4647          * We init netAckSz and netAckSz2 to 0. These are used to track 2
4648          * things. The total byte count acked is tracked in netAckSz AND
4649          * netAck2 is used to track the total bytes acked that are un-
4650          * amibguious and were never retransmitted. We track these on a per
4651          * destination address basis.
4652          */
4653         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4654                 net->prev_cwnd = net->cwnd;
4655                 net->net_ack = 0;
4656                 net->net_ack2 = 0;
4657
4658                 /*
4659                  * CMT: Reset CUC and Fast recovery algo variables before
4660                  * SACK processing
4661                  */
4662                 net->new_pseudo_cumack = 0;
4663                 net->will_exit_fast_recovery = 0;
4664         }
4665         /* process the new consecutive TSN first */
4666         tp1 = TAILQ_FIRST(&asoc->sent_queue);
4667         while (tp1) {
4668                 if (compare_with_wrap(last_tsn, tp1->rec.data.TSN_seq,
4669                     MAX_TSN) ||
4670                     last_tsn == tp1->rec.data.TSN_seq) {
4671                         if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4672                                 /*
4673                                  * ECN Nonce: Add the nonce to the sender's
4674                                  * nonce sum
4675                                  */
4676                                 asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce;
4677                                 accum_moved = 1;
4678                                 if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4679                                         /*
4680                                          * If it is less than ACKED, it is
4681                                          * now no-longer in flight. Higher
4682                                          * values may occur during marking
4683                                          */
4684                                         if ((tp1->whoTo->dest_state &
4685                                             SCTP_ADDR_UNCONFIRMED) &&
4686                                             (tp1->snd_count < 2)) {
4687                                                 /*
4688                                                  * If there was no retran
4689                                                  * and the address is
4690                                                  * un-confirmed and we sent
4691                                                  * there and are now
4692                                                  * sacked.. its confirmed,
4693                                                  * mark it so.
4694                                                  */
4695                                                 tp1->whoTo->dest_state &=
4696                                                     ~SCTP_ADDR_UNCONFIRMED;
4697                                         }
4698 #ifdef SCTP_FLIGHT_LOGGING
4699                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN,
4700                                             tp1->whoTo->flight_size,
4701                                             tp1->book_size,
4702                                             (uintptr_t) stcb,
4703                                             tp1->rec.data.TSN_seq);
4704 #endif
4705                                         if (tp1->whoTo->flight_size >= tp1->book_size) {
4706                                                 tp1->whoTo->flight_size -= tp1->book_size;
4707                                         } else {
4708                                                 tp1->whoTo->flight_size = 0;
4709                                         }
4710                                         if (asoc->total_flight >= tp1->book_size) {
4711                                                 asoc->total_flight -= tp1->book_size;
4712                                                 if (asoc->total_flight_count > 0)
4713                                                         asoc->total_flight_count--;
4714                                         } else {
4715                                                 asoc->total_flight = 0;
4716                                                 asoc->total_flight_count = 0;
4717                                         }
4718                                         tp1->whoTo->net_ack += tp1->send_size;
4719
4720                                         /* CMT SFR and DAC algos */
4721                                         this_sack_lowest_newack = tp1->rec.data.TSN_seq;
4722                                         tp1->whoTo->saw_newack = 1;
4723
4724                                         if (tp1->snd_count < 2) {
4725                                                 /*
4726                                                  * True non-retransmited
4727                                                  * chunk
4728                                                  */
4729                                                 tp1->whoTo->net_ack2 +=
4730                                                     tp1->send_size;
4731
4732                                                 /* update RTO too? */
4733                                                 if (tp1->do_rtt) {
4734                                                         tp1->whoTo->RTO =
4735                                                             sctp_calculate_rto(stcb,
4736                                                             asoc, tp1->whoTo,
4737                                                             &tp1->sent_rcv_time);
4738                                                         tp1->do_rtt = 0;
4739                                                 }
4740                                         }
4741                                         /*
4742                                          * CMT: CUCv2 algorithm. From the
4743                                          * cumack'd TSNs, for each TSN being
4744                                          * acked for the first time, set the
4745                                          * following variables for the
4746                                          * corresp destination.
4747                                          * new_pseudo_cumack will trigger a
4748                                          * cwnd update.
4749                                          * find_(rtx_)pseudo_cumack will
4750                                          * trigger search for the next
4751                                          * expected (rtx-)pseudo-cumack.
4752                                          */
4753                                         tp1->whoTo->new_pseudo_cumack = 1;
4754                                         tp1->whoTo->find_pseudo_cumack = 1;
4755                                         tp1->whoTo->find_rtx_pseudo_cumack = 1;
4756
4757
4758 #ifdef SCTP_SACK_LOGGING
4759                                         sctp_log_sack(asoc->last_acked_seq,
4760                                             cum_ack,
4761                                             tp1->rec.data.TSN_seq,
4762                                             0,
4763                                             0,
4764                                             SCTP_LOG_TSN_ACKED);
4765 #endif
4766 #ifdef SCTP_CWND_LOGGING
4767                                         sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
4768 #endif
4769                                 }
4770                                 if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4771                                         sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4772 #ifdef SCTP_AUDITING_ENABLED
4773                                         sctp_audit_log(0xB3,
4774                                             (asoc->sent_queue_retran_cnt & 0x000000ff));
4775 #endif
4776                                 }
4777                                 if (tp1->rec.data.chunk_was_revoked) {
4778                                         /* deflate the cwnd */
4779                                         tp1->whoTo->cwnd -= tp1->book_size;
4780                                         tp1->rec.data.chunk_was_revoked = 0;
4781                                 }
4782                                 tp1->sent = SCTP_DATAGRAM_ACKED;
4783                         }
4784                 } else {
4785                         break;
4786                 }
4787                 tp1 = TAILQ_NEXT(tp1, sctp_next);
4788         }
4789         biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
4790         /* always set this up to cum-ack */
4791         asoc->this_sack_highest_gap = last_tsn;
4792
4793         if (((num_seg * (sizeof(struct sctp_gap_ack_block))) + sizeof(struct sctp_sack_chunk)) > sack_length) {
4794
4795                 /* skip corrupt segments */
4796                 goto skip_segments;
4797         }
4798         if (num_seg > 0) {
4799
4800                 /*
4801                  * CMT: SFR algo (and HTNA) - this_sack_highest_newack has
4802                  * to be greater than the cumack. Also reset saw_newack to 0
4803                  * for all dests.
