xref: /freebsd/sys/netinet/sctp_indata.c (revision ad81507eed9cb07d9b9295c8d77100a2b8d95dbe)
1f8829a4aSRandall Stewart /*-
2b1006367SRandall Stewart  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3f8829a4aSRandall Stewart  *
4f8829a4aSRandall Stewart  * Redistribution and use in source and binary forms, with or without
5f8829a4aSRandall Stewart  * modification, are permitted provided that the following conditions are met:
6f8829a4aSRandall Stewart  *
7f8829a4aSRandall Stewart  * a) Redistributions of source code must retain the above copyright notice,
8f8829a4aSRandall Stewart  *   this list of conditions and the following disclaimer.
9f8829a4aSRandall Stewart  *
10f8829a4aSRandall Stewart  * b) Redistributions in binary form must reproduce the above copyright
11f8829a4aSRandall Stewart  *    notice, this list of conditions and the following disclaimer in
12f8829a4aSRandall Stewart  *   the documentation and/or other materials provided with the distribution.
13f8829a4aSRandall Stewart  *
14f8829a4aSRandall Stewart  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15f8829a4aSRandall Stewart  *    contributors may be used to endorse or promote products derived
16f8829a4aSRandall Stewart  *    from this software without specific prior written permission.
17f8829a4aSRandall Stewart  *
18f8829a4aSRandall Stewart  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19f8829a4aSRandall Stewart  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20f8829a4aSRandall Stewart  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21f8829a4aSRandall Stewart  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22f8829a4aSRandall Stewart  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23f8829a4aSRandall Stewart  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24f8829a4aSRandall Stewart  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25f8829a4aSRandall Stewart  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26f8829a4aSRandall Stewart  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27f8829a4aSRandall Stewart  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28f8829a4aSRandall Stewart  * THE POSSIBILITY OF SUCH DAMAGE.
29f8829a4aSRandall Stewart  */
30f8829a4aSRandall Stewart 
31a5d547adSRandall Stewart /* $KAME: sctp_indata.c,v 1.36 2005/03/06 16:04:17 itojun Exp $	 */
32f8829a4aSRandall Stewart 
33f8829a4aSRandall Stewart #include <sys/cdefs.h>
34f8829a4aSRandall Stewart __FBSDID("$FreeBSD$");
35f8829a4aSRandall Stewart 
36f8829a4aSRandall Stewart #include <netinet/sctp_os.h>
37f8829a4aSRandall Stewart #include <netinet/sctp_var.h>
3842551e99SRandall Stewart #include <netinet/sctp_sysctl.h>
39f8829a4aSRandall Stewart #include <netinet/sctp_pcb.h>
40f8829a4aSRandall Stewart #include <netinet/sctp_header.h>
41f8829a4aSRandall Stewart #include <netinet/sctputil.h>
42f8829a4aSRandall Stewart #include <netinet/sctp_output.h>
43f8829a4aSRandall Stewart #include <netinet/sctp_input.h>
44f8829a4aSRandall Stewart #include <netinet/sctp_indata.h>
45f8829a4aSRandall Stewart #include <netinet/sctp_uio.h>
46f8829a4aSRandall Stewart #include <netinet/sctp_timer.h>
47f8829a4aSRandall Stewart 
48f8829a4aSRandall Stewart 
49f8829a4aSRandall Stewart /*
50f8829a4aSRandall Stewart  * NOTES: On the outbound side of things I need to check the sack timer to
51f8829a4aSRandall Stewart  * see if I should generate a sack into the chunk queue (if I have data to
52f8829a4aSRandall Stewart  * send that is and will be sending it .. for bundling.
53f8829a4aSRandall Stewart  *
54f8829a4aSRandall Stewart  * The callback in sctp_usrreq.c will get called when the socket is read from.
55f8829a4aSRandall Stewart  * This will cause sctp_service_queues() to get called on the top entry in
56f8829a4aSRandall Stewart  * the list.
57f8829a4aSRandall Stewart  */
58f8829a4aSRandall Stewart 
59f8829a4aSRandall Stewart __inline void
60f8829a4aSRandall Stewart sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
61f8829a4aSRandall Stewart {
62f8829a4aSRandall Stewart 	uint32_t calc, calc_w_oh;
63f8829a4aSRandall Stewart 
64f8829a4aSRandall Stewart 	/*
65f8829a4aSRandall Stewart 	 * This is really set wrong with respect to a 1-2-m socket. Since
66f8829a4aSRandall Stewart 	 * the sb_cc is the count that everyone as put up. When we re-write
67f8829a4aSRandall Stewart 	 * sctp_soreceive then we will fix this so that ONLY this
68f8829a4aSRandall Stewart 	 * associations data is taken into account.
69f8829a4aSRandall Stewart 	 */
70f8829a4aSRandall Stewart 	if (stcb->sctp_socket == NULL)
71f8829a4aSRandall Stewart 		return;
72f8829a4aSRandall Stewart 
73f8829a4aSRandall Stewart 	if (stcb->asoc.sb_cc == 0 &&
74f8829a4aSRandall Stewart 	    asoc->size_on_reasm_queue == 0 &&
75f8829a4aSRandall Stewart 	    asoc->size_on_all_streams == 0) {
76f8829a4aSRandall Stewart 		/* Full rwnd granted */
7762c1ff9cSRandall Stewart 		asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket),
78f8829a4aSRandall Stewart 		    SCTP_MINIMAL_RWND);
79f8829a4aSRandall Stewart 		return;
80f8829a4aSRandall Stewart 	}
81f8829a4aSRandall Stewart 	/* get actual space */
82f8829a4aSRandall Stewart 	calc = (uint32_t) sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
83f8829a4aSRandall Stewart 
84f8829a4aSRandall Stewart 	/*
85f8829a4aSRandall Stewart 	 * take out what has NOT been put on socket queue and we yet hold
86f8829a4aSRandall Stewart 	 * for putting up.
87f8829a4aSRandall Stewart 	 */
88f8829a4aSRandall Stewart 	calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_reasm_queue);
89f8829a4aSRandall Stewart 	calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_all_streams);
90f8829a4aSRandall Stewart 
91f8829a4aSRandall Stewart 	if (calc == 0) {
92f8829a4aSRandall Stewart 		/* out of space */
93f8829a4aSRandall Stewart 		asoc->my_rwnd = 0;
94f8829a4aSRandall Stewart 		return;
95f8829a4aSRandall Stewart 	}
96f8829a4aSRandall Stewart 	/* what is the overhead of all these rwnd's */
97f8829a4aSRandall Stewart 	calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
98f8829a4aSRandall Stewart 	asoc->my_rwnd = calc;
99f8829a4aSRandall Stewart 	if (calc_w_oh == 0) {
100f8829a4aSRandall Stewart 		/*
101f8829a4aSRandall Stewart 		 * If our overhead is greater than the advertised rwnd, we
102f8829a4aSRandall Stewart 		 * clamp the rwnd to 1. This lets us still accept inbound
103f8829a4aSRandall Stewart 		 * segments, but hopefully will shut the sender down when he
104f8829a4aSRandall Stewart 		 * finally gets the message.
105f8829a4aSRandall Stewart 		 */
106f8829a4aSRandall Stewart 		asoc->my_rwnd = 1;
107f8829a4aSRandall Stewart 	} else {
108f8829a4aSRandall Stewart 		/* SWS threshold */
109f8829a4aSRandall Stewart 		if (asoc->my_rwnd &&
110f8829a4aSRandall Stewart 		    (asoc->my_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
111f8829a4aSRandall Stewart 			/* SWS engaged, tell peer none left */
112f8829a4aSRandall Stewart 			asoc->my_rwnd = 1;
113f8829a4aSRandall Stewart 		}
114f8829a4aSRandall Stewart 	}
115f8829a4aSRandall Stewart }
116f8829a4aSRandall Stewart 
117f8829a4aSRandall Stewart /* Calculate what the rwnd would be */
118f8829a4aSRandall Stewart 
119f8829a4aSRandall Stewart __inline uint32_t
120f8829a4aSRandall Stewart sctp_calc_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
121f8829a4aSRandall Stewart {
122f8829a4aSRandall Stewart 	uint32_t calc = 0, calc_w_oh;
123f8829a4aSRandall Stewart 
124f8829a4aSRandall Stewart 	/*
125f8829a4aSRandall Stewart 	 * This is really set wrong with respect to a 1-2-m socket. Since
126f8829a4aSRandall Stewart 	 * the sb_cc is the count that everyone as put up. When we re-write
127f8829a4aSRandall Stewart 	 * sctp_soreceive then we will fix this so that ONLY this
128f8829a4aSRandall Stewart 	 * associations data is taken into account.
129f8829a4aSRandall Stewart 	 */
130f8829a4aSRandall Stewart 	if (stcb->sctp_socket == NULL)
131f8829a4aSRandall Stewart 		return (calc);
132f8829a4aSRandall Stewart 
133f8829a4aSRandall Stewart 	if (stcb->asoc.sb_cc == 0 &&
134f8829a4aSRandall Stewart 	    asoc->size_on_reasm_queue == 0 &&
135f8829a4aSRandall Stewart 	    asoc->size_on_all_streams == 0) {
136f8829a4aSRandall Stewart 		/* Full rwnd granted */
13762c1ff9cSRandall Stewart 		calc = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket),
138f8829a4aSRandall Stewart 		    SCTP_MINIMAL_RWND);
139f8829a4aSRandall Stewart 		return (calc);
140f8829a4aSRandall Stewart 	}
141f8829a4aSRandall Stewart 	/* get actual space */
142f8829a4aSRandall Stewart 	calc = (uint32_t) sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
143f8829a4aSRandall Stewart 
144f8829a4aSRandall Stewart 	/*
145f8829a4aSRandall Stewart 	 * take out what has NOT been put on socket queue and we yet hold
146f8829a4aSRandall Stewart 	 * for putting up.
147f8829a4aSRandall Stewart 	 */
148f8829a4aSRandall Stewart 	calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_reasm_queue);
149f8829a4aSRandall Stewart 	calc = sctp_sbspace_sub(calc, (uint32_t) asoc->size_on_all_streams);
150f8829a4aSRandall Stewart 
151f8829a4aSRandall Stewart 	if (calc == 0) {
152f8829a4aSRandall Stewart 		/* out of space */
153f8829a4aSRandall Stewart 		return (calc);
154f8829a4aSRandall Stewart 	}
155f8829a4aSRandall Stewart 	/* what is the overhead of all these rwnd's */
156f8829a4aSRandall Stewart 	calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
157f8829a4aSRandall Stewart 	if (calc_w_oh == 0) {
158f8829a4aSRandall Stewart 		/*
159f8829a4aSRandall Stewart 		 * If our overhead is greater than the advertised rwnd, we
160f8829a4aSRandall Stewart 		 * clamp the rwnd to 1. This lets us still accept inbound
161f8829a4aSRandall Stewart 		 * segments, but hopefully will shut the sender down when he
162f8829a4aSRandall Stewart 		 * finally gets the message.
163f8829a4aSRandall Stewart 		 */
164f8829a4aSRandall Stewart 		calc = 1;
165f8829a4aSRandall Stewart 	} else {
166f8829a4aSRandall Stewart 		/* SWS threshold */
167f8829a4aSRandall Stewart 		if (calc &&
168f8829a4aSRandall Stewart 		    (calc < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) {
169f8829a4aSRandall Stewart 			/* SWS engaged, tell peer none left */
170f8829a4aSRandall Stewart 			calc = 1;
171f8829a4aSRandall Stewart 		}
172f8829a4aSRandall Stewart 	}
173f8829a4aSRandall Stewart 	return (calc);
174f8829a4aSRandall Stewart }
175f8829a4aSRandall Stewart 
176f8829a4aSRandall Stewart 
177f8829a4aSRandall Stewart 
178f8829a4aSRandall Stewart /*
179f8829a4aSRandall Stewart  * Build out our readq entry based on the incoming packet.
180f8829a4aSRandall Stewart  */
181f8829a4aSRandall Stewart struct sctp_queued_to_read *
182f8829a4aSRandall Stewart sctp_build_readq_entry(struct sctp_tcb *stcb,
183f8829a4aSRandall Stewart     struct sctp_nets *net,
184f8829a4aSRandall Stewart     uint32_t tsn, uint32_t ppid,
185f8829a4aSRandall Stewart     uint32_t context, uint16_t stream_no,
186f8829a4aSRandall Stewart     uint16_t stream_seq, uint8_t flags,
187f8829a4aSRandall Stewart     struct mbuf *dm)
188f8829a4aSRandall Stewart {
189f8829a4aSRandall Stewart 	struct sctp_queued_to_read *read_queue_e = NULL;
190f8829a4aSRandall Stewart 
191f8829a4aSRandall Stewart 	sctp_alloc_a_readq(stcb, read_queue_e);
192f8829a4aSRandall Stewart 	if (read_queue_e == NULL) {
193f8829a4aSRandall Stewart 		goto failed_build;
194f8829a4aSRandall Stewart 	}
195f8829a4aSRandall Stewart 	read_queue_e->sinfo_stream = stream_no;
196f8829a4aSRandall Stewart 	read_queue_e->sinfo_ssn = stream_seq;
197f8829a4aSRandall Stewart 	read_queue_e->sinfo_flags = (flags << 8);
198f8829a4aSRandall Stewart 	read_queue_e->sinfo_ppid = ppid;
199f8829a4aSRandall Stewart 	read_queue_e->sinfo_context = stcb->asoc.context;
200f8829a4aSRandall Stewart 	read_queue_e->sinfo_timetolive = 0;
201f8829a4aSRandall Stewart 	read_queue_e->sinfo_tsn = tsn;
202f8829a4aSRandall Stewart 	read_queue_e->sinfo_cumtsn = tsn;
203f8829a4aSRandall Stewart 	read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
204f8829a4aSRandall Stewart 	read_queue_e->whoFrom = net;
205f8829a4aSRandall Stewart 	read_queue_e->length = 0;
206f8829a4aSRandall Stewart 	atomic_add_int(&net->ref_count, 1);
207f8829a4aSRandall Stewart 	read_queue_e->data = dm;
208139bc87fSRandall Stewart 	read_queue_e->spec_flags = 0;
209f8829a4aSRandall Stewart 	read_queue_e->tail_mbuf = NULL;
21017205eccSRandall Stewart 	read_queue_e->aux_data = NULL;
211f8829a4aSRandall Stewart 	read_queue_e->stcb = stcb;
212f8829a4aSRandall Stewart 	read_queue_e->port_from = stcb->rport;
213f8829a4aSRandall Stewart 	read_queue_e->do_not_ref_stcb = 0;
214f8829a4aSRandall Stewart 	read_queue_e->end_added = 0;
2159a6142d8SRandall Stewart 	read_queue_e->some_taken = 0;
21603b0b021SRandall Stewart 	read_queue_e->pdapi_aborted = 0;
217f8829a4aSRandall Stewart failed_build:
218f8829a4aSRandall Stewart 	return (read_queue_e);
219f8829a4aSRandall Stewart }
220f8829a4aSRandall Stewart 
221f8829a4aSRandall Stewart 
222f8829a4aSRandall Stewart /*
223f8829a4aSRandall Stewart  * Build out our readq entry based on the incoming packet.
224f8829a4aSRandall Stewart  */
225f8829a4aSRandall Stewart static struct sctp_queued_to_read *
226f8829a4aSRandall Stewart sctp_build_readq_entry_chk(struct sctp_tcb *stcb,
227f8829a4aSRandall Stewart     struct sctp_tmit_chunk *chk)
228f8829a4aSRandall Stewart {
229f8829a4aSRandall Stewart 	struct sctp_queued_to_read *read_queue_e = NULL;
230f8829a4aSRandall Stewart 
231f8829a4aSRandall Stewart 	sctp_alloc_a_readq(stcb, read_queue_e);
232f8829a4aSRandall Stewart 	if (read_queue_e == NULL) {
233f8829a4aSRandall Stewart 		goto failed_build;
234f8829a4aSRandall Stewart 	}
235f8829a4aSRandall Stewart 	read_queue_e->sinfo_stream = chk->rec.data.stream_number;
236f8829a4aSRandall Stewart 	read_queue_e->sinfo_ssn = chk->rec.data.stream_seq;
237f8829a4aSRandall Stewart 	read_queue_e->sinfo_flags = (chk->rec.data.rcv_flags << 8);
238f8829a4aSRandall Stewart 	read_queue_e->sinfo_ppid = chk->rec.data.payloadtype;
239f8829a4aSRandall Stewart 	read_queue_e->sinfo_context = stcb->asoc.context;
240f8829a4aSRandall Stewart 	read_queue_e->sinfo_timetolive = 0;
241f8829a4aSRandall Stewart 	read_queue_e->sinfo_tsn = chk->rec.data.TSN_seq;
242f8829a4aSRandall Stewart 	read_queue_e->sinfo_cumtsn = chk->rec.data.TSN_seq;
243f8829a4aSRandall Stewart 	read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
244f8829a4aSRandall Stewart 	read_queue_e->whoFrom = chk->whoTo;
24517205eccSRandall Stewart 	read_queue_e->aux_data = NULL;
246f8829a4aSRandall Stewart 	read_queue_e->length = 0;
247f8829a4aSRandall Stewart 	atomic_add_int(&chk->whoTo->ref_count, 1);
248f8829a4aSRandall Stewart 	read_queue_e->data = chk->data;
249f8829a4aSRandall Stewart 	read_queue_e->tail_mbuf = NULL;
250f8829a4aSRandall Stewart 	read_queue_e->stcb = stcb;
251f8829a4aSRandall Stewart 	read_queue_e->port_from = stcb->rport;
252139bc87fSRandall Stewart 	read_queue_e->spec_flags = 0;
253f8829a4aSRandall Stewart 	read_queue_e->do_not_ref_stcb = 0;
254f8829a4aSRandall Stewart 	read_queue_e->end_added = 0;
2559a6142d8SRandall Stewart 	read_queue_e->some_taken = 0;
25603b0b021SRandall Stewart 	read_queue_e->pdapi_aborted = 0;
257f8829a4aSRandall Stewart failed_build:
258f8829a4aSRandall Stewart 	return (read_queue_e);
259f8829a4aSRandall Stewart }
260f8829a4aSRandall Stewart 
261f8829a4aSRandall Stewart 
262f8829a4aSRandall Stewart struct mbuf *
263f8829a4aSRandall Stewart sctp_build_ctl_nchunk(struct sctp_inpcb *inp,
264f8829a4aSRandall Stewart     struct sctp_sndrcvinfo *sinfo)
265f8829a4aSRandall Stewart {
266f8829a4aSRandall Stewart 	struct sctp_sndrcvinfo *outinfo;
267f8829a4aSRandall Stewart 	struct cmsghdr *cmh;
268f8829a4aSRandall Stewart 	struct mbuf *ret;
269f8829a4aSRandall Stewart 	int len;
270f8829a4aSRandall Stewart 	int use_extended = 0;
271f8829a4aSRandall Stewart 
272f8829a4aSRandall Stewart 	if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
273f8829a4aSRandall Stewart 		/* user does not want the sndrcv ctl */
274f8829a4aSRandall Stewart 		return (NULL);
275f8829a4aSRandall Stewart 	}
276f8829a4aSRandall Stewart 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
277f8829a4aSRandall Stewart 		use_extended = 1;
278f8829a4aSRandall Stewart 		len = CMSG_LEN(sizeof(struct sctp_extrcvinfo));
279f8829a4aSRandall Stewart 	} else {
280f8829a4aSRandall Stewart 		len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
281f8829a4aSRandall Stewart 	}
282f8829a4aSRandall Stewart 
283f8829a4aSRandall Stewart 
284f8829a4aSRandall Stewart 	ret = sctp_get_mbuf_for_msg(len,
285139bc87fSRandall Stewart 	    0, M_DONTWAIT, 1, MT_DATA);
286f8829a4aSRandall Stewart 
287f8829a4aSRandall Stewart 	if (ret == NULL) {
288f8829a4aSRandall Stewart 		/* No space */
289f8829a4aSRandall Stewart 		return (ret);
290f8829a4aSRandall Stewart 	}
291f8829a4aSRandall Stewart 	/* We need a CMSG header followed by the struct  */
292f8829a4aSRandall Stewart 	cmh = mtod(ret, struct cmsghdr *);
293f8829a4aSRandall Stewart 	outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
294f8829a4aSRandall Stewart 	cmh->cmsg_level = IPPROTO_SCTP;
295f8829a4aSRandall Stewart 	if (use_extended) {
296f8829a4aSRandall Stewart 		cmh->cmsg_type = SCTP_EXTRCV;
297f8829a4aSRandall Stewart 		cmh->cmsg_len = len;
298f8829a4aSRandall Stewart 		memcpy(outinfo, sinfo, len);
299f8829a4aSRandall Stewart 	} else {
300f8829a4aSRandall Stewart 		cmh->cmsg_type = SCTP_SNDRCV;
301f8829a4aSRandall Stewart 		cmh->cmsg_len = len;
302f8829a4aSRandall Stewart 		*outinfo = *sinfo;
303f8829a4aSRandall Stewart 	}
304139bc87fSRandall Stewart 	SCTP_BUF_LEN(ret) = cmh->cmsg_len;
305f8829a4aSRandall Stewart 	return (ret);
306f8829a4aSRandall Stewart }
307f8829a4aSRandall Stewart 
308139bc87fSRandall Stewart 
30917205eccSRandall Stewart char *
31017205eccSRandall Stewart sctp_build_ctl_cchunk(struct sctp_inpcb *inp,
31117205eccSRandall Stewart     int *control_len,
31217205eccSRandall Stewart     struct sctp_sndrcvinfo *sinfo)
31317205eccSRandall Stewart {
31417205eccSRandall Stewart 	struct sctp_sndrcvinfo *outinfo;
31517205eccSRandall Stewart 	struct cmsghdr *cmh;
31617205eccSRandall Stewart 	char *buf;
31717205eccSRandall Stewart 	int len;
31817205eccSRandall Stewart 	int use_extended = 0;
31917205eccSRandall Stewart 
32017205eccSRandall Stewart 	if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
32117205eccSRandall Stewart 		/* user does not want the sndrcv ctl */
32217205eccSRandall Stewart 		return (NULL);
32317205eccSRandall Stewart 	}
32417205eccSRandall Stewart 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
32517205eccSRandall Stewart 		use_extended = 1;
32617205eccSRandall Stewart 		len = CMSG_LEN(sizeof(struct sctp_extrcvinfo));
32717205eccSRandall Stewart 	} else {
32817205eccSRandall Stewart 		len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
32917205eccSRandall Stewart 	}
33017205eccSRandall Stewart 	SCTP_MALLOC(buf, char *, len, "SCTP_CMSG");
33117205eccSRandall Stewart 	if (buf == NULL) {
33217205eccSRandall Stewart 		/* No space */
33317205eccSRandall Stewart 		return (buf);
33417205eccSRandall Stewart 	}
33517205eccSRandall Stewart 	/* We need a CMSG header followed by the struct  */
33617205eccSRandall Stewart 	cmh = (struct cmsghdr *)buf;
33717205eccSRandall Stewart 	outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
33817205eccSRandall Stewart 	cmh->cmsg_level = IPPROTO_SCTP;
33917205eccSRandall Stewart 	if (use_extended) {
34017205eccSRandall Stewart 		cmh->cmsg_type = SCTP_EXTRCV;
34117205eccSRandall Stewart 		cmh->cmsg_len = len;
34217205eccSRandall Stewart 		memcpy(outinfo, sinfo, len);
34317205eccSRandall Stewart 	} else {
34417205eccSRandall Stewart 		cmh->cmsg_type = SCTP_SNDRCV;
34517205eccSRandall Stewart 		cmh->cmsg_len = len;
34617205eccSRandall Stewart 		*outinfo = *sinfo;
34717205eccSRandall Stewart 	}
34817205eccSRandall Stewart 	*control_len = len;
34917205eccSRandall Stewart 	return (buf);
35017205eccSRandall Stewart }
35117205eccSRandall Stewart 
35217205eccSRandall Stewart 
353f8829a4aSRandall Stewart /*
354f8829a4aSRandall Stewart  * We are delivering currently from the reassembly queue. We must continue to
355f8829a4aSRandall Stewart  * deliver until we either: 1) run out of space. 2) run out of sequential
356f8829a4aSRandall Stewart  * TSN's 3) hit the SCTP_DATA_LAST_FRAG flag.
357f8829a4aSRandall Stewart  */
358f8829a4aSRandall Stewart static void
359f8829a4aSRandall Stewart sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc)
360f8829a4aSRandall Stewart {
361f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
362f8829a4aSRandall Stewart 	uint16_t nxt_todel;
363f8829a4aSRandall Stewart 	uint16_t stream_no;
364f8829a4aSRandall Stewart 	int end = 0;
365f8829a4aSRandall Stewart 	int cntDel;
366f8829a4aSRandall Stewart 	struct sctp_queued_to_read *control, *ctl, *ctlat;
367f8829a4aSRandall Stewart 
368ad81507eSRandall Stewart 	if (stcb == NULL)
369ad81507eSRandall Stewart 		return;
370ad81507eSRandall Stewart 
371f42a358aSRandall Stewart 	cntDel = stream_no = 0;
372ad81507eSRandall Stewart 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
373ad81507eSRandall Stewart 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
374f8829a4aSRandall Stewart 		/* socket above is long gone */
375f8829a4aSRandall Stewart 		asoc->fragmented_delivery_inprogress = 0;
376f8829a4aSRandall Stewart 		chk = TAILQ_FIRST(&asoc->reasmqueue);
377f8829a4aSRandall Stewart 		while (chk) {
378f8829a4aSRandall Stewart 			TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
379f8829a4aSRandall Stewart 			asoc->size_on_reasm_queue -= chk->send_size;
380f8829a4aSRandall Stewart 			sctp_ucount_decr(asoc->cnt_on_reasm_queue);
381f8829a4aSRandall Stewart 			/*
382f8829a4aSRandall Stewart 			 * Lose the data pointer, since its in the socket
383f8829a4aSRandall Stewart 			 * buffer
384f8829a4aSRandall Stewart 			 */
385f8829a4aSRandall Stewart 			if (chk->data) {
386f8829a4aSRandall Stewart 				sctp_m_freem(chk->data);
387f8829a4aSRandall Stewart 				chk->data = NULL;
388f8829a4aSRandall Stewart 			}
389f8829a4aSRandall Stewart 			/* Now free the address and data */
390f8829a4aSRandall Stewart 			sctp_free_remote_addr(chk->whoTo);
391f8829a4aSRandall Stewart 			sctp_free_a_chunk(stcb, chk);
392f8829a4aSRandall Stewart 			chk = TAILQ_FIRST(&asoc->reasmqueue);
393f8829a4aSRandall Stewart 		}
394f8829a4aSRandall Stewart 		return;
395f8829a4aSRandall Stewart 	}
396f8829a4aSRandall Stewart 	SCTP_TCB_LOCK_ASSERT(stcb);
397f8829a4aSRandall Stewart 	do {
398f8829a4aSRandall Stewart 		chk = TAILQ_FIRST(&asoc->reasmqueue);
399f8829a4aSRandall Stewart 		if (chk == NULL) {
400f8829a4aSRandall Stewart 			return;
401f8829a4aSRandall Stewart 		}
402f8829a4aSRandall Stewart 		if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) {
403f8829a4aSRandall Stewart 			/* Can't deliver more :< */
404f8829a4aSRandall Stewart 			return;
405f8829a4aSRandall Stewart 		}
406f8829a4aSRandall Stewart 		stream_no = chk->rec.data.stream_number;
407f8829a4aSRandall Stewart 		nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1;
408f8829a4aSRandall Stewart 		if (nxt_todel != chk->rec.data.stream_seq &&
409f8829a4aSRandall Stewart 		    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
410f8829a4aSRandall Stewart 			/*
411f8829a4aSRandall Stewart 			 * Not the next sequence to deliver in its stream OR
412f8829a4aSRandall Stewart 			 * unordered
413f8829a4aSRandall Stewart 			 */
414f8829a4aSRandall Stewart 			return;
415f8829a4aSRandall Stewart 		}
416f8829a4aSRandall Stewart 		if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
417f8829a4aSRandall Stewart 
418f8829a4aSRandall Stewart 			control = sctp_build_readq_entry_chk(stcb, chk);
419f8829a4aSRandall Stewart 			if (control == NULL) {
420f8829a4aSRandall Stewart 				/* out of memory? */
421f8829a4aSRandall Stewart 				return;
422f8829a4aSRandall Stewart 			}
423f8829a4aSRandall Stewart 			/* save it off for our future deliveries */
424f8829a4aSRandall Stewart 			stcb->asoc.control_pdapi = control;
425f8829a4aSRandall Stewart 			if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG)
426f8829a4aSRandall Stewart 				end = 1;
427f8829a4aSRandall Stewart 			else
428f8829a4aSRandall Stewart 				end = 0;
429f8829a4aSRandall Stewart 			sctp_add_to_readq(stcb->sctp_ep,
430f8829a4aSRandall Stewart 			    stcb, control, &stcb->sctp_socket->so_rcv, end);
431f8829a4aSRandall Stewart 			cntDel++;
432f8829a4aSRandall Stewart 		} else {
433f8829a4aSRandall Stewart 			if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG)
434f8829a4aSRandall Stewart 				end = 1;
435f8829a4aSRandall Stewart 			else
436f8829a4aSRandall Stewart 				end = 0;
437f8829a4aSRandall Stewart 			if (sctp_append_to_readq(stcb->sctp_ep, stcb,
438f8829a4aSRandall Stewart 			    stcb->asoc.control_pdapi,
439f8829a4aSRandall Stewart 			    chk->data, end, chk->rec.data.TSN_seq,
440f8829a4aSRandall Stewart 			    &stcb->sctp_socket->so_rcv)) {
441f8829a4aSRandall Stewart 				/*
442f8829a4aSRandall Stewart 				 * something is very wrong, either
443f8829a4aSRandall Stewart 				 * control_pdapi is NULL, or the tail_mbuf
444f8829a4aSRandall Stewart 				 * is corrupt, or there is a EOM already on
445f8829a4aSRandall Stewart 				 * the mbuf chain.
446f8829a4aSRandall Stewart 				 */
447ad81507eSRandall Stewart 				if ((stcb->asoc.control_pdapi == NULL) || (stcb->asoc.control_pdapi->tail_mbuf == NULL)) {
448f8829a4aSRandall Stewart 					panic("This should not happen control_pdapi NULL?");
449f8829a4aSRandall Stewart 				}
450f8829a4aSRandall Stewart 				/* if we did not panic, it was a EOM */
451f8829a4aSRandall Stewart 				panic("Bad chunking ??");
452ad81507eSRandall Stewart 				return;
453f8829a4aSRandall Stewart 			}
454f8829a4aSRandall Stewart 			cntDel++;
455f8829a4aSRandall Stewart 		}
456f8829a4aSRandall Stewart 		/* pull it we did it */
457f8829a4aSRandall Stewart 		TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
458f8829a4aSRandall Stewart 		if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
459f8829a4aSRandall Stewart 			asoc->fragmented_delivery_inprogress = 0;
460f8829a4aSRandall Stewart 			if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
461f8829a4aSRandall Stewart 				asoc->strmin[stream_no].last_sequence_delivered++;
462f8829a4aSRandall Stewart 			}
463f8829a4aSRandall Stewart 			if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
464f8829a4aSRandall Stewart 				SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
465f8829a4aSRandall Stewart 			}
466f8829a4aSRandall Stewart 		} else if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
467f8829a4aSRandall Stewart 			/*
468f8829a4aSRandall Stewart 			 * turn the flag back on since we just  delivered
469f8829a4aSRandall Stewart 			 * yet another one.
470f8829a4aSRandall Stewart 			 */
471f8829a4aSRandall Stewart 			asoc->fragmented_delivery_inprogress = 1;
472f8829a4aSRandall Stewart 		}
473f8829a4aSRandall Stewart 		asoc->tsn_of_pdapi_last_delivered = chk->rec.data.TSN_seq;
474f8829a4aSRandall Stewart 		asoc->last_flags_delivered = chk->rec.data.rcv_flags;
475f8829a4aSRandall Stewart 		asoc->last_strm_seq_delivered = chk->rec.data.stream_seq;
476f8829a4aSRandall Stewart 		asoc->last_strm_no_delivered = chk->rec.data.stream_number;
477f8829a4aSRandall Stewart 
478f8829a4aSRandall Stewart 		asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
479f8829a4aSRandall Stewart 		asoc->size_on_reasm_queue -= chk->send_size;
480f8829a4aSRandall Stewart 		sctp_ucount_decr(asoc->cnt_on_reasm_queue);
481f8829a4aSRandall Stewart 		/* free up the chk */
482f8829a4aSRandall Stewart 		chk->data = NULL;
483f8829a4aSRandall Stewart 		sctp_free_remote_addr(chk->whoTo);
484f8829a4aSRandall Stewart 		sctp_free_a_chunk(stcb, chk);
485f8829a4aSRandall Stewart 
486f8829a4aSRandall Stewart 		if (asoc->fragmented_delivery_inprogress == 0) {
487f8829a4aSRandall Stewart 			/*
488f8829a4aSRandall Stewart 			 * Now lets see if we can deliver the next one on
489f8829a4aSRandall Stewart 			 * the stream
490f8829a4aSRandall Stewart 			 */
491f8829a4aSRandall Stewart 			uint16_t nxt_todel;
492f8829a4aSRandall Stewart 			struct sctp_stream_in *strm;
493f8829a4aSRandall Stewart 
494f8829a4aSRandall Stewart 			strm = &asoc->strmin[stream_no];
495f8829a4aSRandall Stewart 			nxt_todel = strm->last_sequence_delivered + 1;
496f8829a4aSRandall Stewart 			ctl = TAILQ_FIRST(&strm->inqueue);
497f8829a4aSRandall Stewart 			if (ctl && (nxt_todel == ctl->sinfo_ssn)) {
498f8829a4aSRandall Stewart 				while (ctl != NULL) {
499f8829a4aSRandall Stewart 					/* Deliver more if we can. */
500f8829a4aSRandall Stewart 					if (nxt_todel == ctl->sinfo_ssn) {
501f8829a4aSRandall Stewart 						ctlat = TAILQ_NEXT(ctl, next);
502f8829a4aSRandall Stewart 						TAILQ_REMOVE(&strm->inqueue, ctl, next);
503f8829a4aSRandall Stewart 						asoc->size_on_all_streams -= ctl->length;
504f8829a4aSRandall Stewart 						sctp_ucount_decr(asoc->cnt_on_all_streams);
505f8829a4aSRandall Stewart 						strm->last_sequence_delivered++;
506f8829a4aSRandall Stewart 						sctp_add_to_readq(stcb->sctp_ep, stcb,
507f8829a4aSRandall Stewart 						    ctl,
508f8829a4aSRandall Stewart 						    &stcb->sctp_socket->so_rcv, 1);
509f8829a4aSRandall Stewart 						ctl = ctlat;
510f8829a4aSRandall Stewart 					} else {
511f8829a4aSRandall Stewart 						break;
512f8829a4aSRandall Stewart 					}
513f8829a4aSRandall Stewart 					nxt_todel = strm->last_sequence_delivered + 1;
514f8829a4aSRandall Stewart 				}
515f8829a4aSRandall Stewart 			}
516139bc87fSRandall Stewart 			break;
517f8829a4aSRandall Stewart 		}
518f8829a4aSRandall Stewart 		chk = TAILQ_FIRST(&asoc->reasmqueue);
519f8829a4aSRandall Stewart 	} while (chk);
520f8829a4aSRandall Stewart }
521f8829a4aSRandall Stewart 
522f8829a4aSRandall Stewart /*
523f8829a4aSRandall Stewart  * Queue the chunk either right into the socket buffer if it is the next one
524f8829a4aSRandall Stewart  * to go OR put it in the correct place in the delivery queue.  If we do
525f8829a4aSRandall Stewart  * append to the so_buf, keep doing so until we are out of order. One big
526f8829a4aSRandall Stewart  * question still remains, what to do when the socket buffer is FULL??
527f8829a4aSRandall Stewart  */
528f8829a4aSRandall Stewart static void
529f8829a4aSRandall Stewart sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc,
530f8829a4aSRandall Stewart     struct sctp_queued_to_read *control, int *abort_flag)
531f8829a4aSRandall Stewart {
532f8829a4aSRandall Stewart 	/*
533f8829a4aSRandall Stewart 	 * FIX-ME maybe? What happens when the ssn wraps? If we are getting
534f8829a4aSRandall Stewart 	 * all the data in one stream this could happen quite rapidly. One
535f8829a4aSRandall Stewart 	 * could use the TSN to keep track of things, but this scheme breaks
536f8829a4aSRandall Stewart 	 * down in the other type of stream useage that could occur. Send a
537f8829a4aSRandall Stewart 	 * single msg to stream 0, send 4Billion messages to stream 1, now
538f8829a4aSRandall Stewart 	 * send a message to stream 0. You have a situation where the TSN
539f8829a4aSRandall Stewart 	 * has wrapped but not in the stream. Is this worth worrying about
540f8829a4aSRandall Stewart 	 * or should we just change our queue sort at the bottom to be by
541f8829a4aSRandall Stewart 	 * TSN.
542f8829a4aSRandall Stewart 	 *
543f8829a4aSRandall Stewart 	 * Could it also be legal for a peer to send ssn 1 with TSN 2 and ssn 2
544f8829a4aSRandall Stewart 	 * with TSN 1? If the peer is doing some sort of funky TSN/SSN
545f8829a4aSRandall Stewart 	 * assignment this could happen... and I don't see how this would be
546f8829a4aSRandall Stewart 	 * a violation. So for now I am undecided an will leave the sort by
547f8829a4aSRandall Stewart 	 * SSN alone. Maybe a hybred approach is the answer
548f8829a4aSRandall Stewart 	 *
549f8829a4aSRandall Stewart 	 */
550f8829a4aSRandall Stewart 	struct sctp_stream_in *strm;
551f8829a4aSRandall Stewart 	struct sctp_queued_to_read *at;
552f8829a4aSRandall Stewart 	int queue_needed;
553f8829a4aSRandall Stewart 	uint16_t nxt_todel;
554f8829a4aSRandall Stewart 	struct mbuf *oper;
555f8829a4aSRandall Stewart 
556f8829a4aSRandall Stewart 	queue_needed = 1;
557f8829a4aSRandall Stewart 	asoc->size_on_all_streams += control->length;
558f8829a4aSRandall Stewart 	sctp_ucount_incr(asoc->cnt_on_all_streams);
559f8829a4aSRandall Stewart 	strm = &asoc->strmin[control->sinfo_stream];
560f8829a4aSRandall Stewart 	nxt_todel = strm->last_sequence_delivered + 1;
561f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
562f8829a4aSRandall Stewart 	sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
563f8829a4aSRandall Stewart #endif
564ad81507eSRandall Stewart 	SCTPDBG(SCTP_DEBUG_INDATA1,
565ad81507eSRandall Stewart 	    "queue to stream called for ssn:%u lastdel:%u nxt:%u\n",
566f8829a4aSRandall Stewart 	    (uint32_t) control->sinfo_stream,
567ad81507eSRandall Stewart 	    (uint32_t) strm->last_sequence_delivered,
568ad81507eSRandall Stewart 	    (uint32_t) nxt_todel);
569f8829a4aSRandall Stewart 	if (compare_with_wrap(strm->last_sequence_delivered,
570f8829a4aSRandall Stewart 	    control->sinfo_ssn, MAX_SEQ) ||
571f8829a4aSRandall Stewart 	    (strm->last_sequence_delivered == control->sinfo_ssn)) {
572f8829a4aSRandall Stewart 		/* The incoming sseq is behind where we last delivered? */
573ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INDATA1, "Duplicate S-SEQ:%d delivered:%d from peer, Abort  association\n",
574ad81507eSRandall Stewart 		    control->sinfo_ssn, strm->last_sequence_delivered);
575f8829a4aSRandall Stewart 		/*
576f8829a4aSRandall Stewart 		 * throw it in the stream so it gets cleaned up in
577f8829a4aSRandall Stewart 		 * association destruction
578f8829a4aSRandall Stewart 		 */
579f8829a4aSRandall Stewart 		TAILQ_INSERT_HEAD(&strm->inqueue, control, next);
580139bc87fSRandall Stewart 		oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
581f8829a4aSRandall Stewart 		    0, M_DONTWAIT, 1, MT_DATA);
582f8829a4aSRandall Stewart 		if (oper) {
583f8829a4aSRandall Stewart 			struct sctp_paramhdr *ph;
584f8829a4aSRandall Stewart 			uint32_t *ippp;
585f8829a4aSRandall Stewart 
586139bc87fSRandall Stewart 			SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
587f8829a4aSRandall Stewart 			    (sizeof(uint32_t) * 3);
588f8829a4aSRandall Stewart 			ph = mtod(oper, struct sctp_paramhdr *);
589f8829a4aSRandall Stewart 			ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
590139bc87fSRandall Stewart 			ph->param_length = htons(SCTP_BUF_LEN(oper));
591f8829a4aSRandall Stewart 			ippp = (uint32_t *) (ph + 1);
592a5d547adSRandall Stewart 			*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_1);
593f8829a4aSRandall Stewart 			ippp++;
594f8829a4aSRandall Stewart 			*ippp = control->sinfo_tsn;
595f8829a4aSRandall Stewart 			ippp++;
596f8829a4aSRandall Stewart 			*ippp = ((control->sinfo_stream << 16) | control->sinfo_ssn);
597f8829a4aSRandall Stewart 		}
598a5d547adSRandall Stewart 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_1;
599f8829a4aSRandall Stewart 		sctp_abort_an_association(stcb->sctp_ep, stcb,
600f8829a4aSRandall Stewart 		    SCTP_PEER_FAULTY, oper);
601f8829a4aSRandall Stewart 
602f8829a4aSRandall Stewart 		*abort_flag = 1;
603f8829a4aSRandall Stewart 		return;
604f8829a4aSRandall Stewart 
605f8829a4aSRandall Stewart 	}
606f8829a4aSRandall Stewart 	if (nxt_todel == control->sinfo_ssn) {
607f8829a4aSRandall Stewart 		/* can be delivered right away? */
608f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
609f8829a4aSRandall Stewart 		sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
610f8829a4aSRandall Stewart #endif
611f8829a4aSRandall Stewart 		queue_needed = 0;
612f8829a4aSRandall Stewart 		asoc->size_on_all_streams -= control->length;
613f8829a4aSRandall Stewart 		sctp_ucount_decr(asoc->cnt_on_all_streams);
614f8829a4aSRandall Stewart 		strm->last_sequence_delivered++;
615f8829a4aSRandall Stewart 		sctp_add_to_readq(stcb->sctp_ep, stcb,
616f8829a4aSRandall Stewart 		    control,
617f8829a4aSRandall Stewart 		    &stcb->sctp_socket->so_rcv, 1);
618f8829a4aSRandall Stewart 		control = TAILQ_FIRST(&strm->inqueue);
619f8829a4aSRandall Stewart 		while (control != NULL) {
620f8829a4aSRandall Stewart 			/* all delivered */
621f8829a4aSRandall Stewart 			nxt_todel = strm->last_sequence_delivered + 1;
622f8829a4aSRandall Stewart 			if (nxt_todel == control->sinfo_ssn) {
623f8829a4aSRandall Stewart 				at = TAILQ_NEXT(control, next);
624f8829a4aSRandall Stewart 				TAILQ_REMOVE(&strm->inqueue, control, next);
625f8829a4aSRandall Stewart 				asoc->size_on_all_streams -= control->length;
626f8829a4aSRandall Stewart 				sctp_ucount_decr(asoc->cnt_on_all_streams);
627f8829a4aSRandall Stewart 				strm->last_sequence_delivered++;
628f8829a4aSRandall Stewart 				/*
629f8829a4aSRandall Stewart 				 * We ignore the return of deliver_data here
630f8829a4aSRandall Stewart 				 * since we always can hold the chunk on the
631f8829a4aSRandall Stewart 				 * d-queue. And we have a finite number that
632f8829a4aSRandall Stewart 				 * can be delivered from the strq.
633f8829a4aSRandall Stewart 				 */
634f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
635f8829a4aSRandall Stewart 				sctp_log_strm_del(control, NULL,
636f8829a4aSRandall Stewart 				    SCTP_STR_LOG_FROM_IMMED_DEL);
637f8829a4aSRandall Stewart #endif
638f8829a4aSRandall Stewart 				sctp_add_to_readq(stcb->sctp_ep, stcb,
639f8829a4aSRandall Stewart 				    control,
640f8829a4aSRandall Stewart 				    &stcb->sctp_socket->so_rcv, 1);
641f8829a4aSRandall Stewart 				control = at;
642f8829a4aSRandall Stewart 				continue;
643f8829a4aSRandall Stewart 			}
644f8829a4aSRandall Stewart 			break;
645f8829a4aSRandall Stewart 		}
646f8829a4aSRandall Stewart 	}
647f8829a4aSRandall Stewart 	if (queue_needed) {
648f8829a4aSRandall Stewart 		/*
649f8829a4aSRandall Stewart 		 * Ok, we did not deliver this guy, find the correct place
650f8829a4aSRandall Stewart 		 * to put it on the queue.
651f8829a4aSRandall Stewart 		 */
652f8829a4aSRandall Stewart 		if (TAILQ_EMPTY(&strm->inqueue)) {
653f8829a4aSRandall Stewart 			/* Empty queue */
654f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
655f8829a4aSRandall Stewart 			sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INSERT_HD);
656f8829a4aSRandall Stewart #endif
657f8829a4aSRandall Stewart 			TAILQ_INSERT_HEAD(&strm->inqueue, control, next);
658f8829a4aSRandall Stewart 		} else {
659f8829a4aSRandall Stewart 			TAILQ_FOREACH(at, &strm->inqueue, next) {
660f8829a4aSRandall Stewart 				if (compare_with_wrap(at->sinfo_ssn,
661f8829a4aSRandall Stewart 				    control->sinfo_ssn, MAX_SEQ)) {
662f8829a4aSRandall Stewart 					/*
663f8829a4aSRandall Stewart 					 * one in queue is bigger than the
664f8829a4aSRandall Stewart 					 * new one, insert before this one
665f8829a4aSRandall Stewart 					 */
666f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
667f8829a4aSRandall Stewart 					sctp_log_strm_del(control, at,
668f8829a4aSRandall Stewart 					    SCTP_STR_LOG_FROM_INSERT_MD);
669f8829a4aSRandall Stewart #endif
670f8829a4aSRandall Stewart 					TAILQ_INSERT_BEFORE(at, control, next);
671f8829a4aSRandall Stewart 					break;
672f8829a4aSRandall Stewart 				} else if (at->sinfo_ssn == control->sinfo_ssn) {
673f8829a4aSRandall Stewart 					/*
674f8829a4aSRandall Stewart 					 * Gak, He sent me a duplicate str
675f8829a4aSRandall Stewart 					 * seq number
676f8829a4aSRandall Stewart 					 */
677f8829a4aSRandall Stewart 					/*
678f8829a4aSRandall Stewart 					 * foo bar, I guess I will just free
679f8829a4aSRandall Stewart 					 * this new guy, should we abort
680f8829a4aSRandall Stewart 					 * too? FIX ME MAYBE? Or it COULD be
681f8829a4aSRandall Stewart 					 * that the SSN's have wrapped.
