sys/netinet/sctp_timer.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_timer.c,v 1.29 2005/03/06 16:04:18 itojun Exp $   */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #define _IP_VHL
  37 #include <netinet/sctp_os.h>
  38 #include <netinet/sctp_pcb.h>
  39 #ifdef INET6
  40 #endif
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #include <netinet/sctp_timer.h>
  44 #include <netinet/sctputil.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_header.h>
  47 #include <netinet/sctp_indata.h>
  48 #include <netinet/sctp_asconf.h>
  49 #include <netinet/sctp_input.h>
  50 #include <netinet/sctp.h>
  51 #include <netinet/sctp_uio.h>
  52 #include <netinet/udp.h>
  53
  54
  55 void
  56 sctp_early_fr_timer(struct sctp_inpcb *inp,
  57     struct sctp_tcb *stcb,
  58     struct sctp_nets *net)
  59 {
  60         struct sctp_tmit_chunk *chk, *tp2;
  61         struct timeval now, min_wait, tv;
  62         unsigned int cur_rtt, cnt = 0, cnt_resend = 0;
  63
  64         /* an early FR is occuring. */
  65         (void)SCTP_GETTIME_TIMEVAL(&now);
  66         /* get cur rto in micro-seconds */
  67         if (net->lastsa == 0) {
  68                 /* Hmm no rtt estimate yet? */
  69                 cur_rtt = stcb->asoc.initial_rto >> 2;
  70         } else {
  71
  72                 cur_rtt = ((net->lastsa >> 2) + net->lastsv) >> 1;
  73         }
  74         if (cur_rtt < SCTP_BASE_SYSCTL(sctp_early_fr_msec)) {
  75                 cur_rtt = SCTP_BASE_SYSCTL(sctp_early_fr_msec);
  76         }
  77         cur_rtt *= 1000;
  78         tv.tv_sec = cur_rtt / 1000000;
  79         tv.tv_usec = cur_rtt % 1000000;
  80         min_wait = now;
  81         timevalsub(&min_wait, &tv);
  82         if (min_wait.tv_sec < 0 || min_wait.tv_usec < 0) {
  83                 /*
  84                  * if we hit here, we don't have enough seconds on the clock
  85                  * to account for the RTO. We just let the lower seconds be
  86                  * the bounds and don't worry about it. This may mean we
  87                  * will mark a lot more than we should.
  88                  */
  89                 min_wait.tv_sec = min_wait.tv_usec = 0;
  90         }
  91         chk = TAILQ_LAST(&stcb->asoc.sent_queue, sctpchunk_listhead);
  92         for (; chk != NULL; chk = tp2) {
  93                 tp2 = TAILQ_PREV(chk, sctpchunk_listhead, sctp_next);
  94                 if (chk->whoTo != net) {
  95                         continue;
  96                 }
  97                 if (chk->sent == SCTP_DATAGRAM_RESEND)
  98                         cnt_resend++;
  99                 else if ((chk->sent > SCTP_DATAGRAM_UNSENT) &&
 100                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 101                         /* pending, may need retran */
 102                         if (chk->sent_rcv_time.tv_sec > min_wait.tv_sec) {
 103                                 /*
 104                                  * we have reached a chunk that was sent
 105                                  * some seconds past our min.. forget it we
 106                                  * will find no more to send.
 107                                  */
 108                                 continue;
 109                         } else if (chk->sent_rcv_time.tv_sec == min_wait.tv_sec) {
 110                                 /*
 111                                  * we must look at the micro seconds to
 112                                  * know.
 113                                  */
 114                                 if (chk->sent_rcv_time.tv_usec >= min_wait.tv_usec) {
 115                                         /*
 116                                          * ok it was sent after our boundary
 117                                          * time.
 118                                          */
 119                                         continue;
 120                                 }
 121                         }
 122                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_EARLYFR_LOGGING_ENABLE) {
 123                                 sctp_log_fr(chk->rec.data.TSN_seq, chk->snd_count,
 124                                     4, SCTP_FR_MARKED_EARLY);
 125                         }
 126                         SCTP_STAT_INCR(sctps_earlyfrmrkretrans);
 127                         chk->sent = SCTP_DATAGRAM_RESEND;
 128                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 129                         /* double book size since we are doing an early FR */
 130                         chk->book_size_scale++;
 131                         cnt += chk->send_size;
 132                         if ((cnt + net->flight_size) > net->cwnd) {
 133                                 /* Mark all we could possibly resend */
 134                                 break;
 135                         }
 136                 }
 137         }
 138         if (cnt) {
 139                 /*
 140                  * JRS - Use the congestion control given in the congestion
 141                  * control module
 142                  */
 143                 stcb->asoc.cc_functions.sctp_cwnd_update_after_fr_timer(inp, stcb, net);
 144         } else if (cnt_resend) {
 145                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_EARLY_FR_TMR, SCTP_SO_NOT_LOCKED);
 146         }
 147         /* Restart it? */
 148         if (net->flight_size < net->cwnd) {
 149                 SCTP_STAT_INCR(sctps_earlyfrstrtmr);
 150                 sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net);
 151         }
 152 }
 153
 154 void
 155 sctp_audit_retranmission_queue(struct sctp_association *asoc)
 156 {
 157         struct sctp_tmit_chunk *chk;
 158
 159         SCTPDBG(SCTP_DEBUG_TIMER4, "Audit invoked on send queue cnt:%d onqueue:%d\n",
 160             asoc->sent_queue_retran_cnt,
 161             asoc->sent_queue_cnt);
 162         asoc->sent_queue_retran_cnt = 0;
 163         asoc->sent_queue_cnt = 0;
 164         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
 165                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 166                         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
 167                 }
 168                 asoc->sent_queue_cnt++;
 169         }
 170         TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
 171                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 172                         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
 173                 }
 174         }
 175         TAILQ_FOREACH(chk, &asoc->asconf_send_queue, sctp_next) {
 176                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 177                         sctp_ucount_incr(asoc->sent_queue_retran_cnt);
 178                 }
 179         }
 180         SCTPDBG(SCTP_DEBUG_TIMER4, "Audit completes retran:%d onqueue:%d\n",
 181             asoc->sent_queue_retran_cnt,
 182             asoc->sent_queue_cnt);
 183 }
 184
 185 int
 186 sctp_threshold_management(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 187     struct sctp_nets *net, uint16_t threshold)
 188 {
 189         if (net) {
 190                 net->error_count++;
 191                 SCTPDBG(SCTP_DEBUG_TIMER4, "Error count for %p now %d thresh:%d\n",
 192                     net, net->error_count,
 193                     net->failure_threshold);
 194                 if (net->error_count > net->failure_threshold) {
 195                         /* We had a threshold failure */
 196                         if (net->dest_state & SCTP_ADDR_REACHABLE) {
 197                                 net->dest_state &= ~SCTP_ADDR_REACHABLE;
 198                                 net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
 199                                 net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
 200                                 if (net == stcb->asoc.primary_destination) {
 201                                         net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
 202                                 }
 203                                 /*
 204                                  * JRS 5/14/07 - If a destination is
 205                                  * unreachable, the PF bit is turned off.
 206                                  * This allows an unambiguous use of the PF
 207                                  * bit for destinations that are reachable
 208                                  * but potentially failed. If the
 209                                  * destination is set to the unreachable
 210                                  * state, also set the destination to the PF
 211                                  * state.
 212                                  */
 213                                 /*
 214                                  * Add debug message here if destination is
 215                                  * not in PF state.
 216                                  */
 217                                 /* Stop any running T3 timers here? */
 218                                 if ((stcb->asoc.sctp_cmt_on_off == 1) &&
 219                                     (stcb->asoc.sctp_cmt_pf > 0)) {
 220                                         net->dest_state &= ~SCTP_ADDR_PF;
 221                                         SCTPDBG(SCTP_DEBUG_TIMER4, "Destination %p moved from PF to unreachable.\n",
 222                                             net);
 223                                 }
 224                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
 225                                     stcb,
 226                                     SCTP_FAILED_THRESHOLD,
 227                                     (void *)net, SCTP_SO_NOT_LOCKED);
 228                         }
 229                 }
 230                 /*********HOLD THIS COMMENT FOR PATCH OF ALTERNATE
 231                  *********ROUTING CODE
 232                  */
 233                 /*********HOLD THIS COMMENT FOR END OF PATCH OF ALTERNATE
 234                  *********ROUTING CODE
 235                  */
 236         }
 237         if (stcb == NULL)
 238                 return (0);
 239
 240         if (net) {
 241                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0) {
 242                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 243                                 sctp_misc_ints(SCTP_THRESHOLD_INCR,
 244                                     stcb->asoc.overall_error_count,
 245                                     (stcb->asoc.overall_error_count + 1),
 246                                     SCTP_FROM_SCTP_TIMER,
 247                                     __LINE__);
 248                         }
 249                         stcb->asoc.overall_error_count++;
 250                 }
 251         } else {
 252                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 253                         sctp_misc_ints(SCTP_THRESHOLD_INCR,
 254                             stcb->asoc.overall_error_count,
 255                             (stcb->asoc.overall_error_count + 1),
 256                             SCTP_FROM_SCTP_TIMER,
 257                             __LINE__);
 258                 }
 259                 stcb->asoc.overall_error_count++;
 260         }
 261         SCTPDBG(SCTP_DEBUG_TIMER4, "Overall error count for %p now %d thresh:%u state:%x\n",
 262             &stcb->asoc, stcb->asoc.overall_error_count,
 263             (uint32_t) threshold,
 264             ((net == NULL) ? (uint32_t) 0 : (uint32_t) net->dest_state));
 265         /*
 266          * We specifically do not do >= to give the assoc one more change
 267          * before we fail it.