4804                  */
4805                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4806                         net->saw_newack = 0;
4807                         net->this_sack_highest_newack = last_tsn;
4808                 }
4809
4810                 /*
4811                  * thisSackHighestGap will increase while handling NEW
4812                  * segments this_sack_highest_newack will increase while
4813                  * handling NEWLY ACKED chunks. this_sack_lowest_newack is
4814                  * used for CMT DAC algo. saw_newack will also change.
4815                  */
4816                 sctp_handle_segments(stcb, asoc, ch, last_tsn,
4817                     &biggest_tsn_acked, &biggest_tsn_newly_acked, &this_sack_lowest_newack,
4818                     num_seg, &ecn_seg_sums);
4819
4820                 if (sctp_strict_sacks) {
4821                         /*
4822                          * validate the biggest_tsn_acked in the gap acks if
4823                          * strict adherence is wanted.
4824                          */
4825                         if ((biggest_tsn_acked == send_s) ||
4826                             (compare_with_wrap(biggest_tsn_acked, send_s, MAX_TSN))) {
4827                                 /*
4828                                  * peer is either confused or we are under
4829                                  * attack. We must abort.
4830                                  */
4831                                 goto hopeless_peer;
4832                         }
4833                 }
4834         }
4835 skip_segments:
4836         /*******************************************/
4837         /* cancel ALL T3-send timer if accum moved */
4838         /*******************************************/
4839         if (sctp_cmt_on_off) {
4840                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4841                         if (net->new_pseudo_cumack)
4842                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4843                                     stcb, net,
4844                                     SCTP_FROM_SCTP_INDATA + SCTP_LOC_27);
4845
4846                 }
4847         } else {
4848                 if (accum_moved) {
4849                         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4850                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4851                                     stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_28);
4852                         }
4853                 }
4854         }
4855         /********************************************/
4856         /* drop the acked chunks from the sendqueue */
4857         /********************************************/
4858         asoc->last_acked_seq = cum_ack;
4859
4860         tp1 = TAILQ_FIRST(&asoc->sent_queue);
4861         if (tp1 == NULL)
4862                 goto done_with_it;
4863         do {
4864                 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
4865                     MAX_TSN)) {
4866                         break;
4867                 }
4868                 if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
4869                         /* no more sent on list */
4870                         break;
4871                 }
4872                 tp2 = TAILQ_NEXT(tp1, sctp_next);
4873                 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4874                 /*
4875                  * Friendlier printf in lieu of panic now that I think its
4876                  * fixed
4877                  */
4878
4879                 if (tp1->pr_sctp_on) {
4880                         if (asoc->pr_sctp_cnt != 0)
4881                                 asoc->pr_sctp_cnt--;
4882                 }
4883                 if ((TAILQ_FIRST(&asoc->sent_queue) == NULL) &&
4884                     (asoc->total_flight > 0)) {
4885                         printf("Warning flight size incorrect should be 0 is %d\n",
4886                             asoc->total_flight);
4887                         asoc->total_flight = 0;
4888                 }
4889                 if (tp1->data) {
4890                         sctp_free_bufspace(stcb, asoc, tp1, 1);
4891                         sctp_m_freem(tp1->data);
4892                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4893                                 asoc->sent_queue_cnt_removeable--;
4894                         }
4895                 }
4896 #ifdef SCTP_SACK_LOGGING
4897                 sctp_log_sack(asoc->last_acked_seq,
4898                     cum_ack,
4899                     tp1->rec.data.TSN_seq,
4900                     0,
4901                     0,
4902                     SCTP_LOG_FREE_SENT);
4903 #endif
4904                 tp1->data = NULL;
4905                 asoc->sent_queue_cnt--;
4906                 sctp_free_remote_addr(tp1->whoTo);
4907
4908                 sctp_free_a_chunk(stcb, tp1);
4909                 wake_him++;
4910                 tp1 = tp2;
4911         } while (tp1 != NULL);
4912
4913 done_with_it:
4914         if ((wake_him) && (stcb->sctp_socket)) {
4915                 SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4916 #ifdef SCTP_WAKE_LOGGING
4917                 sctp_wakeup_log(stcb, cum_ack, wake_him, SCTP_WAKESND_FROM_SACK);
4918 #endif
4919                 sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4920 #ifdef SCTP_WAKE_LOGGING
4921         } else {
4922                 sctp_wakeup_log(stcb, cum_ack, wake_him, SCTP_NOWAKE_FROM_SACK);
4923 #endif
4924         }
4925
4926         if (asoc->fast_retran_loss_recovery && accum_moved) {
4927                 if (compare_with_wrap(asoc->last_acked_seq,
4928                     asoc->fast_recovery_tsn, MAX_TSN) ||
4929                     asoc->last_acked_seq == asoc->fast_recovery_tsn) {
4930                         /* Setup so we will exit RFC2582 fast recovery */
4931                         will_exit_fast_recovery = 1;
4932                 }
4933         }
4934         /*
4935          * Check for revoked fragments:
4936          *
4937          * if Previous sack - Had no frags then we can't have any revoked if
4938          * Previous sack - Had frag's then - If we now have frags aka
4939          * num_seg > 0 call sctp_check_for_revoked() to tell if peer revoked
4940          * some of them. else - The peer revoked all ACKED fragments, since
4941          * we had some before and now we have NONE.