682f8829a4aSRandall Stewart 					 * Maybe I should compare to TSN
683f8829a4aSRandall Stewart 					 * somehow... sigh for now just blow
684f8829a4aSRandall Stewart 					 * away the chunk!
685f8829a4aSRandall Stewart 					 */
686f8829a4aSRandall Stewart 
687f8829a4aSRandall Stewart 					if (control->data)
688f8829a4aSRandall Stewart 						sctp_m_freem(control->data);
689f8829a4aSRandall Stewart 					control->data = NULL;
690f8829a4aSRandall Stewart 					asoc->size_on_all_streams -= control->length;
691f8829a4aSRandall Stewart 					sctp_ucount_decr(asoc->cnt_on_all_streams);
692f8829a4aSRandall Stewart 					sctp_free_remote_addr(control->whoFrom);
693f8829a4aSRandall Stewart 					sctp_free_a_readq(stcb, control);
694f8829a4aSRandall Stewart 					return;
695f8829a4aSRandall Stewart 				} else {
696f8829a4aSRandall Stewart 					if (TAILQ_NEXT(at, next) == NULL) {
697f8829a4aSRandall Stewart 						/*
698f8829a4aSRandall Stewart 						 * We are at the end, insert
699f8829a4aSRandall Stewart 						 * it after this one
700f8829a4aSRandall Stewart 						 */
701f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
702f8829a4aSRandall Stewart 						sctp_log_strm_del(control, at,
703f8829a4aSRandall Stewart 						    SCTP_STR_LOG_FROM_INSERT_TL);
704f8829a4aSRandall Stewart #endif
705f8829a4aSRandall Stewart 						TAILQ_INSERT_AFTER(&strm->inqueue,
706f8829a4aSRandall Stewart 						    at, control, next);
707f8829a4aSRandall Stewart 						break;
708f8829a4aSRandall Stewart 					}
709f8829a4aSRandall Stewart 				}
710f8829a4aSRandall Stewart 			}
711f8829a4aSRandall Stewart 		}
712f8829a4aSRandall Stewart 	}
713f8829a4aSRandall Stewart }
714f8829a4aSRandall Stewart 
715f8829a4aSRandall Stewart /*
716f8829a4aSRandall Stewart  * Returns two things: You get the total size of the deliverable parts of the
717f8829a4aSRandall Stewart  * first fragmented message on the reassembly queue. And you get a 1 back if
718f8829a4aSRandall Stewart  * all of the message is ready or a 0 back if the message is still incomplete
719f8829a4aSRandall Stewart  */
720f8829a4aSRandall Stewart static int
721f8829a4aSRandall Stewart sctp_is_all_msg_on_reasm(struct sctp_association *asoc, uint32_t * t_size)
722f8829a4aSRandall Stewart {
723f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
724f8829a4aSRandall Stewart 	uint32_t tsn;
725f8829a4aSRandall Stewart 
726f8829a4aSRandall Stewart 	*t_size = 0;
727f8829a4aSRandall Stewart 	chk = TAILQ_FIRST(&asoc->reasmqueue);
728f8829a4aSRandall Stewart 	if (chk == NULL) {
729f8829a4aSRandall Stewart 		/* nothing on the queue */
730f8829a4aSRandall Stewart 		return (0);
731f8829a4aSRandall Stewart 	}
732f8829a4aSRandall Stewart 	if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
733f8829a4aSRandall Stewart 		/* Not a first on the queue */
734f8829a4aSRandall Stewart 		return (0);
735f8829a4aSRandall Stewart 	}
736f8829a4aSRandall Stewart 	tsn = chk->rec.data.TSN_seq;
737f8829a4aSRandall Stewart 	while (chk) {
738f8829a4aSRandall Stewart 		if (tsn != chk->rec.data.TSN_seq) {
739f8829a4aSRandall Stewart 			return (0);
740f8829a4aSRandall Stewart 		}
741f8829a4aSRandall Stewart 		*t_size += chk->send_size;
742f8829a4aSRandall Stewart 		if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
743f8829a4aSRandall Stewart 			return (1);
744f8829a4aSRandall Stewart 		}
745f8829a4aSRandall Stewart 		tsn++;
746f8829a4aSRandall Stewart 		chk = TAILQ_NEXT(chk, sctp_next);
747f8829a4aSRandall Stewart 	}
748f8829a4aSRandall Stewart 	return (0);
749f8829a4aSRandall Stewart }
750f8829a4aSRandall Stewart 
751f8829a4aSRandall Stewart static void
752f8829a4aSRandall Stewart sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc)
753f8829a4aSRandall Stewart {
754f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
755f8829a4aSRandall Stewart 	uint16_t nxt_todel;
756f8829a4aSRandall Stewart 	uint32_t tsize;
757f8829a4aSRandall Stewart 
758139bc87fSRandall Stewart doit_again:
759f8829a4aSRandall Stewart 	chk = TAILQ_FIRST(&asoc->reasmqueue);
760f8829a4aSRandall Stewart 	if (chk == NULL) {
761f8829a4aSRandall Stewart 		/* Huh? */
762f8829a4aSRandall Stewart 		asoc->size_on_reasm_queue = 0;
763f8829a4aSRandall Stewart 		asoc->cnt_on_reasm_queue = 0;
764f8829a4aSRandall Stewart 		return;
765f8829a4aSRandall Stewart 	}
766f8829a4aSRandall Stewart 	if (asoc->fragmented_delivery_inprogress == 0) {
767f8829a4aSRandall Stewart 		nxt_todel =
768f8829a4aSRandall Stewart 		    asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
769f8829a4aSRandall Stewart 		if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
770f8829a4aSRandall Stewart 		    (nxt_todel == chk->rec.data.stream_seq ||
771f8829a4aSRandall Stewart 		    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
772f8829a4aSRandall Stewart 			/*
773f8829a4aSRandall Stewart 			 * Yep the first one is here and its ok to deliver
774f8829a4aSRandall Stewart 			 * but should we?
775f8829a4aSRandall Stewart 			 */
776f8829a4aSRandall Stewart 			if ((sctp_is_all_msg_on_reasm(asoc, &tsize) ||
777f8829a4aSRandall Stewart 			    (tsize > stcb->sctp_ep->partial_delivery_point))) {
778f8829a4aSRandall Stewart 
779f8829a4aSRandall Stewart 				/*
780f8829a4aSRandall Stewart 				 * Yes, we setup to start reception, by
781f8829a4aSRandall Stewart 				 * backing down the TSN just in case we
782f8829a4aSRandall Stewart 				 * can't deliver. If we
783f8829a4aSRandall Stewart 				 */
784f8829a4aSRandall Stewart 				asoc->fragmented_delivery_inprogress = 1;
785f8829a4aSRandall Stewart 				asoc->tsn_last_delivered =
786f8829a4aSRandall Stewart 				    chk->rec.data.TSN_seq - 1;
787f8829a4aSRandall Stewart 				asoc->str_of_pdapi =
788f8829a4aSRandall Stewart 				    chk->rec.data.stream_number;
789f8829a4aSRandall Stewart 				asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
790f8829a4aSRandall Stewart 				asoc->pdapi_ppid = chk->rec.data.payloadtype;
791f8829a4aSRandall Stewart 				asoc->fragment_flags = chk->rec.data.rcv_flags;
792f8829a4aSRandall Stewart 				sctp_service_reassembly(stcb, asoc);
793f8829a4aSRandall Stewart 			}
794f8829a4aSRandall Stewart 		}
795f8829a4aSRandall Stewart 	} else {
796139bc87fSRandall Stewart 		/*
797139bc87fSRandall Stewart 		 * Service re-assembly will deliver stream data queued at
798139bc87fSRandall Stewart 		 * the end of fragmented delivery.. but it wont know to go
799139bc87fSRandall Stewart 		 * back and call itself again... we do that here with the
800139bc87fSRandall Stewart 		 * got doit_again
801139bc87fSRandall Stewart 		 */
802f8829a4aSRandall Stewart 		sctp_service_reassembly(stcb, asoc);
803139bc87fSRandall Stewart 		if (asoc->fragmented_delivery_inprogress == 0) {
804139bc87fSRandall Stewart 			/*
805139bc87fSRandall Stewart 			 * finished our Fragmented delivery, could be more
806139bc87fSRandall Stewart 			 * waiting?
807139bc87fSRandall Stewart 			 */
808139bc87fSRandall Stewart 			goto doit_again;
809139bc87fSRandall Stewart 		}
810f8829a4aSRandall Stewart 	}
811f8829a4aSRandall Stewart }
812f8829a4aSRandall Stewart 
813f8829a4aSRandall Stewart /*
814f8829a4aSRandall Stewart  * Dump onto the re-assembly queue, in its proper place. After dumping on the
815f8829a4aSRandall Stewart  * queue, see if anthing can be delivered. If so pull it off (or as much as
816f8829a4aSRandall Stewart  * we can. If we run out of space then we must dump what we can and set the
817f8829a4aSRandall Stewart  * appropriate flag to say we queued what we could.
818f8829a4aSRandall Stewart  */
819f8829a4aSRandall Stewart static void
820f8829a4aSRandall Stewart sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
821f8829a4aSRandall Stewart     struct sctp_tmit_chunk *chk, int *abort_flag)
822f8829a4aSRandall Stewart {
823f8829a4aSRandall Stewart 	struct mbuf *oper;
824f8829a4aSRandall Stewart 	uint32_t cum_ackp1, last_tsn, prev_tsn, post_tsn;
825f8829a4aSRandall Stewart 	u_char last_flags;
826f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *at, *prev, *next;
827f8829a4aSRandall Stewart 
828f8829a4aSRandall Stewart 	prev = next = NULL;
829f8829a4aSRandall Stewart 	cum_ackp1 = asoc->tsn_last_delivered + 1;
830f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&asoc->reasmqueue)) {
831f8829a4aSRandall Stewart 		/* This is the first one on the queue */
832f8829a4aSRandall Stewart 		TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next);
833f8829a4aSRandall Stewart 		/*
834f8829a4aSRandall Stewart 		 * we do not check for delivery of anything when only one
835f8829a4aSRandall Stewart 		 * fragment is here
836f8829a4aSRandall Stewart 		 */
837f8829a4aSRandall Stewart 		asoc->size_on_reasm_queue = chk->send_size;
838f8829a4aSRandall Stewart 		sctp_ucount_incr(asoc->cnt_on_reasm_queue);
839f8829a4aSRandall Stewart 		if (chk->rec.data.TSN_seq == cum_ackp1) {
840f8829a4aSRandall Stewart 			if (asoc->fragmented_delivery_inprogress == 0 &&
841f8829a4aSRandall Stewart 			    (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) !=
842f8829a4aSRandall Stewart 			    SCTP_DATA_FIRST_FRAG) {
843f8829a4aSRandall Stewart 				/*
844f8829a4aSRandall Stewart 				 * An empty queue, no delivery inprogress,
845f8829a4aSRandall Stewart 				 * we hit the next one and it does NOT have
846f8829a4aSRandall Stewart 				 * a FIRST fragment mark.
847f8829a4aSRandall Stewart 				 */
848ad81507eSRandall Stewart 				SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, its not first, no fragmented delivery in progress\n");
849139bc87fSRandall Stewart 				oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
850f8829a4aSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
851f8829a4aSRandall Stewart 
852f8829a4aSRandall Stewart 				if (oper) {
853f8829a4aSRandall Stewart 					struct sctp_paramhdr *ph;
854f8829a4aSRandall Stewart 					uint32_t *ippp;
855f8829a4aSRandall Stewart 
856139bc87fSRandall Stewart 					SCTP_BUF_LEN(oper) =
857f8829a4aSRandall Stewart 					    sizeof(struct sctp_paramhdr) +
858f8829a4aSRandall Stewart 					    (sizeof(uint32_t) * 3);
859f8829a4aSRandall Stewart 					ph = mtod(oper, struct sctp_paramhdr *);
860f8829a4aSRandall Stewart 					ph->param_type =
861f8829a4aSRandall Stewart 					    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
862139bc87fSRandall Stewart 					ph->param_length = htons(SCTP_BUF_LEN(oper));
863f8829a4aSRandall Stewart 					ippp = (uint32_t *) (ph + 1);
864a5d547adSRandall Stewart 					*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_2);
865f8829a4aSRandall Stewart 					ippp++;
866f8829a4aSRandall Stewart 					*ippp = chk->rec.data.TSN_seq;
867f8829a4aSRandall Stewart 					ippp++;
868f8829a4aSRandall Stewart 					*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
869f8829a4aSRandall Stewart 
870f8829a4aSRandall Stewart 				}
871a5d547adSRandall Stewart 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_2;
872f8829a4aSRandall Stewart 				sctp_abort_an_association(stcb->sctp_ep, stcb,
873f8829a4aSRandall Stewart 				    SCTP_PEER_FAULTY, oper);
874f8829a4aSRandall Stewart 				*abort_flag = 1;
875f8829a4aSRandall Stewart 			} else if (asoc->fragmented_delivery_inprogress &&
876f8829a4aSRandall Stewart 			    (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
877f8829a4aSRandall Stewart 				/*
878f8829a4aSRandall Stewart 				 * We are doing a partial delivery and the
879f8829a4aSRandall Stewart 				 * NEXT chunk MUST be either the LAST or
880f8829a4aSRandall Stewart 				 * MIDDLE fragment NOT a FIRST
881f8829a4aSRandall Stewart 				 */
882ad81507eSRandall Stewart 				SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it IS a first and fragmented delivery in progress\n");
883139bc87fSRandall Stewart 				oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
884f8829a4aSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
885f8829a4aSRandall Stewart 				if (oper) {
886f8829a4aSRandall Stewart 					struct sctp_paramhdr *ph;
887f8829a4aSRandall Stewart 					uint32_t *ippp;
888f8829a4aSRandall Stewart 
889139bc87fSRandall Stewart 					SCTP_BUF_LEN(oper) =
890f8829a4aSRandall Stewart 					    sizeof(struct sctp_paramhdr) +
891f8829a4aSRandall Stewart 					    (3 * sizeof(uint32_t));
892f8829a4aSRandall Stewart 					ph = mtod(oper, struct sctp_paramhdr *);
893f8829a4aSRandall Stewart 					ph->param_type =
894f8829a4aSRandall Stewart 					    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
895139bc87fSRandall Stewart 					ph->param_length = htons(SCTP_BUF_LEN(oper));
896f8829a4aSRandall Stewart 					ippp = (uint32_t *) (ph + 1);
897a5d547adSRandall Stewart 					*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_3);
898f8829a4aSRandall Stewart 					ippp++;
899f8829a4aSRandall Stewart 					*ippp = chk->rec.data.TSN_seq;
900f8829a4aSRandall Stewart 					ippp++;
901f8829a4aSRandall Stewart 					*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
902f8829a4aSRandall Stewart 				}
903a5d547adSRandall Stewart 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_3;
904f8829a4aSRandall Stewart 				sctp_abort_an_association(stcb->sctp_ep, stcb,
905f8829a4aSRandall Stewart 				    SCTP_PEER_FAULTY, oper);
906f8829a4aSRandall Stewart 				*abort_flag = 1;
907f8829a4aSRandall Stewart 			} else if (asoc->fragmented_delivery_inprogress) {
908f8829a4aSRandall Stewart 				/*
909f8829a4aSRandall Stewart 				 * Here we are ok with a MIDDLE or LAST
910f8829a4aSRandall Stewart 				 * piece
911f8829a4aSRandall Stewart 				 */
912f8829a4aSRandall Stewart 				if (chk->rec.data.stream_number !=
913f8829a4aSRandall Stewart 				    asoc->str_of_pdapi) {
914f8829a4aSRandall Stewart 					/* Got to be the right STR No */
915ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it IS not same stream number %d vs %d\n",
916f8829a4aSRandall Stewart 					    chk->rec.data.stream_number,
917f8829a4aSRandall Stewart 					    asoc->str_of_pdapi);
918139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
919f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
920f8829a4aSRandall Stewart 					if (oper) {
921f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
922f8829a4aSRandall Stewart 						uint32_t *ippp;
923f8829a4aSRandall Stewart 
924139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
925f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
926f8829a4aSRandall Stewart 						    (sizeof(uint32_t) * 3);
927f8829a4aSRandall Stewart 						ph = mtod(oper,
928f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
929f8829a4aSRandall Stewart 						ph->param_type =
930f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
931f8829a4aSRandall Stewart 						ph->param_length =
932139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
933f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
934a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_4);
935f8829a4aSRandall Stewart 						ippp++;
936f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
937f8829a4aSRandall Stewart 						ippp++;
938f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
939f8829a4aSRandall Stewart 					}
940a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_4;
941f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
942f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
943f8829a4aSRandall Stewart 					*abort_flag = 1;
944f8829a4aSRandall Stewart 				} else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) !=
945f8829a4aSRandall Stewart 					    SCTP_DATA_UNORDERED &&
946f8829a4aSRandall Stewart 					    chk->rec.data.stream_seq !=
947f8829a4aSRandall Stewart 				    asoc->ssn_of_pdapi) {
948f8829a4aSRandall Stewart 					/* Got to be the right STR Seq */
949ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it IS not same stream seq %d vs %d\n",
950f8829a4aSRandall Stewart 					    chk->rec.data.stream_seq,
951f8829a4aSRandall Stewart 					    asoc->ssn_of_pdapi);
952139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
953f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
954f8829a4aSRandall Stewart 					if (oper) {
955f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
956f8829a4aSRandall Stewart 						uint32_t *ippp;
957f8829a4aSRandall Stewart 
958139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
959f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
960f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
961f8829a4aSRandall Stewart 						ph = mtod(oper,
962f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
963f8829a4aSRandall Stewart 						ph->param_type =
964f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
965f8829a4aSRandall Stewart 						ph->param_length =
966139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
967f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
968a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_5);
969f8829a4aSRandall Stewart 						ippp++;
970f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
971f8829a4aSRandall Stewart 						ippp++;
972f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
973f8829a4aSRandall Stewart 
974f8829a4aSRandall Stewart 					}
975a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_5;
976f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
977f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
978f8829a4aSRandall Stewart 					*abort_flag = 1;
979f8829a4aSRandall Stewart 				}
980f8829a4aSRandall Stewart 			}
981f8829a4aSRandall Stewart 		}
982f8829a4aSRandall Stewart 		return;
983f8829a4aSRandall Stewart 	}
984f8829a4aSRandall Stewart 	/* Find its place */
985f8829a4aSRandall Stewart 	TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
986f8829a4aSRandall Stewart 		if (compare_with_wrap(at->rec.data.TSN_seq,
987f8829a4aSRandall Stewart 		    chk->rec.data.TSN_seq, MAX_TSN)) {
988f8829a4aSRandall Stewart 			/*
989f8829a4aSRandall Stewart 			 * one in queue is bigger than the new one, insert
990f8829a4aSRandall Stewart 			 * before this one
991f8829a4aSRandall Stewart 			 */
992f8829a4aSRandall Stewart 			/* A check */
993f8829a4aSRandall Stewart 			asoc->size_on_reasm_queue += chk->send_size;
994f8829a4aSRandall Stewart 			sctp_ucount_incr(asoc->cnt_on_reasm_queue);
995f8829a4aSRandall Stewart 			next = at;
996f8829a4aSRandall Stewart 			TAILQ_INSERT_BEFORE(at, chk, sctp_next);
997f8829a4aSRandall Stewart 			break;
998f8829a4aSRandall Stewart 		} else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) {
999f8829a4aSRandall Stewart 			/* Gak, He sent me a duplicate str seq number */
1000f8829a4aSRandall Stewart 			/*
1001f8829a4aSRandall Stewart 			 * foo bar, I guess I will just free this new guy,
1002f8829a4aSRandall Stewart 			 * should we abort too? FIX ME MAYBE? Or it COULD be
1003f8829a4aSRandall Stewart 			 * that the SSN's have wrapped. Maybe I should
1004f8829a4aSRandall Stewart 			 * compare to TSN somehow... sigh for now just blow
1005f8829a4aSRandall Stewart 			 * away the chunk!
1006f8829a4aSRandall Stewart 			 */
1007f8829a4aSRandall Stewart 			if (chk->data) {
1008f8829a4aSRandall Stewart 				sctp_m_freem(chk->data);
1009f8829a4aSRandall Stewart 				chk->data = NULL;
1010f8829a4aSRandall Stewart 			}
1011f8829a4aSRandall Stewart 			sctp_free_remote_addr(chk->whoTo);
1012f8829a4aSRandall Stewart 			sctp_free_a_chunk(stcb, chk);
1013f8829a4aSRandall Stewart 			return;
1014f8829a4aSRandall Stewart 		} else {
1015f8829a4aSRandall Stewart 			last_flags = at->rec.data.rcv_flags;
1016f8829a4aSRandall Stewart 			last_tsn = at->rec.data.TSN_seq;
1017f8829a4aSRandall Stewart 			prev = at;
1018f8829a4aSRandall Stewart 			if (TAILQ_NEXT(at, sctp_next) == NULL) {
1019f8829a4aSRandall Stewart 				/*
1020f8829a4aSRandall Stewart 				 * We are at the end, insert it after this
1021f8829a4aSRandall Stewart 				 * one
1022f8829a4aSRandall Stewart 				 */
1023f8829a4aSRandall Stewart 				/* check it first */
1024f8829a4aSRandall Stewart 				asoc->size_on_reasm_queue += chk->send_size;
1025f8829a4aSRandall Stewart 				sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1026f8829a4aSRandall Stewart 				TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next);
1027f8829a4aSRandall Stewart 				break;
1028f8829a4aSRandall Stewart 			}
1029f8829a4aSRandall Stewart 		}
1030f8829a4aSRandall Stewart 	}
1031f8829a4aSRandall Stewart 	/* Now the audits */
1032f8829a4aSRandall Stewart 	if (prev) {
1033f8829a4aSRandall Stewart 		prev_tsn = chk->rec.data.TSN_seq - 1;
1034f8829a4aSRandall Stewart 		if (prev_tsn == prev->rec.data.TSN_seq) {
1035f8829a4aSRandall Stewart 			/*
1036f8829a4aSRandall Stewart 			 * Ok the one I am dropping onto the end is the
1037f8829a4aSRandall Stewart 			 * NEXT. A bit of valdiation here.
1038f8829a4aSRandall Stewart 			 */
1039f8829a4aSRandall Stewart 			if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1040f8829a4aSRandall Stewart 			    SCTP_DATA_FIRST_FRAG ||
1041f8829a4aSRandall Stewart 			    (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1042f8829a4aSRandall Stewart 			    SCTP_DATA_MIDDLE_FRAG) {
1043f8829a4aSRandall Stewart 				/*
1044f8829a4aSRandall Stewart 				 * Insert chk MUST be a MIDDLE or LAST
1045f8829a4aSRandall Stewart 				 * fragment
1046f8829a4aSRandall Stewart 				 */
1047f8829a4aSRandall Stewart 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1048f8829a4aSRandall Stewart 				    SCTP_DATA_FIRST_FRAG) {
1049ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - It can be a midlle or last but not a first\n");
1050ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it's a FIRST!\n");
1051139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1052f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1053f8829a4aSRandall Stewart 					if (oper) {
1054f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1055f8829a4aSRandall Stewart 						uint32_t *ippp;
1056f8829a4aSRandall Stewart 
1057139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1058f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1059f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1060f8829a4aSRandall Stewart 						ph = mtod(oper,
1061f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1062f8829a4aSRandall Stewart 						ph->param_type =
1063f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1064f8829a4aSRandall Stewart 						ph->param_length =
1065139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1066f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1067a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_6);
1068f8829a4aSRandall Stewart 						ippp++;
1069f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1070f8829a4aSRandall Stewart 						ippp++;
1071f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1072f8829a4aSRandall Stewart 
1073f8829a4aSRandall Stewart 					}
1074a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_6;
1075f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1076f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1077f8829a4aSRandall Stewart 					*abort_flag = 1;
1078f8829a4aSRandall Stewart 					return;
1079f8829a4aSRandall Stewart 				}
1080f8829a4aSRandall Stewart 				if (chk->rec.data.stream_number !=
1081f8829a4aSRandall Stewart 				    prev->rec.data.stream_number) {
1082f8829a4aSRandall Stewart 					/*
1083f8829a4aSRandall Stewart 					 * Huh, need the correct STR here,
1084f8829a4aSRandall Stewart 					 * they must be the same.
1085f8829a4aSRandall Stewart 					 */
1086ad81507eSRandall Stewart 					SCTP_PRINTF("Prev check - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1087f8829a4aSRandall Stewart 					    chk->rec.data.stream_number,
1088f8829a4aSRandall Stewart 					    prev->rec.data.stream_number);
1089139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1090f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1091f8829a4aSRandall Stewart 					if (oper) {
1092f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1093f8829a4aSRandall Stewart 						uint32_t *ippp;
1094f8829a4aSRandall Stewart 
1095139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1096f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1097f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1098f8829a4aSRandall Stewart 						ph = mtod(oper,
1099f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1100f8829a4aSRandall Stewart 						ph->param_type =
1101f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1102f8829a4aSRandall Stewart 						ph->param_length =
1103139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1104f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1105a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_7);
1106f8829a4aSRandall Stewart 						ippp++;
1107f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1108f8829a4aSRandall Stewart 						ippp++;
1109f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1110f8829a4aSRandall Stewart 					}
1111a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_7;
1112f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1113f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1114f8829a4aSRandall Stewart 
1115f8829a4aSRandall Stewart 					*abort_flag = 1;
1116f8829a4aSRandall Stewart 					return;
1117f8829a4aSRandall Stewart 				}
1118f8829a4aSRandall Stewart 				if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1119f8829a4aSRandall Stewart 				    chk->rec.data.stream_seq !=
1120f8829a4aSRandall Stewart 				    prev->rec.data.stream_seq) {
1121f8829a4aSRandall Stewart 					/*
1122f8829a4aSRandall Stewart 					 * Huh, need the correct STR here,
1123f8829a4aSRandall Stewart 					 * they must be the same.
1124f8829a4aSRandall Stewart 					 */
1125ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1126f8829a4aSRandall Stewart 					    chk->rec.data.stream_seq,
1127f8829a4aSRandall Stewart 					    prev->rec.data.stream_seq);
1128139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1129f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1130f8829a4aSRandall Stewart 					if (oper) {
1131f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1132f8829a4aSRandall Stewart 						uint32_t *ippp;
1133f8829a4aSRandall Stewart 
1134139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1135f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1136f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1137f8829a4aSRandall Stewart 						ph = mtod(oper,
1138f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1139f8829a4aSRandall Stewart 						ph->param_type =
1140f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1141f8829a4aSRandall Stewart 						ph->param_length =
1142139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1143f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1144a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_8);
1145f8829a4aSRandall Stewart 						ippp++;
1146f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1147f8829a4aSRandall Stewart 						ippp++;
1148f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1149f8829a4aSRandall Stewart 					}
1150a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_8;
1151f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1152f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1153f8829a4aSRandall Stewart 
1154f8829a4aSRandall Stewart 					*abort_flag = 1;
1155f8829a4aSRandall Stewart 					return;
1156f8829a4aSRandall Stewart 				}
1157f8829a4aSRandall Stewart 			} else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1158f8829a4aSRandall Stewart 			    SCTP_DATA_LAST_FRAG) {
1159f8829a4aSRandall Stewart 				/* Insert chk MUST be a FIRST */
1160f8829a4aSRandall Stewart 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1161f8829a4aSRandall Stewart 				    SCTP_DATA_FIRST_FRAG) {
1162ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - Gak, evil plot, its not FIRST and it must be!\n");
1163139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1164f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1165f8829a4aSRandall Stewart 					if (oper) {
1166f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1167f8829a4aSRandall Stewart 						uint32_t *ippp;
1168f8829a4aSRandall Stewart 
1169139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1170f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1171f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1172f8829a4aSRandall Stewart 						ph = mtod(oper,
1173f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1174f8829a4aSRandall Stewart 						ph->param_type =
1175f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1176f8829a4aSRandall Stewart 						ph->param_length =
1177139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1178f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1179a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
1180f8829a4aSRandall Stewart 						ippp++;
1181f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1182f8829a4aSRandall Stewart 						ippp++;
1183f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1184f8829a4aSRandall Stewart 
1185f8829a4aSRandall Stewart 					}
1186a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_9;
1187f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1188f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1189f8829a4aSRandall Stewart 
1190f8829a4aSRandall Stewart 					*abort_flag = 1;
1191f8829a4aSRandall Stewart 					return;
1192f8829a4aSRandall Stewart 				}
1193f8829a4aSRandall Stewart 			}
1194f8829a4aSRandall Stewart 		}
1195f8829a4aSRandall Stewart 	}
1196f8829a4aSRandall Stewart 	if (next) {
1197f8829a4aSRandall Stewart 		post_tsn = chk->rec.data.TSN_seq + 1;
1198f8829a4aSRandall Stewart 		if (post_tsn == next->rec.data.TSN_seq) {
1199f8829a4aSRandall Stewart 			/*
1200f8829a4aSRandall Stewart 			 * Ok the one I am inserting ahead of is my NEXT
1201f8829a4aSRandall Stewart 			 * one. A bit of valdiation here.
1202f8829a4aSRandall Stewart 			 */
1203f8829a4aSRandall Stewart 			if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1204f8829a4aSRandall Stewart 				/* Insert chk MUST be a last fragment */
1205f8829a4aSRandall Stewart 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK)
1206f8829a4aSRandall Stewart 				    != SCTP_DATA_LAST_FRAG) {
1207ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Next is FIRST, we must be LAST\n");
1208ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, its not a last!\n");
1209139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1210f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1211f8829a4aSRandall Stewart 					if (oper) {
1212f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1213f8829a4aSRandall Stewart 						uint32_t *ippp;
1214f8829a4aSRandall Stewart 
1215139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1216f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1217f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1218f8829a4aSRandall Stewart 						ph = mtod(oper,
1219f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1220f8829a4aSRandall Stewart 						ph->param_type =
1221f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1222f8829a4aSRandall Stewart 						ph->param_length =
1223139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1224f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1225a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
1226f8829a4aSRandall Stewart 						ippp++;
1227f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1228f8829a4aSRandall Stewart 						ippp++;
1229f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1230f8829a4aSRandall Stewart 					}
1231a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_10;
1232f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1233f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1234f8829a4aSRandall Stewart 
1235f8829a4aSRandall Stewart 					*abort_flag = 1;
1236f8829a4aSRandall Stewart 					return;
1237f8829a4aSRandall Stewart 				}
1238f8829a4aSRandall Stewart 			} else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1239f8829a4aSRandall Stewart 				    SCTP_DATA_MIDDLE_FRAG ||
1240f8829a4aSRandall Stewart 				    (next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1241f8829a4aSRandall Stewart 			    SCTP_DATA_LAST_FRAG) {
1242f8829a4aSRandall Stewart 				/*
1243f8829a4aSRandall Stewart 				 * Insert chk CAN be MIDDLE or FIRST NOT
1244f8829a4aSRandall Stewart 				 * LAST
1245f8829a4aSRandall Stewart 				 */
1246f8829a4aSRandall Stewart 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1247f8829a4aSRandall Stewart 				    SCTP_DATA_LAST_FRAG) {
1248ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Next is a MIDDLE/LAST\n");
1249ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, new prev chunk is a LAST\n");
1250139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1251f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1252f8829a4aSRandall Stewart 					if (oper) {
1253f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1254f8829a4aSRandall Stewart 						uint32_t *ippp;
1255f8829a4aSRandall Stewart 
1256139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1257f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1258f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1259f8829a4aSRandall Stewart 						ph = mtod(oper,
1260f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1261f8829a4aSRandall Stewart 						ph->param_type =
1262f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1263f8829a4aSRandall Stewart 						ph->param_length =
1264139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1265f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1266a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
1267f8829a4aSRandall Stewart 						ippp++;
1268f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1269f8829a4aSRandall Stewart 						ippp++;
1270f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1271f8829a4aSRandall Stewart 
1272f8829a4aSRandall Stewart 					}
1273a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_11;
1274f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1275f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1276f8829a4aSRandall Stewart 
1277f8829a4aSRandall Stewart 					*abort_flag = 1;
1278f8829a4aSRandall Stewart 					return;
1279f8829a4aSRandall Stewart 				}
1280f8829a4aSRandall Stewart 				if (chk->rec.data.stream_number !=
1281f8829a4aSRandall Stewart 				    next->rec.data.stream_number) {
1282f8829a4aSRandall Stewart 					/*
1283f8829a4aSRandall Stewart 					 * Huh, need the correct STR here,
1284f8829a4aSRandall Stewart 					 * they must be the same.
1285f8829a4aSRandall Stewart 					 */
1286ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1287f8829a4aSRandall Stewart 					    chk->rec.data.stream_number,
1288f8829a4aSRandall Stewart 					    next->rec.data.stream_number);
1289139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1290f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1291f8829a4aSRandall Stewart 					if (oper) {
1292f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1293f8829a4aSRandall Stewart 						uint32_t *ippp;
1294f8829a4aSRandall Stewart 
1295139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1296f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1297f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1298f8829a4aSRandall Stewart 						ph = mtod(oper,
1299f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1300f8829a4aSRandall Stewart 						ph->param_type =
1301f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1302f8829a4aSRandall Stewart 						ph->param_length =
1303139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1304f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1305a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
1306f8829a4aSRandall Stewart 						ippp++;
1307f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1308f8829a4aSRandall Stewart 						ippp++;
1309f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1310f8829a4aSRandall Stewart 
1311f8829a4aSRandall Stewart 					}
1312a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_12;
1313f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1314f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1315f8829a4aSRandall Stewart 
1316f8829a4aSRandall Stewart 					*abort_flag = 1;
1317f8829a4aSRandall Stewart 					return;
1318f8829a4aSRandall Stewart 				}
1319f8829a4aSRandall Stewart 				if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1320f8829a4aSRandall Stewart 				    chk->rec.data.stream_seq !=
1321f8829a4aSRandall Stewart 				    next->rec.data.stream_seq) {
1322f8829a4aSRandall Stewart 					/*
1323f8829a4aSRandall Stewart 					 * Huh, need the correct STR here,
1324f8829a4aSRandall Stewart 					 * they must be the same.
1325f8829a4aSRandall Stewart 					 */
1326ad81507eSRandall Stewart 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1327f8829a4aSRandall Stewart 					    chk->rec.data.stream_seq,
1328f8829a4aSRandall Stewart 					    next->rec.data.stream_seq);
1329139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1330f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1331f8829a4aSRandall Stewart 					if (oper) {
1332f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1333f8829a4aSRandall Stewart 						uint32_t *ippp;
1334f8829a4aSRandall Stewart 
1335139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1336f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1337f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1338f8829a4aSRandall Stewart 						ph = mtod(oper,
1339f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1340f8829a4aSRandall Stewart 						ph->param_type =
1341f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1342f8829a4aSRandall Stewart 						ph->param_length =
1343139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1344f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1345a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
1346f8829a4aSRandall Stewart 						ippp++;
1347f8829a4aSRandall Stewart 						*ippp = chk->rec.data.TSN_seq;
1348f8829a4aSRandall Stewart 						ippp++;
1349f8829a4aSRandall Stewart 						*ippp = ((chk->rec.data.stream_number << 16) | chk->rec.data.stream_seq);
1350f8829a4aSRandall Stewart 					}
1351a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_13;
1352f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1353f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1354f8829a4aSRandall Stewart 
1355f8829a4aSRandall Stewart 					*abort_flag = 1;
1356f8829a4aSRandall Stewart 					return;
1357f8829a4aSRandall Stewart 
1358f8829a4aSRandall Stewart 				}
1359f8829a4aSRandall Stewart 			}
1360f8829a4aSRandall Stewart 		}
1361f8829a4aSRandall Stewart 	}
1362f8829a4aSRandall Stewart 	/* Do we need to do some delivery? check */
1363f8829a4aSRandall Stewart 	sctp_deliver_reasm_check(stcb, asoc);
1364f8829a4aSRandall Stewart }
1365f8829a4aSRandall Stewart 
1366f8829a4aSRandall Stewart /*
1367f8829a4aSRandall Stewart  * This is an unfortunate routine. It checks to make sure a evil guy is not
1368f8829a4aSRandall Stewart  * stuffing us full of bad packet fragments. A broken peer could also do this
1369f8829a4aSRandall Stewart  * but this is doubtful. It is to bad I must worry about evil crackers sigh
1370f8829a4aSRandall Stewart  * :< more cycles.
1371f8829a4aSRandall Stewart  */
1372f8829a4aSRandall Stewart static int
1373f8829a4aSRandall Stewart sctp_does_tsn_belong_to_reasm(struct sctp_association *asoc,
1374f8829a4aSRandall Stewart     uint32_t TSN_seq)
1375f8829a4aSRandall Stewart {
1376f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *at;
1377f8829a4aSRandall Stewart 	uint32_t tsn_est;
1378f8829a4aSRandall Stewart 
1379f8829a4aSRandall Stewart 	TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1380f8829a4aSRandall Stewart 		if (compare_with_wrap(TSN_seq,
1381f8829a4aSRandall Stewart 		    at->rec.data.TSN_seq, MAX_TSN)) {
1382f8829a4aSRandall Stewart 			/* is it one bigger? */
1383f8829a4aSRandall Stewart 			tsn_est = at->rec.data.TSN_seq + 1;
1384f8829a4aSRandall Stewart 			if (tsn_est == TSN_seq) {
1385f8829a4aSRandall Stewart 				/* yep. It better be a last then */
1386f8829a4aSRandall Stewart 				if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1387f8829a4aSRandall Stewart 				    SCTP_DATA_LAST_FRAG) {
1388f8829a4aSRandall Stewart 					/*
1389f8829a4aSRandall Stewart 					 * Ok this guy belongs next to a guy
1390f8829a4aSRandall Stewart 					 * that is NOT last, it should be a
1391f8829a4aSRandall Stewart 					 * middle/last, not a complete
1392f8829a4aSRandall Stewart 					 * chunk.
1393f8829a4aSRandall Stewart 					 */
1394f8829a4aSRandall Stewart 					return (1);
1395f8829a4aSRandall Stewart 				} else {
1396f8829a4aSRandall Stewart 					/*
1397f8829a4aSRandall Stewart 					 * This guy is ok since its a LAST
1398f8829a4aSRandall Stewart 					 * and the new chunk is a fully
1399f8829a4aSRandall Stewart 					 * self- contained one.
1400f8829a4aSRandall Stewart 					 */
1401f8829a4aSRandall Stewart 					return (0);
1402f8829a4aSRandall Stewart 				}
1403f8829a4aSRandall Stewart 			}
1404f8829a4aSRandall Stewart 		} else if (TSN_seq == at->rec.data.TSN_seq) {
1405f8829a4aSRandall Stewart 			/* Software error since I have a dup? */
1406f8829a4aSRandall Stewart 			return (1);
1407f8829a4aSRandall Stewart 		} else {
1408f8829a4aSRandall Stewart 			/*
1409f8829a4aSRandall Stewart 			 * Ok, 'at' is larger than new chunk but does it
1410f8829a4aSRandall Stewart 			 * need to be right before it.
1411f8829a4aSRandall Stewart 			 */
1412f8829a4aSRandall Stewart 			tsn_est = TSN_seq + 1;
1413f8829a4aSRandall Stewart 			if (tsn_est == at->rec.data.TSN_seq) {
1414f8829a4aSRandall Stewart 				/* Yep, It better be a first */
1415f8829a4aSRandall Stewart 				if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1416f8829a4aSRandall Stewart 				    SCTP_DATA_FIRST_FRAG) {
1417f8829a4aSRandall Stewart 					return (1);
1418f8829a4aSRandall Stewart 				} else {
1419f8829a4aSRandall Stewart 					return (0);
1420f8829a4aSRandall Stewart 				}
1421f8829a4aSRandall Stewart 			}
1422f8829a4aSRandall Stewart 		}
1423f8829a4aSRandall Stewart 	}
1424f8829a4aSRandall Stewart 	return (0);
1425f8829a4aSRandall Stewart }
1426f8829a4aSRandall Stewart 
1427f8829a4aSRandall Stewart 
1428f8829a4aSRandall Stewart static int
1429f8829a4aSRandall Stewart sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1430f8829a4aSRandall Stewart     struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length,
1431f8829a4aSRandall Stewart     struct sctp_nets *net, uint32_t * high_tsn, int *abort_flag,
1432f8829a4aSRandall Stewart     int *break_flag, int last_chunk)
1433f8829a4aSRandall Stewart {
1434f8829a4aSRandall Stewart 	/* Process a data chunk */
1435f8829a4aSRandall Stewart 	/* struct sctp_tmit_chunk *chk; */
1436f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
1437f8829a4aSRandall Stewart 	uint32_t tsn, gap;
1438f8829a4aSRandall Stewart 	struct mbuf *dmbuf;
1439f8829a4aSRandall Stewart 	int indx, the_len;
1440139bc87fSRandall Stewart 	int need_reasm_check = 0;
1441f8829a4aSRandall Stewart 	uint16_t strmno, strmseq;
1442f8829a4aSRandall Stewart 	struct mbuf *oper;
1443f8829a4aSRandall Stewart 	struct sctp_queued_to_read *control;
1444f42a358aSRandall Stewart 	int ordered;
1445f42a358aSRandall Stewart 	uint32_t protocol_id;
1446f42a358aSRandall Stewart 	uint8_t chunk_flags;
144717205eccSRandall Stewart 	struct sctp_stream_reset_list *liste;
1448f8829a4aSRandall Stewart 
1449f8829a4aSRandall Stewart 	chk = NULL;
1450f8829a4aSRandall Stewart 	tsn = ntohl(ch->dp.tsn);
1451f42a358aSRandall Stewart 	chunk_flags = ch->ch.chunk_flags;
1452f42a358aSRandall Stewart 	protocol_id = ch->dp.protocol_id;
1453f42a358aSRandall Stewart 	ordered = ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0);
1454f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
1455f8829a4aSRandall Stewart 	sctp_log_map(0, tsn, asoc->cumulative_tsn, SCTP_MAP_PREPARE_SLIDE);
1456f8829a4aSRandall Stewart #endif
1457ad81507eSRandall Stewart 	if (stcb == NULL) {
1458ad81507eSRandall Stewart 		return (0);
1459ad81507eSRandall Stewart 	}
1460f8829a4aSRandall Stewart 	if (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN) ||
1461f8829a4aSRandall Stewart 	    asoc->cumulative_tsn == tsn) {
1462f8829a4aSRandall Stewart 		/* It is a duplicate */
1463f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_recvdupdata);
1464f8829a4aSRandall Stewart 		if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1465f8829a4aSRandall Stewart 			/* Record a dup for the next outbound sack */
1466f8829a4aSRandall Stewart 			asoc->dup_tsns[asoc->numduptsns] = tsn;
1467f8829a4aSRandall Stewart 			asoc->numduptsns++;
1468f8829a4aSRandall Stewart 		}
1469f8829a4aSRandall Stewart 		return (0);
1470f8829a4aSRandall Stewart 	}
1471f8829a4aSRandall Stewart 	/* Calculate the number of TSN's between the base and this TSN */
1472f8829a4aSRandall Stewart 	if (tsn >= asoc->mapping_array_base_tsn) {
1473f8829a4aSRandall Stewart 		gap = tsn - asoc->mapping_array_base_tsn;
1474f8829a4aSRandall Stewart 	} else {
1475f8829a4aSRandall Stewart 		gap = (MAX_TSN - asoc->mapping_array_base_tsn) + tsn + 1;
1476f8829a4aSRandall Stewart 	}
1477f8829a4aSRandall Stewart 	if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1478f8829a4aSRandall Stewart 		/* Can't hold the bit in the mapping at max array, toss it */
1479f8829a4aSRandall Stewart 		return (0);
1480f8829a4aSRandall Stewart 	}
1481f8829a4aSRandall Stewart 	if (gap >= (uint32_t) (asoc->mapping_array_size << 3)) {
1482f8829a4aSRandall Stewart 		if (sctp_expand_mapping_array(asoc)) {
1483f8829a4aSRandall Stewart 			/* Can't expand, drop it */
1484f8829a4aSRandall Stewart 			return (0);
1485f8829a4aSRandall Stewart 		}
1486f8829a4aSRandall Stewart 	}
1487f8829a4aSRandall Stewart 	if (compare_with_wrap(tsn, *high_tsn, MAX_TSN)) {
1488f8829a4aSRandall Stewart 		*high_tsn = tsn;
1489f8829a4aSRandall Stewart 	}
1490f8829a4aSRandall Stewart 	/* See if we have received this one already */
1491f8829a4aSRandall Stewart 	if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
1492f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_recvdupdata);
1493f8829a4aSRandall Stewart 		if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1494f8829a4aSRandall Stewart 			/* Record a dup for the next outbound sack */
1495f8829a4aSRandall Stewart 			asoc->dup_tsns[asoc->numduptsns] = tsn;
1496f8829a4aSRandall Stewart 			asoc->numduptsns++;
1497f8829a4aSRandall Stewart 		}
149842551e99SRandall Stewart 		asoc->send_sack = 1;
1499f8829a4aSRandall Stewart 		return (0);
1500f8829a4aSRandall Stewart 	}
1501f8829a4aSRandall Stewart 	/*
1502f8829a4aSRandall Stewart 	 * Check to see about the GONE flag, duplicates would cause a sack
1503f8829a4aSRandall Stewart 	 * to be sent up above
1504f8829a4aSRandall Stewart 	 */
1505ad81507eSRandall Stewart 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
1506f8829a4aSRandall Stewart 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
1507f8829a4aSRandall Stewart 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET))
1508f8829a4aSRandall Stewart 	    ) {
1509f8829a4aSRandall Stewart 		/*
1510f8829a4aSRandall Stewart 		 * wait a minute, this guy is gone, there is no longer a
1511f8829a4aSRandall Stewart 		 * receiver. Send peer an ABORT!