 268          */
 269         if (stcb->asoc.overall_error_count > threshold) {
 270                 /* Abort notification sends a ULP notify */
 271                 struct mbuf *oper;
 272
 273                 oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
 274                     0, M_DONTWAIT, 1, MT_DATA);
 275                 if (oper) {
 276                         struct sctp_paramhdr *ph;
 277                         uint32_t *ippp;
 278
 279                         SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
 280                             sizeof(uint32_t);
 281                         ph = mtod(oper, struct sctp_paramhdr *);
 282                         ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
 283                         ph->param_length = htons(SCTP_BUF_LEN(oper));
 284                         ippp = (uint32_t *) (ph + 1);
 285                         *ippp = htonl(SCTP_FROM_SCTP_TIMER + SCTP_LOC_1);
 286                 }
 287                 inp->last_abort_code = SCTP_FROM_SCTP_TIMER + SCTP_LOC_1;
 288                 sctp_abort_an_association(inp, stcb, SCTP_FAILED_THRESHOLD, oper, SCTP_SO_NOT_LOCKED);
 289                 return (1);
 290         }
 291         return (0);
 292 }
 293
 294 /*
 295  * sctp_find_alternate_net() returns a non-NULL pointer as long
 296  * the argument net is non-NULL.
 297  */
 298 struct sctp_nets *
 299 sctp_find_alternate_net(struct sctp_tcb *stcb,
 300     struct sctp_nets *net,
 301     int mode)
 302 {
 303         /* Find and return an alternate network if possible */
 304         struct sctp_nets *alt, *mnet, *min_errors_net = NULL, *max_cwnd_net = NULL;
 305         int once;
 306
 307         /* JRS 5/14/07 - Initialize min_errors to an impossible value. */
 308         int min_errors = -1;
 309         uint32_t max_cwnd = 0;
 310
 311         if (stcb->asoc.numnets == 1) {
 312                 /* No others but net */
 313                 return (TAILQ_FIRST(&stcb->asoc.nets));
 314         }
 315         /*
 316          * JRS 5/14/07 - If mode is set to 2, use the CMT PF find alternate
 317          * net algorithm. This algorithm chooses the active destination (not
 318          * in PF state) with the largest cwnd value. If all destinations are
 319          * in PF state, unreachable, or unconfirmed, choose the desination
 320          * that is in PF state with the lowest error count. In case of a
 321          * tie, choose the destination that was most recently active.
 322          */
 323         if (mode == 2) {
 324                 TAILQ_FOREACH(mnet, &stcb->asoc.nets, sctp_next) {
 325                         /*
 326                          * JRS 5/14/07 - If the destination is unreachable
 327                          * or unconfirmed, skip it.
 328                          */
 329                         if (((mnet->dest_state & SCTP_ADDR_REACHABLE) != SCTP_ADDR_REACHABLE) ||
 330                             (mnet->dest_state & SCTP_ADDR_UNCONFIRMED)) {
 331                                 continue;
 332                         }
 333                         /*
 334                          * JRS 5/14/07 -  If the destination is reachable
 335                          * but in PF state, compare the error count of the
 336                          * destination to the minimum error count seen thus
 337                          * far. Store the destination with the lower error
 338                          * count.  If the error counts are equal, store the
 339                          * destination that was most recently active.
 340                          */
 341                         if (mnet->dest_state & SCTP_ADDR_PF) {
 342                                 /*
 343                                  * JRS 5/14/07 - If the destination under
 344                                  * consideration is the current destination,
 345                                  * work as if the error count is one higher.
 346                                  * The actual error count will not be
 347                                  * incremented until later in the t3
 348                                  * handler.
 349                                  */
 350                                 if (mnet == net) {
 351                                         if (min_errors == -1) {
 352                                                 min_errors = mnet->error_count + 1;
 353                                                 min_errors_net = mnet;
 354                                         } else if (mnet->error_count + 1 < min_errors) {
 355                                                 min_errors = mnet->error_count + 1;
 356                                                 min_errors_net = mnet;
 357                                         } else if (mnet->error_count + 1 == min_errors
 358                                             && mnet->last_active > min_errors_net->last_active) {
 359                                                 min_errors_net = mnet;
 360                                                 min_errors = mnet->error_count + 1;
 361                                         }
 362                                         continue;
 363                                 } else {
 364                                         if (min_errors == -1) {
 365                                                 min_errors = mnet->error_count;
 366                                                 min_errors_net = mnet;
 367                                         } else if (mnet->error_count < min_errors) {
 368                                                 min_errors = mnet->error_count;
 369                                                 min_errors_net = mnet;
 370                                         } else if (mnet->error_count == min_errors
 371                                             && mnet->last_active > min_errors_net->last_active) {
 372                                                 min_errors_net = mnet;
 373                                                 min_errors = mnet->error_count;
 374                                         }
 375                                         continue;
 376                                 }
 377                         }
 378                         /*
 379                          * JRS 5/14/07 - If the destination is reachable and
 380                          * not in PF state, compare the cwnd of the
 381                          * destination to the highest cwnd seen thus far.
 382                          * Store the destination with the higher cwnd value.
 383                          * If the cwnd values are equal, randomly choose one
 384                          * of the two destinations.
 385                          */
 386                         if (max_cwnd < mnet->cwnd) {
 387                                 max_cwnd_net = mnet;
 388                                 max_cwnd = mnet->cwnd;
 389                         } else if (max_cwnd == mnet->cwnd) {
 390                                 uint32_t rndval;
 391                                 uint8_t this_random;
 392
 393                                 if (stcb->asoc.hb_random_idx > 3) {
 394                                         rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
 395                                         memcpy(stcb->asoc.hb_random_values, &rndval, sizeof(stcb->asoc.hb_random_values));
 396                                         this_random = stcb->asoc.hb_random_values[0];
 397                                         stcb->asoc.hb_random_idx++;
 398                                         stcb->asoc.hb_ect_randombit = 0;
 399                                 } else {
 400                                         this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
 401                                         stcb->asoc.hb_random_idx++;
 402                                         stcb->asoc.hb_ect_randombit = 0;
 403                                 }
 404                                 if (this_random % 2 == 1) {
 405                                         max_cwnd_net = mnet;
 406                                         max_cwnd = mnet->cwnd;  /* Useless? */
 407                                 }
 408                         }
 409                 }
 410                 /*
 411                  * JRS 5/14/07 - After all destination have been considered
 412                  * as alternates, check to see if there was some active
 413                  * destination (not in PF state).  If not, check to see if
 414                  * there was some PF destination with the minimum number of
 415                  * errors.  If not, return the original destination.  If
 416                  * there is a min_errors_net, remove the PF flag from that
 417                  * destination, set the cwnd to one or two MTUs, and return
 418                  * the destination as an alt. If there was some active
 419                  * destination with a highest cwnd, return the destination
 420                  * as an alt.
 421                  */
 422                 if (max_cwnd_net == NULL) {
 423                         if (min_errors_net == NULL) {
 424                                 return (net);
 425                         }
 426                         min_errors_net->dest_state &= ~SCTP_ADDR_PF;
 427                         min_errors_net->cwnd = min_errors_net->mtu * stcb->asoc.sctp_cmt_pf;
 428                         if (SCTP_OS_TIMER_PENDING(&min_errors_net->rxt_timer.timer)) {
 429                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 430                                     stcb, min_errors_net,
 431                                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_2);
 432                         }
 433                         SCTPDBG(SCTP_DEBUG_TIMER4, "Destination %p moved from PF to active with %d errors.\n",
 434                             min_errors_net, min_errors_net->error_count);
 435                         return (min_errors_net);
 436                 } else {
 437                         return (max_cwnd_net);
 438                 }
 439         }
 440         /*
 441          * JRS 5/14/07 - If mode is set to 1, use the CMT policy for
 442          * choosing an alternate net.