4942          */
4943
4944         if (num_seg)
4945                 sctp_check_for_revoked(asoc, cum_ack, biggest_tsn_acked);
4946         else if (asoc->saw_sack_with_frags) {
4947                 int cnt_revoked = 0;
4948
4949                 tp1 = TAILQ_FIRST(&asoc->sent_queue);
4950                 if (tp1 != NULL) {
4951                         /* Peer revoked all dg's marked or acked */
4952                         TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4953                                 if ((tp1->sent > SCTP_DATAGRAM_RESEND) &&
4954                                     (tp1->sent < SCTP_FORWARD_TSN_SKIP)) {
4955                                         tp1->sent = SCTP_DATAGRAM_SENT;
4956                                         tp1->rec.data.chunk_was_revoked = 1;
4957                                         tp1->whoTo->flight_size += tp1->book_size;
4958                                         /*
4959                                          * To ensure that this increase in
4960                                          * flightsize, which is artificial,
4961                                          * does not throttle the sender, we
4962                                          * also increase the cwnd
4963                                          * artificially.
4964                                          */
4965                                         tp1->whoTo->cwnd += tp1->book_size;
4966                                         asoc->total_flight_count++;
4967                                         asoc->total_flight += tp1->book_size;
4968                                         cnt_revoked++;
4969                                 }
4970                         }
4971                         if (cnt_revoked) {
4972                                 reneged_all = 1;
4973                         }
4974                 }
4975                 asoc->saw_sack_with_frags = 0;
4976         }
4977         if (num_seg)
4978                 asoc->saw_sack_with_frags = 1;
4979         else
4980                 asoc->saw_sack_with_frags = 0;
4981
4982
4983         sctp_cwnd_update(stcb, asoc, accum_moved, reneged_all, will_exit_fast_recovery);
4984
4985         if (TAILQ_EMPTY(&asoc->sent_queue)) {
4986                 /* nothing left in-flight */
4987                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4988                         /* stop all timers */
4989                         if (sctp_early_fr) {
4990                                 if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
4991                                         SCTP_STAT_INCR(sctps_earlyfrstpidsck4);
4992                                         sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
4993                                             SCTP_FROM_SCTP_INDATA + SCTP_LOC_29);
4994                                 }
4995                         }
4996                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4997                             stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_30);
4998                         net->flight_size = 0;
4999                         net->partial_bytes_acked = 0;
5000                 }
5001                 asoc->total_flight = 0;
5002                 asoc->total_flight_count = 0;
5003         }
5004         /**********************************/
5005         /* Now what about shutdown issues */
5006         /**********************************/
5007         if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
5008                 /* nothing left on sendqueue.. consider done */
5009 #ifdef SCTP_LOG_RWND
5010                 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5011                     asoc->peers_rwnd, 0, 0, a_rwnd);
5012 #endif
5013                 asoc->peers_rwnd = a_rwnd;
5014                 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5015                         /* SWS sender side engages */
5016                         asoc->peers_rwnd = 0;
5017                 }
5018                 /* clean up */
5019                 if ((asoc->stream_queue_cnt == 1) &&
5020                     ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
5021                     (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
5022                     (asoc->locked_on_sending)
5023                     ) {
5024                         struct sctp_stream_queue_pending *sp;
5025
5026                         /*
5027                          * I may be in a state where we got all across.. but
5028                          * cannot write more due to a shutdown... we abort
5029                          * since the user did not indicate EOR in this case.
5030                          */
5031                         sp = TAILQ_LAST(&((asoc->locked_on_sending)->outqueue),
5032                             sctp_streamhead);
5033                         if ((sp) && (sp->length == 0) && (sp->msg_is_complete == 0)) {
5034                                 asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
5035                                 asoc->locked_on_sending = NULL;
5036                                 asoc->stream_queue_cnt--;
5037                         }
5038                 }
5039                 if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
5040                     (asoc->stream_queue_cnt == 0)) {
5041                         if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
5042                                 /* Need to abort here */
5043                                 struct mbuf *oper;
5044
5045                 abort_out_now:
5046                                 *abort_now = 1;
5047                                 /* XXX */
5048                                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
5049                                     0, M_DONTWAIT, 1, MT_DATA);
5050                                 if (oper) {
5051                                         struct sctp_paramhdr *ph;
5052                                         uint32_t *ippp;
5053
5054                                         SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
5055                                             sizeof(uint32_t);
5056                                         ph = mtod(oper, struct sctp_paramhdr *);
5057                                         ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
5058                                         ph->param_length = htons(SCTP_BUF_LEN(oper));
5059                                         ippp = (uint32_t *) (ph + 1);
5060                                         *ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_31);
5061                                 }
5062                                 stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_31;
5063                                 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, oper);
5064                                 return;
5065                         } else {
5066                                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
5067                                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
5068                                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5069                                 }
5070                                 asoc->state = SCTP_STATE_SHUTDOWN_SENT;
5071                                 sctp_stop_timers_for_shutdown(stcb);
5072                                 sctp_send_shutdown(stcb,
5073                                     stcb->asoc.primary_destination);
5074                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
5075                                     stcb->sctp_ep, stcb, asoc->primary_destination);
5076                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
5077                                     stcb->sctp_ep, stcb, asoc->primary_destination);
5078                         }
5079                         return;
5080                 } else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
5081                     (asoc->stream_queue_cnt == 0)) {
5082                         if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
5083                                 goto abort_out_now;
5084                         }
5085                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5086                         asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
5087                         sctp_send_shutdown_ack(stcb,
5088                             stcb->asoc.primary_destination);
5089
5090                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
5091                             stcb->sctp_ep, stcb, asoc->primary_destination);
5092                         return;
5093                 }
5094         }
5095         /*
5096          * Now here we are going to recycle net_ack for a different use...