1512f8829a4aSRandall Stewart 		 */
1513f8829a4aSRandall Stewart 		struct mbuf *op_err;
1514f8829a4aSRandall Stewart 
1515f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1516f8829a4aSRandall Stewart 		sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
1517f8829a4aSRandall Stewart 		*abort_flag = 1;
1518f8829a4aSRandall Stewart 		return (0);
1519f8829a4aSRandall Stewart 	}
1520f8829a4aSRandall Stewart 	/*
1521f8829a4aSRandall Stewart 	 * Now before going further we see if there is room. If NOT then we
1522f8829a4aSRandall Stewart 	 * MAY let one through only IF this TSN is the one we are waiting
1523f8829a4aSRandall Stewart 	 * for on a partial delivery API.
1524f8829a4aSRandall Stewart 	 */
1525f8829a4aSRandall Stewart 
1526f8829a4aSRandall Stewart 	/* now do the tests */
1527f8829a4aSRandall Stewart 	if (((asoc->cnt_on_all_streams +
1528f8829a4aSRandall Stewart 	    asoc->cnt_on_reasm_queue +
1529f8829a4aSRandall Stewart 	    asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) ||
1530f8829a4aSRandall Stewart 	    (((int)asoc->my_rwnd) <= 0)) {
1531f8829a4aSRandall Stewart 		/*
1532f8829a4aSRandall Stewart 		 * When we have NO room in the rwnd we check to make sure
1533f8829a4aSRandall Stewart 		 * the reader is doing its job...
1534f8829a4aSRandall Stewart 		 */
1535f8829a4aSRandall Stewart 		if (stcb->sctp_socket->so_rcv.sb_cc) {
1536f8829a4aSRandall Stewart 			/* some to read, wake-up */
1537f8829a4aSRandall Stewart 			sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1538f8829a4aSRandall Stewart 		}
1539f8829a4aSRandall Stewart 		/* now is it in the mapping array of what we have accepted? */
1540f8829a4aSRandall Stewart 		if (compare_with_wrap(tsn,
1541f8829a4aSRandall Stewart 		    asoc->highest_tsn_inside_map, MAX_TSN)) {
1542f8829a4aSRandall Stewart 
1543f8829a4aSRandall Stewart 			/* Nope not in the valid range dump it */
1544ad81507eSRandall Stewart 			SCTPDBG(SCTP_DEBUG_INDATA1, "My rwnd overrun1:tsn:%lx rwnd %lu sbspace:%ld\n",
1545f8829a4aSRandall Stewart 			    (u_long)tsn, (u_long)asoc->my_rwnd,
1546f8829a4aSRandall Stewart 			    sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv));
1547f8829a4aSRandall Stewart 			sctp_set_rwnd(stcb, asoc);
1548f8829a4aSRandall Stewart 			if ((asoc->cnt_on_all_streams +
1549f8829a4aSRandall Stewart 			    asoc->cnt_on_reasm_queue +
1550f8829a4aSRandall Stewart 			    asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) {
1551f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_datadropchklmt);
1552f8829a4aSRandall Stewart 			} else {
1553f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_datadroprwnd);
1554f8829a4aSRandall Stewart 			}
1555f8829a4aSRandall Stewart 			indx = *break_flag;
1556f8829a4aSRandall Stewart 			*break_flag = 1;
1557f8829a4aSRandall Stewart 			return (0);
1558f8829a4aSRandall Stewart 		}
1559f8829a4aSRandall Stewart 	}
1560f8829a4aSRandall Stewart 	strmno = ntohs(ch->dp.stream_id);
1561f8829a4aSRandall Stewart 	if (strmno >= asoc->streamincnt) {
1562f8829a4aSRandall Stewart 		struct sctp_paramhdr *phdr;
1563f8829a4aSRandall Stewart 		struct mbuf *mb;
1564f8829a4aSRandall Stewart 
1565f8829a4aSRandall Stewart 		mb = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) * 2),
1566139bc87fSRandall Stewart 		    0, M_DONTWAIT, 1, MT_DATA);
1567f8829a4aSRandall Stewart 		if (mb != NULL) {
1568f8829a4aSRandall Stewart 			/* add some space up front so prepend will work well */
1569139bc87fSRandall Stewart 			SCTP_BUF_RESV_UF(mb, sizeof(struct sctp_chunkhdr));
1570f8829a4aSRandall Stewart 			phdr = mtod(mb, struct sctp_paramhdr *);
1571f8829a4aSRandall Stewart 			/*
1572f8829a4aSRandall Stewart 			 * Error causes are just param's and this one has
1573f8829a4aSRandall Stewart 			 * two back to back phdr, one with the error type
1574f8829a4aSRandall Stewart 			 * and size, the other with the streamid and a rsvd
1575f8829a4aSRandall Stewart 			 */
1576139bc87fSRandall Stewart 			SCTP_BUF_LEN(mb) = (sizeof(struct sctp_paramhdr) * 2);
1577f8829a4aSRandall Stewart 			phdr->param_type = htons(SCTP_CAUSE_INVALID_STREAM);
1578f8829a4aSRandall Stewart 			phdr->param_length =
1579f8829a4aSRandall Stewart 			    htons(sizeof(struct sctp_paramhdr) * 2);
1580f8829a4aSRandall Stewart 			phdr++;
1581f8829a4aSRandall Stewart 			/* We insert the stream in the type field */
1582f8829a4aSRandall Stewart 			phdr->param_type = ch->dp.stream_id;
1583f8829a4aSRandall Stewart 			/* And set the length to 0 for the rsvd field */
1584f8829a4aSRandall Stewart 			phdr->param_length = 0;
1585f8829a4aSRandall Stewart 			sctp_queue_op_err(stcb, mb);
1586f8829a4aSRandall Stewart 		}
1587f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_badsid);
1588d06c82f1SRandall Stewart 		SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
1589d06c82f1SRandall Stewart 		if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
1590d06c82f1SRandall Stewart 			/* we have a new high score */
1591d06c82f1SRandall Stewart 			asoc->highest_tsn_inside_map = tsn;
1592d06c82f1SRandall Stewart #ifdef SCTP_MAP_LOGGING
1593d06c82f1SRandall Stewart 			sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
1594d06c82f1SRandall Stewart #endif
1595d06c82f1SRandall Stewart 		}
1596d06c82f1SRandall Stewart 		if (tsn == (asoc->cumulative_tsn + 1)) {
1597d06c82f1SRandall Stewart 			/* Update cum-ack */
1598d06c82f1SRandall Stewart 			asoc->cumulative_tsn = tsn;
1599d06c82f1SRandall Stewart 		}
1600f8829a4aSRandall Stewart 		return (0);
1601f8829a4aSRandall Stewart 	}
1602f8829a4aSRandall Stewart 	/*
1603f8829a4aSRandall Stewart 	 * Before we continue lets validate that we are not being fooled by
1604f8829a4aSRandall Stewart 	 * an evil attacker. We can only have 4k chunks based on our TSN
1605f8829a4aSRandall Stewart 	 * spread allowed by the mapping array 512 * 8 bits, so there is no
1606f8829a4aSRandall Stewart 	 * way our stream sequence numbers could have wrapped. We of course
1607f8829a4aSRandall Stewart 	 * only validate the FIRST fragment so the bit must be set.
1608f8829a4aSRandall Stewart 	 */
1609f8829a4aSRandall Stewart 	strmseq = ntohs(ch->dp.stream_sequence);
1610f42a358aSRandall Stewart 
1611f42a358aSRandall Stewart #ifdef SCTP_ASOCLOG_OF_TSNS
1612f42a358aSRandall Stewart 	asoc->in_tsnlog[asoc->tsn_in_at].tsn = tsn;
1613f42a358aSRandall Stewart 	asoc->in_tsnlog[asoc->tsn_in_at].strm = strmno;
1614f42a358aSRandall Stewart 	asoc->in_tsnlog[asoc->tsn_in_at].seq = strmseq;
1615f1f73e57SRandall Stewart 	asoc->in_tsnlog[asoc->tsn_in_at].sz = chk_length;
1616f1f73e57SRandall Stewart 	asoc->in_tsnlog[asoc->tsn_in_at].flgs = chunk_flags;
1617f42a358aSRandall Stewart 	asoc->tsn_in_at++;
1618f42a358aSRandall Stewart 	if (asoc->tsn_in_at >= SCTP_TSN_LOG_SIZE) {
1619f42a358aSRandall Stewart 		asoc->tsn_in_at = 0;
1620f1f73e57SRandall Stewart 		asoc->tsn_in_wrapped = 1;
1621f42a358aSRandall Stewart 	}
1622f42a358aSRandall Stewart #endif
1623f42a358aSRandall Stewart 	if ((chunk_flags & SCTP_DATA_FIRST_FRAG) &&
1624f42a358aSRandall Stewart 	    (chunk_flags & SCTP_DATA_UNORDERED) == 0 &&
1625f8829a4aSRandall Stewart 	    (compare_with_wrap(asoc->strmin[strmno].last_sequence_delivered,
1626f8829a4aSRandall Stewart 	    strmseq, MAX_SEQ) ||
1627f8829a4aSRandall Stewart 	    asoc->strmin[strmno].last_sequence_delivered == strmseq)) {
1628f8829a4aSRandall Stewart 		/* The incoming sseq is behind where we last delivered? */
1629ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INDATA1, "EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n",
1630ad81507eSRandall Stewart 		    strmseq, asoc->strmin[strmno].last_sequence_delivered);
1631139bc87fSRandall Stewart 		oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1632f8829a4aSRandall Stewart 		    0, M_DONTWAIT, 1, MT_DATA);
1633f8829a4aSRandall Stewart 		if (oper) {
1634f8829a4aSRandall Stewart 			struct sctp_paramhdr *ph;
1635f8829a4aSRandall Stewart 			uint32_t *ippp;
1636f8829a4aSRandall Stewart 
1637139bc87fSRandall Stewart 			SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
1638f8829a4aSRandall Stewart 			    (3 * sizeof(uint32_t));
1639f8829a4aSRandall Stewart 			ph = mtod(oper, struct sctp_paramhdr *);
1640f8829a4aSRandall Stewart 			ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1641139bc87fSRandall Stewart 			ph->param_length = htons(SCTP_BUF_LEN(oper));
1642f8829a4aSRandall Stewart 			ippp = (uint32_t *) (ph + 1);
1643a5d547adSRandall Stewart 			*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_14);
1644f8829a4aSRandall Stewart 			ippp++;
1645f8829a4aSRandall Stewart 			*ippp = tsn;
1646f8829a4aSRandall Stewart 			ippp++;
1647f8829a4aSRandall Stewart 			*ippp = ((strmno << 16) | strmseq);
1648f8829a4aSRandall Stewart 
1649f8829a4aSRandall Stewart 		}
1650a5d547adSRandall Stewart 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_14;
1651f8829a4aSRandall Stewart 		sctp_abort_an_association(stcb->sctp_ep, stcb,
1652f8829a4aSRandall Stewart 		    SCTP_PEER_FAULTY, oper);
1653f8829a4aSRandall Stewart 		*abort_flag = 1;
1654f8829a4aSRandall Stewart 		return (0);
1655f8829a4aSRandall Stewart 	}
1656f42a358aSRandall Stewart 	/************************************
1657f42a358aSRandall Stewart 	 * From here down we may find ch-> invalid
1658f42a358aSRandall Stewart 	 * so its a good idea NOT to use it.
1659f42a358aSRandall Stewart 	 *************************************/
1660f42a358aSRandall Stewart 
1661f8829a4aSRandall Stewart 	the_len = (chk_length - sizeof(struct sctp_data_chunk));
1662f8829a4aSRandall Stewart 	if (last_chunk == 0) {
166344b7479bSRandall Stewart 		dmbuf = SCTP_M_COPYM(*m,
1664f8829a4aSRandall Stewart 		    (offset + sizeof(struct sctp_data_chunk)),
1665f8829a4aSRandall Stewart 		    the_len, M_DONTWAIT);
1666f8829a4aSRandall Stewart #ifdef SCTP_MBUF_LOGGING
1667f8829a4aSRandall Stewart 		{
1668f8829a4aSRandall Stewart 			struct mbuf *mat;
1669f8829a4aSRandall Stewart 
1670f8829a4aSRandall Stewart 			mat = dmbuf;
1671f8829a4aSRandall Stewart 			while (mat) {
1672139bc87fSRandall Stewart 				if (SCTP_BUF_IS_EXTENDED(mat)) {
1673f8829a4aSRandall Stewart 					sctp_log_mb(mat, SCTP_MBUF_ICOPY);
1674f8829a4aSRandall Stewart 				}
1675139bc87fSRandall Stewart 				mat = SCTP_BUF_NEXT(mat);
1676f8829a4aSRandall Stewart 			}
1677f8829a4aSRandall Stewart 		}
1678f8829a4aSRandall Stewart #endif
1679f8829a4aSRandall Stewart 	} else {
1680f8829a4aSRandall Stewart 		/* We can steal the last chunk */
1681139bc87fSRandall Stewart 		int l_len;
1682139bc87fSRandall Stewart 
1683f8829a4aSRandall Stewart 		dmbuf = *m;
1684f8829a4aSRandall Stewart 		/* lop off the top part */
1685f8829a4aSRandall Stewart 		m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
1686139bc87fSRandall Stewart 		if (SCTP_BUF_NEXT(dmbuf) == NULL) {
1687139bc87fSRandall Stewart 			l_len = SCTP_BUF_LEN(dmbuf);
1688139bc87fSRandall Stewart 		} else {
1689139bc87fSRandall Stewart 			/*
1690139bc87fSRandall Stewart 			 * need to count up the size hopefully does not hit
1691139bc87fSRandall Stewart 			 * this to often :-0
1692139bc87fSRandall Stewart 			 */
1693139bc87fSRandall Stewart 			struct mbuf *lat;
1694139bc87fSRandall Stewart 
1695139bc87fSRandall Stewart 			l_len = 0;
1696139bc87fSRandall Stewart 			lat = dmbuf;
1697139bc87fSRandall Stewart 			while (lat) {
1698139bc87fSRandall Stewart 				l_len += SCTP_BUF_LEN(lat);
1699139bc87fSRandall Stewart 				lat = SCTP_BUF_NEXT(lat);
1700139bc87fSRandall Stewart 			}
1701139bc87fSRandall Stewart 		}
1702139bc87fSRandall Stewart 		if (l_len > the_len) {
1703f8829a4aSRandall Stewart 			/* Trim the end round bytes off  too */
1704139bc87fSRandall Stewart 			m_adj(dmbuf, -(l_len - the_len));
1705f8829a4aSRandall Stewart 		}
1706f8829a4aSRandall Stewart 	}
1707f8829a4aSRandall Stewart 	if (dmbuf == NULL) {
1708f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_nomem);
1709f8829a4aSRandall Stewart 		return (0);
1710f8829a4aSRandall Stewart 	}
1711f42a358aSRandall Stewart 	if ((chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
1712f8829a4aSRandall Stewart 	    asoc->fragmented_delivery_inprogress == 0 &&
1713f8829a4aSRandall Stewart 	    TAILQ_EMPTY(&asoc->resetHead) &&
1714f42a358aSRandall Stewart 	    ((ordered == 0) ||
1715f8829a4aSRandall Stewart 	    ((asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq &&
1716f8829a4aSRandall Stewart 	    TAILQ_EMPTY(&asoc->strmin[strmno].inqueue)))) {
1717f8829a4aSRandall Stewart 		/* Candidate for express delivery */
1718f8829a4aSRandall Stewart 		/*
1719f8829a4aSRandall Stewart 		 * Its not fragmented, No PD-API is up, Nothing in the
1720f8829a4aSRandall Stewart 		 * delivery queue, Its un-ordered OR ordered and the next to
1721f8829a4aSRandall Stewart 		 * deliver AND nothing else is stuck on the stream queue,
1722f8829a4aSRandall Stewart 		 * And there is room for it in the socket buffer. Lets just
1723f8829a4aSRandall Stewart 		 * stuff it up the buffer....
1724f8829a4aSRandall Stewart 		 */
1725f8829a4aSRandall Stewart 
1726f8829a4aSRandall Stewart 		/* It would be nice to avoid this copy if we could :< */
1727f8829a4aSRandall Stewart 		sctp_alloc_a_readq(stcb, control);
1728f8829a4aSRandall Stewart 		sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
1729f42a358aSRandall Stewart 		    protocol_id,
1730f8829a4aSRandall Stewart 		    stcb->asoc.context,
1731f8829a4aSRandall Stewart 		    strmno, strmseq,
1732f42a358aSRandall Stewart 		    chunk_flags,
1733f8829a4aSRandall Stewart 		    dmbuf);
1734f8829a4aSRandall Stewart 		if (control == NULL) {
1735f8829a4aSRandall Stewart 			goto failed_express_del;
1736f8829a4aSRandall Stewart 		}
1737f8829a4aSRandall Stewart 		sctp_add_to_readq(stcb->sctp_ep, stcb, control, &stcb->sctp_socket->so_rcv, 1);
1738f42a358aSRandall Stewart 		if ((chunk_flags & SCTP_DATA_UNORDERED) == 0) {
1739f8829a4aSRandall Stewart 			/* for ordered, bump what we delivered */
1740f8829a4aSRandall Stewart 			asoc->strmin[strmno].last_sequence_delivered++;
1741f8829a4aSRandall Stewart 		}
1742f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_recvexpress);
1743f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
17446a91f103SRandall Stewart 		sctp_log_strm_del_alt(stcb, tsn, strmseq, strmno,
1745f8829a4aSRandall Stewart 		    SCTP_STR_LOG_FROM_EXPRS_DEL);
1746f8829a4aSRandall Stewart #endif
1747f8829a4aSRandall Stewart 		control = NULL;
1748f8829a4aSRandall Stewart 		goto finish_express_del;
1749f8829a4aSRandall Stewart 	}
1750f8829a4aSRandall Stewart failed_express_del:
1751f8829a4aSRandall Stewart 	/* If we reach here this is a new chunk */
1752f8829a4aSRandall Stewart 	chk = NULL;
1753f8829a4aSRandall Stewart 	control = NULL;
1754f8829a4aSRandall Stewart 	/* Express for fragmented delivery? */
1755f8829a4aSRandall Stewart 	if ((asoc->fragmented_delivery_inprogress) &&
1756f8829a4aSRandall Stewart 	    (stcb->asoc.control_pdapi) &&
1757f8829a4aSRandall Stewart 	    (asoc->str_of_pdapi == strmno) &&
1758f8829a4aSRandall Stewart 	    (asoc->ssn_of_pdapi == strmseq)
1759f8829a4aSRandall Stewart 	    ) {
1760f8829a4aSRandall Stewart 		control = stcb->asoc.control_pdapi;
1761f42a358aSRandall Stewart 		if ((chunk_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
1762f8829a4aSRandall Stewart 			/* Can't be another first? */
1763f8829a4aSRandall Stewart 			goto failed_pdapi_express_del;
1764f8829a4aSRandall Stewart 		}
1765f8829a4aSRandall Stewart 		if (tsn == (control->sinfo_tsn + 1)) {
1766f8829a4aSRandall Stewart 			/* Yep, we can add it on */
1767f8829a4aSRandall Stewart 			int end = 0;
1768f8829a4aSRandall Stewart 			uint32_t cumack;
1769f8829a4aSRandall Stewart 
1770f42a358aSRandall Stewart 			if (chunk_flags & SCTP_DATA_LAST_FRAG) {
1771f8829a4aSRandall Stewart 				end = 1;
1772f8829a4aSRandall Stewart 			}
1773f8829a4aSRandall Stewart 			cumack = asoc->cumulative_tsn;
1774f8829a4aSRandall Stewart 			if ((cumack + 1) == tsn)
1775f8829a4aSRandall Stewart 				cumack = tsn;
1776f8829a4aSRandall Stewart 
1777f8829a4aSRandall Stewart 			if (sctp_append_to_readq(stcb->sctp_ep, stcb, control, dmbuf, end,
1778f8829a4aSRandall Stewart 			    tsn,
1779f8829a4aSRandall Stewart 			    &stcb->sctp_socket->so_rcv)) {
1780ad81507eSRandall Stewart 				SCTP_PRINTF("Append fails end:%d\n", end);
1781f8829a4aSRandall Stewart 				goto failed_pdapi_express_del;
1782f8829a4aSRandall Stewart 			}
1783f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_recvexpressm);
1784f8829a4aSRandall Stewart 			control->sinfo_tsn = tsn;
1785f8829a4aSRandall Stewart 			asoc->tsn_last_delivered = tsn;
1786f42a358aSRandall Stewart 			asoc->fragment_flags = chunk_flags;
1787f8829a4aSRandall Stewart 			asoc->tsn_of_pdapi_last_delivered = tsn;
1788f42a358aSRandall Stewart 			asoc->last_flags_delivered = chunk_flags;
1789f8829a4aSRandall Stewart 			asoc->last_strm_seq_delivered = strmseq;
1790f8829a4aSRandall Stewart 			asoc->last_strm_no_delivered = strmno;
1791f8829a4aSRandall Stewart 			if (end) {
1792f8829a4aSRandall Stewart 				/* clean up the flags and such */
1793f8829a4aSRandall Stewart 				asoc->fragmented_delivery_inprogress = 0;
1794f42a358aSRandall Stewart 				if ((chunk_flags & SCTP_DATA_UNORDERED) == 0) {
1795f8829a4aSRandall Stewart 					asoc->strmin[strmno].last_sequence_delivered++;
1796a5d547adSRandall Stewart 				}
1797f8829a4aSRandall Stewart 				stcb->asoc.control_pdapi = NULL;
1798139bc87fSRandall Stewart 				if (TAILQ_EMPTY(&asoc->reasmqueue) == 0) {
1799139bc87fSRandall Stewart 					/*
1800139bc87fSRandall Stewart 					 * There could be another message
1801139bc87fSRandall Stewart 					 * ready
1802139bc87fSRandall Stewart 					 */
1803139bc87fSRandall Stewart 					need_reasm_check = 1;
1804139bc87fSRandall Stewart 				}
1805f8829a4aSRandall Stewart 			}
1806f8829a4aSRandall Stewart 			control = NULL;
1807f8829a4aSRandall Stewart 			goto finish_express_del;
1808f8829a4aSRandall Stewart 		}
1809f8829a4aSRandall Stewart 	}
1810f8829a4aSRandall Stewart failed_pdapi_express_del:
1811f8829a4aSRandall Stewart 	control = NULL;
1812f42a358aSRandall Stewart 	if ((chunk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
1813f8829a4aSRandall Stewart 		sctp_alloc_a_chunk(stcb, chk);
1814f8829a4aSRandall Stewart 		if (chk == NULL) {
1815f8829a4aSRandall Stewart 			/* No memory so we drop the chunk */
1816f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_nomem);
1817f8829a4aSRandall Stewart 			if (last_chunk == 0) {
1818f8829a4aSRandall Stewart 				/* we copied it, free the copy */
1819f8829a4aSRandall Stewart 				sctp_m_freem(dmbuf);
1820f8829a4aSRandall Stewart 			}
1821f8829a4aSRandall Stewart 			return (0);
1822f8829a4aSRandall Stewart 		}
1823f8829a4aSRandall Stewart 		chk->rec.data.TSN_seq = tsn;
1824f8829a4aSRandall Stewart 		chk->no_fr_allowed = 0;
1825f8829a4aSRandall Stewart 		chk->rec.data.stream_seq = strmseq;
1826f8829a4aSRandall Stewart 		chk->rec.data.stream_number = strmno;
1827f42a358aSRandall Stewart 		chk->rec.data.payloadtype = protocol_id;
1828f8829a4aSRandall Stewart 		chk->rec.data.context = stcb->asoc.context;
1829f8829a4aSRandall Stewart 		chk->rec.data.doing_fast_retransmit = 0;
1830f42a358aSRandall Stewart 		chk->rec.data.rcv_flags = chunk_flags;
1831f8829a4aSRandall Stewart 		chk->asoc = asoc;
1832f8829a4aSRandall Stewart 		chk->send_size = the_len;
1833f8829a4aSRandall Stewart 		chk->whoTo = net;
1834f8829a4aSRandall Stewart 		atomic_add_int(&net->ref_count, 1);
1835f8829a4aSRandall Stewart 		chk->data = dmbuf;
1836f8829a4aSRandall Stewart 	} else {
1837f8829a4aSRandall Stewart 		sctp_alloc_a_readq(stcb, control);
1838f8829a4aSRandall Stewart 		sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
1839f42a358aSRandall Stewart 		    protocol_id,
1840f8829a4aSRandall Stewart 		    stcb->asoc.context,
1841f8829a4aSRandall Stewart 		    strmno, strmseq,
1842f42a358aSRandall Stewart 		    chunk_flags,
1843f8829a4aSRandall Stewart 		    dmbuf);
1844f8829a4aSRandall Stewart 		if (control == NULL) {
1845f8829a4aSRandall Stewart 			/* No memory so we drop the chunk */
1846f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_nomem);
1847f8829a4aSRandall Stewart 			if (last_chunk == 0) {
1848f8829a4aSRandall Stewart 				/* we copied it, free the copy */
1849f8829a4aSRandall Stewart 				sctp_m_freem(dmbuf);
1850f8829a4aSRandall Stewart 			}
1851f8829a4aSRandall Stewart 			return (0);
1852f8829a4aSRandall Stewart 		}
1853f8829a4aSRandall Stewart 		control->length = the_len;
1854f8829a4aSRandall Stewart 	}
1855f8829a4aSRandall Stewart 
1856f8829a4aSRandall Stewart 	/* Mark it as received */
1857f8829a4aSRandall Stewart 	/* Now queue it where it belongs */
1858f8829a4aSRandall Stewart 	if (control != NULL) {
1859f8829a4aSRandall Stewart 		/* First a sanity check */
1860f8829a4aSRandall Stewart 		if (asoc->fragmented_delivery_inprogress) {
1861f8829a4aSRandall Stewart 			/*
1862f8829a4aSRandall Stewart 			 * Ok, we have a fragmented delivery in progress if
1863f8829a4aSRandall Stewart 			 * this chunk is next to deliver OR belongs in our
1864f8829a4aSRandall Stewart 			 * view to the reassembly, the peer is evil or
1865f8829a4aSRandall Stewart 			 * broken.
1866f8829a4aSRandall Stewart 			 */
1867f8829a4aSRandall Stewart 			uint32_t estimate_tsn;
1868f8829a4aSRandall Stewart 
1869f8829a4aSRandall Stewart 			estimate_tsn = asoc->tsn_last_delivered + 1;
1870f8829a4aSRandall Stewart 			if (TAILQ_EMPTY(&asoc->reasmqueue) &&
1871f8829a4aSRandall Stewart 			    (estimate_tsn == control->sinfo_tsn)) {
1872f8829a4aSRandall Stewart 				/* Evil/Broke peer */
1873f8829a4aSRandall Stewart 				sctp_m_freem(control->data);
1874f8829a4aSRandall Stewart 				control->data = NULL;
1875f8829a4aSRandall Stewart 				sctp_free_remote_addr(control->whoFrom);
1876f8829a4aSRandall Stewart 				sctp_free_a_readq(stcb, control);
1877139bc87fSRandall Stewart 				oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1878f8829a4aSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
1879f8829a4aSRandall Stewart 				if (oper) {
1880f8829a4aSRandall Stewart 					struct sctp_paramhdr *ph;
1881f8829a4aSRandall Stewart 					uint32_t *ippp;
1882f8829a4aSRandall Stewart 
1883139bc87fSRandall Stewart 					SCTP_BUF_LEN(oper) =
1884f8829a4aSRandall Stewart 					    sizeof(struct sctp_paramhdr) +
1885f8829a4aSRandall Stewart 					    (3 * sizeof(uint32_t));
1886f8829a4aSRandall Stewart 					ph = mtod(oper, struct sctp_paramhdr *);
1887f8829a4aSRandall Stewart 					ph->param_type =
1888f8829a4aSRandall Stewart 					    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1889139bc87fSRandall Stewart 					ph->param_length = htons(SCTP_BUF_LEN(oper));
1890f8829a4aSRandall Stewart 					ippp = (uint32_t *) (ph + 1);
1891a5d547adSRandall Stewart 					*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_15);
1892f8829a4aSRandall Stewart 					ippp++;
1893f8829a4aSRandall Stewart 					*ippp = tsn;
1894f8829a4aSRandall Stewart 					ippp++;
1895f8829a4aSRandall Stewart 					*ippp = ((strmno << 16) | strmseq);
1896f8829a4aSRandall Stewart 				}
1897a5d547adSRandall Stewart 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_15;
1898f8829a4aSRandall Stewart 				sctp_abort_an_association(stcb->sctp_ep, stcb,
1899f8829a4aSRandall Stewart 				    SCTP_PEER_FAULTY, oper);
1900f8829a4aSRandall Stewart 
1901f8829a4aSRandall Stewart 				*abort_flag = 1;
1902f8829a4aSRandall Stewart 				return (0);
1903f8829a4aSRandall Stewart 			} else {
1904f8829a4aSRandall Stewart 				if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
1905f8829a4aSRandall Stewart 					sctp_m_freem(control->data);
1906f8829a4aSRandall Stewart 					control->data = NULL;
1907f8829a4aSRandall Stewart 					sctp_free_remote_addr(control->whoFrom);
1908f8829a4aSRandall Stewart 					sctp_free_a_readq(stcb, control);
1909f8829a4aSRandall Stewart 
1910139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1911f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1912f8829a4aSRandall Stewart 					if (oper) {
1913f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1914f8829a4aSRandall Stewart 						uint32_t *ippp;
1915f8829a4aSRandall Stewart 
1916139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1917f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1918f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1919f8829a4aSRandall Stewart 						ph = mtod(oper,
1920f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1921f8829a4aSRandall Stewart 						ph->param_type =
1922f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1923f8829a4aSRandall Stewart 						ph->param_length =
1924139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1925f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1926a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_16);
1927f8829a4aSRandall Stewart 						ippp++;
1928f8829a4aSRandall Stewart 						*ippp = tsn;
1929f8829a4aSRandall Stewart 						ippp++;
1930f8829a4aSRandall Stewart 						*ippp = ((strmno << 16) | strmseq);
1931f8829a4aSRandall Stewart 					}
1932a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
1933f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1934f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1935f8829a4aSRandall Stewart 
1936f8829a4aSRandall Stewart 					*abort_flag = 1;
1937f8829a4aSRandall Stewart 					return (0);
1938f8829a4aSRandall Stewart 				}
1939f8829a4aSRandall Stewart 			}
1940f8829a4aSRandall Stewart 		} else {
1941f8829a4aSRandall Stewart 			/* No PDAPI running */
1942f8829a4aSRandall Stewart 			if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
1943f8829a4aSRandall Stewart 				/*
1944f8829a4aSRandall Stewart 				 * Reassembly queue is NOT empty validate
1945f8829a4aSRandall Stewart 				 * that this tsn does not need to be in
1946f8829a4aSRandall Stewart 				 * reasembly queue. If it does then our peer
1947f8829a4aSRandall Stewart 				 * is broken or evil.
1948f8829a4aSRandall Stewart 				 */
1949f8829a4aSRandall Stewart 				if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
1950f8829a4aSRandall Stewart 					sctp_m_freem(control->data);
1951f8829a4aSRandall Stewart 					control->data = NULL;
1952f8829a4aSRandall Stewart 					sctp_free_remote_addr(control->whoFrom);
1953f8829a4aSRandall Stewart 					sctp_free_a_readq(stcb, control);
1954139bc87fSRandall Stewart 					oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
1955f8829a4aSRandall Stewart 					    0, M_DONTWAIT, 1, MT_DATA);
1956f8829a4aSRandall Stewart 					if (oper) {
1957f8829a4aSRandall Stewart 						struct sctp_paramhdr *ph;
1958f8829a4aSRandall Stewart 						uint32_t *ippp;
1959f8829a4aSRandall Stewart 
1960139bc87fSRandall Stewart 						SCTP_BUF_LEN(oper) =
1961f8829a4aSRandall Stewart 						    sizeof(struct sctp_paramhdr) +
1962f8829a4aSRandall Stewart 						    (3 * sizeof(uint32_t));
1963f8829a4aSRandall Stewart 						ph = mtod(oper,
1964f8829a4aSRandall Stewart 						    struct sctp_paramhdr *);
1965f8829a4aSRandall Stewart 						ph->param_type =
1966f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1967f8829a4aSRandall Stewart 						ph->param_length =
1968139bc87fSRandall Stewart 						    htons(SCTP_BUF_LEN(oper));
1969f8829a4aSRandall Stewart 						ippp = (uint32_t *) (ph + 1);
1970a5d547adSRandall Stewart 						*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_17);
1971f8829a4aSRandall Stewart 						ippp++;
1972f8829a4aSRandall Stewart 						*ippp = tsn;
1973f8829a4aSRandall Stewart 						ippp++;
1974f8829a4aSRandall Stewart 						*ippp = ((strmno << 16) | strmseq);
1975f8829a4aSRandall Stewart 					}
1976a5d547adSRandall Stewart 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_17;
1977f8829a4aSRandall Stewart 					sctp_abort_an_association(stcb->sctp_ep,
1978f8829a4aSRandall Stewart 					    stcb, SCTP_PEER_FAULTY, oper);
1979f8829a4aSRandall Stewart 
1980f8829a4aSRandall Stewart 					*abort_flag = 1;
1981f8829a4aSRandall Stewart 					return (0);
1982f8829a4aSRandall Stewart 				}
1983f8829a4aSRandall Stewart 			}
1984f8829a4aSRandall Stewart 		}
1985f8829a4aSRandall Stewart 		/* ok, if we reach here we have passed the sanity checks */
1986f42a358aSRandall Stewart 		if (chunk_flags & SCTP_DATA_UNORDERED) {
1987f8829a4aSRandall Stewart 			/* queue directly into socket buffer */
1988f8829a4aSRandall Stewart 			sctp_add_to_readq(stcb->sctp_ep, stcb,
1989f8829a4aSRandall Stewart 			    control,
1990f8829a4aSRandall Stewart 			    &stcb->sctp_socket->so_rcv, 1);
1991f8829a4aSRandall Stewart 		} else {
1992f8829a4aSRandall Stewart 			/*
1993f8829a4aSRandall Stewart 			 * Special check for when streams are resetting. We
1994f8829a4aSRandall Stewart 			 * could be more smart about this and check the
1995f8829a4aSRandall Stewart 			 * actual stream to see if it is not being reset..
1996f8829a4aSRandall Stewart 			 * that way we would not create a HOLB when amongst
1997f8829a4aSRandall Stewart 			 * streams being reset and those not being reset.
1998f8829a4aSRandall Stewart 			 *
1999f8829a4aSRandall Stewart 			 * We take complete messages that have a stream reset
2000f8829a4aSRandall Stewart 			 * intervening (aka the TSN is after where our
2001f8829a4aSRandall Stewart 			 * cum-ack needs to be) off and put them on a
2002f8829a4aSRandall Stewart 			 * pending_reply_queue. The reassembly ones we do
2003f8829a4aSRandall Stewart 			 * not have to worry about since they are all sorted
2004f8829a4aSRandall Stewart 			 * and proceessed by TSN order. It is only the
2005f8829a4aSRandall Stewart 			 * singletons I must worry about.
2006f8829a4aSRandall Stewart 			 */
2007f8829a4aSRandall Stewart 			struct sctp_stream_reset_list *liste;
2008f8829a4aSRandall Stewart 
2009f8829a4aSRandall Stewart 			if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2010d06c82f1SRandall Stewart 			    ((compare_with_wrap(tsn, ntohl(liste->tsn), MAX_TSN)) ||
2011f8829a4aSRandall Stewart 			    (tsn == ntohl(liste->tsn)))
2012f8829a4aSRandall Stewart 			    ) {
2013f8829a4aSRandall Stewart 				/*
2014f8829a4aSRandall Stewart 				 * yep its past where we need to reset... go
2015f8829a4aSRandall Stewart 				 * ahead and queue it.
2016f8829a4aSRandall Stewart 				 */
2017f8829a4aSRandall Stewart 				if (TAILQ_EMPTY(&asoc->pending_reply_queue)) {
2018f8829a4aSRandall Stewart 					/* first one on */
2019f8829a4aSRandall Stewart 					TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2020f8829a4aSRandall Stewart 				} else {
2021f8829a4aSRandall Stewart 					struct sctp_queued_to_read *ctlOn;
2022f8829a4aSRandall Stewart 					unsigned char inserted = 0;
2023f8829a4aSRandall Stewart 
2024f8829a4aSRandall Stewart 					ctlOn = TAILQ_FIRST(&asoc->pending_reply_queue);
2025f8829a4aSRandall Stewart 					while (ctlOn) {
2026f8829a4aSRandall Stewart 						if (compare_with_wrap(control->sinfo_tsn,
2027f8829a4aSRandall Stewart 						    ctlOn->sinfo_tsn, MAX_TSN)) {
2028f8829a4aSRandall Stewart 							ctlOn = TAILQ_NEXT(ctlOn, next);
2029f8829a4aSRandall Stewart 						} else {
2030f8829a4aSRandall Stewart 							/* found it */
2031f8829a4aSRandall Stewart 							TAILQ_INSERT_BEFORE(ctlOn, control, next);
2032f8829a4aSRandall Stewart 							inserted = 1;
2033f8829a4aSRandall Stewart 							break;
2034f8829a4aSRandall Stewart 						}
2035f8829a4aSRandall Stewart 					}
2036f8829a4aSRandall Stewart 					if (inserted == 0) {
2037f8829a4aSRandall Stewart 						/*
2038f8829a4aSRandall Stewart 						 * must be put at end, use
2039f8829a4aSRandall Stewart 						 * prevP (all setup from
2040f8829a4aSRandall Stewart 						 * loop) to setup nextP.
2041f8829a4aSRandall Stewart 						 */
2042f8829a4aSRandall Stewart 						TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2043f8829a4aSRandall Stewart 					}
2044f8829a4aSRandall Stewart 				}
2045f8829a4aSRandall Stewart 			} else {
2046f8829a4aSRandall Stewart 				sctp_queue_data_to_stream(stcb, asoc, control, abort_flag);
2047f8829a4aSRandall Stewart 				if (*abort_flag) {
2048f8829a4aSRandall Stewart 					return (0);
2049f8829a4aSRandall Stewart 				}
2050f8829a4aSRandall Stewart 			}
2051f8829a4aSRandall Stewart 		}
2052f8829a4aSRandall Stewart 	} else {
2053f8829a4aSRandall Stewart 		/* Into the re-assembly queue */
2054f8829a4aSRandall Stewart 		sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag);
2055f8829a4aSRandall Stewart 		if (*abort_flag) {
2056a5d547adSRandall Stewart 			/*
2057a5d547adSRandall Stewart 			 * the assoc is now gone and chk was put onto the
2058a5d547adSRandall Stewart 			 * reasm queue, which has all been freed.
2059a5d547adSRandall Stewart 			 */
2060a5d547adSRandall Stewart 			*m = NULL;
2061f8829a4aSRandall Stewart 			return (0);
2062f8829a4aSRandall Stewart 		}
2063f8829a4aSRandall Stewart 	}
2064f8829a4aSRandall Stewart finish_express_del:
2065f8829a4aSRandall Stewart 	if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) {
2066f8829a4aSRandall Stewart 		/* we have a new high score */
2067f8829a4aSRandall Stewart 		asoc->highest_tsn_inside_map = tsn;
2068f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2069f8829a4aSRandall Stewart 		sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2070f8829a4aSRandall Stewart #endif
2071f8829a4aSRandall Stewart 	}
2072f8829a4aSRandall Stewart 	if (tsn == (asoc->cumulative_tsn + 1)) {
2073f8829a4aSRandall Stewart 		/* Update cum-ack */
2074f8829a4aSRandall Stewart 		asoc->cumulative_tsn = tsn;
2075f8829a4aSRandall Stewart 	}
2076f8829a4aSRandall Stewart 	if (last_chunk) {
2077f8829a4aSRandall Stewart 		*m = NULL;
2078f8829a4aSRandall Stewart 	}
2079f42a358aSRandall Stewart 	if (ordered) {
2080f8829a4aSRandall Stewart 		SCTP_STAT_INCR_COUNTER64(sctps_inorderchunks);
2081f8829a4aSRandall Stewart 	} else {
2082f8829a4aSRandall Stewart 		SCTP_STAT_INCR_COUNTER64(sctps_inunorderchunks);
2083f8829a4aSRandall Stewart 	}
2084f8829a4aSRandall Stewart 	SCTP_STAT_INCR(sctps_recvdata);
2085f8829a4aSRandall Stewart 	/* Set it present please */
2086f8829a4aSRandall Stewart #ifdef SCTP_STR_LOGGING
20876a91f103SRandall Stewart 	sctp_log_strm_del_alt(stcb, tsn, strmseq, strmno, SCTP_STR_LOG_FROM_MARK_TSN);
2088f8829a4aSRandall Stewart #endif
2089f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2090f8829a4aSRandall Stewart 	sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2091f8829a4aSRandall Stewart 	    asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2092f8829a4aSRandall Stewart #endif
2093f8829a4aSRandall Stewart 	SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
209417205eccSRandall Stewart 	/* check the special flag for stream resets */
209517205eccSRandall Stewart 	if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
209617205eccSRandall Stewart 	    ((compare_with_wrap(asoc->cumulative_tsn, ntohl(liste->tsn), MAX_TSN)) ||
209717205eccSRandall Stewart 	    (asoc->cumulative_tsn == ntohl(liste->tsn)))
209817205eccSRandall Stewart 	    ) {
209917205eccSRandall Stewart 		/*
210017205eccSRandall Stewart 		 * we have finished working through the backlogged TSN's now
210117205eccSRandall Stewart 		 * time to reset streams. 1: call reset function. 2: free
210217205eccSRandall Stewart 		 * pending_reply space 3: distribute any chunks in
210317205eccSRandall Stewart 		 * pending_reply_queue.
210417205eccSRandall Stewart 		 */
210517205eccSRandall Stewart 		struct sctp_queued_to_read *ctl;
210617205eccSRandall Stewart 
210717205eccSRandall Stewart 		sctp_reset_in_stream(stcb, liste->number_entries, liste->req.list_of_streams);
210817205eccSRandall Stewart 		TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
210917205eccSRandall Stewart 		SCTP_FREE(liste);
211017205eccSRandall Stewart 		liste = TAILQ_FIRST(&asoc->resetHead);
211117205eccSRandall Stewart 		ctl = TAILQ_FIRST(&asoc->pending_reply_queue);
211217205eccSRandall Stewart 		if (ctl && (liste == NULL)) {
211317205eccSRandall Stewart 			/* All can be removed */
211417205eccSRandall Stewart 			while (ctl) {
211517205eccSRandall Stewart 				TAILQ_REMOVE(&asoc->pending_reply_queue, ctl, next);
211617205eccSRandall Stewart 				sctp_queue_data_to_stream(stcb, asoc, ctl, abort_flag);
211717205eccSRandall Stewart 				if (*abort_flag) {
211817205eccSRandall Stewart 					return (0);
211917205eccSRandall Stewart 				}
212017205eccSRandall Stewart 				ctl = TAILQ_FIRST(&asoc->pending_reply_queue);
212117205eccSRandall Stewart 			}
212217205eccSRandall Stewart 		} else if (ctl) {
212317205eccSRandall Stewart 			/* more than one in queue */
212417205eccSRandall Stewart 			while (!compare_with_wrap(ctl->sinfo_tsn, ntohl(liste->tsn), MAX_TSN)) {
212517205eccSRandall Stewart 				/*
212617205eccSRandall Stewart 				 * if ctl->sinfo_tsn is <= liste->tsn we can
212717205eccSRandall Stewart 				 * process it which is the NOT of
212817205eccSRandall Stewart 				 * ctl->sinfo_tsn > liste->tsn
212917205eccSRandall Stewart 				 */
213017205eccSRandall Stewart 				TAILQ_REMOVE(&asoc->pending_reply_queue, ctl, next);
213117205eccSRandall Stewart 				sctp_queue_data_to_stream(stcb, asoc, ctl, abort_flag);
213217205eccSRandall Stewart 				if (*abort_flag) {
213317205eccSRandall Stewart 					return (0);
213417205eccSRandall Stewart 				}
213517205eccSRandall Stewart 				ctl = TAILQ_FIRST(&asoc->pending_reply_queue);
213617205eccSRandall Stewart 			}
213717205eccSRandall Stewart 		}
213817205eccSRandall Stewart 		/*
213917205eccSRandall Stewart 		 * Now service re-assembly to pick up anything that has been
214017205eccSRandall Stewart 		 * held on reassembly queue?
214117205eccSRandall Stewart 		 */
214217205eccSRandall Stewart 		sctp_deliver_reasm_check(stcb, asoc);
214317205eccSRandall Stewart 		need_reasm_check = 0;
214417205eccSRandall Stewart 	}
2145139bc87fSRandall Stewart 	if (need_reasm_check) {
2146139bc87fSRandall Stewart 		/* Another one waits ? */
2147139bc87fSRandall Stewart 		sctp_deliver_reasm_check(stcb, asoc);
2148139bc87fSRandall Stewart 	}
2149f8829a4aSRandall Stewart 	return (1);
2150f8829a4aSRandall Stewart }
2151f8829a4aSRandall Stewart 
2152f8829a4aSRandall Stewart int8_t sctp_map_lookup_tab[256] = {
2153f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2154f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2155f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2156f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 4,
2157f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2158f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2159f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2160f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 5,
2161f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2162f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2163f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2164f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 4,
2165f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2166f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2167f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2168f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 6,
2169f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2170f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2171f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2172f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 4,
2173f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2174f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2175f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2176f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 5,
2177f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2178f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2179f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2180f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 4,
2181f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2182f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 3,
2183f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 2,
2184f8829a4aSRandall Stewart 	-1, 0, -1, 1, -1, 0, -1, 7,
2185f8829a4aSRandall Stewart };
2186f8829a4aSRandall Stewart 
2187f8829a4aSRandall Stewart 
2188f8829a4aSRandall Stewart void
2189f8829a4aSRandall Stewart sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort_flag)
2190f8829a4aSRandall Stewart {
2191f8829a4aSRandall Stewart 	/*
2192f8829a4aSRandall Stewart 	 * Now we also need to check the mapping array in a couple of ways.
2193f8829a4aSRandall Stewart 	 * 1) Did we move the cum-ack point?