 443          */
 444         else if (mode == 1) {
 445                 TAILQ_FOREACH(mnet, &stcb->asoc.nets, sctp_next) {
 446                         if (((mnet->dest_state & SCTP_ADDR_REACHABLE) != SCTP_ADDR_REACHABLE) ||
 447                             (mnet->dest_state & SCTP_ADDR_UNCONFIRMED)) {
 448                                 /*
 449                                  * will skip ones that are not-reachable or
 450                                  * unconfirmed
 451                                  */
 452                                 continue;
 453                         }
 454                         if (max_cwnd < mnet->cwnd) {
 455                                 max_cwnd_net = mnet;
 456                                 max_cwnd = mnet->cwnd;
 457                         } else if (max_cwnd == mnet->cwnd) {
 458                                 uint32_t rndval;
 459                                 uint8_t this_random;
 460
 461                                 if (stcb->asoc.hb_random_idx > 3) {
 462                                         rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
 463                                         memcpy(stcb->asoc.hb_random_values, &rndval,
 464                                             sizeof(stcb->asoc.hb_random_values));
 465                                         this_random = stcb->asoc.hb_random_values[0];
 466                                         stcb->asoc.hb_random_idx = 0;
 467                                         stcb->asoc.hb_ect_randombit = 0;
 468                                 } else {
 469                                         this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
 470                                         stcb->asoc.hb_random_idx++;
 471                                         stcb->asoc.hb_ect_randombit = 0;
 472                                 }
 473                                 if (this_random % 2) {
 474                                         max_cwnd_net = mnet;
 475                                         max_cwnd = mnet->cwnd;
 476                                 }
 477                         }
 478                 }
 479                 if (max_cwnd_net) {
 480                         return (max_cwnd_net);
 481                 }
 482         }
 483         mnet = net;
 484         once = 0;
 485
 486         if (mnet == NULL) {
 487                 mnet = TAILQ_FIRST(&stcb->asoc.nets);
 488                 if (mnet == NULL) {
 489                         return (NULL);
 490                 }
 491         }
 492         do {
 493                 alt = TAILQ_NEXT(mnet, sctp_next);
 494                 if (alt == NULL) {
 495                         once++;
 496                         if (once > 1) {
 497                                 break;
 498                         }
 499                         alt = TAILQ_FIRST(&stcb->asoc.nets);
 500                         if (alt == NULL) {
 501                                 return (NULL);
 502                         }
 503                 }
 504                 if (alt->ro.ro_rt == NULL) {
 505                         if (alt->ro._s_addr) {
 506                                 sctp_free_ifa(alt->ro._s_addr);
 507                                 alt->ro._s_addr = NULL;
 508                         }
 509                         alt->src_addr_selected = 0;
 510                 }
 511                 /* sa_ignore NO_NULL_CHK */
 512                 if (((alt->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE) &&
 513                     (alt->ro.ro_rt != NULL) &&
 514                     (!(alt->dest_state & SCTP_ADDR_UNCONFIRMED))) {
 515                         /* Found a reachable address */
 516                         break;
 517                 }
 518                 mnet = alt;
 519         } while (alt != NULL);
 520
 521         if (alt == NULL) {
 522                 /* Case where NO insv network exists (dormant state) */
 523                 /* we rotate destinations */
 524                 once = 0;
 525                 mnet = net;
 526                 do {
 527                         if (mnet == NULL) {
 528                                 return (TAILQ_FIRST(&stcb->asoc.nets));
 529                         }
 530                         alt = TAILQ_NEXT(mnet, sctp_next);
 531                         if (alt == NULL) {
 532                                 once++;
 533                                 if (once > 1) {
 534                                         break;
 535                                 }
 536                                 alt = TAILQ_FIRST(&stcb->asoc.nets);
 537                         }
 538                         /* sa_ignore NO_NULL_CHK */
 539                         if ((!(alt->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
 540                             (alt != net)) {
 541                                 /* Found an alternate address */
 542                                 break;
 543                         }
 544                         mnet = alt;
 545                 } while (alt != NULL);
 546         }
 547         if (alt == NULL) {
 548                 return (net);
 549         }
 550         return (alt);
 551 }
 552
 553 static void
 554 sctp_backoff_on_timeout(struct sctp_tcb *stcb,
 555     struct sctp_nets *net,
 556     int win_probe,
 557     int num_marked, int num_abandoned)
 558 {
 559         if (net->RTO == 0) {
 560                 net->RTO = stcb->asoc.minrto;
 561         }
 562         net->RTO <<= 1;
 563         if (net->RTO > stcb->asoc.maxrto) {
 564                 net->RTO = stcb->asoc.maxrto;
 565         }
 566         if ((win_probe == 0) && (num_marked || num_abandoned)) {
 567                 /* We don't apply penalty to window probe scenarios */
 568                 /* JRS - Use the congestion control given in the CC module */
 569                 stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout(stcb, net);
 570         }
 571 }
 572
 573 #ifndef INVARIANTS
 574 static void
 575 sctp_recover_sent_list(struct sctp_tcb *stcb)
 576 {
 577         struct sctp_tmit_chunk *chk, *tp2;
 578         struct sctp_association *asoc;
 579
 580         asoc = &stcb->asoc;
 581         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 582         for (; chk != NULL; chk = tp2) {
 583                 tp2 = TAILQ_NEXT(chk, sctp_next);
 584                 if ((compare_with_wrap(stcb->asoc.last_acked_seq,
 585                     chk->rec.data.TSN_seq,
 586                     MAX_TSN)) ||
 587                     (stcb->asoc.last_acked_seq == chk->rec.data.TSN_seq)) {
 588
 589                         SCTP_PRINTF("Found chk:%p tsn:%x <= last_acked_seq:%x\n",
 590                             chk, chk->rec.data.TSN_seq, stcb->asoc.last_acked_seq);
 591                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
 592                         if (chk->pr_sctp_on) {
 593                                 if (asoc->pr_sctp_cnt != 0)
 594                                         asoc->pr_sctp_cnt--;
 595                         }
 596                         if (chk->data) {
 597                                 /* sa_ignore NO_NULL_CHK */
 598                                 sctp_free_bufspace(stcb, asoc, chk, 1);
 599                                 sctp_m_freem(chk->data);
 600                                 if (asoc->peer_supports_prsctp && PR_SCTP_BUF_ENABLED(chk->flags)) {
 601                                         asoc->sent_queue_cnt_removeable--;
 602                                 }
 603                         }
 604                         chk->data = NULL;
 605                         asoc->sent_queue_cnt--;
 606                         sctp_free_a_chunk(stcb, chk);
 607                 }
 608         }
 609         SCTP_PRINTF("after recover order is as follows\n");
 610         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 611         for (; chk != NULL; chk = tp2) {
 612                 tp2 = TAILQ_NEXT(chk, sctp_next);
 613                 SCTP_PRINTF("chk:%p TSN:%x\n", chk, chk->rec.data.TSN_seq);
 614         }
 615 }
 616
 617 #endif
 618
 619 static int
 620 sctp_mark_all_for_resend(struct sctp_tcb *stcb,
 621     struct sctp_nets *net,
 622     struct sctp_nets *alt,
 623     int window_probe,
 624     int *num_marked,
 625     int *num_abandoned)
 626 {
 627
 628         /*
 629          * Mark all chunks (well not all) that were sent to *net for
 630          * retransmission. Move them to alt for there destination as well...
 631          * We only mark chunks that have been outstanding long enough to
 632          * have received feed-back.
 633          */
 634         struct sctp_tmit_chunk *chk, *tp2;
 635         struct sctp_nets *lnets;
 636         struct timeval now, min_wait, tv;
 637         int cur_rtt;
 638         int cnt_abandoned;
 639         int audit_tf, num_mk, fir;
 640         unsigned int cnt_mk;
 641         uint32_t orig_flight, orig_tf;
 642         uint32_t tsnlast, tsnfirst;
 643         int recovery_cnt = 0;
 644
 645
 646         /* none in flight now */
 647         audit_tf = 0;
 648         fir = 0;
 649         /*
 650          * figure out how long a data chunk must be pending before we can
 651          * mark it ..
 652          */
 653         (void)SCTP_GETTIME_TIMEVAL(&now);
 654         /* get cur rto in micro-seconds */
 655         cur_rtt = (((net->lastsa >> 2) + net->lastsv) >> 1);
 656         cur_rtt *= 1000;
 657         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 658                 sctp_log_fr(cur_rtt,
 659                     stcb->asoc.peers_rwnd,
 660                     window_probe,
 661                     SCTP_FR_T3_MARK_TIME);
 662                 sctp_log_fr(net->flight_size,
 663                     SCTP_OS_TIMER_PENDING(&net->fr_timer.timer),
 664                     SCTP_OS_TIMER_ACTIVE(&net->fr_timer.timer),
 665                     SCTP_FR_CWND_REPORT);
 666                 sctp_log_fr(net->flight_size, net->cwnd, stcb->asoc.total_flight, SCTP_FR_CWND_REPORT);
 667         }
 668         tv.tv_sec = cur_rtt / 1000000;
 669         tv.tv_usec = cur_rtt % 1000000;
 670         min_wait = now;
 671         timevalsub(&min_wait, &tv);
 672         if (min_wait.tv_sec < 0 || min_wait.tv_usec < 0) {
 673                 /*
 674                  * if we hit here, we don't have enough seconds on the clock
 675                  * to account for the RTO. We just let the lower seconds be
 676                  * the bounds and don't worry about it. This may mean we
 677                  * will mark a lot more than we should.