5097          * HEADS UP.
5098          */
5099         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5100                 net->net_ack = 0;
5101         }
5102
5103         /*
5104          * CMT DAC algorithm: If SACK DAC flag was 0, then no extra marking
5105          * to be done. Setting this_sack_lowest_newack to the cum_ack will
5106          * automatically ensure that.
5107          */
5108         if (sctp_cmt_on_off && sctp_cmt_use_dac && (cmt_dac_flag == 0)) {
5109                 this_sack_lowest_newack = cum_ack;
5110         }
5111         if (num_seg > 0) {
5112                 sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked,
5113                     biggest_tsn_newly_acked, this_sack_lowest_newack, accum_moved);
5114         }
5115         /*********************************************/
5116         /* Here we perform PR-SCTP procedures        */
5117         /* (section 4.2)                             */
5118         /*********************************************/
5119         /* C1. update advancedPeerAckPoint */
5120         if (compare_with_wrap(cum_ack, asoc->advanced_peer_ack_point, MAX_TSN)) {
5121                 asoc->advanced_peer_ack_point = cum_ack;
5122         }
5123         /* C2. try to further move advancedPeerAckPoint ahead */
5124
5125         if ((asoc->peer_supports_prsctp) && (asoc->pr_sctp_cnt > 0)) {
5126                 struct sctp_tmit_chunk *lchk;
5127
5128                 lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
5129                 /* C3. See if we need to send a Fwd-TSN */
5130                 if (compare_with_wrap(asoc->advanced_peer_ack_point, cum_ack,
5131                     MAX_TSN)) {
5132                         /*
5133                          * ISSUE with ECN, see FWD-TSN processing for notes
5134                          * on issues that will occur when the ECN NONCE
5135                          * stuff is put into SCTP for cross checking.
5136                          */
5137                         send_forward_tsn(stcb, asoc);
5138
5139                         /*
5140                          * ECN Nonce: Disable Nonce Sum check when FWD TSN
5141                          * is sent and store resync tsn
5142                          */
5143                         asoc->nonce_sum_check = 0;
5144                         asoc->nonce_resync_tsn = asoc->advanced_peer_ack_point;
5145                         if (lchk) {
5146                                 /* Assure a timer is up */
5147                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5148                                     stcb->sctp_ep, stcb, lchk->whoTo);
5149                         }
5150                 }
5151         }
5152         /*
5153          * CMT fast recovery code. Need to debug. ((sctp_cmt_on_off == 1) &&
5154          * (net->fast_retran_loss_recovery == 0))) if
5155          * ((asoc->fast_retran_loss_recovery == 0) || (sctp_cmt_on_off ==
5156          * 1)) {
5157          */
5158         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5159                 if (asoc->fast_retran_loss_recovery == 0) {
5160                         /* out of a RFC2582 Fast recovery window? */
5161                         if (net->net_ack > 0) {
5162                                 /*
5163                                  * per section 7.2.3, are there any
5164                                  * destinations that had a fast retransmit
5165                                  * to them. If so what we need to do is
5166                                  * adjust ssthresh and cwnd.
5167                                  */
5168                                 struct sctp_tmit_chunk *lchk;
5169
5170 #ifdef  SCTP_HIGH_SPEED
5171                                 sctp_hs_cwnd_decrease(stcb, net);
5172 #else
5173 #ifdef SCTP_CWND_MONITOR
5174                                 int old_cwnd = net->cwnd;
5175
5176 #endif
5177                                 net->ssthresh = net->cwnd / 2;
5178                                 if (net->ssthresh < (net->mtu * 2)) {
5179                                         net->ssthresh = 2 * net->mtu;
5180                                 }
5181                                 net->cwnd = net->ssthresh;
5182 #ifdef SCTP_CWND_MONITOR
5183                                 sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd),
5184                                     SCTP_CWND_LOG_FROM_FR);
5185 #endif
5186 #endif
5187
5188                                 lchk = TAILQ_FIRST(&asoc->send_queue);
5189
5190                                 net->partial_bytes_acked = 0;
5191                                 /* Turn on fast recovery window */
5192                                 asoc->fast_retran_loss_recovery = 1;
5193                                 if (lchk == NULL) {
5194                                         /* Mark end of the window */
5195                                         asoc->fast_recovery_tsn = asoc->sending_seq - 1;
5196                                 } else {
5197                                         asoc->fast_recovery_tsn = lchk->rec.data.TSN_seq - 1;
5198                                 }
5199
5200                                 /*
5201                                  * CMT fast recovery -- per destination
5202                                  * recovery variable.