2194f8829a4aSRandall Stewart 	 */
2195f8829a4aSRandall Stewart 	struct sctp_association *asoc;
2196f8829a4aSRandall Stewart 	int i, at;
219793164cf9SRandall Stewart 	int all_ones, last_all_ones = 0;
2198f8829a4aSRandall Stewart 	int slide_from, slide_end, lgap, distance;
2199f8829a4aSRandall Stewart 
2200f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2201f8829a4aSRandall Stewart 	uint32_t old_cumack, old_base, old_highest;
2202f8829a4aSRandall Stewart 	unsigned char aux_array[64];
2203f8829a4aSRandall Stewart 
2204f8829a4aSRandall Stewart #endif
2205f8829a4aSRandall Stewart 
2206f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
2207f8829a4aSRandall Stewart 	at = 0;
2208f8829a4aSRandall Stewart 
2209f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2210f8829a4aSRandall Stewart 	old_cumack = asoc->cumulative_tsn;
2211f8829a4aSRandall Stewart 	old_base = asoc->mapping_array_base_tsn;
2212f8829a4aSRandall Stewart 	old_highest = asoc->highest_tsn_inside_map;
2213f8829a4aSRandall Stewart 	if (asoc->mapping_array_size < 64)
2214f8829a4aSRandall Stewart 		memcpy(aux_array, asoc->mapping_array,
2215f8829a4aSRandall Stewart 		    asoc->mapping_array_size);
2216f8829a4aSRandall Stewart 	else
2217f8829a4aSRandall Stewart 		memcpy(aux_array, asoc->mapping_array, 64);
2218f8829a4aSRandall Stewart #endif
2219f8829a4aSRandall Stewart 
2220f8829a4aSRandall Stewart 	/*
2221f8829a4aSRandall Stewart 	 * We could probably improve this a small bit by calculating the
2222f8829a4aSRandall Stewart 	 * offset of the current cum-ack as the starting point.
2223f8829a4aSRandall Stewart 	 */
2224f8829a4aSRandall Stewart 	all_ones = 1;
2225f8829a4aSRandall Stewart 	at = 0;
2226f8829a4aSRandall Stewart 	for (i = 0; i < stcb->asoc.mapping_array_size; i++) {
2227d06c82f1SRandall Stewart 
2228f8829a4aSRandall Stewart 		if (asoc->mapping_array[i] == 0xff) {
2229f8829a4aSRandall Stewart 			at += 8;
223093164cf9SRandall Stewart 			last_all_ones = 1;
2231f8829a4aSRandall Stewart 		} else {
2232f8829a4aSRandall Stewart 			/* there is a 0 bit */
2233f8829a4aSRandall Stewart 			all_ones = 0;
2234f8829a4aSRandall Stewart 			at += sctp_map_lookup_tab[asoc->mapping_array[i]];
223593164cf9SRandall Stewart 			last_all_ones = 0;
2236f8829a4aSRandall Stewart 			break;
2237f8829a4aSRandall Stewart 		}
2238f8829a4aSRandall Stewart 	}
223993164cf9SRandall Stewart 	asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - last_all_ones);
2240f8829a4aSRandall Stewart 	/* at is one off, since in the table a embedded -1 is present */
2241f8829a4aSRandall Stewart 	at++;
2242f8829a4aSRandall Stewart 
2243f8829a4aSRandall Stewart 	if (compare_with_wrap(asoc->cumulative_tsn,
2244f8829a4aSRandall Stewart 	    asoc->highest_tsn_inside_map,
2245f8829a4aSRandall Stewart 	    MAX_TSN)) {
2246a5d547adSRandall Stewart #ifdef INVARIANTS
2247f8829a4aSRandall Stewart 		panic("huh, cumack greater than high-tsn in map");
2248f8829a4aSRandall Stewart #else
2249ad81507eSRandall Stewart 		SCTP_PRINTF("huh, cumack greater than high-tsn in map - should panic?\n");
2250f8829a4aSRandall Stewart 		asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2251f8829a4aSRandall Stewart #endif
2252f8829a4aSRandall Stewart 	}
2253f8829a4aSRandall Stewart 	if (all_ones ||
2254f8829a4aSRandall Stewart 	    (asoc->cumulative_tsn == asoc->highest_tsn_inside_map && at >= 8)) {
2255f8829a4aSRandall Stewart 		/* The complete array was completed by a single FR */
2256f8829a4aSRandall Stewart 		/* higest becomes the cum-ack */
2257f8829a4aSRandall Stewart 		int clr;
2258f8829a4aSRandall Stewart 
2259f8829a4aSRandall Stewart 		asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
2260f8829a4aSRandall Stewart 		/* clear the array */
2261f8829a4aSRandall Stewart 		if (all_ones)
2262f8829a4aSRandall Stewart 			clr = asoc->mapping_array_size;
2263f8829a4aSRandall Stewart 		else {
2264f8829a4aSRandall Stewart 			clr = (at >> 3) + 1;
2265f8829a4aSRandall Stewart 			/*
2266f8829a4aSRandall Stewart 			 * this should be the allones case but just in case
2267f8829a4aSRandall Stewart 			 * :>
2268f8829a4aSRandall Stewart 			 */
2269f8829a4aSRandall Stewart 			if (clr > asoc->mapping_array_size)
2270f8829a4aSRandall Stewart 				clr = asoc->mapping_array_size;
2271f8829a4aSRandall Stewart 		}
2272f8829a4aSRandall Stewart 		memset(asoc->mapping_array, 0, clr);
2273f8829a4aSRandall Stewart 		/* base becomes one ahead of the cum-ack */
2274f8829a4aSRandall Stewart 		asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2275f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2276f8829a4aSRandall Stewart 		sctp_log_map(old_base, old_cumack, old_highest,
2277f8829a4aSRandall Stewart 		    SCTP_MAP_PREPARE_SLIDE);
2278f8829a4aSRandall Stewart 		sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2279f8829a4aSRandall Stewart 		    asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_CLEARED);
2280f8829a4aSRandall Stewart #endif
2281f8829a4aSRandall Stewart 	} else if (at >= 8) {
2282f8829a4aSRandall Stewart 		/* we can slide the mapping array down */
2283f8829a4aSRandall Stewart 		/* Calculate the new byte postion we can move down */
2284f8829a4aSRandall Stewart 		slide_from = at >> 3;
2285f8829a4aSRandall Stewart 		/*
2286f8829a4aSRandall Stewart 		 * now calculate the ceiling of the move using our highest
2287f8829a4aSRandall Stewart 		 * TSN value
2288f8829a4aSRandall Stewart 		 */
2289f8829a4aSRandall Stewart 		if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
2290f8829a4aSRandall Stewart 			lgap = asoc->highest_tsn_inside_map -
2291f8829a4aSRandall Stewart 			    asoc->mapping_array_base_tsn;
2292f8829a4aSRandall Stewart 		} else {
2293f8829a4aSRandall Stewart 			lgap = (MAX_TSN - asoc->mapping_array_base_tsn) +
2294f8829a4aSRandall Stewart 			    asoc->highest_tsn_inside_map + 1;
2295f8829a4aSRandall Stewart 		}
2296f8829a4aSRandall Stewart 		slide_end = lgap >> 3;
2297f8829a4aSRandall Stewart 		if (slide_end < slide_from) {
2298f8829a4aSRandall Stewart 			panic("impossible slide");
2299f8829a4aSRandall Stewart 		}
2300f8829a4aSRandall Stewart 		distance = (slide_end - slide_from) + 1;
2301f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2302f8829a4aSRandall Stewart 		sctp_log_map(old_base, old_cumack, old_highest,
2303f8829a4aSRandall Stewart 		    SCTP_MAP_PREPARE_SLIDE);
2304f8829a4aSRandall Stewart 		sctp_log_map((uint32_t) slide_from, (uint32_t) slide_end,
2305f8829a4aSRandall Stewart 		    (uint32_t) lgap, SCTP_MAP_SLIDE_FROM);
2306f8829a4aSRandall Stewart #endif
2307f8829a4aSRandall Stewart 		if (distance + slide_from > asoc->mapping_array_size ||
2308f8829a4aSRandall Stewart 		    distance < 0) {
2309f8829a4aSRandall Stewart 			/*
2310f8829a4aSRandall Stewart 			 * Here we do NOT slide forward the array so that
2311f8829a4aSRandall Stewart 			 * hopefully when more data comes in to fill it up
2312f8829a4aSRandall Stewart 			 * we will be able to slide it forward. Really I
2313f8829a4aSRandall Stewart 			 * don't think this should happen :-0
2314f8829a4aSRandall Stewart 			 */
2315f8829a4aSRandall Stewart 
2316f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2317f8829a4aSRandall Stewart 			sctp_log_map((uint32_t) distance, (uint32_t) slide_from,
2318f8829a4aSRandall Stewart 			    (uint32_t) asoc->mapping_array_size,
2319f8829a4aSRandall Stewart 			    SCTP_MAP_SLIDE_NONE);
2320f8829a4aSRandall Stewart #endif
2321f8829a4aSRandall Stewart 		} else {
2322f8829a4aSRandall Stewart 			int ii;
2323f8829a4aSRandall Stewart 
2324f8829a4aSRandall Stewart 			for (ii = 0; ii < distance; ii++) {
2325f8829a4aSRandall Stewart 				asoc->mapping_array[ii] =
2326f8829a4aSRandall Stewart 				    asoc->mapping_array[slide_from + ii];
2327f8829a4aSRandall Stewart 			}
2328f8829a4aSRandall Stewart 			for (ii = distance; ii <= slide_end; ii++) {
2329f8829a4aSRandall Stewart 				asoc->mapping_array[ii] = 0;
2330f8829a4aSRandall Stewart 			}
2331f8829a4aSRandall Stewart 			asoc->mapping_array_base_tsn += (slide_from << 3);
2332f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
2333f8829a4aSRandall Stewart 			sctp_log_map(asoc->mapping_array_base_tsn,
2334f8829a4aSRandall Stewart 			    asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2335f8829a4aSRandall Stewart 			    SCTP_MAP_SLIDE_RESULT);
2336f8829a4aSRandall Stewart #endif
2337f8829a4aSRandall Stewart 		}
2338f8829a4aSRandall Stewart 	}
2339f8829a4aSRandall Stewart 	/*
2340f8829a4aSRandall Stewart 	 * Now we need to see if we need to queue a sack or just start the
2341f8829a4aSRandall Stewart 	 * timer (if allowed).
2342f8829a4aSRandall Stewart 	 */
2343f8829a4aSRandall Stewart 	if (ok_to_sack) {
2344f8829a4aSRandall Stewart 		if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2345f8829a4aSRandall Stewart 			/*
2346f8829a4aSRandall Stewart 			 * Ok special case, in SHUTDOWN-SENT case. here we
2347f8829a4aSRandall Stewart 			 * maker sure SACK timer is off and instead send a
2348f8829a4aSRandall Stewart 			 * SHUTDOWN and a SACK
2349f8829a4aSRandall Stewart 			 */
2350139bc87fSRandall Stewart 			if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2351f8829a4aSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2352a5d547adSRandall Stewart 				    stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_INDATA + SCTP_LOC_18);
2353f8829a4aSRandall Stewart 			}
2354f8829a4aSRandall Stewart 			sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
2355f8829a4aSRandall Stewart 			sctp_send_sack(stcb);
2356f8829a4aSRandall Stewart 		} else {
2357f8829a4aSRandall Stewart 			int is_a_gap;
2358f8829a4aSRandall Stewart 
2359f8829a4aSRandall Stewart 			/* is there a gap now ? */
2360f8829a4aSRandall Stewart 			is_a_gap = compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2361f8829a4aSRandall Stewart 			    stcb->asoc.cumulative_tsn, MAX_TSN);
2362f8829a4aSRandall Stewart 
2363f8829a4aSRandall Stewart 			/*
2364f8829a4aSRandall Stewart 			 * CMT DAC algorithm: increase number of packets
2365f8829a4aSRandall Stewart 			 * received since last ack
2366f8829a4aSRandall Stewart 			 */
2367f8829a4aSRandall Stewart 			stcb->asoc.cmt_dac_pkts_rcvd++;
2368f8829a4aSRandall Stewart 
236942551e99SRandall Stewart 			if ((stcb->asoc.send_sack == 1) ||	/* We need to send a
237042551e99SRandall Stewart 								 * SACK */
2371f8829a4aSRandall Stewart 			    ((was_a_gap) && (is_a_gap == 0)) ||	/* was a gap, but no
2372f8829a4aSRandall Stewart 								 * longer is one */
2373f8829a4aSRandall Stewart 			    (stcb->asoc.numduptsns) ||	/* we have dup's */
2374f8829a4aSRandall Stewart 			    (is_a_gap) ||	/* is still a gap */
237542551e99SRandall Stewart 			    (stcb->asoc.delayed_ack == 0) ||	/* Delayed sack disabled */
237642551e99SRandall Stewart 			    (stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq)	/* hit limit of pkts */
2377f8829a4aSRandall Stewart 			    ) {
2378f8829a4aSRandall Stewart 
2379f8829a4aSRandall Stewart 				if ((sctp_cmt_on_off) && (sctp_cmt_use_dac) &&
238042551e99SRandall Stewart 				    (stcb->asoc.send_sack == 0) &&
2381f8829a4aSRandall Stewart 				    (stcb->asoc.numduptsns == 0) &&
2382f8829a4aSRandall Stewart 				    (stcb->asoc.delayed_ack) &&
2383139bc87fSRandall Stewart 				    (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer))) {
2384f8829a4aSRandall Stewart 
2385f8829a4aSRandall Stewart 					/*
2386f8829a4aSRandall Stewart 					 * CMT DAC algorithm: With CMT,
2387f8829a4aSRandall Stewart 					 * delay acks even in the face of
2388f8829a4aSRandall Stewart 					 *
2389f8829a4aSRandall Stewart 					 * reordering. Therefore, if acks that
2390f8829a4aSRandall Stewart 					 * do not have to be sent because of
2391f8829a4aSRandall Stewart 					 * the above reasons, will be
2392f8829a4aSRandall Stewart 					 * delayed. That is, acks that would
2393f8829a4aSRandall Stewart 					 * have been sent due to gap reports
2394f8829a4aSRandall Stewart 					 * will be delayed with DAC. Start
2395f8829a4aSRandall Stewart 					 * the delayed ack timer.
2396f8829a4aSRandall Stewart 					 */
2397f8829a4aSRandall Stewart 					sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2398f8829a4aSRandall Stewart 					    stcb->sctp_ep, stcb, NULL);
2399f8829a4aSRandall Stewart 				} else {
2400f8829a4aSRandall Stewart 					/*
2401f8829a4aSRandall Stewart 					 * Ok we must build a SACK since the
2402f8829a4aSRandall Stewart 					 * timer is pending, we got our
2403f8829a4aSRandall Stewart 					 * first packet OR there are gaps or
2404f8829a4aSRandall Stewart 					 * duplicates.
2405f8829a4aSRandall Stewart 					 */
2406ad81507eSRandall Stewart 					(void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
2407f8829a4aSRandall Stewart 					sctp_send_sack(stcb);
2408f8829a4aSRandall Stewart 				}
2409f8829a4aSRandall Stewart 			} else {
241042551e99SRandall Stewart 				if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2411f8829a4aSRandall Stewart 					sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2412f8829a4aSRandall Stewart 					    stcb->sctp_ep, stcb, NULL);
2413f8829a4aSRandall Stewart 				}
2414f8829a4aSRandall Stewart 			}
2415f8829a4aSRandall Stewart 		}
2416f8829a4aSRandall Stewart 	}
241742551e99SRandall Stewart }
2418f8829a4aSRandall Stewart 
2419f8829a4aSRandall Stewart void
2420f8829a4aSRandall Stewart sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc)
2421f8829a4aSRandall Stewart {
2422f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk;
2423f8829a4aSRandall Stewart 	uint32_t tsize;
2424f8829a4aSRandall Stewart 	uint16_t nxt_todel;
2425f8829a4aSRandall Stewart 
2426f8829a4aSRandall Stewart 	if (asoc->fragmented_delivery_inprogress) {
2427f8829a4aSRandall Stewart 		sctp_service_reassembly(stcb, asoc);
2428f8829a4aSRandall Stewart 	}
2429f8829a4aSRandall Stewart 	/* Can we proceed further, i.e. the PD-API is complete */
2430f8829a4aSRandall Stewart 	if (asoc->fragmented_delivery_inprogress) {
2431f8829a4aSRandall Stewart 		/* no */
2432f8829a4aSRandall Stewart 		return;
2433f8829a4aSRandall Stewart 	}
2434f8829a4aSRandall Stewart 	/*
2435f8829a4aSRandall Stewart 	 * Now is there some other chunk I can deliver from the reassembly
2436f8829a4aSRandall Stewart 	 * queue.
2437f8829a4aSRandall Stewart 	 */
2438139bc87fSRandall Stewart doit_again:
2439f8829a4aSRandall Stewart 	chk = TAILQ_FIRST(&asoc->reasmqueue);
2440f8829a4aSRandall Stewart 	if (chk == NULL) {
2441f8829a4aSRandall Stewart 		asoc->size_on_reasm_queue = 0;
2442f8829a4aSRandall Stewart 		asoc->cnt_on_reasm_queue = 0;
2443f8829a4aSRandall Stewart 		return;
2444f8829a4aSRandall Stewart 	}
2445f8829a4aSRandall Stewart 	nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
2446f8829a4aSRandall Stewart 	if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
2447f8829a4aSRandall Stewart 	    ((nxt_todel == chk->rec.data.stream_seq) ||
2448f8829a4aSRandall Stewart 	    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
2449f8829a4aSRandall Stewart 		/*
2450f8829a4aSRandall Stewart 		 * Yep the first one is here. We setup to start reception,
2451f8829a4aSRandall Stewart 		 * by backing down the TSN just in case we can't deliver.
2452f8829a4aSRandall Stewart 		 */
2453f8829a4aSRandall Stewart 
2454f8829a4aSRandall Stewart 		/*
2455f8829a4aSRandall Stewart 		 * Before we start though either all of the message should
2456f8829a4aSRandall Stewart 		 * be here or 1/4 the socket buffer max or nothing on the
2457f8829a4aSRandall Stewart 		 * delivery queue and something can be delivered.
2458f8829a4aSRandall Stewart 		 */
2459f8829a4aSRandall Stewart 		if ((sctp_is_all_msg_on_reasm(asoc, &tsize) ||
2460f8829a4aSRandall Stewart 		    (tsize > stcb->sctp_ep->partial_delivery_point))) {
2461f8829a4aSRandall Stewart 			asoc->fragmented_delivery_inprogress = 1;
2462f8829a4aSRandall Stewart 			asoc->tsn_last_delivered = chk->rec.data.TSN_seq - 1;
2463f8829a4aSRandall Stewart 			asoc->str_of_pdapi = chk->rec.data.stream_number;
2464f8829a4aSRandall Stewart 			asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
2465f8829a4aSRandall Stewart 			asoc->pdapi_ppid = chk->rec.data.payloadtype;
2466f8829a4aSRandall Stewart 			asoc->fragment_flags = chk->rec.data.rcv_flags;
2467f8829a4aSRandall Stewart 			sctp_service_reassembly(stcb, asoc);
2468139bc87fSRandall Stewart 			if (asoc->fragmented_delivery_inprogress == 0) {
2469139bc87fSRandall Stewart 				goto doit_again;
2470139bc87fSRandall Stewart 			}
2471f8829a4aSRandall Stewart 		}
2472f8829a4aSRandall Stewart 	}
2473f8829a4aSRandall Stewart }
2474f8829a4aSRandall Stewart 
2475f8829a4aSRandall Stewart int
2476f8829a4aSRandall Stewart sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2477f8829a4aSRandall Stewart     struct sctphdr *sh, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2478f8829a4aSRandall Stewart     struct sctp_nets *net, uint32_t * high_tsn)
2479f8829a4aSRandall Stewart {
2480f8829a4aSRandall Stewart 	struct sctp_data_chunk *ch, chunk_buf;
2481f8829a4aSRandall Stewart 	struct sctp_association *asoc;
2482f8829a4aSRandall Stewart 	int num_chunks = 0;	/* number of control chunks processed */
2483f8829a4aSRandall Stewart 	int stop_proc = 0;
2484f8829a4aSRandall Stewart 	int chk_length, break_flag, last_chunk;
2485f8829a4aSRandall Stewart 	int abort_flag = 0, was_a_gap = 0;
2486f8829a4aSRandall Stewart 	struct mbuf *m;
2487f8829a4aSRandall Stewart 
2488f8829a4aSRandall Stewart 	/* set the rwnd */
2489f8829a4aSRandall Stewart 	sctp_set_rwnd(stcb, &stcb->asoc);
2490f8829a4aSRandall Stewart 
2491f8829a4aSRandall Stewart 	m = *mm;
2492f8829a4aSRandall Stewart 	SCTP_TCB_LOCK_ASSERT(stcb);
2493f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
2494f8829a4aSRandall Stewart 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
2495f8829a4aSRandall Stewart 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
2496f8829a4aSRandall Stewart 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
2497f8829a4aSRandall Stewart 		/*
2498f8829a4aSRandall Stewart 		 * wait a minute, this guy is gone, there is no longer a
2499f8829a4aSRandall Stewart 		 * receiver. Send peer an ABORT!
2500f8829a4aSRandall Stewart 		 */
2501f8829a4aSRandall Stewart 		struct mbuf *op_err;
2502f8829a4aSRandall Stewart 
2503f8829a4aSRandall Stewart 		op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2504f8829a4aSRandall Stewart 		sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err);
2505f8829a4aSRandall Stewart 		return (2);
2506f8829a4aSRandall Stewart 	}
2507f8829a4aSRandall Stewart 	if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
2508f8829a4aSRandall Stewart 	    stcb->asoc.cumulative_tsn, MAX_TSN)) {
2509f8829a4aSRandall Stewart 		/* there was a gap before this data was processed */
2510f8829a4aSRandall Stewart 		was_a_gap = 1;
2511f8829a4aSRandall Stewart 	}
2512f8829a4aSRandall Stewart 	/*
2513f8829a4aSRandall Stewart 	 * setup where we got the last DATA packet from for any SACK that
2514f8829a4aSRandall Stewart 	 * may need to go out. Don't bump the net. This is done ONLY when a
2515f8829a4aSRandall Stewart 	 * chunk is assigned.
2516f8829a4aSRandall Stewart 	 */
2517f8829a4aSRandall Stewart 	asoc->last_data_chunk_from = net;
2518f8829a4aSRandall Stewart 
2519d06c82f1SRandall Stewart 	/*-
2520f8829a4aSRandall Stewart 	 * Now before we proceed we must figure out if this is a wasted
2521f8829a4aSRandall Stewart 	 * cluster... i.e. it is a small packet sent in and yet the driver
2522f8829a4aSRandall Stewart 	 * underneath allocated a full cluster for it. If so we must copy it
2523f8829a4aSRandall Stewart 	 * to a smaller mbuf and free up the cluster mbuf. This will help
2524d06c82f1SRandall Stewart 	 * with cluster starvation. Note for __Panda__ we don't do this
2525d06c82f1SRandall Stewart 	 * since it has clusters all the way down to 64 bytes.
2526f8829a4aSRandall Stewart 	 */
252744b7479bSRandall Stewart 	if (SCTP_BUF_LEN(m) < (long)MLEN && SCTP_BUF_NEXT(m) == NULL) {
2528f8829a4aSRandall Stewart 		/* we only handle mbufs that are singletons.. not chains */
2529139bc87fSRandall Stewart 		m = sctp_get_mbuf_for_msg(SCTP_BUF_LEN(m), 0, M_DONTWAIT, 1, MT_DATA);
2530f8829a4aSRandall Stewart 		if (m) {
2531f8829a4aSRandall Stewart 			/* ok lets see if we can copy the data up */
2532f8829a4aSRandall Stewart 			caddr_t *from, *to;
2533f8829a4aSRandall Stewart 
2534f8829a4aSRandall Stewart 			/* get the pointers and copy */
2535f8829a4aSRandall Stewart 			to = mtod(m, caddr_t *);
2536f8829a4aSRandall Stewart 			from = mtod((*mm), caddr_t *);
2537139bc87fSRandall Stewart 			memcpy(to, from, SCTP_BUF_LEN((*mm)));
2538f8829a4aSRandall Stewart 			/* copy the length and free up the old */
2539139bc87fSRandall Stewart 			SCTP_BUF_LEN(m) = SCTP_BUF_LEN((*mm));
2540f8829a4aSRandall Stewart 			sctp_m_freem(*mm);
2541f8829a4aSRandall Stewart 			/* sucess, back copy */
2542f8829a4aSRandall Stewart 			*mm = m;
2543f8829a4aSRandall Stewart 		} else {
2544f8829a4aSRandall Stewart 			/* We are in trouble in the mbuf world .. yikes */
2545f8829a4aSRandall Stewart 			m = *mm;
2546f8829a4aSRandall Stewart 		}
2547f8829a4aSRandall Stewart 	}
2548f8829a4aSRandall Stewart 	/* get pointer to the first chunk header */
2549f8829a4aSRandall Stewart 	ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2550f8829a4aSRandall Stewart 	    sizeof(struct sctp_data_chunk), (uint8_t *) & chunk_buf);
2551f8829a4aSRandall Stewart 	if (ch == NULL) {
2552f8829a4aSRandall Stewart 		return (1);
2553f8829a4aSRandall Stewart 	}
2554f8829a4aSRandall Stewart 	/*
2555f8829a4aSRandall Stewart 	 * process all DATA chunks...
2556f8829a4aSRandall Stewart 	 */
2557f8829a4aSRandall Stewart 	*high_tsn = asoc->cumulative_tsn;
2558f8829a4aSRandall Stewart 	break_flag = 0;
255942551e99SRandall Stewart 	asoc->data_pkts_seen++;
2560f8829a4aSRandall Stewart 	while (stop_proc == 0) {
2561f8829a4aSRandall Stewart 		/* validate chunk length */
2562f8829a4aSRandall Stewart 		chk_length = ntohs(ch->ch.chunk_length);
2563f8829a4aSRandall Stewart 		if (length - *offset < chk_length) {
2564f8829a4aSRandall Stewart 			/* all done, mutulated chunk */
2565f8829a4aSRandall Stewart 			stop_proc = 1;
2566f8829a4aSRandall Stewart 			break;
2567f8829a4aSRandall Stewart 		}
2568f8829a4aSRandall Stewart 		if (ch->ch.chunk_type == SCTP_DATA) {
2569f8829a4aSRandall Stewart 			if ((size_t)chk_length < sizeof(struct sctp_data_chunk) + 1) {
2570f8829a4aSRandall Stewart 				/*
2571f8829a4aSRandall Stewart 				 * Need to send an abort since we had a
2572f8829a4aSRandall Stewart 				 * invalid data chunk.
2573f8829a4aSRandall Stewart 				 */
2574f8829a4aSRandall Stewart 				struct mbuf *op_err;
2575f8829a4aSRandall Stewart 
2576139bc87fSRandall Stewart 				op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 2 * sizeof(uint32_t)),
2577f8829a4aSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
2578f8829a4aSRandall Stewart 
2579f8829a4aSRandall Stewart 				if (op_err) {
2580f8829a4aSRandall Stewart 					struct sctp_paramhdr *ph;
2581f8829a4aSRandall Stewart 					uint32_t *ippp;
2582f8829a4aSRandall Stewart 
2583139bc87fSRandall Stewart 					SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr) +
2584f8829a4aSRandall Stewart 					    (2 * sizeof(uint32_t));
2585f8829a4aSRandall Stewart 					ph = mtod(op_err, struct sctp_paramhdr *);
2586f8829a4aSRandall Stewart 					ph->param_type =
2587f8829a4aSRandall Stewart 					    htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
2588139bc87fSRandall Stewart 					ph->param_length = htons(SCTP_BUF_LEN(op_err));
2589f8829a4aSRandall Stewart 					ippp = (uint32_t *) (ph + 1);
2590a5d547adSRandall Stewart 					*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_19);
2591f8829a4aSRandall Stewart 					ippp++;
2592f8829a4aSRandall Stewart 					*ippp = asoc->cumulative_tsn;
2593f8829a4aSRandall Stewart 
2594f8829a4aSRandall Stewart 				}
2595a5d547adSRandall Stewart 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_19;
2596f8829a4aSRandall Stewart 				sctp_abort_association(inp, stcb, m, iphlen, sh,
259717205eccSRandall Stewart 				    op_err, 0, 0);
2598f8829a4aSRandall Stewart 				return (2);
2599f8829a4aSRandall Stewart 			}
2600f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
2601f8829a4aSRandall Stewart 			sctp_audit_log(0xB1, 0);
2602f8829a4aSRandall Stewart #endif
2603f8829a4aSRandall Stewart 			if (SCTP_SIZE32(chk_length) == (length - *offset)) {
2604f8829a4aSRandall Stewart 				last_chunk = 1;
2605f8829a4aSRandall Stewart 			} else {
2606f8829a4aSRandall Stewart 				last_chunk = 0;
2607f8829a4aSRandall Stewart 			}
2608f8829a4aSRandall Stewart 			if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch,
2609f8829a4aSRandall Stewart 			    chk_length, net, high_tsn, &abort_flag, &break_flag,
2610f8829a4aSRandall Stewart 			    last_chunk)) {
2611f8829a4aSRandall Stewart 				num_chunks++;
2612f8829a4aSRandall Stewart 			}
2613f8829a4aSRandall Stewart 			if (abort_flag)
2614f8829a4aSRandall Stewart 				return (2);
2615f8829a4aSRandall Stewart 
2616f8829a4aSRandall Stewart 			if (break_flag) {
2617f8829a4aSRandall Stewart 				/*
2618f8829a4aSRandall Stewart 				 * Set because of out of rwnd space and no
2619f8829a4aSRandall Stewart 				 * drop rep space left.
2620f8829a4aSRandall Stewart 				 */
2621f8829a4aSRandall Stewart 				stop_proc = 1;
2622f8829a4aSRandall Stewart 				break;
2623f8829a4aSRandall Stewart 			}
2624f8829a4aSRandall Stewart 		} else {
2625f8829a4aSRandall Stewart 			/* not a data chunk in the data region */
2626f8829a4aSRandall Stewart 			switch (ch->ch.chunk_type) {
2627f8829a4aSRandall Stewart 			case SCTP_INITIATION:
2628f8829a4aSRandall Stewart 			case SCTP_INITIATION_ACK:
2629f8829a4aSRandall Stewart 			case SCTP_SELECTIVE_ACK:
2630f8829a4aSRandall Stewart 			case SCTP_HEARTBEAT_REQUEST:
2631f8829a4aSRandall Stewart 			case SCTP_HEARTBEAT_ACK:
2632f8829a4aSRandall Stewart 			case SCTP_ABORT_ASSOCIATION:
2633f8829a4aSRandall Stewart 			case SCTP_SHUTDOWN:
2634f8829a4aSRandall Stewart 			case SCTP_SHUTDOWN_ACK:
2635f8829a4aSRandall Stewart 			case SCTP_OPERATION_ERROR:
2636f8829a4aSRandall Stewart 			case SCTP_COOKIE_ECHO:
2637f8829a4aSRandall Stewart 			case SCTP_COOKIE_ACK:
2638f8829a4aSRandall Stewart 			case SCTP_ECN_ECHO:
2639f8829a4aSRandall Stewart 			case SCTP_ECN_CWR:
2640f8829a4aSRandall Stewart 			case SCTP_SHUTDOWN_COMPLETE:
2641f8829a4aSRandall Stewart 			case SCTP_AUTHENTICATION:
2642f8829a4aSRandall Stewart 			case SCTP_ASCONF_ACK:
2643f8829a4aSRandall Stewart 			case SCTP_PACKET_DROPPED:
2644f8829a4aSRandall Stewart 			case SCTP_STREAM_RESET:
2645f8829a4aSRandall Stewart 			case SCTP_FORWARD_CUM_TSN:
2646f8829a4aSRandall Stewart 			case SCTP_ASCONF:
2647f8829a4aSRandall Stewart 				/*
2648f8829a4aSRandall Stewart 				 * Now, what do we do with KNOWN chunks that
2649f8829a4aSRandall Stewart 				 * are NOT in the right place?
2650f8829a4aSRandall Stewart 				 *
2651f8829a4aSRandall Stewart 				 * For now, I do nothing but ignore them. We
2652f8829a4aSRandall Stewart 				 * may later want to add sysctl stuff to
2653f8829a4aSRandall Stewart 				 * switch out and do either an ABORT() or
2654f8829a4aSRandall Stewart 				 * possibly process them.
2655f8829a4aSRandall Stewart 				 */
2656f8829a4aSRandall Stewart 				if (sctp_strict_data_order) {
2657f8829a4aSRandall Stewart 					struct mbuf *op_err;
2658f8829a4aSRandall Stewart 
2659f8829a4aSRandall Stewart 					op_err = sctp_generate_invmanparam(SCTP_CAUSE_PROTOCOL_VIOLATION);
266017205eccSRandall Stewart 					sctp_abort_association(inp, stcb, m, iphlen, sh, op_err, 0, 0);
2661f8829a4aSRandall Stewart 					return (2);
2662f8829a4aSRandall Stewart 				}
2663f8829a4aSRandall Stewart 				break;
2664f8829a4aSRandall Stewart 			default:
2665f8829a4aSRandall Stewart 				/* unknown chunk type, use bit rules */
2666f8829a4aSRandall Stewart 				if (ch->ch.chunk_type & 0x40) {
2667f8829a4aSRandall Stewart 					/* Add a error report to the queue */
2668f8829a4aSRandall Stewart 					struct mbuf *mm;
2669f8829a4aSRandall Stewart 					struct sctp_paramhdr *phd;
2670f8829a4aSRandall Stewart 
2671139bc87fSRandall Stewart 					mm = sctp_get_mbuf_for_msg(sizeof(*phd), 0, M_DONTWAIT, 1, MT_DATA);
2672f8829a4aSRandall Stewart 					if (mm) {
2673f8829a4aSRandall Stewart 						phd = mtod(mm, struct sctp_paramhdr *);
2674f8829a4aSRandall Stewart 						/*
2675f8829a4aSRandall Stewart 						 * We cheat and use param
2676f8829a4aSRandall Stewart 						 * type since we did not
2677f8829a4aSRandall Stewart 						 * bother to define a error
2678f8829a4aSRandall Stewart 						 * cause struct. They are
2679f8829a4aSRandall Stewart 						 * the same basic format
2680f8829a4aSRandall Stewart 						 * with different names.
2681f8829a4aSRandall Stewart 						 */
2682f8829a4aSRandall Stewart 						phd->param_type =
2683f8829a4aSRandall Stewart 						    htons(SCTP_CAUSE_UNRECOG_CHUNK);
2684f8829a4aSRandall Stewart 						phd->param_length =
2685f8829a4aSRandall Stewart 						    htons(chk_length + sizeof(*phd));
2686139bc87fSRandall Stewart 						SCTP_BUF_LEN(mm) = sizeof(*phd);
268744b7479bSRandall Stewart 						SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset,
2688f8829a4aSRandall Stewart 						    SCTP_SIZE32(chk_length),
2689f8829a4aSRandall Stewart 						    M_DONTWAIT);
2690139bc87fSRandall Stewart 						if (SCTP_BUF_NEXT(mm)) {
2691f8829a4aSRandall Stewart 							sctp_queue_op_err(stcb, mm);
2692f8829a4aSRandall Stewart 						} else {
2693f8829a4aSRandall Stewart 							sctp_m_freem(mm);
2694f8829a4aSRandall Stewart 						}
2695f8829a4aSRandall Stewart 					}
2696f8829a4aSRandall Stewart 				}
2697f8829a4aSRandall Stewart 				if ((ch->ch.chunk_type & 0x80) == 0) {
2698f8829a4aSRandall Stewart 					/* discard the rest of this packet */
2699f8829a4aSRandall Stewart 					stop_proc = 1;
2700f8829a4aSRandall Stewart 				}	/* else skip this bad chunk and
2701f8829a4aSRandall Stewart 					 * continue... */
2702f8829a4aSRandall Stewart 				break;
2703f8829a4aSRandall Stewart 			};	/* switch of chunk type */
2704f8829a4aSRandall Stewart 		}
2705f8829a4aSRandall Stewart 		*offset += SCTP_SIZE32(chk_length);
2706f8829a4aSRandall Stewart 		if ((*offset >= length) || stop_proc) {
2707f8829a4aSRandall Stewart 			/* no more data left in the mbuf chain */
2708f8829a4aSRandall Stewart 			stop_proc = 1;
2709f8829a4aSRandall Stewart 			continue;
2710f8829a4aSRandall Stewart 		}
2711f8829a4aSRandall Stewart 		ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2712f8829a4aSRandall Stewart 		    sizeof(struct sctp_data_chunk), (uint8_t *) & chunk_buf);
2713f8829a4aSRandall Stewart 		if (ch == NULL) {
2714f8829a4aSRandall Stewart 			*offset = length;
2715f8829a4aSRandall Stewart 			stop_proc = 1;
2716f8829a4aSRandall Stewart 			break;
2717f8829a4aSRandall Stewart 
2718f8829a4aSRandall Stewart 		}
2719f8829a4aSRandall Stewart 	}			/* while */
2720f8829a4aSRandall Stewart 	if (break_flag) {
2721f8829a4aSRandall Stewart 		/*
2722f8829a4aSRandall Stewart 		 * we need to report rwnd overrun drops.
2723f8829a4aSRandall Stewart 		 */
2724f8829a4aSRandall Stewart 		sctp_send_packet_dropped(stcb, net, *mm, iphlen, 0);
2725f8829a4aSRandall Stewart 	}
2726f8829a4aSRandall Stewart 	if (num_chunks) {
2727f8829a4aSRandall Stewart 		/*
2728f8829a4aSRandall Stewart 		 * Did we get data, if so update the time for auto-close and
2729f8829a4aSRandall Stewart 		 * give peer credit for being alive.
2730f8829a4aSRandall Stewart 		 */
2731f8829a4aSRandall Stewart 		SCTP_STAT_INCR(sctps_recvpktwithdata);
2732f8829a4aSRandall Stewart 		stcb->asoc.overall_error_count = 0;
27336e55db54SRandall Stewart 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2734f8829a4aSRandall Stewart 	}
2735f8829a4aSRandall Stewart 	/* now service all of the reassm queue if needed */
2736f8829a4aSRandall Stewart 	if (!(TAILQ_EMPTY(&asoc->reasmqueue)))
2737f8829a4aSRandall Stewart 		sctp_service_queues(stcb, asoc);
2738f8829a4aSRandall Stewart 
2739f8829a4aSRandall Stewart 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
274042551e99SRandall Stewart 		/* Assure that we ack right away */
274142551e99SRandall Stewart 		stcb->asoc.send_sack = 1;
2742f8829a4aSRandall Stewart 	}
2743f8829a4aSRandall Stewart 	/* Start a sack timer or QUEUE a SACK for sending */
2744f8829a4aSRandall Stewart 	if ((stcb->asoc.cumulative_tsn == stcb->asoc.highest_tsn_inside_map) &&
274542551e99SRandall Stewart 	    (stcb->asoc.mapping_array[0] != 0xff)) {
274642551e99SRandall Stewart 		if ((stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq) ||
274742551e99SRandall Stewart 		    (stcb->asoc.delayed_ack == 0) ||
274842551e99SRandall Stewart 		    (stcb->asoc.send_sack == 1)) {
2749139bc87fSRandall Stewart 			if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2750ad81507eSRandall Stewart 				(void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
275142551e99SRandall Stewart 			}
2752f8829a4aSRandall Stewart 			sctp_send_sack(stcb);
2753f8829a4aSRandall Stewart 		} else {
275442551e99SRandall Stewart 			if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2755f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2756f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, NULL);
2757f8829a4aSRandall Stewart 			}
2758f8829a4aSRandall Stewart 		}
2759f8829a4aSRandall Stewart 	} else {
2760f8829a4aSRandall Stewart 		sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
2761f8829a4aSRandall Stewart 	}
2762f8829a4aSRandall Stewart 	if (abort_flag)
2763f8829a4aSRandall Stewart 		return (2);
2764f8829a4aSRandall Stewart 
2765f8829a4aSRandall Stewart 	return (0);
2766f8829a4aSRandall Stewart }
2767f8829a4aSRandall Stewart 
2768f8829a4aSRandall Stewart static void
2769f8829a4aSRandall Stewart sctp_handle_segments(struct sctp_tcb *stcb, struct sctp_association *asoc,
2770f8829a4aSRandall Stewart     struct sctp_sack_chunk *ch, uint32_t last_tsn, uint32_t * biggest_tsn_acked,
2771139bc87fSRandall Stewart     uint32_t * biggest_newly_acked_tsn, uint32_t * this_sack_lowest_newack,
2772139bc87fSRandall Stewart     int num_seg, int *ecn_seg_sums)
2773f8829a4aSRandall Stewart {
2774f8829a4aSRandall Stewart 	/************************************************/
2775f8829a4aSRandall Stewart 	/* process fragments and update sendqueue        */
2776f8829a4aSRandall Stewart 	/************************************************/
2777f8829a4aSRandall Stewart 	struct sctp_sack *sack;
2778f8829a4aSRandall Stewart 	struct sctp_gap_ack_block *frag;
2779f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *tp1;
2780f8829a4aSRandall Stewart 	int i;
2781f8829a4aSRandall Stewart 	unsigned int j;
2782f8829a4aSRandall Stewart 
2783f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
2784f8829a4aSRandall Stewart 	int num_frs = 0;
2785f8829a4aSRandall Stewart 
2786f8829a4aSRandall Stewart #endif
2787f8829a4aSRandall Stewart 	uint16_t frag_strt, frag_end, primary_flag_set;
2788f8829a4aSRandall Stewart 	u_long last_frag_high;
2789f8829a4aSRandall Stewart 
2790f8829a4aSRandall Stewart 	/*
2791f8829a4aSRandall Stewart 	 * @@@ JRI : TODO: This flag is not used anywhere .. remove?
2792f8829a4aSRandall Stewart 	 */
2793f8829a4aSRandall Stewart 	if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) {
2794f8829a4aSRandall Stewart 		primary_flag_set = 1;
2795f8829a4aSRandall Stewart 	} else {
2796f8829a4aSRandall Stewart 		primary_flag_set = 0;
2797f8829a4aSRandall Stewart 	}
2798f8829a4aSRandall Stewart 
2799f8829a4aSRandall Stewart 	sack = &ch->sack;
2800f8829a4aSRandall Stewart 	frag = (struct sctp_gap_ack_block *)((caddr_t)sack +
2801f8829a4aSRandall Stewart 	    sizeof(struct sctp_sack));
2802f8829a4aSRandall Stewart 	tp1 = NULL;
2803f8829a4aSRandall Stewart 	last_frag_high = 0;
2804f8829a4aSRandall Stewart 	for (i = 0; i < num_seg; i++) {
2805f8829a4aSRandall Stewart 		frag_strt = ntohs(frag->start);
2806f8829a4aSRandall Stewart 		frag_end = ntohs(frag->end);
2807f8829a4aSRandall Stewart 		/* some sanity checks on the fargment offsets */
2808f8829a4aSRandall Stewart 		if (frag_strt > frag_end) {
2809f8829a4aSRandall Stewart 			/* this one is malformed, skip */
2810f8829a4aSRandall Stewart 			frag++;
2811f8829a4aSRandall Stewart 			continue;
2812f8829a4aSRandall Stewart 		}
2813f8829a4aSRandall Stewart 		if (compare_with_wrap((frag_end + last_tsn), *biggest_tsn_acked,
2814f8829a4aSRandall Stewart 		    MAX_TSN))
2815f8829a4aSRandall Stewart 			*biggest_tsn_acked = frag_end + last_tsn;
2816f8829a4aSRandall Stewart 
2817f8829a4aSRandall Stewart 		/* mark acked dgs and find out the highestTSN being acked */
2818f8829a4aSRandall Stewart 		if (tp1 == NULL) {
2819f8829a4aSRandall Stewart 			tp1 = TAILQ_FIRST(&asoc->sent_queue);
2820f8829a4aSRandall Stewart 
2821f8829a4aSRandall Stewart 			/* save the locations of the last frags */
2822f8829a4aSRandall Stewart 			last_frag_high = frag_end + last_tsn;
2823f8829a4aSRandall Stewart 		} else {
2824f8829a4aSRandall Stewart 			/*
2825f8829a4aSRandall Stewart 			 * now lets see if we need to reset the queue due to
2826f8829a4aSRandall Stewart 			 * a out-of-order SACK fragment
2827f8829a4aSRandall Stewart 			 */
2828f8829a4aSRandall Stewart 			if (compare_with_wrap(frag_strt + last_tsn,
2829f8829a4aSRandall Stewart 			    last_frag_high, MAX_TSN)) {
2830f8829a4aSRandall Stewart 				/*
2831f8829a4aSRandall Stewart 				 * if the new frag starts after the last TSN
2832f8829a4aSRandall Stewart 				 * frag covered, we are ok and this one is
2833f8829a4aSRandall Stewart 				 * beyond the last one
2834f8829a4aSRandall Stewart 				 */
2835f8829a4aSRandall Stewart 				;
2836f8829a4aSRandall Stewart 			} else {
2837f8829a4aSRandall Stewart 				/*
2838f8829a4aSRandall Stewart 				 * ok, they have reset us, so we need to
2839f8829a4aSRandall Stewart 				 * reset the queue this will cause extra
2840f8829a4aSRandall Stewart 				 * hunting but hey, they chose the
2841f8829a4aSRandall Stewart 				 * performance hit when they failed to order
2842f8829a4aSRandall Stewart 				 * there gaps..
2843f8829a4aSRandall Stewart 				 */
2844f8829a4aSRandall Stewart 				tp1 = TAILQ_FIRST(&asoc->sent_queue);
2845f8829a4aSRandall Stewart 			}
2846f8829a4aSRandall Stewart 			last_frag_high = frag_end + last_tsn;
2847f8829a4aSRandall Stewart 		}
2848f8829a4aSRandall Stewart 		for (j = frag_strt + last_tsn; j <= frag_end + last_tsn; j++) {
2849f8829a4aSRandall Stewart 			while (tp1) {
2850f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
2851f8829a4aSRandall Stewart 				if (tp1->rec.data.doing_fast_retransmit)
2852f8829a4aSRandall Stewart 					num_frs++;
2853f8829a4aSRandall Stewart #endif
2854f8829a4aSRandall Stewart 
2855f8829a4aSRandall Stewart 				/*
2856f8829a4aSRandall Stewart 				 * CMT: CUCv2 algorithm. For each TSN being
2857f8829a4aSRandall Stewart 				 * processed from the sent queue, track the
2858f8829a4aSRandall Stewart 				 * next expected pseudo-cumack, or
2859f8829a4aSRandall Stewart 				 * rtx_pseudo_cumack, if required. Separate
2860f8829a4aSRandall Stewart 				 * cumack trackers for first transmissions,
2861f8829a4aSRandall Stewart 				 * and retransmissions.