 678                  */
 679                 min_wait.tv_sec = min_wait.tv_usec = 0;
 680         }
 681         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 682                 sctp_log_fr(cur_rtt, now.tv_sec, now.tv_usec, SCTP_FR_T3_MARK_TIME);
 683                 sctp_log_fr(0, min_wait.tv_sec, min_wait.tv_usec, SCTP_FR_T3_MARK_TIME);
 684         }
 685         /*
 686          * Our rwnd will be incorrect here since we are not adding back the
 687          * cnt * mbuf but we will fix that down below.
 688          */
 689         orig_flight = net->flight_size;
 690         orig_tf = stcb->asoc.total_flight;
 691
 692         net->fast_retran_ip = 0;
 693         /* Now on to each chunk */
 694         cnt_abandoned = 0;
 695         num_mk = cnt_mk = 0;
 696         tsnfirst = tsnlast = 0;
 697 #ifndef INVARIANTS
 698 start_again:
 699 #endif
 700         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 701         for (; chk != NULL; chk = tp2) {
 702                 tp2 = TAILQ_NEXT(chk, sctp_next);
 703                 if ((compare_with_wrap(stcb->asoc.last_acked_seq,
 704                     chk->rec.data.TSN_seq,
 705                     MAX_TSN)) ||
 706                     (stcb->asoc.last_acked_seq == chk->rec.data.TSN_seq)) {
 707                         /* Strange case our list got out of order? */
 708                         SCTP_PRINTF("Our list is out of order? last_acked:%x chk:%x",
 709                             (unsigned int)stcb->asoc.last_acked_seq, (unsigned int)chk->rec.data.TSN_seq);
 710                         recovery_cnt++;
 711 #ifdef INVARIANTS
 712                         panic("last acked >= chk on sent-Q");
 713 #else
 714                         SCTP_PRINTF("Recover attempts a restart cnt:%d\n", recovery_cnt);
 715                         sctp_recover_sent_list(stcb);
 716                         if (recovery_cnt < 10) {
 717                                 goto start_again;
 718                         } else {
 719                                 SCTP_PRINTF("Recovery fails %d times??\n", recovery_cnt);
 720                         }
 721 #endif
 722                 }
 723                 if ((chk->whoTo == net) && (chk->sent < SCTP_DATAGRAM_ACKED)) {
 724                         /*
 725                          * found one to mark: If it is less than
 726                          * DATAGRAM_ACKED it MUST not be a skipped or marked
 727                          * TSN but instead one that is either already set
 728                          * for retransmission OR one that needs
 729                          * retransmission.
 730                          */
 731
 732                         /* validate its been outstanding long enough */
 733                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 734                                 sctp_log_fr(chk->rec.data.TSN_seq,
 735                                     chk->sent_rcv_time.tv_sec,
 736                                     chk->sent_rcv_time.tv_usec,
 737                                     SCTP_FR_T3_MARK_TIME);
 738                         }
 739                         if ((chk->sent_rcv_time.tv_sec > min_wait.tv_sec) && (window_probe == 0)) {
 740                                 /*
 741                                  * we have reached a chunk that was sent
 742                                  * some seconds past our min.. forget it we
 743                                  * will find no more to send.
 744                                  */
 745                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 746                                         sctp_log_fr(0,
 747                                             chk->sent_rcv_time.tv_sec,
 748                                             chk->sent_rcv_time.tv_usec,
 749                                             SCTP_FR_T3_STOPPED);
 750                                 }
 751                                 continue;
 752                         } else if ((chk->sent_rcv_time.tv_sec == min_wait.tv_sec) &&
 753                             (window_probe == 0)) {
 754                                 /*
 755                                  * we must look at the micro seconds to
 756                                  * know.
 757                                  */
 758                                 if (chk->sent_rcv_time.tv_usec >= min_wait.tv_usec) {
 759                                         /*
 760                                          * ok it was sent after our boundary
 761                                          * time.
 762                                          */
 763                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 764                                                 sctp_log_fr(0,
 765                                                     chk->sent_rcv_time.tv_sec,
 766                                                     chk->sent_rcv_time.tv_usec,
 767                                                     SCTP_FR_T3_STOPPED);
 768                                         }
 769                                         continue;
 770                                 }
 771                         }
 772                         if (stcb->asoc.peer_supports_prsctp && PR_SCTP_TTL_ENABLED(chk->flags)) {
 773                                 /* Is it expired? */
 774                                 if (timevalcmp(&now, &chk->rec.data.timetodrop, >)) {
 775                                         /* Yes so drop it */
 776                                         if (chk->data) {
 777                                                 (void)sctp_release_pr_sctp_chunk(stcb,
 778                                                     chk,
 779                                                     (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
 780                                                     SCTP_SO_NOT_LOCKED);
 781                                                 cnt_abandoned++;
 782                                         }
 783                                         continue;
 784                                 }
 785                         }
 786                         if (stcb->asoc.peer_supports_prsctp && PR_SCTP_RTX_ENABLED(chk->flags)) {
 787                                 /* Has it been retransmitted tv_sec times? */
 788                                 if (chk->snd_count > chk->rec.data.timetodrop.tv_sec) {
 789                                         if (chk->data) {
 790                                                 (void)sctp_release_pr_sctp_chunk(stcb,
 791                                                     chk,
 792                                                     (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
 793                                                     SCTP_SO_NOT_LOCKED);
 794                                                 cnt_abandoned++;
 795                                         }
 796                                         continue;
 797                                 }
 798                         }
 799                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
 800                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 801                                 num_mk++;
 802                                 if (fir == 0) {
 803                                         fir = 1;
 804                                         tsnfirst = chk->rec.data.TSN_seq;
 805                                 }
 806                                 tsnlast = chk->rec.data.TSN_seq;
 807                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 808                                         sctp_log_fr(chk->rec.data.TSN_seq, chk->snd_count,
 809                                             0, SCTP_FR_T3_MARKED);
 810                                 }
 811                                 if (chk->rec.data.chunk_was_revoked) {
 812                                         /* deflate the cwnd */
 813                                         chk->whoTo->cwnd -= chk->book_size;
 814                                         chk->rec.data.chunk_was_revoked = 0;
 815                                 }
 816                                 net->marked_retrans++;
 817                                 stcb->asoc.marked_retrans++;
 818                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
 819                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND_TO,
 820                                             chk->whoTo->flight_size,
 821                                             chk->book_size,
 822                                             (uintptr_t) chk->whoTo,
 823                                             chk->rec.data.TSN_seq);
 824                                 }
 825                                 sctp_flight_size_decrease(chk);
 826                                 sctp_total_flight_decrease(stcb, chk);
 827                                 stcb->asoc.peers_rwnd += chk->send_size;
 828                                 stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
 829                         }
 830                         chk->sent = SCTP_DATAGRAM_RESEND;
 831                         SCTP_STAT_INCR(sctps_markedretrans);
 832
 833                         /* reset the TSN for striking and other FR stuff */
 834                         chk->rec.data.doing_fast_retransmit = 0;
 835                         /* Clear any time so NO RTT is being done */
 836                         chk->do_rtt = 0;
 837                         if (alt != net) {
 838                                 sctp_free_remote_addr(chk->whoTo);
 839                                 chk->no_fr_allowed = 1;
 840                                 chk->whoTo = alt;
 841                                 atomic_add_int(&alt->ref_count, 1);
 842                         } else {
 843                                 chk->no_fr_allowed = 0;
 844                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
 845                                         chk->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
 846                                 } else {
 847                                         chk->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
 848                                 }
 849                         }
 850                         /*
 851                          * CMT: Do not allow FRs on retransmitted TSNs.
 852                          */
 853                         if (stcb->asoc.sctp_cmt_on_off == 1) {
 854                                 chk->no_fr_allowed = 1;
 855                         }
 856 #ifdef THIS_SHOULD_NOT_BE_DONE
 857                 } else if (chk->sent == SCTP_DATAGRAM_ACKED) {
 858                         /* remember highest acked one */
 859                         could_be_sent = chk;
 860 #endif
 861                 }
 862                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 863                         cnt_mk++;
 864                 }
 865         }
 866         if ((orig_flight - net->flight_size) != (orig_tf - stcb->asoc.total_flight)) {
 867                 /* we did not subtract the same things? */
 868                 audit_tf = 1;
 869         }
 870         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
 871                 sctp_log_fr(tsnfirst, tsnlast, num_mk, SCTP_FR_T3_TIMEOUT);
 872         }
 873 #ifdef SCTP_DEBUG
 874         if (num_mk) {
 875                 SCTPDBG(SCTP_DEBUG_TIMER1, "LAST TSN marked was %x\n",
 876                     tsnlast);
 877                 SCTPDBG(SCTP_DEBUG_TIMER1, "Num marked for retransmission was %d peer-rwd:%ld\n",
 878                     num_mk, (u_long)stcb->asoc.peers_rwnd);
 879                 SCTPDBG(SCTP_DEBUG_TIMER1, "LAST TSN marked was %x\n",
 880                     tsnlast);
 881                 SCTPDBG(SCTP_DEBUG_TIMER1, "Num marked for retransmission was %d peer-rwd:%d\n",
 882                     num_mk,
 883                     (int)stcb->asoc.peers_rwnd);
 884         }
 885 #endif
 886         *num_marked = num_mk;
 887         *num_abandoned = cnt_abandoned;
 888         /*
 889          * Now check for a ECN Echo that may be stranded And include the
 890          * cnt_mk'd to have all resends in the control queue.