5203                                  */
5204                                 net->fast_retran_loss_recovery = 1;
5205
5206                                 if (lchk == NULL) {
5207                                         /* Mark end of the window */
5208                                         net->fast_recovery_tsn = asoc->sending_seq - 1;
5209                                 } else {
5210                                         net->fast_recovery_tsn = lchk->rec.data.TSN_seq - 1;
5211                                 }
5212
5213
5214
5215                                 /*
5216                                  * Disable Nonce Sum Checking and store the
5217                                  * resync tsn
5218                                  */
5219                                 asoc->nonce_sum_check = 0;
5220                                 asoc->nonce_resync_tsn = asoc->fast_recovery_tsn + 1;
5221
5222                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND,
5223                                     stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_32);
5224                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5225                                     stcb->sctp_ep, stcb, net);
5226                         }
5227                 } else if (net->net_ack > 0) {
5228                         /*
5229                          * Mark a peg that we WOULD have done a cwnd
5230                          * reduction but RFC2582 prevented this action.
5231                          */
5232                         SCTP_STAT_INCR(sctps_fastretransinrtt);
5233                 }
5234         }
5235
5236
5237         /******************************************************************
5238          *  Here we do the stuff with ECN Nonce checking.
5239          *  We basically check to see if the nonce sum flag was incorrect
5240          *  or if resynchronization needs to be done. Also if we catch a
5241          *  misbehaving receiver we give him the kick.
5242          ******************************************************************/
5243
5244         if (asoc->ecn_nonce_allowed) {
5245                 if (asoc->nonce_sum_check) {
5246                         if (nonce_sum_flag != ((asoc->nonce_sum_expect_base + ecn_seg_sums) & SCTP_SACK_NONCE_SUM)) {
5247                                 if (asoc->nonce_wait_for_ecne == 0) {
5248                                         struct sctp_tmit_chunk *lchk;
5249
5250                                         lchk = TAILQ_FIRST(&asoc->send_queue);
5251                                         asoc->nonce_wait_for_ecne = 1;
5252                                         if (lchk) {
5253                                                 asoc->nonce_wait_tsn = lchk->rec.data.TSN_seq;
5254                                         } else {
5255                                                 asoc->nonce_wait_tsn = asoc->sending_seq;
5256                                         }
5257                                 } else {
5258                                         if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_wait_tsn, MAX_TSN) ||
5259                                             (asoc->last_acked_seq == asoc->nonce_wait_tsn)) {
5260                                                 /*
5261                                                  * Misbehaving peer. We need
5262                                                  * to react to this guy
5263                                                  */
5264                                                 asoc->ecn_allowed = 0;
5265                                                 asoc->ecn_nonce_allowed = 0;
5266                                         }
5267                                 }
5268                         }
5269                 } else {
5270                         /* See if Resynchronization Possible */
5271                         if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_resync_tsn, MAX_TSN)) {
5272                                 asoc->nonce_sum_check = 1;
5273                                 /*
5274                                  * now we must calculate what the base is.
5275                                  * We do this based on two things, we know
5276                                  * the total's for all the segments
5277                                  * gap-acked in the SACK, its stored in
5278                                  * ecn_seg_sums. We also know the SACK's
5279                                  * nonce sum, its in nonce_sum_flag. So we
5280                                  * can build a truth table to back-calculate
5281                                  * the new value of
5282                                  * asoc->nonce_sum_expect_base:
5283                                  *
5284                                  * SACK-flag-Value         Seg-Sums Base 0 0 0
5285                                  * 1                    0 1 0 1 1 1
5286                                  * 1 0
5287                                  */
5288                                 asoc->nonce_sum_expect_base = (ecn_seg_sums ^ nonce_sum_flag) & SCTP_SACK_NONCE_SUM;
5289                         }
5290                 }
5291         }
5292         /* Now are we exiting loss recovery ? */
5293         if (will_exit_fast_recovery) {
5294                 /* Ok, we must exit fast recovery */
5295                 asoc->fast_retran_loss_recovery = 0;
5296         }
5297         if ((asoc->sat_t3_loss_recovery) &&
5298             ((compare_with_wrap(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn,
5299             MAX_TSN) ||
5300             (asoc->last_acked_seq == asoc->sat_t3_recovery_tsn)))) {
5301                 /* end satellite t3 loss recovery */
5302                 asoc->sat_t3_loss_recovery = 0;
5303         }
5304         /*
5305          * CMT Fast recovery
5306          */
5307         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5308                 if (net->will_exit_fast_recovery) {
5309                         /* Ok, we must exit fast recovery */
5310                         net->fast_retran_loss_recovery = 0;
5311                 }
5312         }
5313
5314         /* Adjust and set the new rwnd value */
5315 #ifdef SCTP_LOG_RWND
5316         sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5317             asoc->peers_rwnd, asoc->total_flight, (asoc->sent_queue_cnt * sctp_peer_chunk_oh), a_rwnd);
5318 #endif
5319
5320         asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd,
5321             (uint32_t) (asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh)));
5322         if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5323                 /* SWS sender side engages */
5324                 asoc->peers_rwnd = 0;
5325         }
5326         /*
5327          * Now we must setup so we have a timer up for anyone with
5328          * outstanding data.