2862f8829a4aSRandall Stewart 				 */
2863f8829a4aSRandall Stewart 				if ((tp1->whoTo->find_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) &&
2864f8829a4aSRandall Stewart 				    (tp1->snd_count == 1)) {
2865f8829a4aSRandall Stewart 					tp1->whoTo->pseudo_cumack = tp1->rec.data.TSN_seq;
2866f8829a4aSRandall Stewart 					tp1->whoTo->find_pseudo_cumack = 0;
2867f8829a4aSRandall Stewart 				}
2868f8829a4aSRandall Stewart 				if ((tp1->whoTo->find_rtx_pseudo_cumack == 1) && (tp1->sent < SCTP_DATAGRAM_RESEND) &&
2869f8829a4aSRandall Stewart 				    (tp1->snd_count > 1)) {
2870f8829a4aSRandall Stewart 					tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.TSN_seq;
2871f8829a4aSRandall Stewart 					tp1->whoTo->find_rtx_pseudo_cumack = 0;
2872f8829a4aSRandall Stewart 				}
2873f8829a4aSRandall Stewart 				if (tp1->rec.data.TSN_seq == j) {
2874f8829a4aSRandall Stewart 					if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2875f8829a4aSRandall Stewart 						/*
2876f8829a4aSRandall Stewart 						 * must be held until
2877f8829a4aSRandall Stewart 						 * cum-ack passes
2878f8829a4aSRandall Stewart 						 */
2879f8829a4aSRandall Stewart 						/*
2880f8829a4aSRandall Stewart 						 * ECN Nonce: Add the nonce
2881f8829a4aSRandall Stewart 						 * value to the sender's
2882f8829a4aSRandall Stewart 						 * nonce sum
2883f8829a4aSRandall Stewart 						 */
2884c105859eSRandall Stewart 						if (tp1->sent < SCTP_DATAGRAM_RESEND) {
2885c105859eSRandall Stewart 							/*-
2886c105859eSRandall Stewart 							 * If it is less than RESEND, it is
2887c105859eSRandall Stewart 							 * now no-longer in flight.
2888c105859eSRandall Stewart 							 * Higher values may already be set
2889c105859eSRandall Stewart 							 * via previous Gap Ack Blocks...
2890c105859eSRandall Stewart 							 * i.e. ACKED or RESEND.
2891f8829a4aSRandall Stewart 							 */
2892f8829a4aSRandall Stewart 							if (compare_with_wrap(tp1->rec.data.TSN_seq,
2893f8829a4aSRandall Stewart 							    *biggest_newly_acked_tsn, MAX_TSN)) {
2894f8829a4aSRandall Stewart 								*biggest_newly_acked_tsn = tp1->rec.data.TSN_seq;
2895f8829a4aSRandall Stewart 							}
2896f8829a4aSRandall Stewart 							/*
2897f8829a4aSRandall Stewart 							 * CMT: SFR algo
2898f8829a4aSRandall Stewart 							 * (and HTNA) - set
2899f8829a4aSRandall Stewart 							 * saw_newack to 1
2900f8829a4aSRandall Stewart 							 * for dest being
2901f8829a4aSRandall Stewart 							 * newly acked.
2902f8829a4aSRandall Stewart 							 * update
2903f8829a4aSRandall Stewart 							 * this_sack_highest_
2904f8829a4aSRandall Stewart 							 * newack if
2905f8829a4aSRandall Stewart 							 * appropriate.
2906f8829a4aSRandall Stewart 							 */
2907f8829a4aSRandall Stewart 							if (tp1->rec.data.chunk_was_revoked == 0)
2908f8829a4aSRandall Stewart 								tp1->whoTo->saw_newack = 1;
2909f8829a4aSRandall Stewart 
2910f8829a4aSRandall Stewart 							if (compare_with_wrap(tp1->rec.data.TSN_seq,
2911f8829a4aSRandall Stewart 							    tp1->whoTo->this_sack_highest_newack,
2912f8829a4aSRandall Stewart 							    MAX_TSN)) {
2913f8829a4aSRandall Stewart 								tp1->whoTo->this_sack_highest_newack =
2914f8829a4aSRandall Stewart 								    tp1->rec.data.TSN_seq;
2915f8829a4aSRandall Stewart 							}
2916f8829a4aSRandall Stewart 							/*
2917f8829a4aSRandall Stewart 							 * CMT DAC algo:
2918f8829a4aSRandall Stewart 							 * also update
2919f8829a4aSRandall Stewart 							 * this_sack_lowest_n
2920f8829a4aSRandall Stewart 							 * ewack
2921f8829a4aSRandall Stewart 							 */
2922f8829a4aSRandall Stewart 							if (*this_sack_lowest_newack == 0) {
2923f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
2924f8829a4aSRandall Stewart 								sctp_log_sack(*this_sack_lowest_newack,
2925d0cf96b4SMax Laier 								    last_tsn,
2926f8829a4aSRandall Stewart 								    tp1->rec.data.TSN_seq,
2927f8829a4aSRandall Stewart 								    0,
2928f8829a4aSRandall Stewart 								    0,
2929f8829a4aSRandall Stewart 								    SCTP_LOG_TSN_ACKED);
2930f8829a4aSRandall Stewart #endif
2931f8829a4aSRandall Stewart 								*this_sack_lowest_newack = tp1->rec.data.TSN_seq;
2932f8829a4aSRandall Stewart 							}
2933f8829a4aSRandall Stewart 							/*
2934f8829a4aSRandall Stewart 							 * CMT: CUCv2
2935f8829a4aSRandall Stewart 							 * algorithm. If
2936f8829a4aSRandall Stewart 							 * (rtx-)pseudo-cumac
2937f8829a4aSRandall Stewart 							 * k for corresp
2938f8829a4aSRandall Stewart 							 * dest is being
2939f8829a4aSRandall Stewart 							 * acked, then we
2940f8829a4aSRandall Stewart 							 * have a new
2941f8829a4aSRandall Stewart 							 * (rtx-)pseudo-cumac
2942f8829a4aSRandall Stewart 							 * k. Set
2943f8829a4aSRandall Stewart 							 * new_(rtx_)pseudo_c
2944f8829a4aSRandall Stewart 							 * umack to TRUE so
2945f8829a4aSRandall Stewart 							 * that the cwnd for
2946f8829a4aSRandall Stewart 							 * this dest can be
2947f8829a4aSRandall Stewart 							 * updated. Also
2948f8829a4aSRandall Stewart 							 * trigger search
2949f8829a4aSRandall Stewart 							 * for the next
2950f8829a4aSRandall Stewart 							 * expected
2951f8829a4aSRandall Stewart 							 * (rtx-)pseudo-cumac
2952f8829a4aSRandall Stewart 							 * k. Separate
2953f8829a4aSRandall Stewart 							 * pseudo_cumack
2954f8829a4aSRandall Stewart 							 * trackers for
2955f8829a4aSRandall Stewart 							 * first
2956f8829a4aSRandall Stewart 							 * transmissions and
2957f8829a4aSRandall Stewart 							 * retransmissions.
2958f8829a4aSRandall Stewart 							 */
2959f8829a4aSRandall Stewart 							if (tp1->rec.data.TSN_seq == tp1->whoTo->pseudo_cumack) {
2960f8829a4aSRandall Stewart 								if (tp1->rec.data.chunk_was_revoked == 0) {
2961f8829a4aSRandall Stewart 									tp1->whoTo->new_pseudo_cumack = 1;
2962f8829a4aSRandall Stewart 								}
2963f8829a4aSRandall Stewart 								tp1->whoTo->find_pseudo_cumack = 1;
2964f8829a4aSRandall Stewart 							}
2965f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
2966f8829a4aSRandall Stewart 							sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
2967f8829a4aSRandall Stewart #endif
2968f8829a4aSRandall Stewart 							if (tp1->rec.data.TSN_seq == tp1->whoTo->rtx_pseudo_cumack) {
2969f8829a4aSRandall Stewart 								if (tp1->rec.data.chunk_was_revoked == 0) {
2970f8829a4aSRandall Stewart 									tp1->whoTo->new_pseudo_cumack = 1;
2971f8829a4aSRandall Stewart 								}
2972f8829a4aSRandall Stewart 								tp1->whoTo->find_rtx_pseudo_cumack = 1;
2973f8829a4aSRandall Stewart 							}
2974f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
2975f8829a4aSRandall Stewart 							sctp_log_sack(*biggest_newly_acked_tsn,
2976f8829a4aSRandall Stewart 							    last_tsn,
2977f8829a4aSRandall Stewart 							    tp1->rec.data.TSN_seq,
2978f8829a4aSRandall Stewart 							    frag_strt,
2979f8829a4aSRandall Stewart 							    frag_end,
2980f8829a4aSRandall Stewart 							    SCTP_LOG_TSN_ACKED);
2981f8829a4aSRandall Stewart #endif
2982a5d547adSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
2983c105859eSRandall Stewart 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_GAP,
2984a5d547adSRandall Stewart 							    tp1->whoTo->flight_size,
2985a5d547adSRandall Stewart 							    tp1->book_size,
2986c105859eSRandall Stewart 							    (uintptr_t) tp1->whoTo,
2987a5d547adSRandall Stewart 							    tp1->rec.data.TSN_seq);
2988a5d547adSRandall Stewart #endif
2989c105859eSRandall Stewart 							sctp_flight_size_decrease(tp1);
2990c105859eSRandall Stewart 							sctp_total_flight_decrease(stcb, tp1);
2991f8829a4aSRandall Stewart 
2992f8829a4aSRandall Stewart 							tp1->whoTo->net_ack += tp1->send_size;
2993f8829a4aSRandall Stewart 							if (tp1->snd_count < 2) {
2994f8829a4aSRandall Stewart 								/*
2995a5d547adSRandall Stewart 								 * True
2996a5d547adSRandall Stewart 								 * non-retran
2997a5d547adSRandall Stewart 								 * smited
2998a5d547adSRandall Stewart 								 * chunk */
2999f8829a4aSRandall Stewart 								tp1->whoTo->net_ack2 += tp1->send_size;
3000f8829a4aSRandall Stewart 
3001f8829a4aSRandall Stewart 								/*
3002a5d547adSRandall Stewart 								 * update RTO
3003a5d547adSRandall Stewart 								 * too ? */
3004f8829a4aSRandall Stewart 								if (tp1->do_rtt) {
3005f8829a4aSRandall Stewart 									tp1->whoTo->RTO =
3006f8829a4aSRandall Stewart 									    sctp_calculate_rto(stcb,
3007f8829a4aSRandall Stewart 									    asoc,
3008f8829a4aSRandall Stewart 									    tp1->whoTo,
3009f8829a4aSRandall Stewart 									    &tp1->sent_rcv_time);
3010f8829a4aSRandall Stewart 									tp1->do_rtt = 0;
3011f8829a4aSRandall Stewart 								}
3012f8829a4aSRandall Stewart 							}
3013f8829a4aSRandall Stewart 						}
3014c105859eSRandall Stewart 						if (tp1->sent <= SCTP_DATAGRAM_RESEND) {
3015c105859eSRandall Stewart 							(*ecn_seg_sums) += tp1->rec.data.ect_nonce;
3016c105859eSRandall Stewart 							(*ecn_seg_sums) &= SCTP_SACK_NONCE_SUM;
3017c105859eSRandall Stewart 							if (compare_with_wrap(tp1->rec.data.TSN_seq,
3018f8829a4aSRandall Stewart 							    asoc->this_sack_highest_gap,
3019f8829a4aSRandall Stewart 							    MAX_TSN)) {
3020f8829a4aSRandall Stewart 								asoc->this_sack_highest_gap =
3021f8829a4aSRandall Stewart 								    tp1->rec.data.TSN_seq;
3022f8829a4aSRandall Stewart 							}
3023f8829a4aSRandall Stewart 							if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3024f8829a4aSRandall Stewart 								sctp_ucount_decr(asoc->sent_queue_retran_cnt);
3025f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
3026f8829a4aSRandall Stewart 								sctp_audit_log(0xB2,
3027f8829a4aSRandall Stewart 								    (asoc->sent_queue_retran_cnt & 0x000000ff));
3028f8829a4aSRandall Stewart #endif
3029f8829a4aSRandall Stewart 							}
3030c105859eSRandall Stewart 						}
3031c105859eSRandall Stewart 						/*
3032c105859eSRandall Stewart 						 * All chunks NOT UNSENT
3033c105859eSRandall Stewart 						 * fall through here and are
3034c105859eSRandall Stewart 						 * marked
3035c105859eSRandall Stewart 						 */
3036f8829a4aSRandall Stewart 						tp1->sent = SCTP_DATAGRAM_MARKED;
303742551e99SRandall Stewart 						if (tp1->rec.data.chunk_was_revoked) {
303842551e99SRandall Stewart 							/* deflate the cwnd */
303942551e99SRandall Stewart 							tp1->whoTo->cwnd -= tp1->book_size;
304042551e99SRandall Stewart 							tp1->rec.data.chunk_was_revoked = 0;
304142551e99SRandall Stewart 						}
3042f8829a4aSRandall Stewart 					}
3043f8829a4aSRandall Stewart 					break;
3044f8829a4aSRandall Stewart 				}	/* if (tp1->TSN_seq == j) */
3045f8829a4aSRandall Stewart 				if (compare_with_wrap(tp1->rec.data.TSN_seq, j,
3046f8829a4aSRandall Stewart 				    MAX_TSN))
3047f8829a4aSRandall Stewart 					break;
3048f8829a4aSRandall Stewart 
3049f8829a4aSRandall Stewart 				tp1 = TAILQ_NEXT(tp1, sctp_next);
3050f8829a4aSRandall Stewart 			}	/* end while (tp1) */
3051f8829a4aSRandall Stewart 		}		/* end for (j = fragStart */
3052f8829a4aSRandall Stewart 		frag++;		/* next one */
3053f8829a4aSRandall Stewart 	}
3054f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3055f8829a4aSRandall Stewart 	/*
3056f8829a4aSRandall Stewart 	 * if (num_frs) sctp_log_fr(*biggest_tsn_acked,
3057f8829a4aSRandall Stewart 	 * *biggest_newly_acked_tsn, last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
3058f8829a4aSRandall Stewart 	 */
3059f8829a4aSRandall Stewart #endif
3060f8829a4aSRandall Stewart }
3061f8829a4aSRandall Stewart 
3062f8829a4aSRandall Stewart static void
3063c105859eSRandall Stewart sctp_check_for_revoked(struct sctp_tcb *stcb,
3064c105859eSRandall Stewart     struct sctp_association *asoc, uint32_t cumack,
3065f8829a4aSRandall Stewart     u_long biggest_tsn_acked)
3066f8829a4aSRandall Stewart {
3067f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *tp1;
3068f8829a4aSRandall Stewart 	int tot_revoked = 0;
3069f8829a4aSRandall Stewart 
3070f8829a4aSRandall Stewart 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
3071f8829a4aSRandall Stewart 	while (tp1) {
3072f8829a4aSRandall Stewart 		if (compare_with_wrap(tp1->rec.data.TSN_seq, cumack,
3073f8829a4aSRandall Stewart 		    MAX_TSN)) {
3074f8829a4aSRandall Stewart 			/*
3075f8829a4aSRandall Stewart 			 * ok this guy is either ACK or MARKED. If it is
3076f8829a4aSRandall Stewart 			 * ACKED it has been previously acked but not this
3077f8829a4aSRandall Stewart 			 * time i.e. revoked.  If it is MARKED it was ACK'ed
3078f8829a4aSRandall Stewart 			 * again.
3079f8829a4aSRandall Stewart 			 */
3080d06c82f1SRandall Stewart 			if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
3081d06c82f1SRandall Stewart 			    MAX_TSN))
3082d06c82f1SRandall Stewart 				break;
3083d06c82f1SRandall Stewart 
3084d06c82f1SRandall Stewart 
3085f8829a4aSRandall Stewart 			if (tp1->sent == SCTP_DATAGRAM_ACKED) {
3086f8829a4aSRandall Stewart 				/* it has been revoked */
3087f8829a4aSRandall Stewart 				tp1->sent = SCTP_DATAGRAM_SENT;
3088f8829a4aSRandall Stewart 				tp1->rec.data.chunk_was_revoked = 1;
3089a5d547adSRandall Stewart 				/*
309042551e99SRandall Stewart 				 * We must add this stuff back in to assure
309142551e99SRandall Stewart 				 * timers and such get started.
3092a5d547adSRandall Stewart 				 */
3093c105859eSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
3094c105859eSRandall Stewart 				sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
3095c105859eSRandall Stewart 				    tp1->whoTo->flight_size,
3096c105859eSRandall Stewart 				    tp1->book_size,
3097c105859eSRandall Stewart 				    (uintptr_t) tp1->whoTo,
3098c105859eSRandall Stewart 				    tp1->rec.data.TSN_seq);
3099c105859eSRandall Stewart #endif
3100c105859eSRandall Stewart 				sctp_flight_size_increase(tp1);
3101c105859eSRandall Stewart 				sctp_total_flight_increase(stcb, tp1);
310242551e99SRandall Stewart 				/*
310342551e99SRandall Stewart 				 * We inflate the cwnd to compensate for our
310442551e99SRandall Stewart 				 * artificial inflation of the flight_size.
310542551e99SRandall Stewart 				 */
310642551e99SRandall Stewart 				tp1->whoTo->cwnd += tp1->book_size;
3107f8829a4aSRandall Stewart 				tot_revoked++;
3108f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
3109f8829a4aSRandall Stewart 				sctp_log_sack(asoc->last_acked_seq,
3110f8829a4aSRandall Stewart 				    cumack,
3111f8829a4aSRandall Stewart 				    tp1->rec.data.TSN_seq,
3112f8829a4aSRandall Stewart 				    0,
3113f8829a4aSRandall Stewart 				    0,
3114f8829a4aSRandall Stewart 				    SCTP_LOG_TSN_REVOKED);
3115f8829a4aSRandall Stewart #endif
3116f8829a4aSRandall Stewart 			} else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
3117f8829a4aSRandall Stewart 				/* it has been re-acked in this SACK */
3118f8829a4aSRandall Stewart 				tp1->sent = SCTP_DATAGRAM_ACKED;
3119f8829a4aSRandall Stewart 			}
3120f8829a4aSRandall Stewart 		}
3121f8829a4aSRandall Stewart 		if (tp1->sent == SCTP_DATAGRAM_UNSENT)
3122f8829a4aSRandall Stewart 			break;
3123f8829a4aSRandall Stewart 		tp1 = TAILQ_NEXT(tp1, sctp_next);
3124f8829a4aSRandall Stewart 	}
3125f8829a4aSRandall Stewart 	if (tot_revoked > 0) {
3126f8829a4aSRandall Stewart 		/*
3127f8829a4aSRandall Stewart 		 * Setup the ecn nonce re-sync point. We do this since once
3128f8829a4aSRandall Stewart 		 * data is revoked we begin to retransmit things, which do
3129f8829a4aSRandall Stewart 		 * NOT have the ECN bits set. This means we are now out of
3130f8829a4aSRandall Stewart 		 * sync and must wait until we get back in sync with the
3131f8829a4aSRandall Stewart 		 * peer to check ECN bits.
3132f8829a4aSRandall Stewart 		 */
3133f8829a4aSRandall Stewart 		tp1 = TAILQ_FIRST(&asoc->send_queue);
3134f8829a4aSRandall Stewart 		if (tp1 == NULL) {
3135f8829a4aSRandall Stewart 			asoc->nonce_resync_tsn = asoc->sending_seq;
3136f8829a4aSRandall Stewart 		} else {
3137f8829a4aSRandall Stewart 			asoc->nonce_resync_tsn = tp1->rec.data.TSN_seq;
3138f8829a4aSRandall Stewart 		}
3139f8829a4aSRandall Stewart 		asoc->nonce_wait_for_ecne = 0;
3140f8829a4aSRandall Stewart 		asoc->nonce_sum_check = 0;
3141f8829a4aSRandall Stewart 	}
3142f8829a4aSRandall Stewart }
3143f8829a4aSRandall Stewart 
3144f8829a4aSRandall Stewart static void
3145f8829a4aSRandall Stewart sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
3146f8829a4aSRandall Stewart     u_long biggest_tsn_acked, u_long biggest_tsn_newly_acked, u_long this_sack_lowest_newack, int accum_moved)
3147f8829a4aSRandall Stewart {
3148f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *tp1;
3149f8829a4aSRandall Stewart 	int strike_flag = 0;
3150f8829a4aSRandall Stewart 	struct timeval now;
3151f8829a4aSRandall Stewart 	int tot_retrans = 0;
3152f8829a4aSRandall Stewart 	uint32_t sending_seq;
3153f8829a4aSRandall Stewart 	struct sctp_nets *net;
3154f8829a4aSRandall Stewart 	int num_dests_sacked = 0;
3155f8829a4aSRandall Stewart 
3156f8829a4aSRandall Stewart 	/*
3157f8829a4aSRandall Stewart 	 * select the sending_seq, this is either the next thing ready to be
3158f8829a4aSRandall Stewart 	 * sent but not transmitted, OR, the next seq we assign.
3159f8829a4aSRandall Stewart 	 */
3160f8829a4aSRandall Stewart 	tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3161f8829a4aSRandall Stewart 	if (tp1 == NULL) {
3162f8829a4aSRandall Stewart 		sending_seq = asoc->sending_seq;
3163f8829a4aSRandall Stewart 	} else {
3164f8829a4aSRandall Stewart 		sending_seq = tp1->rec.data.TSN_seq;
3165f8829a4aSRandall Stewart 	}
3166f8829a4aSRandall Stewart 
3167f8829a4aSRandall Stewart 	/* CMT DAC algo: finding out if SACK is a mixed SACK */
3168f8829a4aSRandall Stewart 	if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3169f8829a4aSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3170f8829a4aSRandall Stewart 			if (net->saw_newack)
3171f8829a4aSRandall Stewart 				num_dests_sacked++;
3172f8829a4aSRandall Stewart 		}
3173f8829a4aSRandall Stewart 	}
3174f8829a4aSRandall Stewart 	if (stcb->asoc.peer_supports_prsctp) {
31756e55db54SRandall Stewart 		(void)SCTP_GETTIME_TIMEVAL(&now);
3176f8829a4aSRandall Stewart 	}
3177f8829a4aSRandall Stewart 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
3178f8829a4aSRandall Stewart 	while (tp1) {
3179f8829a4aSRandall Stewart 		strike_flag = 0;
3180f8829a4aSRandall Stewart 		if (tp1->no_fr_allowed) {
3181f8829a4aSRandall Stewart 			/* this one had a timeout or something */
3182f8829a4aSRandall Stewart 			tp1 = TAILQ_NEXT(tp1, sctp_next);
3183f8829a4aSRandall Stewart 			continue;
3184f8829a4aSRandall Stewart 		}
3185f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3186f8829a4aSRandall Stewart 		if (tp1->sent < SCTP_DATAGRAM_RESEND)
3187f8829a4aSRandall Stewart 			sctp_log_fr(biggest_tsn_newly_acked,
3188f8829a4aSRandall Stewart 			    tp1->rec.data.TSN_seq,
3189f8829a4aSRandall Stewart 			    tp1->sent,
3190f8829a4aSRandall Stewart 			    SCTP_FR_LOG_CHECK_STRIKE);
3191f8829a4aSRandall Stewart #endif
3192f8829a4aSRandall Stewart 		if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked,
3193f8829a4aSRandall Stewart 		    MAX_TSN) ||
3194f8829a4aSRandall Stewart 		    tp1->sent == SCTP_DATAGRAM_UNSENT) {
3195f8829a4aSRandall Stewart 			/* done */
3196f8829a4aSRandall Stewart 			break;
3197f8829a4aSRandall Stewart 		}
3198f8829a4aSRandall Stewart 		if (stcb->asoc.peer_supports_prsctp) {
3199f8829a4aSRandall Stewart 			if ((PR_SCTP_TTL_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
3200f8829a4aSRandall Stewart 				/* Is it expired? */
32015e54f665SRandall Stewart 				if (
32025e54f665SRandall Stewart 				    (timevalcmp(&now, &tp1->rec.data.timetodrop, >))
32035e54f665SRandall Stewart 				    ) {
3204f8829a4aSRandall Stewart 					/* Yes so drop it */
3205f8829a4aSRandall Stewart 					if (tp1->data != NULL) {
3206ad81507eSRandall Stewart 						(void)sctp_release_pr_sctp_chunk(stcb, tp1,
3207f8829a4aSRandall Stewart 						    (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3208f8829a4aSRandall Stewart 						    &asoc->sent_queue);
3209f8829a4aSRandall Stewart 					}
3210f8829a4aSRandall Stewart 					tp1 = TAILQ_NEXT(tp1, sctp_next);
3211f8829a4aSRandall Stewart 					continue;
3212f8829a4aSRandall Stewart 				}
3213f8829a4aSRandall Stewart 			}
3214f8829a4aSRandall Stewart 			if ((PR_SCTP_RTX_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
3215f8829a4aSRandall Stewart 				/* Has it been retransmitted tv_sec times? */
3216f8829a4aSRandall Stewart 				if (tp1->snd_count > tp1->rec.data.timetodrop.tv_sec) {
3217f8829a4aSRandall Stewart 					/* Yes, so drop it */
3218f8829a4aSRandall Stewart 					if (tp1->data != NULL) {
3219ad81507eSRandall Stewart 						(void)sctp_release_pr_sctp_chunk(stcb, tp1,
3220f8829a4aSRandall Stewart 						    (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3221f8829a4aSRandall Stewart 						    &asoc->sent_queue);
3222f8829a4aSRandall Stewart 					}
3223f8829a4aSRandall Stewart 					tp1 = TAILQ_NEXT(tp1, sctp_next);
3224f8829a4aSRandall Stewart 					continue;
3225f8829a4aSRandall Stewart 				}
3226f8829a4aSRandall Stewart 			}
3227f8829a4aSRandall Stewart 		}
3228f8829a4aSRandall Stewart 		if (compare_with_wrap(tp1->rec.data.TSN_seq,
3229f8829a4aSRandall Stewart 		    asoc->this_sack_highest_gap, MAX_TSN)) {
3230f8829a4aSRandall Stewart 			/* we are beyond the tsn in the sack  */
3231f8829a4aSRandall Stewart 			break;
3232f8829a4aSRandall Stewart 		}
3233f8829a4aSRandall Stewart 		if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3234f8829a4aSRandall Stewart 			/* either a RESEND, ACKED, or MARKED */
3235f8829a4aSRandall Stewart 			/* skip */
3236f8829a4aSRandall Stewart 			tp1 = TAILQ_NEXT(tp1, sctp_next);
3237f8829a4aSRandall Stewart 			continue;
3238f8829a4aSRandall Stewart 		}
3239f8829a4aSRandall Stewart 		/*
3240f8829a4aSRandall Stewart 		 * CMT : SFR algo (covers part of DAC and HTNA as well)
3241f8829a4aSRandall Stewart 		 */
3242ad81507eSRandall Stewart 		if (tp1->whoTo && tp1->whoTo->saw_newack == 0) {
3243f8829a4aSRandall Stewart 			/*
3244f8829a4aSRandall Stewart 			 * No new acks were receieved for data sent to this
3245f8829a4aSRandall Stewart 			 * dest. Therefore, according to the SFR algo for
3246f8829a4aSRandall Stewart 			 * CMT, no data sent to this dest can be marked for
3247c105859eSRandall Stewart 			 * FR using this SACK.
3248f8829a4aSRandall Stewart 			 */
3249f8829a4aSRandall Stewart 			tp1 = TAILQ_NEXT(tp1, sctp_next);
3250f8829a4aSRandall Stewart 			continue;
3251ad81507eSRandall Stewart 		} else if (tp1->whoTo && compare_with_wrap(tp1->rec.data.TSN_seq,
3252f8829a4aSRandall Stewart 		    tp1->whoTo->this_sack_highest_newack, MAX_TSN)) {
3253f8829a4aSRandall Stewart 			/*
3254f8829a4aSRandall Stewart 			 * CMT: New acks were receieved for data sent to
3255f8829a4aSRandall Stewart 			 * this dest. But no new acks were seen for data
3256f8829a4aSRandall Stewart 			 * sent after tp1. Therefore, according to the SFR
3257f8829a4aSRandall Stewart 			 * algo for CMT, tp1 cannot be marked for FR using
3258f8829a4aSRandall Stewart 			 * this SACK. This step covers part of the DAC algo
3259f8829a4aSRandall Stewart 			 * and the HTNA algo as well.
3260f8829a4aSRandall Stewart 			 */
3261f8829a4aSRandall Stewart 			tp1 = TAILQ_NEXT(tp1, sctp_next);
3262f8829a4aSRandall Stewart 			continue;
3263f8829a4aSRandall Stewart 		}
3264f8829a4aSRandall Stewart 		/*
3265f8829a4aSRandall Stewart 		 * Here we check to see if we were have already done a FR
3266f8829a4aSRandall Stewart 		 * and if so we see if the biggest TSN we saw in the sack is
3267f8829a4aSRandall Stewart 		 * smaller than the recovery point. If so we don't strike
3268f8829a4aSRandall Stewart 		 * the tsn... otherwise we CAN strike the TSN.
3269f8829a4aSRandall Stewart 		 */
3270f8829a4aSRandall Stewart 		/*
327142551e99SRandall Stewart 		 * @@@ JRI: Check for CMT if (accum_moved &&
327242551e99SRandall Stewart 		 * asoc->fast_retran_loss_recovery && (sctp_cmt_on_off ==
327342551e99SRandall Stewart 		 * 0)) {
3274f8829a4aSRandall Stewart 		 */
327542551e99SRandall Stewart 		if (accum_moved && asoc->fast_retran_loss_recovery) {
3276f8829a4aSRandall Stewart 			/*
3277f8829a4aSRandall Stewart 			 * Strike the TSN if in fast-recovery and cum-ack
3278f8829a4aSRandall Stewart 			 * moved.
3279f8829a4aSRandall Stewart 			 */
3280f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3281f8829a4aSRandall Stewart 			sctp_log_fr(biggest_tsn_newly_acked,
3282f8829a4aSRandall Stewart 			    tp1->rec.data.TSN_seq,
3283f8829a4aSRandall Stewart 			    tp1->sent,
3284f8829a4aSRandall Stewart 			    SCTP_FR_LOG_STRIKE_CHUNK);
3285f8829a4aSRandall Stewart #endif
32865e54f665SRandall Stewart 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3287f8829a4aSRandall Stewart 				tp1->sent++;
32885e54f665SRandall Stewart 			}
3289f8829a4aSRandall Stewart 			if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3290f8829a4aSRandall Stewart 				/*
3291f8829a4aSRandall Stewart 				 * CMT DAC algorithm: If SACK flag is set to
3292f8829a4aSRandall Stewart 				 * 0, then lowest_newack test will not pass
3293f8829a4aSRandall Stewart 				 * because it would have been set to the
3294f8829a4aSRandall Stewart 				 * cumack earlier. If not already to be
3295f8829a4aSRandall Stewart 				 * rtx'd, If not a mixed sack and if tp1 is
3296f8829a4aSRandall Stewart 				 * not between two sacked TSNs, then mark by
3297c105859eSRandall Stewart 				 * one more. NOTE that we are marking by one
3298c105859eSRandall Stewart 				 * additional time since the SACK DAC flag
3299c105859eSRandall Stewart 				 * indicates that two packets have been
3300c105859eSRandall Stewart 				 * received after this missing TSN.
33015e54f665SRandall Stewart 				 */
33025e54f665SRandall Stewart 				if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3303f8829a4aSRandall Stewart 				    compare_with_wrap(this_sack_lowest_newack, tp1->rec.data.TSN_seq, MAX_TSN)) {
3304f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3305f8829a4aSRandall Stewart 					sctp_log_fr(16 + num_dests_sacked,
3306f8829a4aSRandall Stewart 					    tp1->rec.data.TSN_seq,
3307f8829a4aSRandall Stewart 					    tp1->sent,
3308f8829a4aSRandall Stewart 					    SCTP_FR_LOG_STRIKE_CHUNK);
3309f8829a4aSRandall Stewart #endif
3310f8829a4aSRandall Stewart 					tp1->sent++;
3311f8829a4aSRandall Stewart 				}
3312f8829a4aSRandall Stewart 			}
3313f8829a4aSRandall Stewart 		} else if (tp1->rec.data.doing_fast_retransmit) {
3314f8829a4aSRandall Stewart 			/*
3315f8829a4aSRandall Stewart 			 * For those that have done a FR we must take
3316f8829a4aSRandall Stewart 			 * special consideration if we strike. I.e the
3317f8829a4aSRandall Stewart 			 * biggest_newly_acked must be higher than the
3318f8829a4aSRandall Stewart 			 * sending_seq at the time we did the FR.
3319f8829a4aSRandall Stewart 			 */
33205e54f665SRandall Stewart 			if (
3321f8829a4aSRandall Stewart #ifdef SCTP_FR_TO_ALTERNATE
3322f8829a4aSRandall Stewart 			/*
3323f8829a4aSRandall Stewart 			 * If FR's go to new networks, then we must only do
3324f8829a4aSRandall Stewart 			 * this for singly homed asoc's. However if the FR's
3325f8829a4aSRandall Stewart 			 * go to the same network (Armando's work) then its
3326f8829a4aSRandall Stewart 			 * ok to FR multiple times.
3327f8829a4aSRandall Stewart 			 */
33285e54f665SRandall Stewart 			    (asoc->numnets < 2)
3329f8829a4aSRandall Stewart #else
33305e54f665SRandall Stewart 			    (1)
3331f8829a4aSRandall Stewart #endif
33325e54f665SRandall Stewart 			    ) {
33335e54f665SRandall Stewart 
3334f8829a4aSRandall Stewart 				if ((compare_with_wrap(biggest_tsn_newly_acked,
3335f8829a4aSRandall Stewart 				    tp1->rec.data.fast_retran_tsn, MAX_TSN)) ||
3336f8829a4aSRandall Stewart 				    (biggest_tsn_newly_acked ==
3337f8829a4aSRandall Stewart 				    tp1->rec.data.fast_retran_tsn)) {
3338f8829a4aSRandall Stewart 					/*
3339f8829a4aSRandall Stewart 					 * Strike the TSN, since this ack is
3340f8829a4aSRandall Stewart 					 * beyond where things were when we
3341f8829a4aSRandall Stewart 					 * did a FR.
3342f8829a4aSRandall Stewart 					 */
3343f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3344f8829a4aSRandall Stewart 					sctp_log_fr(biggest_tsn_newly_acked,
3345f8829a4aSRandall Stewart 					    tp1->rec.data.TSN_seq,
3346f8829a4aSRandall Stewart 					    tp1->sent,
3347f8829a4aSRandall Stewart 					    SCTP_FR_LOG_STRIKE_CHUNK);
3348f8829a4aSRandall Stewart #endif
33495e54f665SRandall Stewart 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3350f8829a4aSRandall Stewart 						tp1->sent++;
33515e54f665SRandall Stewart 					}
3352f8829a4aSRandall Stewart 					strike_flag = 1;
3353f8829a4aSRandall Stewart 					if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3354f8829a4aSRandall Stewart 						/*
3355f8829a4aSRandall Stewart 						 * CMT DAC algorithm: If
3356f8829a4aSRandall Stewart 						 * SACK flag is set to 0,
3357f8829a4aSRandall Stewart 						 * then lowest_newack test
3358f8829a4aSRandall Stewart 						 * will not pass because it
3359f8829a4aSRandall Stewart 						 * would have been set to
3360f8829a4aSRandall Stewart 						 * the cumack earlier. If
3361f8829a4aSRandall Stewart 						 * not already to be rtx'd,
3362f8829a4aSRandall Stewart 						 * If not a mixed sack and
3363f8829a4aSRandall Stewart 						 * if tp1 is not between two
3364f8829a4aSRandall Stewart 						 * sacked TSNs, then mark by
3365c105859eSRandall Stewart 						 * one more. NOTE that we
3366c105859eSRandall Stewart 						 * are marking by one
3367c105859eSRandall Stewart 						 * additional time since the
3368c105859eSRandall Stewart 						 * SACK DAC flag indicates
3369c105859eSRandall Stewart 						 * that two packets have
3370c105859eSRandall Stewart 						 * been received after this
3371c105859eSRandall Stewart 						 * missing TSN.
3372f8829a4aSRandall Stewart 						 */
33735e54f665SRandall Stewart 						if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
33745e54f665SRandall Stewart 						    (num_dests_sacked == 1) &&
33755e54f665SRandall Stewart 						    compare_with_wrap(this_sack_lowest_newack,
33765e54f665SRandall Stewart 						    tp1->rec.data.TSN_seq, MAX_TSN)) {
3377f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3378f8829a4aSRandall Stewart 							sctp_log_fr(32 + num_dests_sacked,
3379f8829a4aSRandall Stewart 							    tp1->rec.data.TSN_seq,
3380f8829a4aSRandall Stewart 							    tp1->sent,
3381f8829a4aSRandall Stewart 							    SCTP_FR_LOG_STRIKE_CHUNK);
3382f8829a4aSRandall Stewart #endif
33835e54f665SRandall Stewart 							if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3384f8829a4aSRandall Stewart 								tp1->sent++;
33855e54f665SRandall Stewart 
33865e54f665SRandall Stewart 							}
3387f8829a4aSRandall Stewart 						}
3388f8829a4aSRandall Stewart 					}
3389f8829a4aSRandall Stewart 				}
3390f8829a4aSRandall Stewart 			}
3391f8829a4aSRandall Stewart 			/*
339242551e99SRandall Stewart 			 * JRI: TODO: remove code for HTNA algo. CMT's SFR
339342551e99SRandall Stewart 			 * algo covers HTNA.
3394f8829a4aSRandall Stewart 			 */
3395f8829a4aSRandall Stewart 		} else if (compare_with_wrap(tp1->rec.data.TSN_seq,
3396f8829a4aSRandall Stewart 		    biggest_tsn_newly_acked, MAX_TSN)) {
3397f8829a4aSRandall Stewart 			/*
3398f8829a4aSRandall Stewart 			 * We don't strike these: This is the  HTNA
3399f8829a4aSRandall Stewart 			 * algorithm i.e. we don't strike If our TSN is
3400f8829a4aSRandall Stewart 			 * larger than the Highest TSN Newly Acked.
3401f8829a4aSRandall Stewart 			 */
3402f8829a4aSRandall Stewart 			;
3403f8829a4aSRandall Stewart 		} else {
3404f8829a4aSRandall Stewart 			/* Strike the TSN */
3405f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3406f8829a4aSRandall Stewart 			sctp_log_fr(biggest_tsn_newly_acked,
3407f8829a4aSRandall Stewart 			    tp1->rec.data.TSN_seq,
3408f8829a4aSRandall Stewart 			    tp1->sent,
3409f8829a4aSRandall Stewart 			    SCTP_FR_LOG_STRIKE_CHUNK);
3410f8829a4aSRandall Stewart #endif
34115e54f665SRandall Stewart 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3412f8829a4aSRandall Stewart 				tp1->sent++;
34135e54f665SRandall Stewart 			}
3414f8829a4aSRandall Stewart 			if (sctp_cmt_on_off && sctp_cmt_use_dac) {
3415f8829a4aSRandall Stewart 				/*
3416f8829a4aSRandall Stewart 				 * CMT DAC algorithm: If SACK flag is set to
3417f8829a4aSRandall Stewart 				 * 0, then lowest_newack test will not pass
3418f8829a4aSRandall Stewart 				 * because it would have been set to the
3419f8829a4aSRandall Stewart 				 * cumack earlier. If not already to be
3420f8829a4aSRandall Stewart 				 * rtx'd, If not a mixed sack and if tp1 is
3421f8829a4aSRandall Stewart 				 * not between two sacked TSNs, then mark by
3422c105859eSRandall Stewart 				 * one more. NOTE that we are marking by one
3423c105859eSRandall Stewart 				 * additional time since the SACK DAC flag
3424c105859eSRandall Stewart 				 * indicates that two packets have been
3425c105859eSRandall Stewart 				 * received after this missing TSN.
3426f8829a4aSRandall Stewart 				 */
34275e54f665SRandall Stewart 				if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3428f8829a4aSRandall Stewart 				    compare_with_wrap(this_sack_lowest_newack, tp1->rec.data.TSN_seq, MAX_TSN)) {
3429f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3430f8829a4aSRandall Stewart 					sctp_log_fr(48 + num_dests_sacked,
3431f8829a4aSRandall Stewart 					    tp1->rec.data.TSN_seq,
3432f8829a4aSRandall Stewart 					    tp1->sent,
3433f8829a4aSRandall Stewart 					    SCTP_FR_LOG_STRIKE_CHUNK);
3434f8829a4aSRandall Stewart #endif
3435f8829a4aSRandall Stewart 					tp1->sent++;
3436f8829a4aSRandall Stewart 				}
3437f8829a4aSRandall Stewart 			}
3438f8829a4aSRandall Stewart 		}
3439f8829a4aSRandall Stewart 		if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3440f8829a4aSRandall Stewart 			/* Increment the count to resend */
3441f8829a4aSRandall Stewart 			struct sctp_nets *alt;
3442f8829a4aSRandall Stewart 
3443f8829a4aSRandall Stewart 			/* printf("OK, we are now ready to FR this guy\n"); */
3444f8829a4aSRandall Stewart #ifdef SCTP_FR_LOGGING
3445f8829a4aSRandall Stewart 			sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count,
3446f8829a4aSRandall Stewart 			    0, SCTP_FR_MARKED);
3447f8829a4aSRandall Stewart #endif
3448f8829a4aSRandall Stewart 			if (strike_flag) {
3449f8829a4aSRandall Stewart 				/* This is a subsequent FR */
3450f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_sendmultfastretrans);
3451f8829a4aSRandall Stewart 			}
34525e54f665SRandall Stewart 			sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3453f8829a4aSRandall Stewart 			if (sctp_cmt_on_off) {
3454f8829a4aSRandall Stewart 				/*
3455f8829a4aSRandall Stewart 				 * CMT: Using RTX_SSTHRESH policy for CMT.
3456f8829a4aSRandall Stewart 				 * If CMT is being used, then pick dest with
3457f8829a4aSRandall Stewart 				 * largest ssthresh for any retransmission.
3458f8829a4aSRandall Stewart 				 */
3459f8829a4aSRandall Stewart 				tp1->no_fr_allowed = 1;
3460f8829a4aSRandall Stewart 				alt = tp1->whoTo;
3461f8829a4aSRandall Stewart 				alt = sctp_find_alternate_net(stcb, alt, 1);
3462ad81507eSRandall Stewart 				if (alt == NULL) {
3463ad81507eSRandall Stewart 					alt = tp1->whoTo;
3464ad81507eSRandall Stewart 				}
3465f8829a4aSRandall Stewart 				/*
3466f8829a4aSRandall Stewart 				 * CUCv2: If a different dest is picked for
3467f8829a4aSRandall Stewart 				 * the retransmission, then new
3468f8829a4aSRandall Stewart 				 * (rtx-)pseudo_cumack needs to be tracked
3469f8829a4aSRandall Stewart 				 * for orig dest. Let CUCv2 track new (rtx-)
3470f8829a4aSRandall Stewart 				 * pseudo-cumack always.
3471f8829a4aSRandall Stewart 				 */
3472ad81507eSRandall Stewart 				if (tp1->whoTo) {
3473f8829a4aSRandall Stewart 					tp1->whoTo->find_pseudo_cumack = 1;
3474f8829a4aSRandall Stewart 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
3475ad81507eSRandall Stewart 				}
3476f8829a4aSRandall Stewart 			} else {/* CMT is OFF */
3477f8829a4aSRandall Stewart 
3478f8829a4aSRandall Stewart #ifdef SCTP_FR_TO_ALTERNATE
3479f8829a4aSRandall Stewart 				/* Can we find an alternate? */
3480f8829a4aSRandall Stewart 				alt = sctp_find_alternate_net(stcb, tp1->whoTo, 0);
3481f8829a4aSRandall Stewart #else
3482f8829a4aSRandall Stewart 				/*
3483f8829a4aSRandall Stewart 				 * default behavior is to NOT retransmit
3484f8829a4aSRandall Stewart 				 * FR's to an alternate. Armando Caro's
3485f8829a4aSRandall Stewart 				 * paper details why.
3486f8829a4aSRandall Stewart 				 */
3487f8829a4aSRandall Stewart 				alt = tp1->whoTo;
3488f8829a4aSRandall Stewart #endif
3489f8829a4aSRandall Stewart 			}
3490f8829a4aSRandall Stewart 
3491f8829a4aSRandall Stewart 			tp1->rec.data.doing_fast_retransmit = 1;
3492f8829a4aSRandall Stewart 			tot_retrans++;
3493f8829a4aSRandall Stewart 			/* mark the sending seq for possible subsequent FR's */
3494f8829a4aSRandall Stewart 			/*
3495f8829a4aSRandall Stewart 			 * printf("Marking TSN for FR new value %x\n",
3496f8829a4aSRandall Stewart 			 * (uint32_t)tpi->rec.data.TSN_seq);
3497f8829a4aSRandall Stewart 			 */
3498f8829a4aSRandall Stewart 			if (TAILQ_EMPTY(&asoc->send_queue)) {
3499f8829a4aSRandall Stewart 				/*
3500f8829a4aSRandall Stewart 				 * If the queue of send is empty then its
3501f8829a4aSRandall Stewart 				 * the next sequence number that will be
3502f8829a4aSRandall Stewart 				 * assigned so we subtract one from this to
3503f8829a4aSRandall Stewart 				 * get the one we last sent.
3504f8829a4aSRandall Stewart 				 */
3505f8829a4aSRandall Stewart 				tp1->rec.data.fast_retran_tsn = sending_seq;
3506f8829a4aSRandall Stewart 			} else {
3507f8829a4aSRandall Stewart 				/*
3508f8829a4aSRandall Stewart 				 * If there are chunks on the send queue
3509f8829a4aSRandall Stewart 				 * (unsent data that has made it from the
3510f8829a4aSRandall Stewart 				 * stream queues but not out the door, we
3511f8829a4aSRandall Stewart 				 * take the first one (which will have the
3512f8829a4aSRandall Stewart 				 * lowest TSN) and subtract one to get the
3513f8829a4aSRandall Stewart 				 * one we last sent.