 891          */
 892         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
 893                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 894                         cnt_mk++;
 895                 }
 896                 if ((chk->whoTo == net) &&
 897                     (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
 898                         sctp_free_remote_addr(chk->whoTo);
 899                         chk->whoTo = alt;
 900                         if (chk->sent != SCTP_DATAGRAM_RESEND) {
 901                                 chk->sent = SCTP_DATAGRAM_RESEND;
 902                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 903                                 cnt_mk++;
 904                         }
 905                         atomic_add_int(&alt->ref_count, 1);
 906                 }
 907         }
 908 #ifdef THIS_SHOULD_NOT_BE_DONE
 909         if ((stcb->asoc.sent_queue_retran_cnt == 0) && (could_be_sent)) {
 910                 /* fix it so we retransmit the highest acked anyway */
 911                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 912                 cnt_mk++;
 913                 could_be_sent->sent = SCTP_DATAGRAM_RESEND;
 914         }
 915 #endif
 916         if (stcb->asoc.sent_queue_retran_cnt != cnt_mk) {
 917 #ifdef INVARIANTS
 918                 SCTP_PRINTF("Local Audit says there are %d for retran asoc cnt:%d we marked:%d this time\n",
 919                     cnt_mk, stcb->asoc.sent_queue_retran_cnt, num_mk);
 920 #endif
 921 #ifndef SCTP_AUDITING_ENABLED
 922                 stcb->asoc.sent_queue_retran_cnt = cnt_mk;
 923 #endif
 924         }
 925         if (audit_tf) {
 926                 SCTPDBG(SCTP_DEBUG_TIMER4,
 927                     "Audit total flight due to negative value net:%p\n",
 928                     net);
 929                 stcb->asoc.total_flight = 0;
 930                 stcb->asoc.total_flight_count = 0;
 931                 /* Clear all networks flight size */
 932                 TAILQ_FOREACH(lnets, &stcb->asoc.nets, sctp_next) {
 933                         lnets->flight_size = 0;
 934                         SCTPDBG(SCTP_DEBUG_TIMER4,
 935                             "Net:%p c-f cwnd:%d ssthresh:%d\n",
 936                             lnets, lnets->cwnd, lnets->ssthresh);
 937                 }
 938                 TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 939                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
 940                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
 941                                         sctp_misc_ints(SCTP_FLIGHT_LOG_UP,
 942                                             chk->whoTo->flight_size,
 943                                             chk->book_size,
 944                                             (uintptr_t) chk->whoTo,
 945                                             chk->rec.data.TSN_seq);
 946                                 }
 947                                 sctp_flight_size_increase(chk);
 948                                 sctp_total_flight_increase(stcb, chk);
 949                         }
 950                 }
 951         }
 952         /*
 953          * Setup the ecn nonce re-sync point. We do this since
 954          * retranmissions are NOT setup for ECN. This means that do to
 955          * Karn's rule, we don't know the total of the peers ecn bits.
 956          */
 957         chk = TAILQ_FIRST(&stcb->asoc.send_queue);
 958         if (chk == NULL) {
 959                 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq;
 960         } else {
 961                 stcb->asoc.nonce_resync_tsn = chk->rec.data.TSN_seq;
 962         }
 963         stcb->asoc.nonce_wait_for_ecne = 0;
 964         stcb->asoc.nonce_sum_check = 0;
 965         /* We return 1 if we only have a window probe outstanding */
 966         return (0);
 967 }
 968
 969
 970 int
 971 sctp_t3rxt_timer(struct sctp_inpcb *inp,
 972     struct sctp_tcb *stcb,
 973     struct sctp_nets *net)
 974 {
 975         struct sctp_nets *alt;
 976         int win_probe, num_mk, num_abandoned;
 977
 978         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
 979                 sctp_log_fr(0, 0, 0, SCTP_FR_T3_TIMEOUT);
 980         }
 981         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
 982                 struct sctp_nets *lnet;
 983
 984                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 985                         if (net == lnet) {
 986                                 sctp_log_cwnd(stcb, lnet, 1, SCTP_CWND_LOG_FROM_T3);
 987                         } else {
 988                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_LOG_FROM_T3);
 989                         }
 990                 }
 991         }
 992         /* Find an alternate and mark those for retransmission */
 993         if ((stcb->asoc.peers_rwnd == 0) &&
 994             (stcb->asoc.total_flight < net->mtu)) {
 995                 SCTP_STAT_INCR(sctps_timowindowprobe);
 996                 win_probe = 1;
 997         } else {
 998                 win_probe = 0;
 999         }
1000
1001         /*
1002          * JRS 5/14/07 - If CMT PF is on and the destination if not already
1003          * in PF state, set the destination to PF state and store the
1004          * current time as the time that the destination was last active. In
1005          * addition, find an alternate destination with PF-based
1006          * find_alt_net().
1007          */
1008         if ((stcb->asoc.sctp_cmt_on_off == 1) &&
1009             (stcb->asoc.sctp_cmt_pf > 0)) {
1010                 if ((net->dest_state & SCTP_ADDR_PF) != SCTP_ADDR_PF) {
1011                         net->dest_state |= SCTP_ADDR_PF;
1012                         net->last_active = sctp_get_tick_count();
1013                         SCTPDBG(SCTP_DEBUG_TIMER4, "Destination %p moved from active to PF.\n",
1014                             net);
1015                 }
1016                 alt = sctp_find_alternate_net(stcb, net, 2);
1017         } else if (stcb->asoc.sctp_cmt_on_off == 1) {
1018                 /*
1019                  * CMT: Using RTX_SSTHRESH policy for CMT. If CMT is being
1020                  * used, then pick dest with largest ssthresh for any
1021                  * retransmission.
1022                  */
1023                 alt = sctp_find_alternate_net(stcb, net, 1);
1024                 /*
1025                  * CUCv2: If a different dest is picked for the
1026                  * retransmission, then new (rtx-)pseudo_cumack needs to be
1027                  * tracked for orig dest. Let CUCv2 track new (rtx-)
1028                  * pseudo-cumack always.
1029                  */
1030                 net->find_pseudo_cumack = 1;
1031                 net->find_rtx_pseudo_cumack = 1;
1032         } else {                /* CMT is OFF */
1033                 alt = sctp_find_alternate_net(stcb, net, 0);
1034         }
1035         num_mk = 0;
1036         num_abandoned = 0;
1037         (void)sctp_mark_all_for_resend(stcb, net, alt, win_probe,
1038             &num_mk, &num_abandoned);
1039         /* FR Loss recovery just ended with the T3. */
1040         stcb->asoc.fast_retran_loss_recovery = 0;
1041
1042         /* CMT FR loss recovery ended with the T3 */
1043         net->fast_retran_loss_recovery = 0;
1044
1045         /*
1046          * setup the sat loss recovery that prevents satellite cwnd advance.
1047          */
1048         stcb->asoc.sat_t3_loss_recovery = 1;
1049         stcb->asoc.sat_t3_recovery_tsn = stcb->asoc.sending_seq;
1050
1051         /* Backoff the timer and cwnd */
1052         sctp_backoff_on_timeout(stcb, net, win_probe, num_mk, num_abandoned);
1053         if (win_probe == 0) {
1054                 /* We don't do normal threshold management on window probes */
1055                 if (sctp_threshold_management(inp, stcb, net,
1056                     stcb->asoc.max_send_times)) {
1057                         /* Association was destroyed */
1058                         return (1);
1059                 } else {
1060                         if (net != stcb->asoc.primary_destination) {
1061                                 /* send a immediate HB if our RTO is stale */
1062                                 struct timeval now;
1063                                 unsigned int ms_goneby;
1064
1065                                 (void)SCTP_GETTIME_TIMEVAL(&now);
1066                                 if (net->last_sent_time.tv_sec) {
1067                                         ms_goneby = (now.tv_sec - net->last_sent_time.tv_sec) * 1000;
1068                                 } else {
1069                                         ms_goneby = 0;
1070                                 }
1071                                 if ((ms_goneby > net->RTO) || (net->RTO == 0)) {
1072                                         /*
1073                                          * no recent feed back in an RTO or
1074                                          * more, request a RTT update
1075                                          */
1076                                         if (sctp_send_hb(stcb, 1, net) < 0)
1077                                                 /*
1078                                                  * Less than 0 means we lost
1079                                                  * the assoc
1080                                                  */
1081                                                 return (1);
1082                                 }
1083                         }
1084                 }
1085         } else {
1086                 /*
1087                  * For a window probe we don't penalize the net's but only
1088                  * the association. This may fail it if SACKs are not coming
1089                  * back. If sack's are coming with rwnd locked at 0, we will
1090                  * continue to hold things waiting for rwnd to raise
1091                  */
1092                 if (sctp_threshold_management(inp, stcb, NULL,
1093                     stcb->asoc.max_send_times)) {
1094                         /* Association was destroyed */
1095                         return (1);
1096                 }
1097         }
1098         if (net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
1099                 /* Move all pending over too */
1100                 sctp_move_chunks_from_net(stcb, net);
1101
1102                 /*
1103                  * Get the address that failed, to force a new src address
1104                  * selecton and a route allocation.