5329          */
5330 again:
5331         j = 0;
5332         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5333                 if (net->flight_size) {
5334                         j++;
5335                         sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5336                             stcb->sctp_ep, stcb, net);
5337                 }
5338         }
5339         if ((j == 0) && (!TAILQ_EMPTY(&asoc->sent_queue)) && (asoc->sent_queue_retran_cnt == 0)) {
5340                 /* huh, this should not happen */
5341 #ifdef INVARIANTS
5342                 panic("Flight size incorrect? fixing??");
5343 #else
5344                 printf("Flight size incorrect? fixing??\n");
5345                 TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5346                         net->flight_size = 0;
5347                 }
5348                 asoc->total_flight = 0;
5349                 asoc->total_flight_count = 0;
5350                 asoc->sent_queue_retran_cnt = 0;
5351                 TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5352                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5353                                 tp1->whoTo->flight_size += tp1->book_size;
5354                                 asoc->total_flight += tp1->book_size;
5355                                 asoc->total_flight_count++;
5356                         } else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
5357                                 asoc->sent_queue_retran_cnt++;
5358                         }
5359                 }
5360 #endif
5361                 goto again;
5362         }
5363 #ifdef SCTP_SACK_RWND_LOGGING
5364         sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
5365             a_rwnd,
5366             stcb->asoc.peers_rwnd,
5367             stcb->asoc.total_flight,
5368             stcb->asoc.total_output_queue_size);
5369
5370 #endif
5371
5372 }
5373
5374 void
5375 sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp,
5376     struct sctp_nets *netp, int *abort_flag)
5377 {
5378         /* Copy cum-ack */
5379         uint32_t cum_ack, a_rwnd;
5380
5381         cum_ack = ntohl(cp->cumulative_tsn_ack);
5382         /* Arrange so a_rwnd does NOT change */
5383         a_rwnd = stcb->asoc.peers_rwnd + stcb->asoc.total_flight;
5384
5385         /* Now call the express sack handling */
5386         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, 0, abort_flag);
5387 }
5388
5389 static void
5390 sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb,
5391     struct sctp_stream_in *strmin)
5392 {
5393         struct sctp_queued_to_read *ctl, *nctl;
5394         struct sctp_association *asoc;
5395         int tt;
5396
5397         asoc = &stcb->asoc;
5398         tt = strmin->last_sequence_delivered;
5399         /*
5400          * First deliver anything prior to and including the stream no that
5401          * came in
5402          */
5403         ctl = TAILQ_FIRST(&strmin->inqueue);
5404         while (ctl) {
5405                 nctl = TAILQ_NEXT(ctl, next);
5406                 if (compare_with_wrap(tt, ctl->sinfo_ssn, MAX_SEQ) ||
5407                     (tt == ctl->sinfo_ssn)) {
5408                         /* this is deliverable now */
5409                         TAILQ_REMOVE(&strmin->inqueue, ctl, next);
5410                         /* subtract pending on streams */
5411                         asoc->size_on_all_streams -= ctl->length;
5412                         sctp_ucount_decr(asoc->cnt_on_all_streams);
5413                         /* deliver it to at least the delivery-q */
5414                         if (stcb->sctp_socket) {
5415                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
5416                                     ctl,
5417                                     &stcb->sctp_socket->so_rcv, 1);
5418                         }
5419                 } else {
5420                         /* no more delivery now. */
5421                         break;
5422                 }
5423                 ctl = nctl;
5424         }
5425         /*
5426          * now we must deliver things in queue the normal way  if any are
5427          * now ready.
5428          */
5429         tt = strmin->last_sequence_delivered + 1;
5430         ctl = TAILQ_FIRST(&strmin->inqueue);
5431         while (ctl) {
5432                 nctl = TAILQ_NEXT(ctl, next);
5433                 if (tt == ctl->sinfo_ssn) {
5434                         /* this is deliverable now */
5435                         TAILQ_REMOVE(&strmin->inqueue, ctl, next);
5436                         /* subtract pending on streams */
5437                         asoc->size_on_all_streams -= ctl->length;
5438                         sctp_ucount_decr(asoc->cnt_on_all_streams);
5439                         /* deliver it to at least the delivery-q */
5440                         strmin->last_sequence_delivered = ctl->sinfo_ssn;
5441                         if (stcb->sctp_socket) {
5442                                 sctp_add_to_readq(stcb->sctp_ep, stcb,
5443                                     ctl,
5444                                     &stcb->sctp_socket->so_rcv, 1);
5445                         }
5446                         tt = strmin->last_sequence_delivered + 1;
5447                 } else {
5448                         break;
5449                 }
5450                 ctl = nctl;
5451         }
5452 }
5453
5454 void
5455 sctp_handle_forward_tsn(struct sctp_tcb *stcb,
5456     struct sctp_forward_tsn_chunk *fwd, int *abort_flag)
5457 {
5458         /*
5459          * ISSUES that MUST be fixed for ECN! When we are the sender of the
5460          * forward TSN, when the SACK comes back that acknowledges the
5461          * FWD-TSN we must reset the NONCE sum to match correctly. This will
5462          * get quite tricky since we may have sent more data interveneing
5463          * and must carefully account for what the SACK says on the nonce
5464          * and any gaps that are reported. This work will NOT be done here,
5465          * but I note it here since it is really related to PR-SCTP and
5466          * FWD-TSN's
5467          */
5468
5469         /* The pr-sctp fwd tsn */
5470         /*
5471          * here we will perform all the data receiver side steps for
5472          * processing FwdTSN, as required in by pr-sctp draft:
5473          *
5474          * Assume we get FwdTSN(x):
5475          *
5476          * 1) update local cumTSN to x 2) try to further advance cumTSN to x +
5477          * others we have 3) examine and update re-ordering queue on
5478          * pr-in-streams 4) clean up re-assembly queue 5) Send a sack to
5479          * report where we are.