3514f8829a4aSRandall Stewart 				 */
3515f8829a4aSRandall Stewart 				struct sctp_tmit_chunk *ttt;
3516f8829a4aSRandall Stewart 
3517f8829a4aSRandall Stewart 				ttt = TAILQ_FIRST(&asoc->send_queue);
3518f8829a4aSRandall Stewart 				tp1->rec.data.fast_retran_tsn =
3519f8829a4aSRandall Stewart 				    ttt->rec.data.TSN_seq;
3520f8829a4aSRandall Stewart 			}
3521f8829a4aSRandall Stewart 
3522f8829a4aSRandall Stewart 			if (tp1->do_rtt) {
3523f8829a4aSRandall Stewart 				/*
3524f8829a4aSRandall Stewart 				 * this guy had a RTO calculation pending on
3525f8829a4aSRandall Stewart 				 * it, cancel it
3526f8829a4aSRandall Stewart 				 */
3527f8829a4aSRandall Stewart 				tp1->do_rtt = 0;
3528f8829a4aSRandall Stewart 			}
3529f8829a4aSRandall Stewart 			/* fix counts and things */
3530a5d547adSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
3531c105859eSRandall Stewart 			sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND,
3532a5d547adSRandall Stewart 			    tp1->whoTo->flight_size,
3533a5d547adSRandall Stewart 			    tp1->book_size,
3534c105859eSRandall Stewart 			    (uintptr_t) tp1->whoTo,
3535a5d547adSRandall Stewart 			    tp1->rec.data.TSN_seq);
3536a5d547adSRandall Stewart #endif
3537ad81507eSRandall Stewart 			if (tp1->whoTo) {
3538f8829a4aSRandall Stewart 				tp1->whoTo->net_ack++;
3539c105859eSRandall Stewart 				sctp_flight_size_decrease(tp1);
3540ad81507eSRandall Stewart 			}
3541f8829a4aSRandall Stewart #ifdef SCTP_LOG_RWND
3542f8829a4aSRandall Stewart 			sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3543f8829a4aSRandall Stewart 			    asoc->peers_rwnd, tp1->send_size, sctp_peer_chunk_oh);
3544f8829a4aSRandall Stewart #endif
3545f8829a4aSRandall Stewart 			/* add back to the rwnd */
3546f8829a4aSRandall Stewart 			asoc->peers_rwnd += (tp1->send_size + sctp_peer_chunk_oh);
3547f8829a4aSRandall Stewart 
3548f8829a4aSRandall Stewart 			/* remove from the total flight */
3549c105859eSRandall Stewart 			sctp_total_flight_decrease(stcb, tp1);
3550f8829a4aSRandall Stewart 			if (alt != tp1->whoTo) {
3551f8829a4aSRandall Stewart 				/* yes, there is an alternate. */
3552f8829a4aSRandall Stewart 				sctp_free_remote_addr(tp1->whoTo);
3553f8829a4aSRandall Stewart 				tp1->whoTo = alt;
3554f8829a4aSRandall Stewart 				atomic_add_int(&alt->ref_count, 1);
3555f8829a4aSRandall Stewart 			}
3556f8829a4aSRandall Stewart 		}
3557f8829a4aSRandall Stewart 		tp1 = TAILQ_NEXT(tp1, sctp_next);
3558f8829a4aSRandall Stewart 	}			/* while (tp1) */
3559f8829a4aSRandall Stewart 
3560f8829a4aSRandall Stewart 	if (tot_retrans > 0) {
3561f8829a4aSRandall Stewart 		/*
3562f8829a4aSRandall Stewart 		 * Setup the ecn nonce re-sync point. We do this since once
3563f8829a4aSRandall Stewart 		 * we go to FR something we introduce a Karn's rule scenario
3564f8829a4aSRandall Stewart 		 * and won't know the totals for the ECN bits.
3565f8829a4aSRandall Stewart 		 */
3566f8829a4aSRandall Stewart 		asoc->nonce_resync_tsn = sending_seq;
3567f8829a4aSRandall Stewart 		asoc->nonce_wait_for_ecne = 0;
3568f8829a4aSRandall Stewart 		asoc->nonce_sum_check = 0;
3569f8829a4aSRandall Stewart 	}
3570f8829a4aSRandall Stewart }
3571f8829a4aSRandall Stewart 
3572f8829a4aSRandall Stewart struct sctp_tmit_chunk *
3573f8829a4aSRandall Stewart sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3574f8829a4aSRandall Stewart     struct sctp_association *asoc)
3575f8829a4aSRandall Stewart {
3576f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *tp1, *tp2, *a_adv = NULL;
3577f8829a4aSRandall Stewart 	struct timeval now;
3578f8829a4aSRandall Stewart 	int now_filled = 0;
3579f8829a4aSRandall Stewart 
3580f8829a4aSRandall Stewart 	if (asoc->peer_supports_prsctp == 0) {
3581f8829a4aSRandall Stewart 		return (NULL);
3582f8829a4aSRandall Stewart 	}
3583f8829a4aSRandall Stewart 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
3584f8829a4aSRandall Stewart 	while (tp1) {
3585f8829a4aSRandall Stewart 		if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3586f8829a4aSRandall Stewart 		    tp1->sent != SCTP_DATAGRAM_RESEND) {
3587f8829a4aSRandall Stewart 			/* no chance to advance, out of here */
3588f8829a4aSRandall Stewart 			break;
3589f8829a4aSRandall Stewart 		}
3590f8829a4aSRandall Stewart 		if (!PR_SCTP_ENABLED(tp1->flags)) {
3591f8829a4aSRandall Stewart 			/*
3592f8829a4aSRandall Stewart 			 * We can't fwd-tsn past any that are reliable aka
3593f8829a4aSRandall Stewart 			 * retransmitted until the asoc fails.
3594f8829a4aSRandall Stewart 			 */
3595f8829a4aSRandall Stewart 			break;
3596f8829a4aSRandall Stewart 		}
3597f8829a4aSRandall Stewart 		if (!now_filled) {
35986e55db54SRandall Stewart 			(void)SCTP_GETTIME_TIMEVAL(&now);
3599f8829a4aSRandall Stewart 			now_filled = 1;
3600f8829a4aSRandall Stewart 		}
3601f8829a4aSRandall Stewart 		tp2 = TAILQ_NEXT(tp1, sctp_next);
3602f8829a4aSRandall Stewart 		/*
3603f8829a4aSRandall Stewart 		 * now we got a chunk which is marked for another
3604f8829a4aSRandall Stewart 		 * retransmission to a PR-stream but has run out its chances
3605f8829a4aSRandall Stewart 		 * already maybe OR has been marked to skip now. Can we skip
3606f8829a4aSRandall Stewart 		 * it if its a resend?
3607f8829a4aSRandall Stewart 		 */
3608f8829a4aSRandall Stewart 		if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3609f8829a4aSRandall Stewart 		    (PR_SCTP_TTL_ENABLED(tp1->flags))) {
3610f8829a4aSRandall Stewart 			/*
3611f8829a4aSRandall Stewart 			 * Now is this one marked for resend and its time is
3612f8829a4aSRandall Stewart 			 * now up?
3613f8829a4aSRandall Stewart 			 */
3614f8829a4aSRandall Stewart 			if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3615f8829a4aSRandall Stewart 				/* Yes so drop it */
3616f8829a4aSRandall Stewart 				if (tp1->data) {
3617ad81507eSRandall Stewart 					(void)sctp_release_pr_sctp_chunk(stcb, tp1,
3618f8829a4aSRandall Stewart 					    (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3619f8829a4aSRandall Stewart 					    &asoc->sent_queue);
3620f8829a4aSRandall Stewart 				}
3621f8829a4aSRandall Stewart 			} else {
3622f8829a4aSRandall Stewart 				/*
3623f8829a4aSRandall Stewart 				 * No, we are done when hit one for resend
3624f8829a4aSRandall Stewart 				 * whos time as not expired.
3625f8829a4aSRandall Stewart 				 */
3626f8829a4aSRandall Stewart 				break;
3627f8829a4aSRandall Stewart 			}
3628f8829a4aSRandall Stewart 		}
3629f8829a4aSRandall Stewart 		/*
3630f8829a4aSRandall Stewart 		 * Ok now if this chunk is marked to drop it we can clean up
3631f8829a4aSRandall Stewart 		 * the chunk, advance our peer ack point and we can check
3632f8829a4aSRandall Stewart 		 * the next chunk.
3633f8829a4aSRandall Stewart 		 */
3634f8829a4aSRandall Stewart 		if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3635f8829a4aSRandall Stewart 			/* advance PeerAckPoint goes forward */
3636f8829a4aSRandall Stewart 			asoc->advanced_peer_ack_point = tp1->rec.data.TSN_seq;
3637f8829a4aSRandall Stewart 			a_adv = tp1;
3638f8829a4aSRandall Stewart 			/*
3639f8829a4aSRandall Stewart 			 * we don't want to de-queue it here. Just wait for
3640f8829a4aSRandall Stewart 			 * the next peer SACK to come with a new cumTSN and
3641f8829a4aSRandall Stewart 			 * then the chunk will be droped in the normal
3642f8829a4aSRandall Stewart 			 * fashion.
3643f8829a4aSRandall Stewart 			 */
3644f8829a4aSRandall Stewart 			if (tp1->data) {
3645f8829a4aSRandall Stewart 				sctp_free_bufspace(stcb, asoc, tp1, 1);
3646f8829a4aSRandall Stewart 				/*
3647f8829a4aSRandall Stewart 				 * Maybe there should be another
3648f8829a4aSRandall Stewart 				 * notification type
3649f8829a4aSRandall Stewart 				 */
3650f8829a4aSRandall Stewart 				sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3651f8829a4aSRandall Stewart 				    (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
3652f8829a4aSRandall Stewart 				    tp1);
3653f8829a4aSRandall Stewart 				sctp_m_freem(tp1->data);
3654f8829a4aSRandall Stewart 				tp1->data = NULL;
3655f8829a4aSRandall Stewart 				if (stcb->sctp_socket) {
3656f8829a4aSRandall Stewart 					sctp_sowwakeup(stcb->sctp_ep,
3657f8829a4aSRandall Stewart 					    stcb->sctp_socket);
3658f8829a4aSRandall Stewart #ifdef SCTP_WAKE_LOGGING
3659f8829a4aSRandall Stewart 					sctp_wakeup_log(stcb, tp1->rec.data.TSN_seq, 1, SCTP_WAKESND_FROM_FWDTSN);
3660f8829a4aSRandall Stewart #endif
3661f8829a4aSRandall Stewart 				}
3662f8829a4aSRandall Stewart 			}
3663f8829a4aSRandall Stewart 		} else {
3664f8829a4aSRandall Stewart 			/*
3665f8829a4aSRandall Stewart 			 * If it is still in RESEND we can advance no
3666f8829a4aSRandall Stewart 			 * further
3667f8829a4aSRandall Stewart 			 */
3668f8829a4aSRandall Stewart 			break;
3669f8829a4aSRandall Stewart 		}
3670f8829a4aSRandall Stewart 		/*
3671f8829a4aSRandall Stewart 		 * If we hit here we just dumped tp1, move to next tsn on
3672f8829a4aSRandall Stewart 		 * sent queue.
3673f8829a4aSRandall Stewart 		 */
3674f8829a4aSRandall Stewart 		tp1 = tp2;
3675f8829a4aSRandall Stewart 	}
3676f8829a4aSRandall Stewart 	return (a_adv);
3677f8829a4aSRandall Stewart }
3678f8829a4aSRandall Stewart 
3679f8829a4aSRandall Stewart #ifdef SCTP_HIGH_SPEED
3680f8829a4aSRandall Stewart struct sctp_hs_raise_drop {
3681f8829a4aSRandall Stewart 	int32_t cwnd;
3682f8829a4aSRandall Stewart 	int32_t increase;
3683f8829a4aSRandall Stewart 	int32_t drop_percent;
3684f8829a4aSRandall Stewart };
3685f8829a4aSRandall Stewart 
3686f8829a4aSRandall Stewart #define SCTP_HS_TABLE_SIZE 73
3687f8829a4aSRandall Stewart 
3688f8829a4aSRandall Stewart struct sctp_hs_raise_drop sctp_cwnd_adjust[SCTP_HS_TABLE_SIZE] = {
3689f8829a4aSRandall Stewart 	{38, 1, 50},		/* 0   */
3690f8829a4aSRandall Stewart 	{118, 2, 44},		/* 1   */
3691f8829a4aSRandall Stewart 	{221, 3, 41},		/* 2   */
3692f8829a4aSRandall Stewart 	{347, 4, 38},		/* 3   */
3693f8829a4aSRandall Stewart 	{495, 5, 37},		/* 4   */
3694f8829a4aSRandall Stewart 	{663, 6, 35},		/* 5   */
3695f8829a4aSRandall Stewart 	{851, 7, 34},		/* 6   */
3696f8829a4aSRandall Stewart 	{1058, 8, 33},		/* 7   */
3697f8829a4aSRandall Stewart 	{1284, 9, 32},		/* 8   */
3698f8829a4aSRandall Stewart 	{1529, 10, 31},		/* 9   */
3699f8829a4aSRandall Stewart 	{1793, 11, 30},		/* 10  */
3700f8829a4aSRandall Stewart 	{2076, 12, 29},		/* 11  */
3701f8829a4aSRandall Stewart 	{2378, 13, 28},		/* 12  */
3702f8829a4aSRandall Stewart 	{2699, 14, 28},		/* 13  */
3703f8829a4aSRandall Stewart 	{3039, 15, 27},		/* 14  */
3704f8829a4aSRandall Stewart 	{3399, 16, 27},		/* 15  */
3705f8829a4aSRandall Stewart 	{3778, 17, 26},		/* 16  */
3706f8829a4aSRandall Stewart 	{4177, 18, 26},		/* 17  */
3707f8829a4aSRandall Stewart 	{4596, 19, 25},		/* 18  */
3708f8829a4aSRandall Stewart 	{5036, 20, 25},		/* 19  */
3709f8829a4aSRandall Stewart 	{5497, 21, 24},		/* 20  */
3710f8829a4aSRandall Stewart 	{5979, 22, 24},		/* 21  */
3711f8829a4aSRandall Stewart 	{6483, 23, 23},		/* 22  */
3712f8829a4aSRandall Stewart 	{7009, 24, 23},		/* 23  */
3713f8829a4aSRandall Stewart 	{7558, 25, 22},		/* 24  */
3714f8829a4aSRandall Stewart 	{8130, 26, 22},		/* 25  */
3715f8829a4aSRandall Stewart 	{8726, 27, 22},		/* 26  */
3716f8829a4aSRandall Stewart 	{9346, 28, 21},		/* 27  */
3717f8829a4aSRandall Stewart 	{9991, 29, 21},		/* 28  */
3718f8829a4aSRandall Stewart 	{10661, 30, 21},	/* 29  */
3719f8829a4aSRandall Stewart 	{11358, 31, 20},	/* 30  */
3720f8829a4aSRandall Stewart 	{12082, 32, 20},	/* 31  */
3721f8829a4aSRandall Stewart 	{12834, 33, 20},	/* 32  */
3722f8829a4aSRandall Stewart 	{13614, 34, 19},	/* 33  */
3723f8829a4aSRandall Stewart 	{14424, 35, 19},	/* 34  */
3724f8829a4aSRandall Stewart 	{15265, 36, 19},	/* 35  */
3725f8829a4aSRandall Stewart 	{16137, 37, 19},	/* 36  */
3726f8829a4aSRandall Stewart 	{17042, 38, 18},	/* 37  */
3727f8829a4aSRandall Stewart 	{17981, 39, 18},	/* 38  */
3728f8829a4aSRandall Stewart 	{18955, 40, 18},	/* 39  */
3729f8829a4aSRandall Stewart 	{19965, 41, 17},	/* 40  */
3730f8829a4aSRandall Stewart 	{21013, 42, 17},	/* 41  */
3731f8829a4aSRandall Stewart 	{22101, 43, 17},	/* 42  */
3732f8829a4aSRandall Stewart 	{23230, 44, 17},	/* 43  */
3733f8829a4aSRandall Stewart 	{24402, 45, 16},	/* 44  */
3734f8829a4aSRandall Stewart 	{25618, 46, 16},	/* 45  */
3735f8829a4aSRandall Stewart 	{26881, 47, 16},	/* 46  */
3736f8829a4aSRandall Stewart 	{28193, 48, 16},	/* 47  */
3737f8829a4aSRandall Stewart 	{29557, 49, 15},	/* 48  */
3738f8829a4aSRandall Stewart 	{30975, 50, 15},	/* 49  */
3739f8829a4aSRandall Stewart 	{32450, 51, 15},	/* 50  */
3740f8829a4aSRandall Stewart 	{33986, 52, 15},	/* 51  */
3741f8829a4aSRandall Stewart 	{35586, 53, 14},	/* 52  */
3742f8829a4aSRandall Stewart 	{37253, 54, 14},	/* 53  */
3743f8829a4aSRandall Stewart 	{38992, 55, 14},	/* 54  */
3744f8829a4aSRandall Stewart 	{40808, 56, 14},	/* 55  */
3745f8829a4aSRandall Stewart 	{42707, 57, 13},	/* 56  */
3746f8829a4aSRandall Stewart 	{44694, 58, 13},	/* 57  */
3747f8829a4aSRandall Stewart 	{46776, 59, 13},	/* 58  */
3748f8829a4aSRandall Stewart 	{48961, 60, 13},	/* 59  */
3749f8829a4aSRandall Stewart 	{51258, 61, 13},	/* 60  */
3750f8829a4aSRandall Stewart 	{53677, 62, 12},	/* 61  */
3751f8829a4aSRandall Stewart 	{56230, 63, 12},	/* 62  */
3752f8829a4aSRandall Stewart 	{58932, 64, 12},	/* 63  */
3753f8829a4aSRandall Stewart 	{61799, 65, 12},	/* 64  */
3754f8829a4aSRandall Stewart 	{64851, 66, 11},	/* 65  */
3755f8829a4aSRandall Stewart 	{68113, 67, 11},	/* 66  */
3756f8829a4aSRandall Stewart 	{71617, 68, 11},	/* 67  */
3757f8829a4aSRandall Stewart 	{75401, 69, 10},	/* 68  */
3758f8829a4aSRandall Stewart 	{79517, 70, 10},	/* 69  */
3759f8829a4aSRandall Stewart 	{84035, 71, 10},	/* 70  */
3760f8829a4aSRandall Stewart 	{89053, 72, 10},	/* 71  */
3761f8829a4aSRandall Stewart 	{94717, 73, 9}		/* 72  */
3762f8829a4aSRandall Stewart };
3763f8829a4aSRandall Stewart 
3764f8829a4aSRandall Stewart static void
376550cec919SRandall Stewart sctp_hs_cwnd_increase(struct sctp_tcb *stcb, struct sctp_nets *net)
3766f8829a4aSRandall Stewart {
3767f8829a4aSRandall Stewart 	int cur_val, i, indx, incr;
3768f8829a4aSRandall Stewart 
3769f8829a4aSRandall Stewart 	cur_val = net->cwnd >> 10;
3770f8829a4aSRandall Stewart 	indx = SCTP_HS_TABLE_SIZE - 1;
3771f8829a4aSRandall Stewart 
3772f8829a4aSRandall Stewart 	if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3773f8829a4aSRandall Stewart 		/* normal mode */
3774f8829a4aSRandall Stewart 		if (net->net_ack > net->mtu) {
3775f8829a4aSRandall Stewart 			net->cwnd += net->mtu;
3776f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3777f8829a4aSRandall Stewart 			sctp_log_cwnd(stcb, net, net->mtu, SCTP_CWND_LOG_FROM_SS);
3778f8829a4aSRandall Stewart #endif
3779f8829a4aSRandall Stewart 		} else {
3780f8829a4aSRandall Stewart 			net->cwnd += net->net_ack;
3781f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3782f8829a4aSRandall Stewart 			sctp_log_cwnd(stcb, net, net->net_ack, SCTP_CWND_LOG_FROM_SS);
3783f8829a4aSRandall Stewart #endif
3784f8829a4aSRandall Stewart 		}
3785f8829a4aSRandall Stewart 	} else {
3786f8829a4aSRandall Stewart 		for (i = net->last_hs_used; i < SCTP_HS_TABLE_SIZE; i++) {
3787f8829a4aSRandall Stewart 			if (cur_val < sctp_cwnd_adjust[i].cwnd) {
3788f8829a4aSRandall Stewart 				indx = i;
3789f8829a4aSRandall Stewart 				break;
3790f8829a4aSRandall Stewart 			}
3791f8829a4aSRandall Stewart 		}
3792f8829a4aSRandall Stewart 		net->last_hs_used = indx;
3793f8829a4aSRandall Stewart 		incr = ((sctp_cwnd_adjust[indx].increase) << 10);
3794f8829a4aSRandall Stewart 		net->cwnd += incr;
3795f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3796f8829a4aSRandall Stewart 		sctp_log_cwnd(stcb, net, incr, SCTP_CWND_LOG_FROM_SS);
3797f8829a4aSRandall Stewart #endif
3798f8829a4aSRandall Stewart 	}
3799f8829a4aSRandall Stewart }
3800f8829a4aSRandall Stewart 
3801f8829a4aSRandall Stewart static void
380250cec919SRandall Stewart sctp_hs_cwnd_decrease(struct sctp_tcb *stcb, struct sctp_nets *net)
3803f8829a4aSRandall Stewart {
3804f8829a4aSRandall Stewart 	int cur_val, i, indx;
3805f8829a4aSRandall Stewart 
3806f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3807f8829a4aSRandall Stewart 	int old_cwnd = net->cwnd;
3808f8829a4aSRandall Stewart 
3809f8829a4aSRandall Stewart #endif
3810f8829a4aSRandall Stewart 
3811f8829a4aSRandall Stewart 	cur_val = net->cwnd >> 10;
3812f8829a4aSRandall Stewart 	indx = net->last_hs_used;
3813f8829a4aSRandall Stewart 	if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3814f8829a4aSRandall Stewart 		/* normal mode */
3815f8829a4aSRandall Stewart 		net->ssthresh = net->cwnd / 2;
3816f8829a4aSRandall Stewart 		if (net->ssthresh < (net->mtu * 2)) {
3817f8829a4aSRandall Stewart 			net->ssthresh = 2 * net->mtu;
3818f8829a4aSRandall Stewart 		}
3819f8829a4aSRandall Stewart 		net->cwnd = net->ssthresh;
3820f8829a4aSRandall Stewart 	} else {
3821f8829a4aSRandall Stewart 		/* drop by the proper amount */
3822f8829a4aSRandall Stewart 		net->ssthresh = net->cwnd - (int)((net->cwnd / 100) *
3823f8829a4aSRandall Stewart 		    sctp_cwnd_adjust[net->last_hs_used].drop_percent);
3824f8829a4aSRandall Stewart 		net->cwnd = net->ssthresh;
3825f8829a4aSRandall Stewart 		/* now where are we */
3826f8829a4aSRandall Stewart 		indx = net->last_hs_used;
3827f8829a4aSRandall Stewart 		cur_val = net->cwnd >> 10;
3828f8829a4aSRandall Stewart 		/* reset where we are in the table */
3829f8829a4aSRandall Stewart 		if (cur_val < sctp_cwnd_adjust[0].cwnd) {
3830f8829a4aSRandall Stewart 			/* feel out of hs */
3831f8829a4aSRandall Stewart 			net->last_hs_used = 0;
3832f8829a4aSRandall Stewart 		} else {
3833f8829a4aSRandall Stewart 			for (i = indx; i >= 1; i--) {
3834f8829a4aSRandall Stewart 				if (cur_val > sctp_cwnd_adjust[i - 1].cwnd) {
3835f8829a4aSRandall Stewart 					break;
3836f8829a4aSRandall Stewart 				}
3837f8829a4aSRandall Stewart 			}
3838f8829a4aSRandall Stewart 			net->last_hs_used = indx;
3839f8829a4aSRandall Stewart 		}
3840f8829a4aSRandall Stewart 	}
3841f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3842f8829a4aSRandall Stewart 	sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd), SCTP_CWND_LOG_FROM_FR);
3843f8829a4aSRandall Stewart #endif
3844f8829a4aSRandall Stewart 
3845f8829a4aSRandall Stewart }
3846f8829a4aSRandall Stewart 
3847f8829a4aSRandall Stewart #endif
3848f8829a4aSRandall Stewart 
3849f8829a4aSRandall Stewart 
3850f8829a4aSRandall Stewart static __inline void
3851f8829a4aSRandall Stewart sctp_cwnd_update(struct sctp_tcb *stcb,
3852f8829a4aSRandall Stewart     struct sctp_association *asoc,
3853f8829a4aSRandall Stewart     int accum_moved, int reneged_all, int will_exit)
3854f8829a4aSRandall Stewart {
3855f8829a4aSRandall Stewart 	struct sctp_nets *net;
3856f8829a4aSRandall Stewart 
3857f8829a4aSRandall Stewart 	/******************************/
3858f8829a4aSRandall Stewart 	/* update cwnd and Early FR   */
3859f8829a4aSRandall Stewart 	/******************************/
3860f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
386142551e99SRandall Stewart 
386242551e99SRandall Stewart #ifdef JANA_CMT_FAST_RECOVERY
3863f8829a4aSRandall Stewart 		/*
3864f8829a4aSRandall Stewart 		 * CMT fast recovery code. Need to debug.
3865f8829a4aSRandall Stewart 		 */
3866f8829a4aSRandall Stewart 		if (net->fast_retran_loss_recovery && net->new_pseudo_cumack) {
3867f8829a4aSRandall Stewart 			if (compare_with_wrap(asoc->last_acked_seq,
3868f8829a4aSRandall Stewart 			    net->fast_recovery_tsn, MAX_TSN) ||
3869f8829a4aSRandall Stewart 			    (asoc->last_acked_seq == net->fast_recovery_tsn) ||
3870f8829a4aSRandall Stewart 			    compare_with_wrap(net->pseudo_cumack, net->fast_recovery_tsn, MAX_TSN) ||
3871f8829a4aSRandall Stewart 			    (net->pseudo_cumack == net->fast_recovery_tsn)) {
3872f8829a4aSRandall Stewart 				net->will_exit_fast_recovery = 1;
3873f8829a4aSRandall Stewart 			}
3874f8829a4aSRandall Stewart 		}
3875f8829a4aSRandall Stewart #endif
3876f8829a4aSRandall Stewart 		if (sctp_early_fr) {
3877f8829a4aSRandall Stewart 			/*
3878f8829a4aSRandall Stewart 			 * So, first of all do we need to have a Early FR
3879f8829a4aSRandall Stewart 			 * timer running?
3880f8829a4aSRandall Stewart 			 */
3881f8829a4aSRandall Stewart 			if (((TAILQ_FIRST(&asoc->sent_queue)) &&
3882f8829a4aSRandall Stewart 			    (net->ref_count > 1) &&
3883f8829a4aSRandall Stewart 			    (net->flight_size < net->cwnd)) ||
3884f8829a4aSRandall Stewart 			    (reneged_all)) {
3885f8829a4aSRandall Stewart 				/*
3886f8829a4aSRandall Stewart 				 * yes, so in this case stop it if its
3887f8829a4aSRandall Stewart 				 * running, and then restart it. Reneging
3888f8829a4aSRandall Stewart 				 * all is a special case where we want to
3889f8829a4aSRandall Stewart 				 * run the Early FR timer and then force the
3890f8829a4aSRandall Stewart 				 * last few unacked to be sent, causing us
3891f8829a4aSRandall Stewart 				 * to illicit a sack with gaps to force out
3892f8829a4aSRandall Stewart 				 * the others.
3893f8829a4aSRandall Stewart 				 */
3894139bc87fSRandall Stewart 				if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
3895f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_earlyfrstpidsck2);
3896a5d547adSRandall Stewart 					sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
3897a5d547adSRandall Stewart 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_20);
3898f8829a4aSRandall Stewart 				}
3899f8829a4aSRandall Stewart 				SCTP_STAT_INCR(sctps_earlyfrstrid);
3900f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net);
3901f8829a4aSRandall Stewart 			} else {
3902f8829a4aSRandall Stewart 				/* No, stop it if its running */
3903139bc87fSRandall Stewart 				if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
3904f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_earlyfrstpidsck3);
3905a5d547adSRandall Stewart 					sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
3906a5d547adSRandall Stewart 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_21);
3907f8829a4aSRandall Stewart 				}
3908f8829a4aSRandall Stewart 			}
3909f8829a4aSRandall Stewart 		}
3910f8829a4aSRandall Stewart 		/* if nothing was acked on this destination skip it */
3911f8829a4aSRandall Stewart 		if (net->net_ack == 0) {
3912f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
3913f8829a4aSRandall Stewart 			sctp_log_cwnd(stcb, net, 0, SCTP_CWND_LOG_FROM_SACK);
3914f8829a4aSRandall Stewart #endif
3915f8829a4aSRandall Stewart 			continue;
3916f8829a4aSRandall Stewart 		}
3917f8829a4aSRandall Stewart 		if (net->net_ack2 > 0) {
3918f8829a4aSRandall Stewart 			/*
3919f8829a4aSRandall Stewart 			 * Karn's rule applies to clearing error count, this
3920f8829a4aSRandall Stewart 			 * is optional.
3921f8829a4aSRandall Stewart 			 */
3922f8829a4aSRandall Stewart 			net->error_count = 0;
3923f8829a4aSRandall Stewart 			if ((net->dest_state & SCTP_ADDR_NOT_REACHABLE) ==
3924f8829a4aSRandall Stewart 			    SCTP_ADDR_NOT_REACHABLE) {
3925f8829a4aSRandall Stewart 				/* addr came good */
3926f8829a4aSRandall Stewart 				net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
3927f8829a4aSRandall Stewart 				net->dest_state |= SCTP_ADDR_REACHABLE;
3928f8829a4aSRandall Stewart 				sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
3929f8829a4aSRandall Stewart 				    SCTP_RECEIVED_SACK, (void *)net);
3930f8829a4aSRandall Stewart 				/* now was it the primary? if so restore */
3931f8829a4aSRandall Stewart 				if (net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
3932ad81507eSRandall Stewart 					(void)sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, net);
3933f8829a4aSRandall Stewart 				}
3934f8829a4aSRandall Stewart 			}
3935f8829a4aSRandall Stewart 		}
393642551e99SRandall Stewart #ifdef JANA_CMT_FAST_RECOVERY
3937f8829a4aSRandall Stewart 		/*
393842551e99SRandall Stewart 		 * CMT fast recovery code
3939f8829a4aSRandall Stewart 		 */
3940f8829a4aSRandall Stewart 		/*
394142551e99SRandall Stewart 		 * if (sctp_cmt_on_off == 1 &&
394242551e99SRandall Stewart 		 * net->fast_retran_loss_recovery &&
394342551e99SRandall Stewart 		 * net->will_exit_fast_recovery == 0) { // @@@ Do something
394442551e99SRandall Stewart 		 * }	   else if (sctp_cmt_on_off == 0 &&
394542551e99SRandall Stewart 		 * asoc->fast_retran_loss_recovery && will_exit == 0) {
394642551e99SRandall Stewart 		 */
394742551e99SRandall Stewart #endif
394842551e99SRandall Stewart 
3949c105859eSRandall Stewart 		if (asoc->fast_retran_loss_recovery && will_exit == 0 && sctp_cmt_on_off == 0) {
395042551e99SRandall Stewart 			/*
395142551e99SRandall Stewart 			 * If we are in loss recovery we skip any cwnd
395242551e99SRandall Stewart 			 * update
3953f8829a4aSRandall Stewart 			 */
3954f8829a4aSRandall Stewart 			goto skip_cwnd_update;
3955f8829a4aSRandall Stewart 		}
3956f8829a4aSRandall Stewart 		/*
3957f8829a4aSRandall Stewart 		 * CMT: CUC algorithm. Update cwnd if pseudo-cumack has
3958f8829a4aSRandall Stewart 		 * moved.
3959f8829a4aSRandall Stewart 		 */
3960f8829a4aSRandall Stewart 		if (accum_moved || (sctp_cmt_on_off && net->new_pseudo_cumack)) {
3961f8829a4aSRandall Stewart 			/* If the cumulative ack moved we can proceed */
3962f8829a4aSRandall Stewart 			if (net->cwnd <= net->ssthresh) {
3963f8829a4aSRandall Stewart 				/* We are in slow start */
3964f8829a4aSRandall Stewart 				if (net->flight_size + net->net_ack >=
3965f8829a4aSRandall Stewart 				    net->cwnd) {
3966f8829a4aSRandall Stewart #ifdef SCTP_HIGH_SPEED
396750cec919SRandall Stewart 					sctp_hs_cwnd_increase(stcb, net);
3968f8829a4aSRandall Stewart #else
3969f8829a4aSRandall Stewart 					if (net->net_ack > (net->mtu * sctp_L2_abc_variable)) {
3970f8829a4aSRandall Stewart 						net->cwnd += (net->mtu * sctp_L2_abc_variable);
3971f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3972f8829a4aSRandall Stewart 						sctp_log_cwnd(stcb, net, net->mtu,
3973f8829a4aSRandall Stewart 						    SCTP_CWND_LOG_FROM_SS);
3974f8829a4aSRandall Stewart #endif
3975f8829a4aSRandall Stewart 
3976f8829a4aSRandall Stewart 					} else {
3977f8829a4aSRandall Stewart 						net->cwnd += net->net_ack;
3978f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
3979f8829a4aSRandall Stewart 						sctp_log_cwnd(stcb, net, net->net_ack,
3980f8829a4aSRandall Stewart 						    SCTP_CWND_LOG_FROM_SS);
3981f8829a4aSRandall Stewart #endif
3982f8829a4aSRandall Stewart 
3983f8829a4aSRandall Stewart 					}
3984f8829a4aSRandall Stewart #endif
3985f8829a4aSRandall Stewart 				} else {
3986f8829a4aSRandall Stewart 					unsigned int dif;
3987f8829a4aSRandall Stewart 
3988f8829a4aSRandall Stewart 					dif = net->cwnd - (net->flight_size +
3989f8829a4aSRandall Stewart 					    net->net_ack);
3990f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
3991f8829a4aSRandall Stewart 					sctp_log_cwnd(stcb, net, net->net_ack,
3992f8829a4aSRandall Stewart 					    SCTP_CWND_LOG_NOADV_SS);
3993f8829a4aSRandall Stewart #endif
3994f8829a4aSRandall Stewart 				}
3995f8829a4aSRandall Stewart 			} else {
3996f8829a4aSRandall Stewart 				/* We are in congestion avoidance */
3997f8829a4aSRandall Stewart 				if (net->flight_size + net->net_ack >=
3998f8829a4aSRandall Stewart 				    net->cwnd) {
3999f8829a4aSRandall Stewart 					/*
4000f8829a4aSRandall Stewart 					 * add to pba only if we had a
4001f8829a4aSRandall Stewart 					 * cwnd's worth (or so) in flight OR
4002f8829a4aSRandall Stewart 					 * the burst limit was applied.
4003f8829a4aSRandall Stewart 					 */
4004f8829a4aSRandall Stewart 					net->partial_bytes_acked +=
4005f8829a4aSRandall Stewart 					    net->net_ack;
4006f8829a4aSRandall Stewart 
4007f8829a4aSRandall Stewart 					/*
4008f8829a4aSRandall Stewart 					 * Do we need to increase (if pba is
4009f8829a4aSRandall Stewart 					 * > cwnd)?
4010f8829a4aSRandall Stewart 					 */
4011f8829a4aSRandall Stewart 					if (net->partial_bytes_acked >=
4012f8829a4aSRandall Stewart 					    net->cwnd) {
4013f8829a4aSRandall Stewart 						if (net->cwnd <
4014f8829a4aSRandall Stewart 						    net->partial_bytes_acked) {
4015f8829a4aSRandall Stewart 							net->partial_bytes_acked -=
4016f8829a4aSRandall Stewart 							    net->cwnd;
4017f8829a4aSRandall Stewart 						} else {
4018f8829a4aSRandall Stewart 							net->partial_bytes_acked =
4019f8829a4aSRandall Stewart 							    0;
4020f8829a4aSRandall Stewart 						}
4021f8829a4aSRandall Stewart 						net->cwnd += net->mtu;
4022f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
4023f8829a4aSRandall Stewart 						sctp_log_cwnd(stcb, net, net->mtu,
4024f8829a4aSRandall Stewart 						    SCTP_CWND_LOG_FROM_CA);
4025f8829a4aSRandall Stewart #endif
4026f8829a4aSRandall Stewart 					}
4027f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
4028f8829a4aSRandall Stewart 					else {
4029f8829a4aSRandall Stewart 						sctp_log_cwnd(stcb, net, net->net_ack,
4030f8829a4aSRandall Stewart 						    SCTP_CWND_LOG_NOADV_CA);
4031f8829a4aSRandall Stewart 					}
4032f8829a4aSRandall Stewart #endif
4033f8829a4aSRandall Stewart 				} else {
4034f8829a4aSRandall Stewart 					unsigned int dif;
4035f8829a4aSRandall Stewart 
4036f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
4037f8829a4aSRandall Stewart 					sctp_log_cwnd(stcb, net, net->net_ack,
4038f8829a4aSRandall Stewart 					    SCTP_CWND_LOG_NOADV_CA);
4039f8829a4aSRandall Stewart #endif
4040f8829a4aSRandall Stewart 					dif = net->cwnd - (net->flight_size +
4041f8829a4aSRandall Stewart 					    net->net_ack);
4042f8829a4aSRandall Stewart 				}
4043f8829a4aSRandall Stewart 			}
4044f8829a4aSRandall Stewart 		} else {
4045f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
4046f8829a4aSRandall Stewart 			sctp_log_cwnd(stcb, net, net->mtu,
4047f8829a4aSRandall Stewart 			    SCTP_CWND_LOG_NO_CUMACK);
4048f8829a4aSRandall Stewart #endif
4049f8829a4aSRandall Stewart 		}
4050f8829a4aSRandall Stewart skip_cwnd_update:
4051f8829a4aSRandall Stewart 		/*
4052f8829a4aSRandall Stewart 		 * NOW, according to Karn's rule do we need to restore the
4053f8829a4aSRandall Stewart 		 * RTO timer back? Check our net_ack2. If not set then we
4054f8829a4aSRandall Stewart 		 * have a ambiguity.. i.e. all data ack'd was sent to more
4055f8829a4aSRandall Stewart 		 * than one place.
4056f8829a4aSRandall Stewart 		 */
4057f8829a4aSRandall Stewart 		if (net->net_ack2) {
4058f8829a4aSRandall Stewart 			/* restore any doubled timers */
4059f8829a4aSRandall Stewart 			net->RTO = ((net->lastsa >> 2) + net->lastsv) >> 1;
4060f8829a4aSRandall Stewart 			if (net->RTO < stcb->asoc.minrto) {
4061f8829a4aSRandall Stewart 				net->RTO = stcb->asoc.minrto;
4062f8829a4aSRandall Stewart 			}
4063f8829a4aSRandall Stewart 			if (net->RTO > stcb->asoc.maxrto) {
4064f8829a4aSRandall Stewart 				net->RTO = stcb->asoc.maxrto;
4065f8829a4aSRandall Stewart 			}
4066f8829a4aSRandall Stewart 		}
4067f8829a4aSRandall Stewart 	}
4068f8829a4aSRandall Stewart }
4069f8829a4aSRandall Stewart 
4070bff64a4dSRandall Stewart static void
4071c105859eSRandall Stewart sctp_fs_audit(struct sctp_association *asoc)
4072bff64a4dSRandall Stewart {
4073bff64a4dSRandall Stewart 	struct sctp_tmit_chunk *chk;
4074bff64a4dSRandall Stewart 	int inflight = 0, resend = 0, inbetween = 0, acked = 0, above = 0;
4075bff64a4dSRandall Stewart 
4076bff64a4dSRandall Stewart 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4077bff64a4dSRandall Stewart 		if (chk->sent < SCTP_DATAGRAM_RESEND) {
4078bff64a4dSRandall Stewart 			inflight++;
4079bff64a4dSRandall Stewart 		} else if (chk->sent == SCTP_DATAGRAM_RESEND) {
4080bff64a4dSRandall Stewart 			resend++;
4081bff64a4dSRandall Stewart 		} else if (chk->sent < SCTP_DATAGRAM_ACKED) {
4082bff64a4dSRandall Stewart 			inbetween++;
4083bff64a4dSRandall Stewart 		} else if (chk->sent > SCTP_DATAGRAM_ACKED) {
4084bff64a4dSRandall Stewart 			above++;
4085bff64a4dSRandall Stewart 		} else {
4086bff64a4dSRandall Stewart 			acked++;
4087bff64a4dSRandall Stewart 		}
4088bff64a4dSRandall Stewart 	}
4089f1f73e57SRandall Stewart 
4090c105859eSRandall Stewart 	if ((inflight > 0) || (inbetween > 0)) {
4091f1f73e57SRandall Stewart #ifdef INVARIANTS
4092c105859eSRandall Stewart 		panic("Flight size-express incorrect? \n");
4093f1f73e57SRandall Stewart #else
4094ad81507eSRandall Stewart 		SCTP_PRINTF("Flight size-express incorrect inflight:%d inbetween:%d\n",
4095f1f73e57SRandall Stewart 		    inflight, inbetween);
4096f1f73e57SRandall Stewart #endif
4097bff64a4dSRandall Stewart 	}
4098c105859eSRandall Stewart }
4099c105859eSRandall Stewart 
4100c105859eSRandall Stewart 
4101c105859eSRandall Stewart static void
4102c105859eSRandall Stewart sctp_window_probe_recovery(struct sctp_tcb *stcb,
4103c105859eSRandall Stewart     struct sctp_association *asoc,
4104c105859eSRandall Stewart     struct sctp_nets *net,
4105c105859eSRandall Stewart     struct sctp_tmit_chunk *tp1)
4106c105859eSRandall Stewart {
4107c105859eSRandall Stewart 	struct sctp_tmit_chunk *chk;
4108c105859eSRandall Stewart 
4109c105859eSRandall Stewart 	/* First setup this one and get it moved back */
4110c105859eSRandall Stewart 	tp1->sent = SCTP_DATAGRAM_UNSENT;
4111c105859eSRandall Stewart 	tp1->window_probe = 0;
4112c105859eSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
4113c105859eSRandall Stewart 	sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_WP,
4114c105859eSRandall Stewart 	    tp1->whoTo->flight_size,
4115c105859eSRandall Stewart 	    tp1->book_size,
4116c105859eSRandall Stewart 	    (uintptr_t) tp1->whoTo,
4117c105859eSRandall Stewart 	    tp1->rec.data.TSN_seq);
4118c105859eSRandall Stewart #endif
4119c105859eSRandall Stewart 	sctp_flight_size_decrease(tp1);
4120c105859eSRandall Stewart 	sctp_total_flight_decrease(stcb, tp1);
4121c105859eSRandall Stewart 	TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4122c105859eSRandall Stewart 	TAILQ_INSERT_HEAD(&asoc->send_queue, tp1, sctp_next);
4123c105859eSRandall Stewart 	asoc->sent_queue_cnt--;
4124c105859eSRandall Stewart 	asoc->send_queue_cnt++;
4125c105859eSRandall Stewart 	/*
4126c105859eSRandall Stewart 	 * Now all guys marked for RESEND on the sent_queue must be moved
4127c105859eSRandall Stewart 	 * back too.