1105                  */
1106                 if (net->ro._s_addr) {
1107                         sctp_free_ifa(net->ro._s_addr);
1108                         net->ro._s_addr = NULL;
1109                 }
1110                 net->src_addr_selected = 0;
1111
1112                 /* Force a route allocation too */
1113                 if (net->ro.ro_rt) {
1114                         RTFREE(net->ro.ro_rt);
1115                         net->ro.ro_rt = NULL;
1116                 }
1117                 /* Was it our primary? */
1118                 if ((stcb->asoc.primary_destination == net) && (alt != net)) {
1119                         /*
1120                          * Yes, note it as such and find an alternate note:
1121                          * this means HB code must use this to resent the
1122                          * primary if it goes active AND if someone does a
1123                          * change-primary then this flag must be cleared
1124                          * from any net structures.
1125                          */
1126                         if (sctp_set_primary_addr(stcb,
1127                             (struct sockaddr *)NULL,
1128                             alt) == 0) {
1129                                 net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
1130                         }
1131                 }
1132         } else if ((stcb->asoc.sctp_cmt_on_off == 1) &&
1133                     (stcb->asoc.sctp_cmt_pf > 0) &&
1134             ((net->dest_state & SCTP_ADDR_PF) == SCTP_ADDR_PF)) {
1135                 /*
1136                  * JRS 5/14/07 - If the destination hasn't failed completely
1137                  * but is in PF state, a PF-heartbeat needs to be sent
1138                  * manually.
1139                  */
1140                 if (sctp_send_hb(stcb, 1, net) < 0)
1141                         /* Return less than 0 means we lost the association */
1142                         return (1);
1143         }
1144         /*
1145          * Special case for cookie-echo'ed case, we don't do output but must
1146          * await the COOKIE-ACK before retransmission
1147          */
1148         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
1149                 /*
1150                  * Here we just reset the timer and start again since we
1151                  * have not established the asoc
1152                  */
1153                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
1154                 return (0);
1155         }
1156         if (stcb->asoc.peer_supports_prsctp) {
1157                 struct sctp_tmit_chunk *lchk;
1158
1159                 lchk = sctp_try_advance_peer_ack_point(stcb, &stcb->asoc);
1160                 /* C3. See if we need to send a Fwd-TSN */
1161                 if (compare_with_wrap(stcb->asoc.advanced_peer_ack_point,
1162                     stcb->asoc.last_acked_seq, MAX_TSN)) {
1163                         /*
1164                          * ISSUE with ECN, see FWD-TSN processing for notes
1165                          * on issues that will occur when the ECN NONCE
1166                          * stuff is put into SCTP for cross checking.
1167                          */
1168                         send_forward_tsn(stcb, &stcb->asoc);
1169                         if (lchk) {
1170                                 /* Assure a timer is up */
1171                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, lchk->whoTo);
1172                         }
1173                 }
1174         }
1175         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_MONITOR_ENABLE) {
1176                 sctp_log_cwnd(stcb, net, net->cwnd, SCTP_CWND_LOG_FROM_RTX);
1177         }
1178         return (0);
1179 }
1180
1181 int
1182 sctp_t1init_timer(struct sctp_inpcb *inp,
1183     struct sctp_tcb *stcb,
1184     struct sctp_nets *net)
1185 {
1186         /* bump the thresholds */
1187         if (stcb->asoc.delayed_connection) {
1188                 /*
1189                  * special hook for delayed connection. The library did NOT
1190                  * complete the rest of its sends.
1191                  */
1192                 stcb->asoc.delayed_connection = 0;
1193                 sctp_send_initiate(inp, stcb, SCTP_SO_NOT_LOCKED);
1194                 return (0);
1195         }
1196         if (SCTP_GET_STATE((&stcb->asoc)) != SCTP_STATE_COOKIE_WAIT) {
1197                 return (0);
1198         }
1199         if (sctp_threshold_management(inp, stcb, net,
1200             stcb->asoc.max_init_times)) {
1201                 /* Association was destroyed */
1202                 return (1);
1203         }
1204         stcb->asoc.dropped_special_cnt = 0;
1205         sctp_backoff_on_timeout(stcb, stcb->asoc.primary_destination, 1, 0, 0);
1206         if (stcb->asoc.initial_init_rto_max < net->RTO) {
1207                 net->RTO = stcb->asoc.initial_init_rto_max;
1208         }
1209         if (stcb->asoc.numnets > 1) {
1210                 /* If we have more than one addr use it */
1211                 struct sctp_nets *alt;
1212
1213                 alt = sctp_find_alternate_net(stcb, stcb->asoc.primary_destination, 0);
1214                 if (alt != stcb->asoc.primary_destination) {
1215                         sctp_move_chunks_from_net(stcb, stcb->asoc.primary_destination);
1216                         stcb->asoc.primary_destination = alt;
1217                 }
1218         }
1219         /* Send out a new init */
1220         sctp_send_initiate(inp, stcb, SCTP_SO_NOT_LOCKED);
1221         return (0);
1222 }
1223
1224 /*
1225  * For cookie and asconf we actually need to find and mark for resend, then
1226  * increment the resend counter (after all the threshold management stuff of
1227  * course).
1228  */
1229 int
1230 sctp_cookie_timer(struct sctp_inpcb *inp,
1231     struct sctp_tcb *stcb,
1232     struct sctp_nets *net)
1233 {
1234         struct sctp_nets *alt;
1235         struct sctp_tmit_chunk *cookie;
1236
1237         /* first before all else we must find the cookie */
1238         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, sctp_next) {
1239                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
1240                         break;
1241                 }
1242         }
1243         if (cookie == NULL) {
1244                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
1245                         /* FOOBAR! */
1246                         struct mbuf *oper;
1247
1248                         oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
1249                             0, M_DONTWAIT, 1, MT_DATA);
1250                         if (oper) {
1251                                 struct sctp_paramhdr *ph;
1252                                 uint32_t *ippp;
1253
1254                                 SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
1255                                     sizeof(uint32_t);
1256                                 ph = mtod(oper, struct sctp_paramhdr *);
1257                                 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1258                                 ph->param_length = htons(SCTP_BUF_LEN(oper));
1259                                 ippp = (uint32_t *) (ph + 1);
1260                                 *ippp = htonl(SCTP_FROM_SCTP_TIMER + SCTP_LOC_3);
1261                         }
1262                         inp->last_abort_code = SCTP_FROM_SCTP_TIMER + SCTP_LOC_4;
1263                         sctp_abort_an_association(inp, stcb, SCTP_INTERNAL_ERROR,
1264                             oper, SCTP_SO_NOT_LOCKED);
1265                 } else {
1266 #ifdef INVARIANTS
1267                         panic("Cookie timer expires in wrong state?");
1268 #else
1269                         SCTP_PRINTF("Strange in state %d not cookie-echoed yet c-e timer expires?\n", SCTP_GET_STATE(&stcb->asoc));
1270                         return (0);
1271 #endif
1272                 }
1273                 return (0);
1274         }
1275         /* Ok we found the cookie, threshold management next */
1276         if (sctp_threshold_management(inp, stcb, cookie->whoTo,
1277             stcb->asoc.max_init_times)) {
1278                 /* Assoc is over */
1279                 return (1);
1280         }
1281         /*
1282          * cleared theshold management now lets backoff the address & select
1283          * an alternate
1284          */
1285         stcb->asoc.dropped_special_cnt = 0;
1286         sctp_backoff_on_timeout(stcb, cookie->whoTo, 1, 0, 0);
1287         alt = sctp_find_alternate_net(stcb, cookie->whoTo, 0);
1288         if (alt != cookie->whoTo) {
1289                 sctp_free_remote_addr(cookie->whoTo);
1290                 cookie->whoTo = alt;
1291                 atomic_add_int(&alt->ref_count, 1);
1292         }
1293         /* Now mark the retran info */
1294         if (cookie->sent != SCTP_DATAGRAM_RESEND) {
1295                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1296         }
1297         cookie->sent = SCTP_DATAGRAM_RESEND;
1298         /*
1299          * Now call the output routine to kick out the cookie again, Note we
1300          * don't mark any chunks for retran so that FR will need to kick in
1301          * to move these (or a send timer).