5480          */
5481         struct sctp_strseq *stseq;
5482         struct sctp_association *asoc;
5483         uint32_t new_cum_tsn, gap, back_out_htsn;
5484         unsigned int i, cnt_gone, fwd_sz, cumack_set_flag, m_size;
5485         struct sctp_stream_in *strm;
5486         struct sctp_tmit_chunk *chk, *at;
5487
5488         cumack_set_flag = 0;
5489         asoc = &stcb->asoc;
5490         cnt_gone = 0;
5491         if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
5492 #ifdef SCTP_DEBUG
5493                 if (sctp_debug_on & SCTP_DEBUG_INDATA1) {
5494                         printf("Bad size too small/big fwd-tsn\n");
5495                 }
5496 #endif
5497                 return;
5498         }
5499         m_size = (stcb->asoc.mapping_array_size << 3);
5500         /*************************************************************/
5501         /* 1. Here we update local cumTSN and shift the bitmap array */
5502         /*************************************************************/
5503         new_cum_tsn = ntohl(fwd->new_cumulative_tsn);
5504
5505         if (compare_with_wrap(asoc->cumulative_tsn, new_cum_tsn, MAX_TSN) ||
5506             asoc->cumulative_tsn == new_cum_tsn) {
5507                 /* Already got there ... */
5508                 return;
5509         }
5510         back_out_htsn = asoc->highest_tsn_inside_map;
5511         if (compare_with_wrap(new_cum_tsn, asoc->highest_tsn_inside_map,
5512             MAX_TSN)) {
5513                 asoc->highest_tsn_inside_map = new_cum_tsn;
5514 #ifdef SCTP_MAP_LOGGING
5515                 sctp_log_map(0, 0, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5516 #endif
5517         }
5518         /*
5519          * now we know the new TSN is more advanced, let's find the actual
5520          * gap
5521          */
5522         if ((compare_with_wrap(new_cum_tsn, asoc->mapping_array_base_tsn,
5523             MAX_TSN)) ||
5524             (new_cum_tsn == asoc->mapping_array_base_tsn)) {
5525                 gap = new_cum_tsn - asoc->mapping_array_base_tsn;
5526         } else {
5527                 /* try to prevent underflow here */
5528                 gap = new_cum_tsn + (MAX_TSN - asoc->mapping_array_base_tsn) + 1;
5529         }
5530
5531         if (gap > m_size || gap < 0) {
5532                 asoc->highest_tsn_inside_map = back_out_htsn;
5533                 if ((long)gap > sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv)) {
5534                         /*
5535                          * out of range (of single byte chunks in the rwnd I
5536                          * give out) too questionable. better to drop it
5537                          * silently
5538                          */
5539                         return;
5540                 }
5541                 if (asoc->highest_tsn_inside_map >
5542                     asoc->mapping_array_base_tsn) {
5543                         gap = asoc->highest_tsn_inside_map -
5544                             asoc->mapping_array_base_tsn;
5545                 } else {
5546                         gap = asoc->highest_tsn_inside_map +
5547                             (MAX_TSN - asoc->mapping_array_base_tsn) + 1;
5548                 }
5549                 cumack_set_flag = 1;
5550         }
5551         for (i = 0; i <= gap; i++) {
5552                 SCTP_SET_TSN_PRESENT(asoc->mapping_array, i);
5553         }
5554         /*
5555          * Now after marking all, slide thing forward but no sack please.
5556          */
5557         sctp_sack_check(stcb, 0, 0, abort_flag);
5558         if (*abort_flag)
5559                 return;
5560
5561         if (cumack_set_flag) {
5562                 /*
5563                  * fwd-tsn went outside my gap array - not a common
5564                  * occurance. Do the same thing we do when a cookie-echo
5565                  * arrives.
5566                  */
5567                 asoc->highest_tsn_inside_map = new_cum_tsn - 1;
5568                 asoc->mapping_array_base_tsn = new_cum_tsn;
5569                 asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
5570 #ifdef SCTP_MAP_LOGGING
5571                 sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5572 #endif
5573                 asoc->last_echo_tsn = asoc->highest_tsn_inside_map;
5574         }
5575         /*************************************************************/
5576         /* 2. Clear up re-assembly queue                             */
5577         /*************************************************************/
5578
5579         /*
5580          * First service it if pd-api is up, just in case we can progress it
5581          * forward
5582          */
5583         if (asoc->fragmented_delivery_inprogress) {
5584                 sctp_service_reassembly(stcb, asoc);
5585         }
5586         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
5587                 /* For each one on here see if we need to toss it */
5588                 /*
5589                  * For now large messages held on the reasmqueue that are
5590                  * complete will be tossed too. We could in theory do more
5591                  * work to spin through and stop after dumping one msg aka
5592                  * seeing the start of a new msg at the head, and call the
5593                  * delivery function... to see if it can be delivered... But
5594                  * for now we just dump everything on the queue.