4128c105859eSRandall Stewart 	 */
4129c105859eSRandall Stewart 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
4130c105859eSRandall Stewart 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
4131c105859eSRandall Stewart 			/* Another chunk to move */
4132c105859eSRandall Stewart 			chk->sent = SCTP_DATAGRAM_UNSENT;
4133c105859eSRandall Stewart 			chk->window_probe = 0;
4134c105859eSRandall Stewart 			/* It should not be in flight */
4135c105859eSRandall Stewart 			TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
4136c105859eSRandall Stewart 			TAILQ_INSERT_AFTER(&asoc->send_queue, tp1, chk, sctp_next);
4137c105859eSRandall Stewart 			asoc->sent_queue_cnt--;
4138c105859eSRandall Stewart 			asoc->send_queue_cnt++;
4139c105859eSRandall Stewart 			sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4140c105859eSRandall Stewart 		}
4141c105859eSRandall Stewart 	}
4142c105859eSRandall Stewart }
4143c105859eSRandall Stewart 
4144f8829a4aSRandall Stewart 
4145f8829a4aSRandall Stewart void
4146f8829a4aSRandall Stewart sctp_express_handle_sack(struct sctp_tcb *stcb, uint32_t cumack,
4147f8829a4aSRandall Stewart     uint32_t rwnd, int nonce_sum_flag, int *abort_now)
4148f8829a4aSRandall Stewart {
4149f8829a4aSRandall Stewart 	struct sctp_nets *net;
4150f8829a4aSRandall Stewart 	struct sctp_association *asoc;
4151f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *tp1, *tp2;
41525e54f665SRandall Stewart 	uint32_t old_rwnd;
41535e54f665SRandall Stewart 	int win_probe_recovery = 0;
4154c105859eSRandall Stewart 	int win_probe_recovered = 0;
4155d06c82f1SRandall Stewart 	int j, done_once = 0;
4156f8829a4aSRandall Stewart 
4157d06c82f1SRandall Stewart 
4158d06c82f1SRandall Stewart #ifdef SCTP_LOG_SACK_ARRIVALS
4159d06c82f1SRandall Stewart 	sctp_misc_ints(SCTP_SACK_LOG_EXPRESS, cumack,
4160d06c82f1SRandall Stewart 	    rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
4161d06c82f1SRandall Stewart #endif
4162f8829a4aSRandall Stewart 	SCTP_TCB_LOCK_ASSERT(stcb);
4163f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
4164d06c82f1SRandall Stewart 	old_rwnd = asoc->peers_rwnd;
41655e54f665SRandall Stewart 	if (compare_with_wrap(asoc->last_acked_seq, cumack, MAX_TSN)) {
41665e54f665SRandall Stewart 		/* old ack */
41675e54f665SRandall Stewart 		return;
4168d06c82f1SRandall Stewart 	} else if (asoc->last_acked_seq == cumack) {
4169d06c82f1SRandall Stewart 		/* Window update sack */
4170d06c82f1SRandall Stewart 		asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
4171d06c82f1SRandall Stewart 		    (uint32_t) (asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh)));
4172d06c82f1SRandall Stewart 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4173d06c82f1SRandall Stewart 			/* SWS sender side engages */
4174d06c82f1SRandall Stewart 			asoc->peers_rwnd = 0;
4175d06c82f1SRandall Stewart 		}
4176d06c82f1SRandall Stewart 		if (asoc->peers_rwnd > old_rwnd) {
4177d06c82f1SRandall Stewart 			goto again;
4178d06c82f1SRandall Stewart 		}
4179d06c82f1SRandall Stewart 		return;
4180d06c82f1SRandall Stewart 
41815e54f665SRandall Stewart 	}
4182f8829a4aSRandall Stewart 	/* First setup for CC stuff */
4183f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4184f8829a4aSRandall Stewart 		net->prev_cwnd = net->cwnd;
4185f8829a4aSRandall Stewart 		net->net_ack = 0;
4186f8829a4aSRandall Stewart 		net->net_ack2 = 0;
4187132dea7dSRandall Stewart 
4188132dea7dSRandall Stewart 		/*
4189132dea7dSRandall Stewart 		 * CMT: Reset CUC and Fast recovery algo variables before
4190132dea7dSRandall Stewart 		 * SACK processing
4191132dea7dSRandall Stewart 		 */
4192132dea7dSRandall Stewart 		net->new_pseudo_cumack = 0;
4193132dea7dSRandall Stewart 		net->will_exit_fast_recovery = 0;
4194f8829a4aSRandall Stewart 	}
4195139bc87fSRandall Stewart 	if (sctp_strict_sacks) {
4196139bc87fSRandall Stewart 		uint32_t send_s;
4197139bc87fSRandall Stewart 
4198c105859eSRandall Stewart 		if (!TAILQ_EMPTY(&asoc->sent_queue)) {
4199c105859eSRandall Stewart 			tp1 = TAILQ_LAST(&asoc->sent_queue,
4200c105859eSRandall Stewart 			    sctpchunk_listhead);
4201c105859eSRandall Stewart 			send_s = tp1->rec.data.TSN_seq + 1;
4202139bc87fSRandall Stewart 		} else {
4203c105859eSRandall Stewart 			send_s = asoc->sending_seq;
4204139bc87fSRandall Stewart 		}
4205139bc87fSRandall Stewart 		if ((cumack == send_s) ||
4206139bc87fSRandall Stewart 		    compare_with_wrap(cumack, send_s, MAX_TSN)) {
4207c105859eSRandall Stewart #ifndef INVARIANTS
4208139bc87fSRandall Stewart 			struct mbuf *oper;
4209139bc87fSRandall Stewart 
4210c105859eSRandall Stewart #endif
4211c105859eSRandall Stewart #ifdef INVARIANTS
4212c105859eSRandall Stewart 			panic("Impossible sack 1");
4213c105859eSRandall Stewart #else
4214139bc87fSRandall Stewart 			*abort_now = 1;
4215139bc87fSRandall Stewart 			/* XXX */
4216139bc87fSRandall Stewart 			oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
4217139bc87fSRandall Stewart 			    0, M_DONTWAIT, 1, MT_DATA);
4218139bc87fSRandall Stewart 			if (oper) {
4219139bc87fSRandall Stewart 				struct sctp_paramhdr *ph;
4220139bc87fSRandall Stewart 				uint32_t *ippp;
4221139bc87fSRandall Stewart 
4222139bc87fSRandall Stewart 				SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
4223139bc87fSRandall Stewart 				    sizeof(uint32_t);
4224139bc87fSRandall Stewart 				ph = mtod(oper, struct sctp_paramhdr *);
4225139bc87fSRandall Stewart 				ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
4226139bc87fSRandall Stewart 				ph->param_length = htons(SCTP_BUF_LEN(oper));
4227139bc87fSRandall Stewart 				ippp = (uint32_t *) (ph + 1);
4228139bc87fSRandall Stewart 				*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_25);
4229139bc87fSRandall Stewart 			}
4230139bc87fSRandall Stewart 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_25;
4231139bc87fSRandall Stewart 			sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper);
4232139bc87fSRandall Stewart 			return;
4233139bc87fSRandall Stewart #endif
4234139bc87fSRandall Stewart 		}
4235139bc87fSRandall Stewart 	}
4236f8829a4aSRandall Stewart 	asoc->this_sack_highest_gap = cumack;
4237f8829a4aSRandall Stewart 	stcb->asoc.overall_error_count = 0;
42385e54f665SRandall Stewart 	if (compare_with_wrap(cumack, asoc->last_acked_seq, MAX_TSN)) {
4239f8829a4aSRandall Stewart 		/* process the new consecutive TSN first */
4240f8829a4aSRandall Stewart 		tp1 = TAILQ_FIRST(&asoc->sent_queue);
4241f8829a4aSRandall Stewart 		while (tp1) {
4242f8829a4aSRandall Stewart 			tp2 = TAILQ_NEXT(tp1, sctp_next);
4243f8829a4aSRandall Stewart 			if (compare_with_wrap(cumack, tp1->rec.data.TSN_seq,
4244f8829a4aSRandall Stewart 			    MAX_TSN) ||
4245f8829a4aSRandall Stewart 			    cumack == tp1->rec.data.TSN_seq) {
4246f8829a4aSRandall Stewart 				if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4247f8829a4aSRandall Stewart 					/*
42485e54f665SRandall Stewart 					 * ECN Nonce: Add the nonce to the
42495e54f665SRandall Stewart 					 * sender's nonce sum
4250f8829a4aSRandall Stewart 					 */
4251f8829a4aSRandall Stewart 					asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce;
4252f8829a4aSRandall Stewart 					if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4253f8829a4aSRandall Stewart 						/*
42545e54f665SRandall Stewart 						 * If it is less than ACKED,
42555e54f665SRandall Stewart 						 * it is now no-longer in
42565e54f665SRandall Stewart 						 * flight. Higher values may
42575e54f665SRandall Stewart 						 * occur during marking
4258f8829a4aSRandall Stewart 						 */
4259c105859eSRandall Stewart 						if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4260a5d547adSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
4261c105859eSRandall Stewart 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4262a5d547adSRandall Stewart 							    tp1->whoTo->flight_size,
4263a5d547adSRandall Stewart 							    tp1->book_size,
4264c105859eSRandall Stewart 							    (uintptr_t) tp1->whoTo,
4265a5d547adSRandall Stewart 							    tp1->rec.data.TSN_seq);
4266a5d547adSRandall Stewart #endif
4267a5d547adSRandall Stewart 
4268c105859eSRandall Stewart 							sctp_flight_size_decrease(tp1);
4269c105859eSRandall Stewart 							sctp_total_flight_decrease(stcb, tp1);
4270f8829a4aSRandall Stewart 						}
4271f8829a4aSRandall Stewart 						tp1->whoTo->net_ack += tp1->send_size;
4272f8829a4aSRandall Stewart 						if (tp1->snd_count < 2) {
4273f8829a4aSRandall Stewart 							/*
42745e54f665SRandall Stewart 							 * True
42755e54f665SRandall Stewart 							 * non-retransmited
4276f8829a4aSRandall Stewart 							 * chunk
4277f8829a4aSRandall Stewart 							 */
4278f8829a4aSRandall Stewart 							tp1->whoTo->net_ack2 +=
4279f8829a4aSRandall Stewart 							    tp1->send_size;
4280f8829a4aSRandall Stewart 
4281f8829a4aSRandall Stewart 							/* update RTO too? */
428262c1ff9cSRandall Stewart 							if (tp1->do_rtt) {
4283f8829a4aSRandall Stewart 								tp1->whoTo->RTO =
4284f8829a4aSRandall Stewart 								    sctp_calculate_rto(stcb,
4285f8829a4aSRandall Stewart 								    asoc, tp1->whoTo,
4286f8829a4aSRandall Stewart 								    &tp1->sent_rcv_time);
4287f8829a4aSRandall Stewart 								tp1->do_rtt = 0;
4288f8829a4aSRandall Stewart 							}
4289f8829a4aSRandall Stewart 						}
4290132dea7dSRandall Stewart 						/*
42915e54f665SRandall Stewart 						 * CMT: CUCv2 algorithm.
42925e54f665SRandall Stewart 						 * From the cumack'd TSNs,
42935e54f665SRandall Stewart 						 * for each TSN being acked
42945e54f665SRandall Stewart 						 * for the first time, set
42955e54f665SRandall Stewart 						 * the following variables
42965e54f665SRandall Stewart 						 * for the corresp
42975e54f665SRandall Stewart 						 * destination.
42985e54f665SRandall Stewart 						 * new_pseudo_cumack will
42995e54f665SRandall Stewart 						 * trigger a cwnd update.
43005e54f665SRandall Stewart 						 * find_(rtx_)pseudo_cumack
43015e54f665SRandall Stewart 						 * will trigger search for
43025e54f665SRandall Stewart 						 * the next expected
43035e54f665SRandall Stewart 						 * (rtx-)pseudo-cumack.
4304132dea7dSRandall Stewart 						 */
4305132dea7dSRandall Stewart 						tp1->whoTo->new_pseudo_cumack = 1;
4306132dea7dSRandall Stewart 						tp1->whoTo->find_pseudo_cumack = 1;
4307132dea7dSRandall Stewart 						tp1->whoTo->find_rtx_pseudo_cumack = 1;
4308132dea7dSRandall Stewart 
4309f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
4310f8829a4aSRandall Stewart 						sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
4311f8829a4aSRandall Stewart #endif
4312f8829a4aSRandall Stewart 					}
4313f8829a4aSRandall Stewart 					if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4314f8829a4aSRandall Stewart 						sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4315f8829a4aSRandall Stewart 					}
431642551e99SRandall Stewart 					if (tp1->rec.data.chunk_was_revoked) {
431742551e99SRandall Stewart 						/* deflate the cwnd */
431842551e99SRandall Stewart 						tp1->whoTo->cwnd -= tp1->book_size;
431942551e99SRandall Stewart 						tp1->rec.data.chunk_was_revoked = 0;
432042551e99SRandall Stewart 					}
4321f8829a4aSRandall Stewart 					tp1->sent = SCTP_DATAGRAM_ACKED;
4322f8829a4aSRandall Stewart 				}
4323f8829a4aSRandall Stewart 			} else {
4324f8829a4aSRandall Stewart 				break;
4325f8829a4aSRandall Stewart 			}
4326f8829a4aSRandall Stewart 			TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4327f8829a4aSRandall Stewart 			if (tp1->data) {
4328f8829a4aSRandall Stewart 				sctp_free_bufspace(stcb, asoc, tp1, 1);
4329f8829a4aSRandall Stewart 				sctp_m_freem(tp1->data);
4330f8829a4aSRandall Stewart 			}
4331f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
4332f8829a4aSRandall Stewart 			sctp_log_sack(asoc->last_acked_seq,
4333f8829a4aSRandall Stewart 			    cumack,
4334f8829a4aSRandall Stewart 			    tp1->rec.data.TSN_seq,
4335f8829a4aSRandall Stewart 			    0,
4336f8829a4aSRandall Stewart 			    0,
4337f8829a4aSRandall Stewart 			    SCTP_LOG_FREE_SENT);
4338f8829a4aSRandall Stewart #endif
4339f8829a4aSRandall Stewart 			tp1->data = NULL;
4340f8829a4aSRandall Stewart 			asoc->sent_queue_cnt--;
4341f8829a4aSRandall Stewart 			sctp_free_remote_addr(tp1->whoTo);
4342f8829a4aSRandall Stewart 			sctp_free_a_chunk(stcb, tp1);
4343f8829a4aSRandall Stewart 			tp1 = tp2;
4344f8829a4aSRandall Stewart 		}
43455e54f665SRandall Stewart 	}
4346f8829a4aSRandall Stewart 	if (stcb->sctp_socket) {
4347f8829a4aSRandall Stewart 		SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4348f8829a4aSRandall Stewart #ifdef SCTP_WAKE_LOGGING
4349f8829a4aSRandall Stewart 		sctp_wakeup_log(stcb, cumack, 1, SCTP_WAKESND_FROM_SACK);
4350f8829a4aSRandall Stewart #endif
4351f8829a4aSRandall Stewart 		sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4352f8829a4aSRandall Stewart #ifdef SCTP_WAKE_LOGGING
4353f8829a4aSRandall Stewart 	} else {
4354f8829a4aSRandall Stewart 		sctp_wakeup_log(stcb, cumack, 1, SCTP_NOWAKE_FROM_SACK);
4355f8829a4aSRandall Stewart #endif
4356f8829a4aSRandall Stewart 	}
4357f8829a4aSRandall Stewart 
43585e54f665SRandall Stewart 
4359f8829a4aSRandall Stewart 	if (asoc->last_acked_seq != cumack)
4360f8829a4aSRandall Stewart 		sctp_cwnd_update(stcb, asoc, 1, 0, 0);
43615e54f665SRandall Stewart 
4362f8829a4aSRandall Stewart 	asoc->last_acked_seq = cumack;
43635e54f665SRandall Stewart 
4364f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
4365f8829a4aSRandall Stewart 		/* nothing left in-flight */
4366f8829a4aSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4367f8829a4aSRandall Stewart 			net->flight_size = 0;
4368f8829a4aSRandall Stewart 			net->partial_bytes_acked = 0;
4369f8829a4aSRandall Stewart 		}
4370f8829a4aSRandall Stewart 		asoc->total_flight = 0;
4371f8829a4aSRandall Stewart 		asoc->total_flight_count = 0;
4372f8829a4aSRandall Stewart 	}
4373f8829a4aSRandall Stewart 	/* Fix up the a-p-a-p for future PR-SCTP sends */
4374f8829a4aSRandall Stewart 	if (compare_with_wrap(cumack, asoc->advanced_peer_ack_point, MAX_TSN)) {
4375f8829a4aSRandall Stewart 		asoc->advanced_peer_ack_point = cumack;
4376f8829a4aSRandall Stewart 	}
4377f8829a4aSRandall Stewart 	/* ECN Nonce updates */
4378f8829a4aSRandall Stewart 	if (asoc->ecn_nonce_allowed) {
4379f8829a4aSRandall Stewart 		if (asoc->nonce_sum_check) {
4380f8829a4aSRandall Stewart 			if (nonce_sum_flag != ((asoc->nonce_sum_expect_base) & SCTP_SACK_NONCE_SUM)) {
4381f8829a4aSRandall Stewart 				if (asoc->nonce_wait_for_ecne == 0) {
4382f8829a4aSRandall Stewart 					struct sctp_tmit_chunk *lchk;
4383f8829a4aSRandall Stewart 
4384f8829a4aSRandall Stewart 					lchk = TAILQ_FIRST(&asoc->send_queue);
4385f8829a4aSRandall Stewart 					asoc->nonce_wait_for_ecne = 1;
4386f8829a4aSRandall Stewart 					if (lchk) {
4387f8829a4aSRandall Stewart 						asoc->nonce_wait_tsn = lchk->rec.data.TSN_seq;
4388f8829a4aSRandall Stewart 					} else {
4389f8829a4aSRandall Stewart 						asoc->nonce_wait_tsn = asoc->sending_seq;
4390f8829a4aSRandall Stewart 					}
4391f8829a4aSRandall Stewart 				} else {
4392f8829a4aSRandall Stewart 					if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_wait_tsn, MAX_TSN) ||
4393f8829a4aSRandall Stewart 					    (asoc->last_acked_seq == asoc->nonce_wait_tsn)) {
4394f8829a4aSRandall Stewart 						/*
4395f8829a4aSRandall Stewart 						 * Misbehaving peer. We need
4396f8829a4aSRandall Stewart 						 * to react to this guy
4397f8829a4aSRandall Stewart 						 */
4398f8829a4aSRandall Stewart 						asoc->ecn_allowed = 0;
4399f8829a4aSRandall Stewart 						asoc->ecn_nonce_allowed = 0;
4400f8829a4aSRandall Stewart 					}
4401f8829a4aSRandall Stewart 				}
4402f8829a4aSRandall Stewart 			}
4403f8829a4aSRandall Stewart 		} else {
4404f8829a4aSRandall Stewart 			/* See if Resynchronization Possible */
4405f8829a4aSRandall Stewart 			if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_resync_tsn, MAX_TSN)) {
4406f8829a4aSRandall Stewart 				asoc->nonce_sum_check = 1;
4407f8829a4aSRandall Stewart 				/*
4408f8829a4aSRandall Stewart 				 * now we must calculate what the base is.
4409f8829a4aSRandall Stewart 				 * We do this based on two things, we know
4410f8829a4aSRandall Stewart 				 * the total's for all the segments
4411f8829a4aSRandall Stewart 				 * gap-acked in the SACK (none), We also
4412f8829a4aSRandall Stewart 				 * know the SACK's nonce sum, its in
4413f8829a4aSRandall Stewart 				 * nonce_sum_flag. So we can build a truth
4414f8829a4aSRandall Stewart 				 * table to back-calculate the new value of
4415f8829a4aSRandall Stewart 				 * asoc->nonce_sum_expect_base:
4416f8829a4aSRandall Stewart 				 *
4417f8829a4aSRandall Stewart 				 * SACK-flag-Value         Seg-Sums Base 0 0 0
4418f8829a4aSRandall Stewart 				 * 1                    0 1 0 1 1 1
4419f8829a4aSRandall Stewart 				 * 1 0
4420f8829a4aSRandall Stewart 				 */
4421f8829a4aSRandall Stewart 				asoc->nonce_sum_expect_base = (0 ^ nonce_sum_flag) & SCTP_SACK_NONCE_SUM;
4422f8829a4aSRandall Stewart 			}
4423f8829a4aSRandall Stewart 		}
4424f8829a4aSRandall Stewart 	}
4425f8829a4aSRandall Stewart 	/* RWND update */
4426f8829a4aSRandall Stewart 	asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
4427f8829a4aSRandall Stewart 	    (uint32_t) (asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh)));
4428f8829a4aSRandall Stewart 	if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4429f8829a4aSRandall Stewart 		/* SWS sender side engages */
4430f8829a4aSRandall Stewart 		asoc->peers_rwnd = 0;
4431f8829a4aSRandall Stewart 	}
44325e54f665SRandall Stewart 	if (asoc->peers_rwnd > old_rwnd) {
44335e54f665SRandall Stewart 		win_probe_recovery = 1;
44345e54f665SRandall Stewart 	}
4435f8829a4aSRandall Stewart 	/* Now assure a timer where data is queued at */
4436a5d547adSRandall Stewart again:
4437a5d547adSRandall Stewart 	j = 0;
4438f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
44395e54f665SRandall Stewart 		if (win_probe_recovery && (net->window_probe)) {
44405e54f665SRandall Stewart 			net->window_probe = 0;
4441c105859eSRandall Stewart 			win_probe_recovered = 1;
44425e54f665SRandall Stewart 			/*
44435e54f665SRandall Stewart 			 * Find first chunk that was used with window probe
44445e54f665SRandall Stewart 			 * and clear the sent
44455e54f665SRandall Stewart 			 */
44465e54f665SRandall Stewart 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
44475e54f665SRandall Stewart 				if (tp1->window_probe) {
44485e54f665SRandall Stewart 					/* move back to data send queue */
4449c105859eSRandall Stewart 					sctp_window_probe_recovery(stcb, asoc, net, tp1);
44505e54f665SRandall Stewart 					break;
44515e54f665SRandall Stewart 				}
44525e54f665SRandall Stewart 			}
44535e54f665SRandall Stewart 		}
4454f8829a4aSRandall Stewart 		if (net->flight_size) {
4455f8829a4aSRandall Stewart 			int to_ticks;
4456f8829a4aSRandall Stewart 
4457f8829a4aSRandall Stewart 			if (net->RTO == 0) {
4458f8829a4aSRandall Stewart 				to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
4459f8829a4aSRandall Stewart 			} else {
4460f8829a4aSRandall Stewart 				to_ticks = MSEC_TO_TICKS(net->RTO);
4461f8829a4aSRandall Stewart 			}
4462a5d547adSRandall Stewart 			j++;
4463ad81507eSRandall Stewart 			(void)SCTP_OS_TIMER_START(&net->rxt_timer.timer, to_ticks,
4464f8829a4aSRandall Stewart 			    sctp_timeout_handler, &net->rxt_timer);
4465f8829a4aSRandall Stewart 		} else {
4466139bc87fSRandall Stewart 			if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4467f8829a4aSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4468a5d547adSRandall Stewart 				    stcb, net,
4469a5d547adSRandall Stewart 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_22);
4470f8829a4aSRandall Stewart 			}
4471f8829a4aSRandall Stewart 			if (sctp_early_fr) {
4472139bc87fSRandall Stewart 				if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
4473f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_earlyfrstpidsck4);
4474a5d547adSRandall Stewart 					sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
4475a5d547adSRandall Stewart 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_23);
4476f8829a4aSRandall Stewart 				}
4477f8829a4aSRandall Stewart 			}
4478f8829a4aSRandall Stewart 		}
4479f8829a4aSRandall Stewart 	}
4480bff64a4dSRandall Stewart 	if ((j == 0) &&
4481bff64a4dSRandall Stewart 	    (!TAILQ_EMPTY(&asoc->sent_queue)) &&
4482bff64a4dSRandall Stewart 	    (asoc->sent_queue_retran_cnt == 0) &&
4483c105859eSRandall Stewart 	    (win_probe_recovered == 0) &&
4484bff64a4dSRandall Stewart 	    (done_once == 0)) {
4485a5d547adSRandall Stewart 		/* huh, this should not happen */
4486c105859eSRandall Stewart 		sctp_fs_audit(asoc);
4487a5d547adSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4488a5d547adSRandall Stewart 			net->flight_size = 0;
4489a5d547adSRandall Stewart 		}
4490a5d547adSRandall Stewart 		asoc->total_flight = 0;
4491a5d547adSRandall Stewart 		asoc->total_flight_count = 0;
4492a5d547adSRandall Stewart 		asoc->sent_queue_retran_cnt = 0;
4493a5d547adSRandall Stewart 		TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4494a5d547adSRandall Stewart 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4495c105859eSRandall Stewart 				sctp_flight_size_increase(tp1);
4496c105859eSRandall Stewart 				sctp_total_flight_increase(stcb, tp1);
4497a5d547adSRandall Stewart 			} else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4498a5d547adSRandall Stewart 				asoc->sent_queue_retran_cnt++;
4499a5d547adSRandall Stewart 			}
4500a5d547adSRandall Stewart 		}
4501bff64a4dSRandall Stewart 		done_once = 1;
4502a5d547adSRandall Stewart 		goto again;
4503a5d547adSRandall Stewart 	}
4504f8829a4aSRandall Stewart 	/**********************************/
4505f8829a4aSRandall Stewart 	/* Now what about shutdown issues */
4506f8829a4aSRandall Stewart 	/**********************************/
4507f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4508f8829a4aSRandall Stewart 		/* nothing left on sendqueue.. consider done */
4509f8829a4aSRandall Stewart 		/* clean up */
4510f8829a4aSRandall Stewart 		if ((asoc->stream_queue_cnt == 1) &&
4511f8829a4aSRandall Stewart 		    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4512f8829a4aSRandall Stewart 		    (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4513f8829a4aSRandall Stewart 		    (asoc->locked_on_sending)
4514f8829a4aSRandall Stewart 		    ) {
4515f8829a4aSRandall Stewart 			struct sctp_stream_queue_pending *sp;
4516f8829a4aSRandall Stewart 
4517f8829a4aSRandall Stewart 			/*
4518f8829a4aSRandall Stewart 			 * I may be in a state where we got all across.. but
4519f8829a4aSRandall Stewart 			 * cannot write more due to a shutdown... we abort
4520f8829a4aSRandall Stewart 			 * since the user did not indicate EOR in this case.
4521f8829a4aSRandall Stewart 			 * The sp will be cleaned during free of the asoc.
4522f8829a4aSRandall Stewart 			 */
4523f8829a4aSRandall Stewart 			sp = TAILQ_LAST(&((asoc->locked_on_sending)->outqueue),
4524f8829a4aSRandall Stewart 			    sctp_streamhead);
4525f8829a4aSRandall Stewart 			if ((sp) && (sp->length == 0) && (sp->msg_is_complete == 0)) {
4526f8829a4aSRandall Stewart 				asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
4527f8829a4aSRandall Stewart 				asoc->locked_on_sending = NULL;
4528f8829a4aSRandall Stewart 				asoc->stream_queue_cnt--;
4529f8829a4aSRandall Stewart 			}
4530f8829a4aSRandall Stewart 		}
4531f8829a4aSRandall Stewart 		if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
4532f8829a4aSRandall Stewart 		    (asoc->stream_queue_cnt == 0)) {
4533f8829a4aSRandall Stewart 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4534f8829a4aSRandall Stewart 				/* Need to abort here */
4535f8829a4aSRandall Stewart 				struct mbuf *oper;
4536f8829a4aSRandall Stewart 
4537f8829a4aSRandall Stewart 		abort_out_now:
4538f8829a4aSRandall Stewart 				*abort_now = 1;
4539f8829a4aSRandall Stewart 				/* XXX */
4540f8829a4aSRandall Stewart 				oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
4541f8829a4aSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
4542f8829a4aSRandall Stewart 				if (oper) {
4543f8829a4aSRandall Stewart 					struct sctp_paramhdr *ph;
4544f8829a4aSRandall Stewart 					uint32_t *ippp;
4545f8829a4aSRandall Stewart 
4546139bc87fSRandall Stewart 					SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
4547f8829a4aSRandall Stewart 					    sizeof(uint32_t);
4548f8829a4aSRandall Stewart 					ph = mtod(oper, struct sctp_paramhdr *);
4549f8829a4aSRandall Stewart 					ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
4550139bc87fSRandall Stewart 					ph->param_length = htons(SCTP_BUF_LEN(oper));
4551f8829a4aSRandall Stewart 					ippp = (uint32_t *) (ph + 1);
4552a5d547adSRandall Stewart 					*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_24);
4553f8829a4aSRandall Stewart 				}
4554a5d547adSRandall Stewart 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_24;
4555f8829a4aSRandall Stewart 				sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, oper);
4556f8829a4aSRandall Stewart 			} else {
4557f42a358aSRandall Stewart 				if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
4558f42a358aSRandall Stewart 				    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4559f8829a4aSRandall Stewart 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4560f42a358aSRandall Stewart 				}
4561f42a358aSRandall Stewart 				asoc->state = SCTP_STATE_SHUTDOWN_SENT;
4562f8829a4aSRandall Stewart 				sctp_stop_timers_for_shutdown(stcb);
4563f8829a4aSRandall Stewart 				sctp_send_shutdown(stcb,
4564f8829a4aSRandall Stewart 				    stcb->asoc.primary_destination);
4565f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4566f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, asoc->primary_destination);
4567f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4568f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, asoc->primary_destination);
4569f8829a4aSRandall Stewart 			}
4570f8829a4aSRandall Stewart 		} else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
4571f8829a4aSRandall Stewart 		    (asoc->stream_queue_cnt == 0)) {
4572f8829a4aSRandall Stewart 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4573f8829a4aSRandall Stewart 				goto abort_out_now;
4574f8829a4aSRandall Stewart 			}
4575f8829a4aSRandall Stewart 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4576f42a358aSRandall Stewart 			asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
4577f8829a4aSRandall Stewart 			sctp_send_shutdown_ack(stcb,
4578f8829a4aSRandall Stewart 			    stcb->asoc.primary_destination);
4579f8829a4aSRandall Stewart 
4580f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4581f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb, asoc->primary_destination);
4582f8829a4aSRandall Stewart 		}
4583f8829a4aSRandall Stewart 	}
4584f8829a4aSRandall Stewart #ifdef SCTP_SACK_RWND_LOGGING
4585f8829a4aSRandall Stewart 	sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
4586f8829a4aSRandall Stewart 	    rwnd,
4587f8829a4aSRandall Stewart 	    stcb->asoc.peers_rwnd,
4588f8829a4aSRandall Stewart 	    stcb->asoc.total_flight,
4589f8829a4aSRandall Stewart 	    stcb->asoc.total_output_queue_size);
4590f8829a4aSRandall Stewart 
4591f8829a4aSRandall Stewart #endif
4592f8829a4aSRandall Stewart }
4593f8829a4aSRandall Stewart 
4594f8829a4aSRandall Stewart 
4595f8829a4aSRandall Stewart 
4596f8829a4aSRandall Stewart void
4597f8829a4aSRandall Stewart sctp_handle_sack(struct sctp_sack_chunk *ch, struct sctp_tcb *stcb,
4598d06c82f1SRandall Stewart     struct sctp_nets *net_from, int *abort_now, int sack_len, uint32_t rwnd)
4599f8829a4aSRandall Stewart {
4600f8829a4aSRandall Stewart 	struct sctp_association *asoc;
4601f8829a4aSRandall Stewart 	struct sctp_sack *sack;
4602f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *tp1, *tp2;
4603f8829a4aSRandall Stewart 	uint32_t cum_ack, last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked,
4604f8829a4aSRandall Stewart 	         this_sack_lowest_newack;
4605bff64a4dSRandall Stewart 	uint32_t sav_cum_ack;
4606f8829a4aSRandall Stewart 	uint16_t num_seg, num_dup;
4607f8829a4aSRandall Stewart 	uint16_t wake_him = 0;
4608f8829a4aSRandall Stewart 	unsigned int sack_length;
4609c105859eSRandall Stewart 	uint32_t send_s = 0;
4610f8829a4aSRandall Stewart 	long j;
4611f8829a4aSRandall Stewart 	int accum_moved = 0;
4612f8829a4aSRandall Stewart 	int will_exit_fast_recovery = 0;
46135e54f665SRandall Stewart 	uint32_t a_rwnd, old_rwnd;
46145e54f665SRandall Stewart 	int win_probe_recovery = 0;
4615c105859eSRandall Stewart 	int win_probe_recovered = 0;
4616f8829a4aSRandall Stewart 	struct sctp_nets *net = NULL;
4617f8829a4aSRandall Stewart 	int nonce_sum_flag, ecn_seg_sums = 0;
4618bff64a4dSRandall Stewart 	int done_once;
4619f8829a4aSRandall Stewart 	uint8_t reneged_all = 0;
4620f8829a4aSRandall Stewart 	uint8_t cmt_dac_flag;
4621f8829a4aSRandall Stewart 
4622f8829a4aSRandall Stewart 	/*
4623f8829a4aSRandall Stewart 	 * we take any chance we can to service our queues since we cannot
4624f8829a4aSRandall Stewart 	 * get awoken when the socket is read from :<
4625f8829a4aSRandall Stewart 	 */
4626f8829a4aSRandall Stewart 	/*
4627f8829a4aSRandall Stewart 	 * Now perform the actual SACK handling: 1) Verify that it is not an
4628f8829a4aSRandall Stewart 	 * old sack, if so discard. 2) If there is nothing left in the send
4629f8829a4aSRandall Stewart 	 * queue (cum-ack is equal to last acked) then you have a duplicate
4630f8829a4aSRandall Stewart 	 * too, update any rwnd change and verify no timers are running.
4631f8829a4aSRandall Stewart 	 * then return. 3) Process any new consequtive data i.e. cum-ack
4632f8829a4aSRandall Stewart 	 * moved process these first and note that it moved. 4) Process any
4633f8829a4aSRandall Stewart 	 * sack blocks. 5) Drop any acked from the queue. 6) Check for any
4634f8829a4aSRandall Stewart 	 * revoked blocks and mark. 7) Update the cwnd. 8) Nothing left,
4635f8829a4aSRandall Stewart 	 * sync up flightsizes and things, stop all timers and also check
4636f8829a4aSRandall Stewart 	 * for shutdown_pending state. If so then go ahead and send off the
4637f8829a4aSRandall Stewart 	 * shutdown. If in shutdown recv, send off the shutdown-ack and
4638f8829a4aSRandall Stewart 	 * start that timer, Ret. 9) Strike any non-acked things and do FR
4639f8829a4aSRandall Stewart 	 * procedure if needed being sure to set the FR flag. 10) Do pr-sctp
4640f8829a4aSRandall Stewart 	 * procedures. 11) Apply any FR penalties. 12) Assure we will SACK
4641f8829a4aSRandall Stewart 	 * if in shutdown_recv state.
4642f8829a4aSRandall Stewart 	 */
4643f8829a4aSRandall Stewart 	SCTP_TCB_LOCK_ASSERT(stcb);
4644f8829a4aSRandall Stewart 	sack = &ch->sack;
4645f8829a4aSRandall Stewart 	/* CMT DAC algo */
4646f8829a4aSRandall Stewart 	this_sack_lowest_newack = 0;
4647f8829a4aSRandall Stewart 	j = 0;
4648d06c82f1SRandall Stewart 	sack_length = (unsigned int)sack_len;
4649f8829a4aSRandall Stewart 	/* ECN Nonce */
4650f8829a4aSRandall Stewart 	SCTP_STAT_INCR(sctps_slowpath_sack);
4651f8829a4aSRandall Stewart 	nonce_sum_flag = ch->ch.chunk_flags & SCTP_SACK_NONCE_SUM;
4652f8829a4aSRandall Stewart 	cum_ack = last_tsn = ntohl(sack->cum_tsn_ack);
4653f8829a4aSRandall Stewart 	num_seg = ntohs(sack->num_gap_ack_blks);
4654d06c82f1SRandall Stewart 	a_rwnd = rwnd;
4655f8829a4aSRandall Stewart 
4656d06c82f1SRandall Stewart #ifdef SCTP_LOG_SACK_ARRIVALS
4657d06c82f1SRandall Stewart 	sctp_misc_ints(SCTP_SACK_LOG_NORMAL, cum_ack,
4658d06c82f1SRandall Stewart 	    rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
4659d06c82f1SRandall Stewart #endif
4660f8829a4aSRandall Stewart 	/* CMT DAC algo */
4661f8829a4aSRandall Stewart 	cmt_dac_flag = ch->ch.chunk_flags & SCTP_SACK_CMT_DAC;
4662f8829a4aSRandall Stewart 	num_dup = ntohs(sack->num_dup_tsns);
4663f8829a4aSRandall Stewart 
46645e54f665SRandall Stewart 	old_rwnd = stcb->asoc.peers_rwnd;
4665f8829a4aSRandall Stewart 	stcb->asoc.overall_error_count = 0;
4666f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
4667f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
4668f8829a4aSRandall Stewart 	sctp_log_sack(asoc->last_acked_seq,
4669f8829a4aSRandall Stewart 	    cum_ack,
4670f8829a4aSRandall Stewart 	    0,
4671f8829a4aSRandall Stewart 	    num_seg,
4672f8829a4aSRandall Stewart 	    num_dup,
4673f8829a4aSRandall Stewart 	    SCTP_LOG_NEW_SACK);
4674f8829a4aSRandall Stewart #endif
4675f8829a4aSRandall Stewart #if defined(SCTP_FR_LOGGING) || defined(SCTP_EARLYFR_LOGGING)
4676f8829a4aSRandall Stewart 	if (num_dup) {
4677f8829a4aSRandall Stewart 		int off_to_dup, iii;
4678f8829a4aSRandall Stewart 		uint32_t *dupdata;
4679f8829a4aSRandall Stewart 
4680f8829a4aSRandall Stewart 		off_to_dup = (num_seg * sizeof(struct sctp_gap_ack_block)) + sizeof(struct sctp_sack_chunk);
4681f8829a4aSRandall Stewart 		if ((off_to_dup + (num_dup * sizeof(uint32_t))) <= sack_length) {
4682f8829a4aSRandall Stewart 			dupdata = (uint32_t *) ((caddr_t)ch + off_to_dup);
4683f8829a4aSRandall Stewart 			for (iii = 0; iii < num_dup; iii++) {
4684f8829a4aSRandall Stewart 				sctp_log_fr(*dupdata, 0, 0, SCTP_FR_DUPED);
4685f8829a4aSRandall Stewart 				dupdata++;
4686f8829a4aSRandall Stewart 
4687f8829a4aSRandall Stewart 			}
4688f8829a4aSRandall Stewart 		} else {
4689ad81507eSRandall Stewart 			SCTP_PRINTF("Size invalid offset to dups:%d number dups:%d sack_len:%d num gaps:%d\n",
4690f8829a4aSRandall Stewart 			    off_to_dup, num_dup, sack_length, num_seg);
4691f8829a4aSRandall Stewart 		}
4692f8829a4aSRandall Stewart 	}
4693f8829a4aSRandall Stewart #endif
4694f8829a4aSRandall Stewart 	if (sctp_strict_sacks) {
4695c105859eSRandall Stewart 		/* reality check */
4696c105859eSRandall Stewart 		if (!TAILQ_EMPTY(&asoc->sent_queue)) {
4697c105859eSRandall Stewart 			tp1 = TAILQ_LAST(&asoc->sent_queue,
4698c105859eSRandall Stewart 			    sctpchunk_listhead);
4699c105859eSRandall Stewart 			send_s = tp1->rec.data.TSN_seq + 1;
4700c105859eSRandall Stewart 		} else {
4701c105859eSRandall Stewart 			send_s = asoc->sending_seq;
4702c105859eSRandall Stewart 		}
4703f8829a4aSRandall Stewart 		if (cum_ack == send_s ||
4704f8829a4aSRandall Stewart 		    compare_with_wrap(cum_ack, send_s, MAX_TSN)) {
4705c105859eSRandall Stewart #ifndef INVARIANTS
4706c105859eSRandall Stewart 			struct mbuf *oper;
4707c105859eSRandall Stewart 
4708c105859eSRandall Stewart #endif
4709c105859eSRandall Stewart #ifdef INVARIANTS
4710139bc87fSRandall Stewart 	hopeless_peer:
4711139bc87fSRandall Stewart 			panic("Impossible sack 1");
4712139bc87fSRandall Stewart #else
4713c105859eSRandall Stewart 
4714f8829a4aSRandall Stewart 
4715f8829a4aSRandall Stewart 			/*
4716f8829a4aSRandall Stewart 			 * no way, we have not even sent this TSN out yet.
4717f8829a4aSRandall Stewart 			 * Peer is hopelessly messed up with us.
4718f8829a4aSRandall Stewart 			 */
4719f8829a4aSRandall Stewart 	hopeless_peer:
4720f8829a4aSRandall Stewart 			*abort_now = 1;
4721f8829a4aSRandall Stewart 			/* XXX */
4722f8829a4aSRandall Stewart 			oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
4723f8829a4aSRandall Stewart 			    0, M_DONTWAIT, 1, MT_DATA);
4724f8829a4aSRandall Stewart 			if (oper) {
4725f8829a4aSRandall Stewart 				struct sctp_paramhdr *ph;
4726f8829a4aSRandall Stewart 				uint32_t *ippp;
4727f8829a4aSRandall Stewart 
4728139bc87fSRandall Stewart 				SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
4729f8829a4aSRandall Stewart 				    sizeof(uint32_t);
4730f8829a4aSRandall Stewart 				ph = mtod(oper, struct sctp_paramhdr *);
4731f8829a4aSRandall Stewart 				ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
4732139bc87fSRandall Stewart 				ph->param_length = htons(SCTP_BUF_LEN(oper));
4733f8829a4aSRandall Stewart 				ippp = (uint32_t *) (ph + 1);
4734a5d547adSRandall Stewart 				*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_25);
4735f8829a4aSRandall Stewart 			}
4736a5d547adSRandall Stewart 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_25;
4737f8829a4aSRandall Stewart 			sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper);
4738f8829a4aSRandall Stewart 			return;
4739139bc87fSRandall Stewart #endif
4740f8829a4aSRandall Stewart 		}
4741f8829a4aSRandall Stewart 	}
4742f8829a4aSRandall Stewart 	/**********************/
4743f8829a4aSRandall Stewart 	/* 1) check the range */
4744f8829a4aSRandall Stewart 	/**********************/
4745f8829a4aSRandall Stewart 	if (compare_with_wrap(asoc->last_acked_seq, last_tsn, MAX_TSN)) {
4746f8829a4aSRandall Stewart 		/* acking something behind */
4747f8829a4aSRandall Stewart 		return;
4748f8829a4aSRandall Stewart 	}
4749bff64a4dSRandall Stewart 	sav_cum_ack = asoc->last_acked_seq;
4750bff64a4dSRandall Stewart 
4751f8829a4aSRandall Stewart 	/* update the Rwnd of the peer */
4752f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&asoc->sent_queue) &&
4753f8829a4aSRandall Stewart 	    TAILQ_EMPTY(&asoc->send_queue) &&
4754f8829a4aSRandall Stewart 	    (asoc->stream_queue_cnt == 0)
4755f8829a4aSRandall Stewart 	    ) {
4756f8829a4aSRandall Stewart 		/* nothing left on send/sent and strmq */
4757f8829a4aSRandall Stewart #ifdef SCTP_LOG_RWND
4758f8829a4aSRandall Stewart 		sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4759f8829a4aSRandall Stewart 		    asoc->peers_rwnd, 0, 0, a_rwnd);
4760f8829a4aSRandall Stewart #endif
4761f8829a4aSRandall Stewart 		asoc->peers_rwnd = a_rwnd;
4762f8829a4aSRandall Stewart 		if (asoc->sent_queue_retran_cnt) {
4763f8829a4aSRandall Stewart 			asoc->sent_queue_retran_cnt = 0;
4764f8829a4aSRandall Stewart 		}
4765f8829a4aSRandall Stewart 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4766f8829a4aSRandall Stewart 			/* SWS sender side engages */
4767f8829a4aSRandall Stewart 			asoc->peers_rwnd = 0;
4768f8829a4aSRandall Stewart 		}
4769f8829a4aSRandall Stewart 		/* stop any timers */
4770f8829a4aSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4771f8829a4aSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4772a5d547adSRandall Stewart 			    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_26);
4773f8829a4aSRandall Stewart 			if (sctp_early_fr) {
4774139bc87fSRandall Stewart 				if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
4775f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_earlyfrstpidsck1);
4776a5d547adSRandall Stewart 					sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
4777a5d547adSRandall Stewart 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_26);
4778f8829a4aSRandall Stewart 				}
4779f8829a4aSRandall Stewart 			}
4780f8829a4aSRandall Stewart 			net->partial_bytes_acked = 0;
4781f8829a4aSRandall Stewart 			net->flight_size = 0;
4782f8829a4aSRandall Stewart 		}
4783f8829a4aSRandall Stewart 		asoc->total_flight = 0;
4784f8829a4aSRandall Stewart 		asoc->total_flight_count = 0;
4785f8829a4aSRandall Stewart 		return;
4786f8829a4aSRandall Stewart 	}
4787f8829a4aSRandall Stewart 	/*
4788f8829a4aSRandall Stewart 	 * We init netAckSz and netAckSz2 to 0. These are used to track 2
4789f8829a4aSRandall Stewart 	 * things. The total byte count acked is tracked in netAckSz AND
4790f8829a4aSRandall Stewart 	 * netAck2 is used to track the total bytes acked that are un-
4791f8829a4aSRandall Stewart 	 * amibguious and were never retransmitted. We track these on a per
4792f8829a4aSRandall Stewart 	 * destination address basis.
4793f8829a4aSRandall Stewart 	 */
4794f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4795f8829a4aSRandall Stewart 		net->prev_cwnd = net->cwnd;
4796f8829a4aSRandall Stewart 		net->net_ack = 0;
4797f8829a4aSRandall Stewart 		net->net_ack2 = 0;
4798f8829a4aSRandall Stewart 
4799f8829a4aSRandall Stewart 		/*
480042551e99SRandall Stewart 		 * CMT: Reset CUC and Fast recovery algo variables before
480142551e99SRandall Stewart 		 * SACK processing
4802f8829a4aSRandall Stewart 		 */
4803f8829a4aSRandall Stewart 		net->new_pseudo_cumack = 0;
4804f8829a4aSRandall Stewart 		net->will_exit_fast_recovery = 0;
4805f8829a4aSRandall Stewart 	}
4806f8829a4aSRandall Stewart 	/* process the new consecutive TSN first */
4807f8829a4aSRandall Stewart 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
4808f8829a4aSRandall Stewart 	while (tp1) {
4809f8829a4aSRandall Stewart 		if (compare_with_wrap(last_tsn, tp1->rec.data.TSN_seq,
4810f8829a4aSRandall Stewart 		    MAX_TSN) ||
4811f8829a4aSRandall Stewart 		    last_tsn == tp1->rec.data.TSN_seq) {
4812f8829a4aSRandall Stewart 			if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4813f8829a4aSRandall Stewart 				/*
4814f8829a4aSRandall Stewart 				 * ECN Nonce: Add the nonce to the sender's
4815f8829a4aSRandall Stewart 				 * nonce sum
4816f8829a4aSRandall Stewart 				 */
4817f8829a4aSRandall Stewart 				asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce;
4818f8829a4aSRandall Stewart 				accum_moved = 1;
4819f8829a4aSRandall Stewart 				if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4820f8829a4aSRandall Stewart 					/*
4821f8829a4aSRandall Stewart 					 * If it is less than ACKED, it is
4822f8829a4aSRandall Stewart 					 * now no-longer in flight. Higher
4823f8829a4aSRandall Stewart 					 * values may occur during marking
4824f8829a4aSRandall Stewart 					 */
4825f8829a4aSRandall Stewart 					if ((tp1->whoTo->dest_state &
4826f8829a4aSRandall Stewart 					    SCTP_ADDR_UNCONFIRMED) &&
4827f8829a4aSRandall Stewart 					    (tp1->snd_count < 2)) {
4828f8829a4aSRandall Stewart 						/*
4829f8829a4aSRandall Stewart 						 * If there was no retran
4830f8829a4aSRandall Stewart 						 * and the address is
4831f8829a4aSRandall Stewart 						 * un-confirmed and we sent
4832f8829a4aSRandall Stewart 						 * there and are now
4833f8829a4aSRandall Stewart 						 * sacked.. its confirmed,
4834f8829a4aSRandall Stewart 						 * mark it so.