1302          */
1303         return (0);
1304 }
1305
1306 int
1307 sctp_strreset_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1308     struct sctp_nets *net)
1309 {
1310         struct sctp_nets *alt;
1311         struct sctp_tmit_chunk *strrst = NULL, *chk = NULL;
1312
1313         if (stcb->asoc.stream_reset_outstanding == 0) {
1314                 return (0);
1315         }
1316         /* find the existing STRRESET, we use the seq number we sent out on */
1317         (void)sctp_find_stream_reset(stcb, stcb->asoc.str_reset_seq_out, &strrst);
1318         if (strrst == NULL) {
1319                 return (0);
1320         }
1321         /* do threshold management */
1322         if (sctp_threshold_management(inp, stcb, strrst->whoTo,
1323             stcb->asoc.max_send_times)) {
1324                 /* Assoc is over */
1325                 return (1);
1326         }
1327         /*
1328          * cleared theshold management now lets backoff the address & select
1329          * an alternate
1330          */
1331         sctp_backoff_on_timeout(stcb, strrst->whoTo, 1, 0, 0);
1332         alt = sctp_find_alternate_net(stcb, strrst->whoTo, 0);
1333         sctp_free_remote_addr(strrst->whoTo);
1334         strrst->whoTo = alt;
1335         atomic_add_int(&alt->ref_count, 1);
1336
1337         /* See if a ECN Echo is also stranded */
1338         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
1339                 if ((chk->whoTo == net) &&
1340                     (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
1341                         sctp_free_remote_addr(chk->whoTo);
1342                         if (chk->sent != SCTP_DATAGRAM_RESEND) {
1343                                 chk->sent = SCTP_DATAGRAM_RESEND;
1344                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1345                         }
1346                         chk->whoTo = alt;
1347                         atomic_add_int(&alt->ref_count, 1);
1348                 }
1349         }
1350         if (net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
1351                 /*
1352                  * If the address went un-reachable, we need to move to
1353                  * alternates for ALL chk's in queue
1354                  */
1355                 sctp_move_chunks_from_net(stcb, net);
1356         }
1357         /* mark the retran info */
1358         if (strrst->sent != SCTP_DATAGRAM_RESEND)
1359                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1360         strrst->sent = SCTP_DATAGRAM_RESEND;
1361
1362         /* restart the timer */
1363         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, inp, stcb, strrst->whoTo);
1364         return (0);
1365 }
1366
1367 int
1368 sctp_asconf_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1369     struct sctp_nets *net)
1370 {
1371         struct sctp_nets *alt;
1372         struct sctp_tmit_chunk *asconf, *chk, *nchk;
1373
1374         /* is this a first send, or a retransmission? */
1375         if (TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) {
1376                 /* compose a new ASCONF chunk and send it */
1377                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1378         } else {
1379                 /*
1380                  * Retransmission of the existing ASCONF is needed
1381                  */
1382
1383                 /* find the existing ASCONF */
1384                 asconf = TAILQ_FIRST(&stcb->asoc.asconf_send_queue);
1385                 if (asconf == NULL) {
1386                         return (0);
1387                 }
1388                 /* do threshold management */
1389                 if (sctp_threshold_management(inp, stcb, asconf->whoTo,
1390                     stcb->asoc.max_send_times)) {
1391                         /* Assoc is over */
1392                         return (1);
1393                 }
1394                 if (asconf->snd_count > stcb->asoc.max_send_times) {
1395                         /*
1396                          * Something is rotten: our peer is not responding
1397                          * to ASCONFs but apparently is to other chunks.
1398                          * i.e. it is not properly handling the chunk type
1399                          * upper bits. Mark this peer as ASCONF incapable
1400                          * and cleanup.
1401                          */
1402                         SCTPDBG(SCTP_DEBUG_TIMER1, "asconf_timer: Peer has not responded to our repeated ASCONFs\n");
1403                         sctp_asconf_cleanup(stcb, net);
1404                         return (0);
1405                 }
1406                 /*
1407                  * cleared threshold management, so now backoff the net and
1408                  * select an alternate
1409                  */
1410                 sctp_backoff_on_timeout(stcb, asconf->whoTo, 1, 0, 0);
1411                 alt = sctp_find_alternate_net(stcb, asconf->whoTo, 0);
1412                 if (asconf->whoTo != alt) {
1413                         sctp_free_remote_addr(asconf->whoTo);
1414                         asconf->whoTo = alt;
1415                         atomic_add_int(&alt->ref_count, 1);
1416                 }
1417                 /* See if an ECN Echo is also stranded */
1418                 TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
1419                         if ((chk->whoTo == net) &&
1420                             (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
1421                                 sctp_free_remote_addr(chk->whoTo);
1422                                 chk->whoTo = alt;
1423                                 if (chk->sent != SCTP_DATAGRAM_RESEND) {
1424                                         chk->sent = SCTP_DATAGRAM_RESEND;
1425                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1426                                 }
1427                                 atomic_add_int(&alt->ref_count, 1);
1428                         }
1429                 }
1430                 for (chk = asconf; chk; chk = nchk) {
1431                         nchk = TAILQ_NEXT(chk, sctp_next);
1432                         if (chk->whoTo != alt) {
1433                                 sctp_free_remote_addr(chk->whoTo);
1434                                 chk->whoTo = alt;
1435                                 atomic_add_int(&alt->ref_count, 1);
1436                         }
1437                         if (asconf->sent != SCTP_DATAGRAM_RESEND && chk->sent != SCTP_DATAGRAM_UNSENT)
1438                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1439                         chk->sent = SCTP_DATAGRAM_RESEND;
1440                 }
1441                 if (net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
1442                         /*
1443                          * If the address went un-reachable, we need to move
1444                          * to the alternate for ALL chunks in queue
1445                          */
1446                         sctp_move_chunks_from_net(stcb, net);
1447                 }
1448                 /* mark the retran info */
1449                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
1450                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1451                 asconf->sent = SCTP_DATAGRAM_RESEND;
1452
1453                 /* send another ASCONF if any and we can do */
1454                 sctp_send_asconf(stcb, alt, SCTP_ADDR_NOT_LOCKED);
1455         }
1456         return (0);
1457 }
1458
1459 /* Mobility adaptation */
1460 void
1461 sctp_delete_prim_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1462     struct sctp_nets *net)
1463 {
1464         if (stcb->asoc.deleted_primary == NULL) {
1465                 SCTPDBG(SCTP_DEBUG_ASCONF1, "delete_prim_timer: deleted_primary is not stored...\n");
1466                 sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
1467                 return;
1468         }
1469         SCTPDBG(SCTP_DEBUG_ASCONF1, "delete_prim_timer: finished to keep deleted primary ");
1470         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1471         sctp_free_remote_addr(stcb->asoc.deleted_primary);
1472         stcb->asoc.deleted_primary = NULL;
1473         sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
1474         return;
1475 }
1476
1477 /*
1478  * For the shutdown and shutdown-ack, we do not keep one around on the
1479  * control queue. This means we must generate a new one and call the general
1480  * chunk output routine, AFTER having done threshold management.
1481  * It is assumed that net is non-NULL.
1482  */
1483 int
1484 sctp_shutdown_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1485     struct sctp_nets *net)
1486 {
1487         struct sctp_nets *alt;
1488
1489         /* first threshold managment */
1490         if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1491                 /* Assoc is over */
1492                 return (1);
1493         }
1494         sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1495         /* second select an alternative */
1496         alt = sctp_find_alternate_net(stcb, net, 0);
1497
1498         /* third generate a shutdown into the queue for out net */
1499         sctp_send_shutdown(stcb, alt);
1500
1501         /* fourth restart timer */
1502         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, alt);
1503         return (0);
1504 }
1505
1506 int
1507 sctp_shutdownack_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1508     struct sctp_nets *net)
1509 {
1510         struct sctp_nets *alt;
1511
1512         /* first threshold managment */
1513         if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1514                 /* Assoc is over */
1515                 return (1);
1516         }
1517         sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1518         /* second select an alternative */
1519         alt = sctp_find_alternate_net(stcb, net, 0);
1520
1521         /* third generate a shutdown into the queue for out net */
1522         sctp_send_shutdown_ack(stcb, alt);
1523
1524         /* fourth restart timer */
1525         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, alt);
1526         return (0);
1527 }
1528
1529 static void
1530 sctp_audit_stream_queues_for_size(struct sctp_inpcb *inp,
1531     struct sctp_tcb *stcb)
1532 {
1533         struct sctp_stream_out *outs;
1534         struct sctp_stream_queue_pending *sp;
1535         unsigned int chks_in_queue = 0;
1536         int being_filled = 0;
1537
1538         /*
1539          * This function is ONLY called when the send/sent queues are empty.