5595                  */
5596                 chk = TAILQ_FIRST(&asoc->reasmqueue);
5597                 while (chk) {
5598                         at = TAILQ_NEXT(chk, sctp_next);
5599                         if (compare_with_wrap(asoc->cumulative_tsn,
5600                             chk->rec.data.TSN_seq, MAX_TSN) ||
5601                             asoc->cumulative_tsn == chk->rec.data.TSN_seq) {
5602                                 /* It needs to be tossed */
5603                                 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5604                                 if (compare_with_wrap(chk->rec.data.TSN_seq,
5605                                     asoc->tsn_last_delivered, MAX_TSN)) {
5606                                         asoc->tsn_last_delivered =
5607                                             chk->rec.data.TSN_seq;
5608                                         asoc->str_of_pdapi =
5609                                             chk->rec.data.stream_number;
5610                                         asoc->ssn_of_pdapi =
5611                                             chk->rec.data.stream_seq;
5612                                         asoc->fragment_flags =
5613                                             chk->rec.data.rcv_flags;
5614                                 }
5615                                 asoc->size_on_reasm_queue -= chk->send_size;
5616                                 sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5617                                 cnt_gone++;
5618
5619                                 /* Clear up any stream problem */
5620                                 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) !=
5621                                     SCTP_DATA_UNORDERED &&
5622                                     (compare_with_wrap(chk->rec.data.stream_seq,
5623                                     asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered,
5624                                     MAX_SEQ))) {
5625                                         /*
5626                                          * We must dump forward this streams
5627                                          * sequence number if the chunk is
5628                                          * not unordered that is being
5629                                          * skipped. There is a chance that
5630                                          * if the peer does not include the
5631                                          * last fragment in its FWD-TSN we
5632                                          * WILL have a problem here since
5633                                          * you would have a partial chunk in
5634                                          * queue that may not be
5635                                          * deliverable. Also if a Partial
5636                                          * delivery API as started the user
5637                                          * may get a partial chunk. The next
5638                                          * read returning a new chunk...
5639                                          * really ugly but I see no way
5640                                          * around it! Maybe a notify??
5641                                          */
5642                                         asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered =
5643                                             chk->rec.data.stream_seq;
5644                                 }
5645                                 if (chk->data) {
5646                                         sctp_m_freem(chk->data);
5647                                         chk->data = NULL;
5648                                 }
5649                                 sctp_free_remote_addr(chk->whoTo);
5650                                 sctp_free_a_chunk(stcb, chk);
5651                         } else {
5652                                 /*
5653                                  * Ok we have gone beyond the end of the
5654                                  * fwd-tsn's mark. Some checks...
5655                                  */
5656                                 if ((asoc->fragmented_delivery_inprogress) &&
5657                                     (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
5658                                         /*
5659                                          * Special case PD-API is up and
5660                                          * what we fwd-tsn' over includes
5661                                          * one that had the LAST_FRAG. We no
5662                                          * longer need to do the PD-API.
5663                                          */
5664                                         asoc->fragmented_delivery_inprogress = 0;
5665                                         sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
5666                                             stcb, SCTP_PARTIAL_DELIVERY_ABORTED, (void *)NULL);
5667
5668                                 }
5669                                 break;
5670                         }
5671                         chk = at;
5672                 }
5673         }
5674         if (asoc->fragmented_delivery_inprogress) {
5675                 /*
5676                  * Ok we removed cnt_gone chunks in the PD-API queue that
5677                  * were being delivered. So now we must turn off the flag.
5678                  */
5679                 sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
5680                     stcb, SCTP_PARTIAL_DELIVERY_ABORTED, (void *)NULL);
5681                 asoc->fragmented_delivery_inprogress = 0;
5682         }
5683         /*************************************************************/
5684         /* 3. Update the PR-stream re-ordering queues                */
5685         /*************************************************************/
5686         stseq = (struct sctp_strseq *)((caddr_t)fwd + sizeof(*fwd));
5687         fwd_sz -= sizeof(*fwd);
5688         {
5689                 /* New method. */
5690                 int num_str, i;
5691
5692                 num_str = fwd_sz / sizeof(struct sctp_strseq);
5693                 for (i = 0; i < num_str; i++) {
5694                         uint16_t st;
5695                         unsigned char *xx;
5696
5697                         /* Convert */
5698                         xx = (unsigned char *)&stseq[i];
5699                         st = ntohs(stseq[i].stream);
5700                         stseq[i].stream = st;
5701                         st = ntohs(stseq[i].sequence);
5702                         stseq[i].sequence = st;
5703                         /* now process */
5704                         if (stseq[i].stream > asoc->streamincnt) {
5705                                 /*
5706                                  * It is arguable if we should continue.
5707                                  * Since the peer sent bogus stream info we
5708                                  * may be in deep trouble.. a return may be
5709                                  * a better choice?
5710                                  */
5711                                 continue;
5712                         }
5713                         strm = &asoc->strmin[stseq[i].stream];
5714                         if (compare_with_wrap(stseq[i].sequence,
5715                             strm->last_sequence_delivered, MAX_SEQ)) {
5716                                 /* Update the sequence number */
5717                                 strm->last_sequence_delivered =
5718                                     stseq[i].sequence;
5719                         }
5720                         /* now kick the stream the new way */
5721                         sctp_kick_prsctp_reorder_queue(stcb, strm);
5722                 }
5723         }
5724         if (TAILQ_FIRST(&asoc->reasmqueue)) {
5725                 /* now lets kick out and check for more fragmented delivery */
5726                 sctp_deliver_reasm_check(stcb, &stcb->asoc);
5727         }
5728 }