1540          */
1541         if ((stcb == NULL) || (inp == NULL))
1542                 return;
1543
1544         if (stcb->asoc.sent_queue_retran_cnt) {
1545                 SCTP_PRINTF("Hmm, sent_queue_retran_cnt is non-zero %d\n",
1546                     stcb->asoc.sent_queue_retran_cnt);
1547                 stcb->asoc.sent_queue_retran_cnt = 0;
1548         }
1549         SCTP_TCB_SEND_LOCK(stcb);
1550         if (TAILQ_EMPTY(&stcb->asoc.out_wheel)) {
1551                 int i, cnt = 0;
1552
1553                 /* Check to see if a spoke fell off the wheel */
1554                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1555                         if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
1556                                 sctp_insert_on_wheel(stcb, &stcb->asoc, &stcb->asoc.strmout[i], 1);
1557                                 cnt++;
1558                         }
1559                 }
1560                 if (cnt) {
1561                         /* yep, we lost a spoke or two */
1562                         SCTP_PRINTF("Found an additional %d streams NOT on outwheel, corrected\n", cnt);
1563                 } else {
1564                         /* no spokes lost, */
1565                         stcb->asoc.total_output_queue_size = 0;
1566                 }
1567                 SCTP_TCB_SEND_UNLOCK(stcb);
1568                 return;
1569         }
1570         SCTP_TCB_SEND_UNLOCK(stcb);
1571         /* Check to see if some data queued, if so report it */
1572         TAILQ_FOREACH(outs, &stcb->asoc.out_wheel, next_spoke) {
1573                 if (!TAILQ_EMPTY(&outs->outqueue)) {
1574                         TAILQ_FOREACH(sp, &outs->outqueue, next) {
1575                                 if (sp->msg_is_complete)
1576                                         being_filled++;
1577                                 chks_in_queue++;
1578                         }
1579                 }
1580         }
1581         if (chks_in_queue != stcb->asoc.stream_queue_cnt) {
1582                 SCTP_PRINTF("Hmm, stream queue cnt at %d I counted %d in stream out wheel\n",
1583                     stcb->asoc.stream_queue_cnt, chks_in_queue);
1584         }
1585         if (chks_in_queue) {
1586                 /* call the output queue function */
1587                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1588                 if ((TAILQ_EMPTY(&stcb->asoc.send_queue)) &&
1589                     (TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
1590                         /*
1591                          * Probably should go in and make it go back through
1592                          * and add fragments allowed
1593                          */
1594                         if (being_filled == 0) {
1595                                 SCTP_PRINTF("Still nothing moved %d chunks are stuck\n",
1596                                     chks_in_queue);
1597                         }
1598                 }
1599         } else {
1600                 SCTP_PRINTF("Found no chunks on any queue tot:%lu\n",
1601                     (u_long)stcb->asoc.total_output_queue_size);
1602                 stcb->asoc.total_output_queue_size = 0;
1603         }
1604 }
1605
1606 int
1607 sctp_heartbeat_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1608     struct sctp_nets *net, int cnt_of_unconf)
1609 {
1610         int ret;
1611
1612         if (net) {
1613                 if (net->hb_responded == 0) {
1614                         if (net->ro._s_addr) {
1615                                 /*
1616                                  * Invalidate the src address if we did not
1617                                  * get a response last time.
1618                                  */
1619                                 sctp_free_ifa(net->ro._s_addr);
1620                                 net->ro._s_addr = NULL;
1621                                 net->src_addr_selected = 0;
1622                         }
1623                         sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1624                 }
1625                 /* Zero PBA, if it needs it */
1626                 if (net->partial_bytes_acked) {
1627                         net->partial_bytes_acked = 0;
1628                 }
1629         }
1630         if ((stcb->asoc.total_output_queue_size > 0) &&
1631             (TAILQ_EMPTY(&stcb->asoc.send_queue)) &&
1632             (TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
1633                 sctp_audit_stream_queues_for_size(inp, stcb);
1634         }
1635         /* Send a new HB, this will do threshold managment, pick a new dest */
1636         if (cnt_of_unconf == 0) {
1637                 if (sctp_send_hb(stcb, 0, NULL) < 0) {
1638                         return (1);
1639                 }
1640         } else {
1641                 /*
1642                  * this will send out extra hb's up to maxburst if there are
1643                  * any unconfirmed addresses.
1644                  */
1645                 uint32_t cnt_sent = 0;
1646
1647                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1648                         if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1649                             (net->dest_state & SCTP_ADDR_REACHABLE)) {
1650                                 cnt_sent++;
1651                                 if (net->hb_responded == 0) {
1652                                         /* Did we respond last time? */
1653                                         if (net->ro._s_addr) {
1654                                                 sctp_free_ifa(net->ro._s_addr);
1655                                                 net->ro._s_addr = NULL;
1656                                                 net->src_addr_selected = 0;
1657                                         }
1658                                 }
1659                                 ret = sctp_send_hb(stcb, 1, net);
1660                                 if (ret < 0)
1661                                         return 1;
1662                                 else if (ret == 0) {
1663                                         break;
1664                                 }
1665                                 if (cnt_sent >= SCTP_BASE_SYSCTL(sctp_hb_maxburst))
1666                                         break;
1667                         }
1668                 }
1669         }
1670         return (0);
1671 }
1672
1673 void
1674 sctp_pathmtu_timer(struct sctp_inpcb *inp,
1675     struct sctp_tcb *stcb,
1676     struct sctp_nets *net)
1677 {
1678         uint32_t next_mtu, mtu;
1679
1680         next_mtu = sctp_get_next_mtu(inp, net->mtu);
1681
1682         if ((next_mtu > net->mtu) && (net->port == 0)) {
1683                 if ((net->src_addr_selected == 0) ||
1684                     (net->ro._s_addr == NULL) ||
1685                     (net->ro._s_addr->localifa_flags & SCTP_BEING_DELETED)) {
1686                         if ((net->ro._s_addr != NULL) && (net->ro._s_addr->localifa_flags & SCTP_BEING_DELETED)) {
1687                                 sctp_free_ifa(net->ro._s_addr);
1688                                 net->ro._s_addr = NULL;
1689                                 net->src_addr_selected = 0;
1690                         } else if (net->ro._s_addr == NULL) {
1691 #if defined(INET6) && defined(SCTP_EMBEDDED_V6_SCOPE)
1692                                 if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1693                                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1694
1695                                         /* KAME hack: embed scopeid */
1696                                         (void)sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone));
1697                                 }
1698 #endif
1699
1700                                 net->ro._s_addr = sctp_source_address_selection(inp,
1701                                     stcb,
1702                                     (sctp_route_t *) & net->ro,
1703                                     net, 0, stcb->asoc.vrf_id);
1704 #if defined(INET6) && defined(SCTP_EMBEDDED_V6_SCOPE)
1705                                 if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1706                                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1707
1708                                         (void)sa6_recoverscope(sin6);
1709                                 }
1710 #endif                          /* INET6 */
1711                         }
1712                         if (net->ro._s_addr)
1713                                 net->src_addr_selected = 1;
1714                 }
1715                 if (net->ro._s_addr) {
1716                         mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._s_addr.sa, net->ro.ro_rt);
1717                         if (net->port) {
1718                                 mtu -= sizeof(struct udphdr);
1719                         }
1720                         if (mtu > next_mtu) {
1721                                 net->mtu = next_mtu;
1722                         }
1723                 }
1724         }
1725         /* restart the timer */
1726         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net);
1727 }
1728
1729 void
1730 sctp_autoclose_timer(struct sctp_inpcb *inp,
1731     struct sctp_tcb *stcb,
1732     struct sctp_nets *net)
1733 {
1734         struct timeval tn, *tim_touse;
1735         struct sctp_association *asoc;
1736         int ticks_gone_by;
1737
1738         (void)SCTP_GETTIME_TIMEVAL(&tn);
1739         if (stcb->asoc.sctp_autoclose_ticks &&
1740             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1741                 /* Auto close is on */
1742                 asoc = &stcb->asoc;
1743                 /* pick the time to use */
1744                 if (asoc->time_last_rcvd.tv_sec >
1745                     asoc->time_last_sent.tv_sec) {
1746                         tim_touse = &asoc->time_last_rcvd;
1747                 } else {
1748                         tim_touse = &asoc->time_last_sent;
1749                 }
1750                 /* Now has long enough transpired to autoclose? */
1751                 ticks_gone_by = SEC_TO_TICKS(tn.tv_sec - tim_touse->tv_sec);
1752                 if ((ticks_gone_by > 0) &&
1753                     (ticks_gone_by >= (int)asoc->sctp_autoclose_ticks)) {
1754                         /*
1755                          * autoclose time has hit, call the output routine,
1756                          * which should do nothing just to be SURE we don't
1757                          * have hanging data. We can then safely check the
1758                          * queues and know that we are clear to send
1759                          * shutdown
1760                          */
1761                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1762                         /* Are we clean? */
1763                         if (TAILQ_EMPTY(&asoc->send_queue) &&
1764                             TAILQ_EMPTY(&asoc->sent_queue)) {
1765                                 /*
1766                                  * there is nothing queued to send, so I'm
1767                                  * done...
1768                                  */
1769                                 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1770                                         /* only send SHUTDOWN 1st time thru */
1771                                         sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
1772                                         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
1773                                             (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
1774                                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
1775                                         }
1776                                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
1777                                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
1778                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
1779                                             stcb->sctp_ep, stcb,
1780                                             asoc->primary_destination);
1781                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1782                                             stcb->sctp_ep, stcb,
1783                                             asoc->primary_destination);
1784                                 }
1785                         }
1786                 } else {
1787                         /*
1788                          * No auto close at this time, reset t-o to check
1789                          * later
1790                          */
1791                         int tmp;
1792
1793                         /* fool the timer startup to use the time left */
1794                         tmp = asoc->sctp_autoclose_ticks;
1795                         asoc->sctp_autoclose_ticks -= ticks_gone_by;
1796                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1797                             net);
1798                         /* restore the real tick value */
1799                         asoc->sctp_autoclose_ticks = tmp;
1800                 }
1801         }
1802 }