4835f8829a4aSRandall Stewart 						 */
4836f8829a4aSRandall Stewart 						tp1->whoTo->dest_state &=
4837f8829a4aSRandall Stewart 						    ~SCTP_ADDR_UNCONFIRMED;
4838f8829a4aSRandall Stewart 					}
4839c105859eSRandall Stewart 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4840a5d547adSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
4841c105859eSRandall Stewart 						sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4842a5d547adSRandall Stewart 						    tp1->whoTo->flight_size,
4843a5d547adSRandall Stewart 						    tp1->book_size,
4844c105859eSRandall Stewart 						    (uintptr_t) tp1->whoTo,
4845a5d547adSRandall Stewart 						    tp1->rec.data.TSN_seq);
4846a5d547adSRandall Stewart #endif
4847c105859eSRandall Stewart 						sctp_flight_size_decrease(tp1);
4848c105859eSRandall Stewart 						sctp_total_flight_decrease(stcb, tp1);
4849f8829a4aSRandall Stewart 					}
4850f8829a4aSRandall Stewart 					tp1->whoTo->net_ack += tp1->send_size;
4851f8829a4aSRandall Stewart 
4852f8829a4aSRandall Stewart 					/* CMT SFR and DAC algos */
4853f8829a4aSRandall Stewart 					this_sack_lowest_newack = tp1->rec.data.TSN_seq;
4854f8829a4aSRandall Stewart 					tp1->whoTo->saw_newack = 1;
4855f8829a4aSRandall Stewart 
4856f8829a4aSRandall Stewart 					if (tp1->snd_count < 2) {
4857f8829a4aSRandall Stewart 						/*
4858f8829a4aSRandall Stewart 						 * True non-retransmited
4859f8829a4aSRandall Stewart 						 * chunk
4860f8829a4aSRandall Stewart 						 */
4861f8829a4aSRandall Stewart 						tp1->whoTo->net_ack2 +=
4862f8829a4aSRandall Stewart 						    tp1->send_size;
4863f8829a4aSRandall Stewart 
4864f8829a4aSRandall Stewart 						/* update RTO too? */
4865f8829a4aSRandall Stewart 						if (tp1->do_rtt) {
4866f8829a4aSRandall Stewart 							tp1->whoTo->RTO =
4867f8829a4aSRandall Stewart 							    sctp_calculate_rto(stcb,
4868f8829a4aSRandall Stewart 							    asoc, tp1->whoTo,
4869f8829a4aSRandall Stewart 							    &tp1->sent_rcv_time);
4870f8829a4aSRandall Stewart 							tp1->do_rtt = 0;
4871f8829a4aSRandall Stewart 						}
4872f8829a4aSRandall Stewart 					}
4873f8829a4aSRandall Stewart 					/*
4874f8829a4aSRandall Stewart 					 * CMT: CUCv2 algorithm. From the
4875f8829a4aSRandall Stewart 					 * cumack'd TSNs, for each TSN being
4876f8829a4aSRandall Stewart 					 * acked for the first time, set the
4877f8829a4aSRandall Stewart 					 * following variables for the
4878f8829a4aSRandall Stewart 					 * corresp destination.
4879f8829a4aSRandall Stewart 					 * new_pseudo_cumack will trigger a
4880f8829a4aSRandall Stewart 					 * cwnd update.
4881f8829a4aSRandall Stewart 					 * find_(rtx_)pseudo_cumack will
4882f8829a4aSRandall Stewart 					 * trigger search for the next
4883f8829a4aSRandall Stewart 					 * expected (rtx-)pseudo-cumack.
4884f8829a4aSRandall Stewart 					 */
4885f8829a4aSRandall Stewart 					tp1->whoTo->new_pseudo_cumack = 1;
4886f8829a4aSRandall Stewart 					tp1->whoTo->find_pseudo_cumack = 1;
4887f8829a4aSRandall Stewart 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
4888f8829a4aSRandall Stewart 
4889f8829a4aSRandall Stewart 
4890f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
4891f8829a4aSRandall Stewart 					sctp_log_sack(asoc->last_acked_seq,
4892f8829a4aSRandall Stewart 					    cum_ack,
4893f8829a4aSRandall Stewart 					    tp1->rec.data.TSN_seq,
4894f8829a4aSRandall Stewart 					    0,
4895f8829a4aSRandall Stewart 					    0,
4896f8829a4aSRandall Stewart 					    SCTP_LOG_TSN_ACKED);
4897f8829a4aSRandall Stewart #endif
4898f8829a4aSRandall Stewart #ifdef SCTP_CWND_LOGGING
4899f8829a4aSRandall Stewart 					sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
4900f8829a4aSRandall Stewart #endif
4901f8829a4aSRandall Stewart 				}
4902f8829a4aSRandall Stewart 				if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4903f8829a4aSRandall Stewart 					sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4904f8829a4aSRandall Stewart #ifdef SCTP_AUDITING_ENABLED
4905f8829a4aSRandall Stewart 					sctp_audit_log(0xB3,
4906f8829a4aSRandall Stewart 					    (asoc->sent_queue_retran_cnt & 0x000000ff));
4907f8829a4aSRandall Stewart #endif
4908f8829a4aSRandall Stewart 				}
490942551e99SRandall Stewart 				if (tp1->rec.data.chunk_was_revoked) {
491042551e99SRandall Stewart 					/* deflate the cwnd */
491142551e99SRandall Stewart 					tp1->whoTo->cwnd -= tp1->book_size;
491242551e99SRandall Stewart 					tp1->rec.data.chunk_was_revoked = 0;
491342551e99SRandall Stewart 				}
4914f8829a4aSRandall Stewart 				tp1->sent = SCTP_DATAGRAM_ACKED;
4915f8829a4aSRandall Stewart 			}
4916f8829a4aSRandall Stewart 		} else {
4917f8829a4aSRandall Stewart 			break;
4918f8829a4aSRandall Stewart 		}
4919f8829a4aSRandall Stewart 		tp1 = TAILQ_NEXT(tp1, sctp_next);
4920f8829a4aSRandall Stewart 	}
4921f8829a4aSRandall Stewart 	biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
4922f8829a4aSRandall Stewart 	/* always set this up to cum-ack */
4923f8829a4aSRandall Stewart 	asoc->this_sack_highest_gap = last_tsn;
4924f8829a4aSRandall Stewart 
4925f8829a4aSRandall Stewart 	if (((num_seg * (sizeof(struct sctp_gap_ack_block))) + sizeof(struct sctp_sack_chunk)) > sack_length) {
4926f8829a4aSRandall Stewart 
4927f8829a4aSRandall Stewart 		/* skip corrupt segments */
4928f8829a4aSRandall Stewart 		goto skip_segments;
4929f8829a4aSRandall Stewart 	}
4930f8829a4aSRandall Stewart 	if (num_seg > 0) {
4931f8829a4aSRandall Stewart 
4932f8829a4aSRandall Stewart 		/*
4933f8829a4aSRandall Stewart 		 * CMT: SFR algo (and HTNA) - this_sack_highest_newack has
4934f8829a4aSRandall Stewart 		 * to be greater than the cumack. Also reset saw_newack to 0
4935f8829a4aSRandall Stewart 		 * for all dests.
4936f8829a4aSRandall Stewart 		 */
4937f8829a4aSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4938f8829a4aSRandall Stewart 			net->saw_newack = 0;
4939f8829a4aSRandall Stewart 			net->this_sack_highest_newack = last_tsn;
4940f8829a4aSRandall Stewart 		}
4941f8829a4aSRandall Stewart 
4942f8829a4aSRandall Stewart 		/*
4943f8829a4aSRandall Stewart 		 * thisSackHighestGap will increase while handling NEW
4944f8829a4aSRandall Stewart 		 * segments this_sack_highest_newack will increase while
4945f8829a4aSRandall Stewart 		 * handling NEWLY ACKED chunks. this_sack_lowest_newack is
4946f8829a4aSRandall Stewart 		 * used for CMT DAC algo. saw_newack will also change.
4947f8829a4aSRandall Stewart 		 */
4948f8829a4aSRandall Stewart 		sctp_handle_segments(stcb, asoc, ch, last_tsn,
4949f8829a4aSRandall Stewart 		    &biggest_tsn_acked, &biggest_tsn_newly_acked, &this_sack_lowest_newack,
4950f8829a4aSRandall Stewart 		    num_seg, &ecn_seg_sums);
4951f8829a4aSRandall Stewart 
4952f8829a4aSRandall Stewart 		if (sctp_strict_sacks) {
4953f8829a4aSRandall Stewart 			/*
4954f8829a4aSRandall Stewart 			 * validate the biggest_tsn_acked in the gap acks if
4955f8829a4aSRandall Stewart 			 * strict adherence is wanted.
4956f8829a4aSRandall Stewart 			 */
4957f8829a4aSRandall Stewart 			if ((biggest_tsn_acked == send_s) ||
4958f8829a4aSRandall Stewart 			    (compare_with_wrap(biggest_tsn_acked, send_s, MAX_TSN))) {
4959f8829a4aSRandall Stewart 				/*
4960f8829a4aSRandall Stewart 				 * peer is either confused or we are under
4961f8829a4aSRandall Stewart 				 * attack. We must abort.
4962f8829a4aSRandall Stewart 				 */
4963f8829a4aSRandall Stewart 				goto hopeless_peer;
4964f8829a4aSRandall Stewart 			}
4965f8829a4aSRandall Stewart 		}
4966f8829a4aSRandall Stewart 	}
4967f8829a4aSRandall Stewart skip_segments:
4968f8829a4aSRandall Stewart 	/*******************************************/
4969f8829a4aSRandall Stewart 	/* cancel ALL T3-send timer if accum moved */
4970f8829a4aSRandall Stewart 	/*******************************************/
4971f8829a4aSRandall Stewart 	if (sctp_cmt_on_off) {
4972f8829a4aSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4973f8829a4aSRandall Stewart 			if (net->new_pseudo_cumack)
4974f8829a4aSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4975a5d547adSRandall Stewart 				    stcb, net,
4976a5d547adSRandall Stewart 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_27);
4977f8829a4aSRandall Stewart 
4978f8829a4aSRandall Stewart 		}
4979f8829a4aSRandall Stewart 	} else {
4980f8829a4aSRandall Stewart 		if (accum_moved) {
4981f8829a4aSRandall Stewart 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4982f8829a4aSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4983a5d547adSRandall Stewart 				    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_28);
4984f8829a4aSRandall Stewart 			}
4985f8829a4aSRandall Stewart 		}
4986f8829a4aSRandall Stewart 	}
4987f8829a4aSRandall Stewart 	/********************************************/
4988f8829a4aSRandall Stewart 	/* drop the acked chunks from the sendqueue */
4989f8829a4aSRandall Stewart 	/********************************************/
4990f8829a4aSRandall Stewart 	asoc->last_acked_seq = cum_ack;
4991f8829a4aSRandall Stewart 
4992f8829a4aSRandall Stewart 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
4993f8829a4aSRandall Stewart 	if (tp1 == NULL)
4994f8829a4aSRandall Stewart 		goto done_with_it;
4995f8829a4aSRandall Stewart 	do {
4996f8829a4aSRandall Stewart 		if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack,
4997f8829a4aSRandall Stewart 		    MAX_TSN)) {
4998f8829a4aSRandall Stewart 			break;
4999f8829a4aSRandall Stewart 		}
5000f8829a4aSRandall Stewart 		if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
5001f8829a4aSRandall Stewart 			/* no more sent on list */
5002f8829a4aSRandall Stewart 			break;
5003f8829a4aSRandall Stewart 		}
5004f8829a4aSRandall Stewart 		tp2 = TAILQ_NEXT(tp1, sctp_next);
5005f8829a4aSRandall Stewart 		TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
5006f8829a4aSRandall Stewart 		/*
5007f8829a4aSRandall Stewart 		 * Friendlier printf in lieu of panic now that I think its
5008f8829a4aSRandall Stewart 		 * fixed
5009f8829a4aSRandall Stewart 		 */
5010f8829a4aSRandall Stewart 
5011f8829a4aSRandall Stewart 		if (tp1->pr_sctp_on) {
5012f8829a4aSRandall Stewart 			if (asoc->pr_sctp_cnt != 0)
5013f8829a4aSRandall Stewart 				asoc->pr_sctp_cnt--;
5014f8829a4aSRandall Stewart 		}
5015f8829a4aSRandall Stewart 		if ((TAILQ_FIRST(&asoc->sent_queue) == NULL) &&
5016f8829a4aSRandall Stewart 		    (asoc->total_flight > 0)) {
5017f1f73e57SRandall Stewart #ifdef INVARIANTS
5018c105859eSRandall Stewart 			panic("Warning flight size is postive and should be 0");
5019f1f73e57SRandall Stewart #else
5020ad81507eSRandall Stewart 			SCTP_PRINTF("Warning flight size incorrect should be 0 is %d\n",
5021f8829a4aSRandall Stewart 			    asoc->total_flight);
5022f1f73e57SRandall Stewart #endif
5023f8829a4aSRandall Stewart 			asoc->total_flight = 0;
5024f8829a4aSRandall Stewart 		}
5025f8829a4aSRandall Stewart 		if (tp1->data) {
5026f8829a4aSRandall Stewart 			sctp_free_bufspace(stcb, asoc, tp1, 1);
5027f8829a4aSRandall Stewart 			sctp_m_freem(tp1->data);
5028f8829a4aSRandall Stewart 			if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
5029f8829a4aSRandall Stewart 				asoc->sent_queue_cnt_removeable--;
5030f8829a4aSRandall Stewart 			}
5031f8829a4aSRandall Stewart 		}
5032f8829a4aSRandall Stewart #ifdef SCTP_SACK_LOGGING
5033f8829a4aSRandall Stewart 		sctp_log_sack(asoc->last_acked_seq,
5034f8829a4aSRandall Stewart 		    cum_ack,
5035f8829a4aSRandall Stewart 		    tp1->rec.data.TSN_seq,
5036f8829a4aSRandall Stewart 		    0,
5037f8829a4aSRandall Stewart 		    0,
5038f8829a4aSRandall Stewart 		    SCTP_LOG_FREE_SENT);
5039f8829a4aSRandall Stewart #endif
5040f8829a4aSRandall Stewart 		tp1->data = NULL;
5041f8829a4aSRandall Stewart 		asoc->sent_queue_cnt--;
5042f8829a4aSRandall Stewart 		sctp_free_remote_addr(tp1->whoTo);
5043f8829a4aSRandall Stewart 
5044f8829a4aSRandall Stewart 		sctp_free_a_chunk(stcb, tp1);
5045f8829a4aSRandall Stewart 		wake_him++;
5046f8829a4aSRandall Stewart 		tp1 = tp2;
5047f8829a4aSRandall Stewart 	} while (tp1 != NULL);
5048f8829a4aSRandall Stewart 
5049f8829a4aSRandall Stewart done_with_it:
5050f8829a4aSRandall Stewart 	if ((wake_him) && (stcb->sctp_socket)) {
5051f8829a4aSRandall Stewart 		SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
5052f8829a4aSRandall Stewart #ifdef SCTP_WAKE_LOGGING
5053f8829a4aSRandall Stewart 		sctp_wakeup_log(stcb, cum_ack, wake_him, SCTP_WAKESND_FROM_SACK);
5054f8829a4aSRandall Stewart #endif
5055f8829a4aSRandall Stewart 		sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
5056f8829a4aSRandall Stewart #ifdef SCTP_WAKE_LOGGING
5057f8829a4aSRandall Stewart 	} else {
5058f8829a4aSRandall Stewart 		sctp_wakeup_log(stcb, cum_ack, wake_him, SCTP_NOWAKE_FROM_SACK);
5059f8829a4aSRandall Stewart #endif
5060f8829a4aSRandall Stewart 	}
5061f8829a4aSRandall Stewart 
506242551e99SRandall Stewart 	if (asoc->fast_retran_loss_recovery && accum_moved) {
5063f8829a4aSRandall Stewart 		if (compare_with_wrap(asoc->last_acked_seq,
5064f8829a4aSRandall Stewart 		    asoc->fast_recovery_tsn, MAX_TSN) ||
5065f8829a4aSRandall Stewart 		    asoc->last_acked_seq == asoc->fast_recovery_tsn) {
5066f8829a4aSRandall Stewart 			/* Setup so we will exit RFC2582 fast recovery */
5067f8829a4aSRandall Stewart 			will_exit_fast_recovery = 1;
5068f8829a4aSRandall Stewart 		}
5069f8829a4aSRandall Stewart 	}
5070f8829a4aSRandall Stewart 	/*
5071f8829a4aSRandall Stewart 	 * Check for revoked fragments:
5072f8829a4aSRandall Stewart 	 *
5073f8829a4aSRandall Stewart 	 * if Previous sack - Had no frags then we can't have any revoked if
5074f8829a4aSRandall Stewart 	 * Previous sack - Had frag's then - If we now have frags aka
5075f8829a4aSRandall Stewart 	 * num_seg > 0 call sctp_check_for_revoked() to tell if peer revoked
5076f8829a4aSRandall Stewart 	 * some of them. else - The peer revoked all ACKED fragments, since
5077f8829a4aSRandall Stewart 	 * we had some before and now we have NONE.
5078f8829a4aSRandall Stewart 	 */
5079f8829a4aSRandall Stewart 
5080f42a358aSRandall Stewart 	if (num_seg)
5081c105859eSRandall Stewart 		sctp_check_for_revoked(stcb, asoc, cum_ack, biggest_tsn_acked);
5082f8829a4aSRandall Stewart 	else if (asoc->saw_sack_with_frags) {
5083f8829a4aSRandall Stewart 		int cnt_revoked = 0;
5084f8829a4aSRandall Stewart 
5085f8829a4aSRandall Stewart 		tp1 = TAILQ_FIRST(&asoc->sent_queue);
5086f8829a4aSRandall Stewart 		if (tp1 != NULL) {
5087f8829a4aSRandall Stewart 			/* Peer revoked all dg's marked or acked */
5088f8829a4aSRandall Stewart 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5089f8829a4aSRandall Stewart 				if ((tp1->sent > SCTP_DATAGRAM_RESEND) &&
5090f8829a4aSRandall Stewart 				    (tp1->sent < SCTP_FORWARD_TSN_SKIP)) {
5091f8829a4aSRandall Stewart 					tp1->sent = SCTP_DATAGRAM_SENT;
5092c105859eSRandall Stewart #ifdef SCTP_FLIGHT_LOGGING
5093c105859eSRandall Stewart 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
5094c105859eSRandall Stewart 					    tp1->whoTo->flight_size,
5095c105859eSRandall Stewart 					    tp1->book_size,
5096c105859eSRandall Stewart 					    (uintptr_t) tp1->whoTo,
5097c105859eSRandall Stewart 					    tp1->rec.data.TSN_seq);
5098c105859eSRandall Stewart #endif
5099c105859eSRandall Stewart 					sctp_flight_size_increase(tp1);
5100c105859eSRandall Stewart 					sctp_total_flight_increase(stcb, tp1);
5101a5d547adSRandall Stewart 					tp1->rec.data.chunk_was_revoked = 1;
510242551e99SRandall Stewart 					/*
510342551e99SRandall Stewart 					 * To ensure that this increase in
510442551e99SRandall Stewart 					 * flightsize, which is artificial,
510542551e99SRandall Stewart 					 * does not throttle the sender, we
510642551e99SRandall Stewart 					 * also increase the cwnd
510742551e99SRandall Stewart 					 * artificially.
510842551e99SRandall Stewart 					 */
510942551e99SRandall Stewart 					tp1->whoTo->cwnd += tp1->book_size;
5110f8829a4aSRandall Stewart 					cnt_revoked++;
5111f8829a4aSRandall Stewart 				}
5112f8829a4aSRandall Stewart 			}
5113f8829a4aSRandall Stewart 			if (cnt_revoked) {
5114f8829a4aSRandall Stewart 				reneged_all = 1;
5115f8829a4aSRandall Stewart 			}
5116f8829a4aSRandall Stewart 		}
5117f8829a4aSRandall Stewart 		asoc->saw_sack_with_frags = 0;
5118f8829a4aSRandall Stewart 	}
5119f8829a4aSRandall Stewart 	if (num_seg)
5120f8829a4aSRandall Stewart 		asoc->saw_sack_with_frags = 1;
5121f8829a4aSRandall Stewart 	else
5122f8829a4aSRandall Stewart 		asoc->saw_sack_with_frags = 0;
5123f8829a4aSRandall Stewart 
5124f8829a4aSRandall Stewart 
5125f8829a4aSRandall Stewart 	sctp_cwnd_update(stcb, asoc, accum_moved, reneged_all, will_exit_fast_recovery);
5126f8829a4aSRandall Stewart 
5127f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
5128f8829a4aSRandall Stewart 		/* nothing left in-flight */
5129f8829a4aSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5130f8829a4aSRandall Stewart 			/* stop all timers */
5131f8829a4aSRandall Stewart 			if (sctp_early_fr) {
5132139bc87fSRandall Stewart 				if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
5133f8829a4aSRandall Stewart 					SCTP_STAT_INCR(sctps_earlyfrstpidsck4);
5134a5d547adSRandall Stewart 					sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
5135a5d547adSRandall Stewart 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_29);
5136f8829a4aSRandall Stewart 				}
5137f8829a4aSRandall Stewart 			}
5138f8829a4aSRandall Stewart 			sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
5139a5d547adSRandall Stewart 			    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_30);
5140f8829a4aSRandall Stewart 			net->flight_size = 0;
5141f8829a4aSRandall Stewart 			net->partial_bytes_acked = 0;
5142f8829a4aSRandall Stewart 		}
5143f8829a4aSRandall Stewart 		asoc->total_flight = 0;
5144f8829a4aSRandall Stewart 		asoc->total_flight_count = 0;
5145f8829a4aSRandall Stewart 	}
5146f8829a4aSRandall Stewart 	/**********************************/
5147f8829a4aSRandall Stewart 	/* Now what about shutdown issues */
5148f8829a4aSRandall Stewart 	/**********************************/
5149f8829a4aSRandall Stewart 	if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
5150f8829a4aSRandall Stewart 		/* nothing left on sendqueue.. consider done */
5151f8829a4aSRandall Stewart #ifdef SCTP_LOG_RWND
5152f8829a4aSRandall Stewart 		sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5153f8829a4aSRandall Stewart 		    asoc->peers_rwnd, 0, 0, a_rwnd);
5154f8829a4aSRandall Stewart #endif
5155f8829a4aSRandall Stewart 		asoc->peers_rwnd = a_rwnd;
5156f8829a4aSRandall Stewart 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5157f8829a4aSRandall Stewart 			/* SWS sender side engages */
5158f8829a4aSRandall Stewart 			asoc->peers_rwnd = 0;
5159f8829a4aSRandall Stewart 		}
5160f8829a4aSRandall Stewart 		/* clean up */
5161f8829a4aSRandall Stewart 		if ((asoc->stream_queue_cnt == 1) &&
5162f8829a4aSRandall Stewart 		    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
5163f8829a4aSRandall Stewart 		    (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
5164f8829a4aSRandall Stewart 		    (asoc->locked_on_sending)
5165f8829a4aSRandall Stewart 		    ) {
5166f8829a4aSRandall Stewart 			struct sctp_stream_queue_pending *sp;
5167f8829a4aSRandall Stewart 
5168f8829a4aSRandall Stewart 			/*
5169f8829a4aSRandall Stewart 			 * I may be in a state where we got all across.. but
5170f8829a4aSRandall Stewart 			 * cannot write more due to a shutdown... we abort
5171f8829a4aSRandall Stewart 			 * since the user did not indicate EOR in this case.
5172f8829a4aSRandall Stewart 			 */
5173f8829a4aSRandall Stewart 			sp = TAILQ_LAST(&((asoc->locked_on_sending)->outqueue),
5174f8829a4aSRandall Stewart 			    sctp_streamhead);
5175f8829a4aSRandall Stewart 			if ((sp) && (sp->length == 0) && (sp->msg_is_complete == 0)) {
5176f8829a4aSRandall Stewart 				asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
5177f8829a4aSRandall Stewart 				asoc->locked_on_sending = NULL;
5178f8829a4aSRandall Stewart 				asoc->stream_queue_cnt--;
5179f8829a4aSRandall Stewart 			}
5180f8829a4aSRandall Stewart 		}
5181f8829a4aSRandall Stewart 		if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
5182f8829a4aSRandall Stewart 		    (asoc->stream_queue_cnt == 0)) {
5183f8829a4aSRandall Stewart 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
5184f8829a4aSRandall Stewart 				/* Need to abort here */
5185f8829a4aSRandall Stewart 				struct mbuf *oper;
5186f8829a4aSRandall Stewart 
5187f8829a4aSRandall Stewart 		abort_out_now:
5188f8829a4aSRandall Stewart 				*abort_now = 1;
5189f8829a4aSRandall Stewart 				/* XXX */
5190f8829a4aSRandall Stewart 				oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
5191f8829a4aSRandall Stewart 				    0, M_DONTWAIT, 1, MT_DATA);
5192f8829a4aSRandall Stewart 				if (oper) {
5193f8829a4aSRandall Stewart 					struct sctp_paramhdr *ph;
5194f8829a4aSRandall Stewart 					uint32_t *ippp;
5195f8829a4aSRandall Stewart 
5196139bc87fSRandall Stewart 					SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
5197f8829a4aSRandall Stewart 					    sizeof(uint32_t);
5198f8829a4aSRandall Stewart 					ph = mtod(oper, struct sctp_paramhdr *);
5199f8829a4aSRandall Stewart 					ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
5200139bc87fSRandall Stewart 					ph->param_length = htons(SCTP_BUF_LEN(oper));
5201f8829a4aSRandall Stewart 					ippp = (uint32_t *) (ph + 1);
5202a5d547adSRandall Stewart 					*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_31);
5203f8829a4aSRandall Stewart 				}
5204a5d547adSRandall Stewart 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_31;
5205f8829a4aSRandall Stewart 				sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_RESPONSE_TO_USER_REQ, oper);
5206f8829a4aSRandall Stewart 				return;
5207f8829a4aSRandall Stewart 			} else {
5208f42a358aSRandall Stewart 				if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
5209f42a358aSRandall Stewart 				    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
5210f8829a4aSRandall Stewart 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5211f42a358aSRandall Stewart 				}
5212f42a358aSRandall Stewart 				asoc->state = SCTP_STATE_SHUTDOWN_SENT;
5213f8829a4aSRandall Stewart 				sctp_stop_timers_for_shutdown(stcb);
5214f8829a4aSRandall Stewart 				sctp_send_shutdown(stcb,
5215f8829a4aSRandall Stewart 				    stcb->asoc.primary_destination);
5216f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
5217f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, asoc->primary_destination);
5218f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
5219f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, asoc->primary_destination);
5220f8829a4aSRandall Stewart 			}
5221f8829a4aSRandall Stewart 			return;
5222f8829a4aSRandall Stewart 		} else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
5223f8829a4aSRandall Stewart 		    (asoc->stream_queue_cnt == 0)) {
5224f8829a4aSRandall Stewart 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
5225f8829a4aSRandall Stewart 				goto abort_out_now;
5226f8829a4aSRandall Stewart 			}
5227f8829a4aSRandall Stewart 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5228f42a358aSRandall Stewart 			asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT;
5229f8829a4aSRandall Stewart 			sctp_send_shutdown_ack(stcb,
5230f8829a4aSRandall Stewart 			    stcb->asoc.primary_destination);
5231f8829a4aSRandall Stewart 
5232f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
5233f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb, asoc->primary_destination);
5234f8829a4aSRandall Stewart 			return;
5235f8829a4aSRandall Stewart 		}
5236f8829a4aSRandall Stewart 	}
5237f8829a4aSRandall Stewart 	/*
5238f8829a4aSRandall Stewart 	 * Now here we are going to recycle net_ack for a different use...
5239f8829a4aSRandall Stewart 	 * HEADS UP.
5240f8829a4aSRandall Stewart 	 */
5241f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5242f8829a4aSRandall Stewart 		net->net_ack = 0;
5243f8829a4aSRandall Stewart 	}
5244f8829a4aSRandall Stewart 
5245f8829a4aSRandall Stewart 	/*
5246f8829a4aSRandall Stewart 	 * CMT DAC algorithm: If SACK DAC flag was 0, then no extra marking
5247f8829a4aSRandall Stewart 	 * to be done. Setting this_sack_lowest_newack to the cum_ack will
5248f8829a4aSRandall Stewart 	 * automatically ensure that.
5249f8829a4aSRandall Stewart 	 */
5250f8829a4aSRandall Stewart 	if (sctp_cmt_on_off && sctp_cmt_use_dac && (cmt_dac_flag == 0)) {
5251f8829a4aSRandall Stewart 		this_sack_lowest_newack = cum_ack;
5252f8829a4aSRandall Stewart 	}
5253f8829a4aSRandall Stewart 	if (num_seg > 0) {
5254f8829a4aSRandall Stewart 		sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked,
5255f8829a4aSRandall Stewart 		    biggest_tsn_newly_acked, this_sack_lowest_newack, accum_moved);
5256f8829a4aSRandall Stewart 	}
5257f8829a4aSRandall Stewart 	/*********************************************/
5258f8829a4aSRandall Stewart 	/* Here we perform PR-SCTP procedures        */
5259f8829a4aSRandall Stewart 	/* (section 4.2)                             */
5260f8829a4aSRandall Stewart 	/*********************************************/
5261f8829a4aSRandall Stewart 	/* C1. update advancedPeerAckPoint */
5262f8829a4aSRandall Stewart 	if (compare_with_wrap(cum_ack, asoc->advanced_peer_ack_point, MAX_TSN)) {
5263f8829a4aSRandall Stewart 		asoc->advanced_peer_ack_point = cum_ack;
5264f8829a4aSRandall Stewart 	}
5265f8829a4aSRandall Stewart 	/* C2. try to further move advancedPeerAckPoint ahead */
5266f8829a4aSRandall Stewart 
5267f8829a4aSRandall Stewart 	if ((asoc->peer_supports_prsctp) && (asoc->pr_sctp_cnt > 0)) {
5268f8829a4aSRandall Stewart 		struct sctp_tmit_chunk *lchk;
5269f8829a4aSRandall Stewart 
5270f8829a4aSRandall Stewart 		lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
5271f8829a4aSRandall Stewart 		/* C3. See if we need to send a Fwd-TSN */
5272f8829a4aSRandall Stewart 		if (compare_with_wrap(asoc->advanced_peer_ack_point, cum_ack,
5273f8829a4aSRandall Stewart 		    MAX_TSN)) {
5274f8829a4aSRandall Stewart 			/*
5275f8829a4aSRandall Stewart 			 * ISSUE with ECN, see FWD-TSN processing for notes
5276f8829a4aSRandall Stewart 			 * on issues that will occur when the ECN NONCE
5277f8829a4aSRandall Stewart 			 * stuff is put into SCTP for cross checking.
5278f8829a4aSRandall Stewart 			 */
5279f8829a4aSRandall Stewart 			send_forward_tsn(stcb, asoc);
5280f8829a4aSRandall Stewart 
5281f8829a4aSRandall Stewart 			/*
5282f8829a4aSRandall Stewart 			 * ECN Nonce: Disable Nonce Sum check when FWD TSN
5283f8829a4aSRandall Stewart 			 * is sent and store resync tsn
5284f8829a4aSRandall Stewart 			 */
5285f8829a4aSRandall Stewart 			asoc->nonce_sum_check = 0;
5286f8829a4aSRandall Stewart 			asoc->nonce_resync_tsn = asoc->advanced_peer_ack_point;
5287f8829a4aSRandall Stewart 			if (lchk) {
5288f8829a4aSRandall Stewart 				/* Assure a timer is up */
5289f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5290f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, lchk->whoTo);
5291f8829a4aSRandall Stewart 			}
5292f8829a4aSRandall Stewart 		}
5293f8829a4aSRandall Stewart 	}
5294f8829a4aSRandall Stewart 	/*
5295f8829a4aSRandall Stewart 	 * CMT fast recovery code. Need to debug. ((sctp_cmt_on_off == 1) &&
5296c105859eSRandall Stewart 	 * (net->fast_retran_loss_recovery == 0)))
5297f8829a4aSRandall Stewart 	 */
5298f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5299c105859eSRandall Stewart 		if ((asoc->fast_retran_loss_recovery == 0) || (sctp_cmt_on_off == 1)) {
5300f8829a4aSRandall Stewart 			/* out of a RFC2582 Fast recovery window? */
5301f8829a4aSRandall Stewart 			if (net->net_ack > 0) {
5302f8829a4aSRandall Stewart 				/*
5303f8829a4aSRandall Stewart 				 * per section 7.2.3, are there any
5304f8829a4aSRandall Stewart 				 * destinations that had a fast retransmit
5305f8829a4aSRandall Stewart 				 * to them. If so what we need to do is
5306f8829a4aSRandall Stewart 				 * adjust ssthresh and cwnd.
5307f8829a4aSRandall Stewart 				 */
5308f8829a4aSRandall Stewart 				struct sctp_tmit_chunk *lchk;
5309f8829a4aSRandall Stewart 
5310f8829a4aSRandall Stewart #ifdef  SCTP_HIGH_SPEED
531150cec919SRandall Stewart 				sctp_hs_cwnd_decrease(stcb, net);
5312f8829a4aSRandall Stewart #else
5313f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
5314f8829a4aSRandall Stewart 				int old_cwnd = net->cwnd;
5315f8829a4aSRandall Stewart 
5316f8829a4aSRandall Stewart #endif
5317f8829a4aSRandall Stewart 				net->ssthresh = net->cwnd / 2;
5318f8829a4aSRandall Stewart 				if (net->ssthresh < (net->mtu * 2)) {
5319f8829a4aSRandall Stewart 					net->ssthresh = 2 * net->mtu;
5320f8829a4aSRandall Stewart 				}
5321f8829a4aSRandall Stewart 				net->cwnd = net->ssthresh;
5322f8829a4aSRandall Stewart #ifdef SCTP_CWND_MONITOR
5323f8829a4aSRandall Stewart 				sctp_log_cwnd(stcb, net, (net->cwnd - old_cwnd),
5324f8829a4aSRandall Stewart 				    SCTP_CWND_LOG_FROM_FR);
5325f8829a4aSRandall Stewart #endif
5326f8829a4aSRandall Stewart #endif
5327f8829a4aSRandall Stewart 
5328f8829a4aSRandall Stewart 				lchk = TAILQ_FIRST(&asoc->send_queue);
5329f8829a4aSRandall Stewart 
5330f8829a4aSRandall Stewart 				net->partial_bytes_acked = 0;
5331f8829a4aSRandall Stewart 				/* Turn on fast recovery window */
5332f8829a4aSRandall Stewart 				asoc->fast_retran_loss_recovery = 1;
5333f8829a4aSRandall Stewart 				if (lchk == NULL) {
5334f8829a4aSRandall Stewart 					/* Mark end of the window */
5335f8829a4aSRandall Stewart 					asoc->fast_recovery_tsn = asoc->sending_seq - 1;
5336f8829a4aSRandall Stewart 				} else {
5337f8829a4aSRandall Stewart 					asoc->fast_recovery_tsn = lchk->rec.data.TSN_seq - 1;
5338f8829a4aSRandall Stewart 				}
5339f8829a4aSRandall Stewart 
5340f8829a4aSRandall Stewart 				/*
5341f8829a4aSRandall Stewart 				 * CMT fast recovery -- per destination
5342f8829a4aSRandall Stewart 				 * recovery variable.
5343f8829a4aSRandall Stewart 				 */
5344f8829a4aSRandall Stewart 				net->fast_retran_loss_recovery = 1;
5345f8829a4aSRandall Stewart 
5346f8829a4aSRandall Stewart 				if (lchk == NULL) {
5347f8829a4aSRandall Stewart 					/* Mark end of the window */
5348f8829a4aSRandall Stewart 					net->fast_recovery_tsn = asoc->sending_seq - 1;
5349f8829a4aSRandall Stewart 				} else {
5350f8829a4aSRandall Stewart 					net->fast_recovery_tsn = lchk->rec.data.TSN_seq - 1;
5351f8829a4aSRandall Stewart 				}
5352f8829a4aSRandall Stewart 
5353f8829a4aSRandall Stewart 
5354f8829a4aSRandall Stewart 
5355f8829a4aSRandall Stewart 				/*
5356f8829a4aSRandall Stewart 				 * Disable Nonce Sum Checking and store the
5357f8829a4aSRandall Stewart 				 * resync tsn
5358f8829a4aSRandall Stewart 				 */
5359f8829a4aSRandall Stewart 				asoc->nonce_sum_check = 0;
5360f8829a4aSRandall Stewart 				asoc->nonce_resync_tsn = asoc->fast_recovery_tsn + 1;
5361f8829a4aSRandall Stewart 
5362f8829a4aSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND,
5363a5d547adSRandall Stewart 				    stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_32);
5364f8829a4aSRandall Stewart 				sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5365f8829a4aSRandall Stewart 				    stcb->sctp_ep, stcb, net);
5366f8829a4aSRandall Stewart 			}
5367f8829a4aSRandall Stewart 		} else if (net->net_ack > 0) {
5368f8829a4aSRandall Stewart 			/*
5369f8829a4aSRandall Stewart 			 * Mark a peg that we WOULD have done a cwnd
5370f8829a4aSRandall Stewart 			 * reduction but RFC2582 prevented this action.
5371f8829a4aSRandall Stewart 			 */
5372f8829a4aSRandall Stewart 			SCTP_STAT_INCR(sctps_fastretransinrtt);
5373f8829a4aSRandall Stewart 		}
5374f8829a4aSRandall Stewart 	}
5375f8829a4aSRandall Stewart 
5376f8829a4aSRandall Stewart 
5377f8829a4aSRandall Stewart 	/******************************************************************
5378f8829a4aSRandall Stewart 	 *  Here we do the stuff with ECN Nonce checking.
5379f8829a4aSRandall Stewart 	 *  We basically check to see if the nonce sum flag was incorrect
5380f8829a4aSRandall Stewart 	 *  or if resynchronization needs to be done. Also if we catch a
5381f8829a4aSRandall Stewart 	 *  misbehaving receiver we give him the kick.
5382f8829a4aSRandall Stewart 	 ******************************************************************/
5383f8829a4aSRandall Stewart 
5384f8829a4aSRandall Stewart 	if (asoc->ecn_nonce_allowed) {
5385f8829a4aSRandall Stewart 		if (asoc->nonce_sum_check) {
5386f8829a4aSRandall Stewart 			if (nonce_sum_flag != ((asoc->nonce_sum_expect_base + ecn_seg_sums) & SCTP_SACK_NONCE_SUM)) {
5387f8829a4aSRandall Stewart 				if (asoc->nonce_wait_for_ecne == 0) {
5388f8829a4aSRandall Stewart 					struct sctp_tmit_chunk *lchk;
5389f8829a4aSRandall Stewart 
5390f8829a4aSRandall Stewart 					lchk = TAILQ_FIRST(&asoc->send_queue);
5391f8829a4aSRandall Stewart 					asoc->nonce_wait_for_ecne = 1;
5392f8829a4aSRandall Stewart 					if (lchk) {
5393f8829a4aSRandall Stewart 						asoc->nonce_wait_tsn = lchk->rec.data.TSN_seq;
5394f8829a4aSRandall Stewart 					} else {
5395f8829a4aSRandall Stewart 						asoc->nonce_wait_tsn = asoc->sending_seq;
5396f8829a4aSRandall Stewart 					}
5397f8829a4aSRandall Stewart 				} else {
5398f8829a4aSRandall Stewart 					if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_wait_tsn, MAX_TSN) ||
5399f8829a4aSRandall Stewart 					    (asoc->last_acked_seq == asoc->nonce_wait_tsn)) {
5400f8829a4aSRandall Stewart 						/*
5401f8829a4aSRandall Stewart 						 * Misbehaving peer. We need
5402f8829a4aSRandall Stewart 						 * to react to this guy
5403f8829a4aSRandall Stewart 						 */
5404f8829a4aSRandall Stewart 						asoc->ecn_allowed = 0;
5405f8829a4aSRandall Stewart 						asoc->ecn_nonce_allowed = 0;
5406f8829a4aSRandall Stewart 					}
5407f8829a4aSRandall Stewart 				}
5408f8829a4aSRandall Stewart 			}
5409f8829a4aSRandall Stewart 		} else {
5410f8829a4aSRandall Stewart 			/* See if Resynchronization Possible */
5411f8829a4aSRandall Stewart 			if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_resync_tsn, MAX_TSN)) {
5412f8829a4aSRandall Stewart 				asoc->nonce_sum_check = 1;
5413f8829a4aSRandall Stewart 				/*
5414f8829a4aSRandall Stewart 				 * now we must calculate what the base is.
5415f8829a4aSRandall Stewart 				 * We do this based on two things, we know
5416f8829a4aSRandall Stewart 				 * the total's for all the segments
5417f8829a4aSRandall Stewart 				 * gap-acked in the SACK, its stored in
5418f8829a4aSRandall Stewart 				 * ecn_seg_sums. We also know the SACK's
5419f8829a4aSRandall Stewart 				 * nonce sum, its in nonce_sum_flag. So we
5420f8829a4aSRandall Stewart 				 * can build a truth table to back-calculate
5421f8829a4aSRandall Stewart 				 * the new value of
5422f8829a4aSRandall Stewart 				 * asoc->nonce_sum_expect_base:
5423f8829a4aSRandall Stewart 				 *
5424f8829a4aSRandall Stewart 				 * SACK-flag-Value         Seg-Sums Base 0 0 0
5425f8829a4aSRandall Stewart 				 * 1                    0 1 0 1 1 1
5426f8829a4aSRandall Stewart 				 * 1 0
5427f8829a4aSRandall Stewart 				 */
5428f8829a4aSRandall Stewart 				asoc->nonce_sum_expect_base = (ecn_seg_sums ^ nonce_sum_flag) & SCTP_SACK_NONCE_SUM;
5429f8829a4aSRandall Stewart 			}
5430f8829a4aSRandall Stewart 		}
5431f8829a4aSRandall Stewart 	}
5432f8829a4aSRandall Stewart 	/* Now are we exiting loss recovery ? */
5433f8829a4aSRandall Stewart 	if (will_exit_fast_recovery) {
5434f8829a4aSRandall Stewart 		/* Ok, we must exit fast recovery */
5435f8829a4aSRandall Stewart 		asoc->fast_retran_loss_recovery = 0;
5436f8829a4aSRandall Stewart 	}
5437f8829a4aSRandall Stewart 	if ((asoc->sat_t3_loss_recovery) &&
5438f8829a4aSRandall Stewart 	    ((compare_with_wrap(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn,
5439f8829a4aSRandall Stewart 	    MAX_TSN) ||
5440f8829a4aSRandall Stewart 	    (asoc->last_acked_seq == asoc->sat_t3_recovery_tsn)))) {
5441f8829a4aSRandall Stewart 		/* end satellite t3 loss recovery */
5442f8829a4aSRandall Stewart 		asoc->sat_t3_loss_recovery = 0;
5443f8829a4aSRandall Stewart 	}
544442551e99SRandall Stewart 	/*
544542551e99SRandall Stewart 	 * CMT Fast recovery
544642551e99SRandall Stewart 	 */
5447f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5448f8829a4aSRandall Stewart 		if (net->will_exit_fast_recovery) {
5449f8829a4aSRandall Stewart 			/* Ok, we must exit fast recovery */
5450f8829a4aSRandall Stewart 			net->fast_retran_loss_recovery = 0;
5451f8829a4aSRandall Stewart 		}
5452f8829a4aSRandall Stewart 	}
5453f8829a4aSRandall Stewart 
5454f8829a4aSRandall Stewart 	/* Adjust and set the new rwnd value */
5455f8829a4aSRandall Stewart #ifdef SCTP_LOG_RWND
5456f8829a4aSRandall Stewart 	sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5457f8829a4aSRandall Stewart 	    asoc->peers_rwnd, asoc->total_flight, (asoc->sent_queue_cnt * sctp_peer_chunk_oh), a_rwnd);
5458f8829a4aSRandall Stewart #endif
5459f8829a4aSRandall Stewart 
5460f8829a4aSRandall Stewart 	asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd,
5461f8829a4aSRandall Stewart 	    (uint32_t) (asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh)));
5462f8829a4aSRandall Stewart 	if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5463f8829a4aSRandall Stewart 		/* SWS sender side engages */
5464f8829a4aSRandall Stewart 		asoc->peers_rwnd = 0;
5465f8829a4aSRandall Stewart 	}
54665e54f665SRandall Stewart 	if (asoc->peers_rwnd > old_rwnd) {
54675e54f665SRandall Stewart 		win_probe_recovery = 1;
54685e54f665SRandall Stewart 	}
5469f8829a4aSRandall Stewart 	/*
5470f8829a4aSRandall Stewart 	 * Now we must setup so we have a timer up for anyone with
5471f8829a4aSRandall Stewart 	 * outstanding data.
5472f8829a4aSRandall Stewart 	 */
5473bff64a4dSRandall Stewart 	done_once = 0;
5474a5d547adSRandall Stewart again:
5475a5d547adSRandall Stewart 	j = 0;
5476f8829a4aSRandall Stewart 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
54775e54f665SRandall Stewart 		if (win_probe_recovery && (net->window_probe)) {
54785e54f665SRandall Stewart 			net->window_probe = 0;
5479c105859eSRandall Stewart 			win_probe_recovered = 1;
54805e54f665SRandall Stewart 			/*-
54815e54f665SRandall Stewart 			 * Find first chunk that was used with
54825e54f665SRandall Stewart 			 * window probe and clear the event. Put
54835e54f665SRandall Stewart 			 * it back into the send queue as if has
54845e54f665SRandall Stewart 			 * not been sent.
54855e54f665SRandall Stewart 			 */
54865e54f665SRandall Stewart 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
54875e54f665SRandall Stewart 				if (tp1->window_probe) {
5488c105859eSRandall Stewart 					sctp_window_probe_recovery(stcb, asoc, net, tp1);
54895e54f665SRandall Stewart 					break;
54905e54f665SRandall Stewart 				}
54915e54f665SRandall Stewart 			}
54925e54f665SRandall Stewart 		}
5493f8829a4aSRandall Stewart 		if (net->flight_size) {
5494a5d547adSRandall Stewart 			j++;
5495f8829a4aSRandall Stewart 			sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5496f8829a4aSRandall Stewart 			    stcb->sctp_ep, stcb, net);
5497c105859eSRandall Stewart 		} else {
5498c105859eSRandall Stewart 			if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5499c105859eSRandall Stewart 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
5500c105859eSRandall Stewart 				    stcb, net,
5501c105859eSRandall Stewart 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_22);
5502c105859eSRandall Stewart 			}
5503c105859eSRandall Stewart 			if (sctp_early_fr) {
5504c105859eSRandall Stewart 				if (SCTP_OS_TIMER_PENDING(&net->fr_timer.timer)) {
5505c105859eSRandall Stewart 					SCTP_STAT_INCR(sctps_earlyfrstpidsck4);
5506c105859eSRandall Stewart 					sctp_timer_stop(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net,
5507c105859eSRandall Stewart 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_23);
5508c105859eSRandall Stewart 				}
5509c105859eSRandall Stewart 			}
5510f8829a4aSRandall Stewart 		}
5511f8829a4aSRandall Stewart 	}
5512bff64a4dSRandall Stewart 	if ((j == 0) &&
5513bff64a4dSRandall Stewart 	    (!TAILQ_EMPTY(&asoc->sent_queue)) &&
5514bff64a4dSRandall Stewart 	    (asoc->sent_queue_retran_cnt == 0) &&
5515c105859eSRandall Stewart 	    (win_probe_recovered == 0) &&
5516bff64a4dSRandall Stewart 	    (done_once == 0)) {
5517a5d547adSRandall Stewart 		/* huh, this should not happen */
5518c105859eSRandall Stewart 		sctp_fs_audit(asoc);
5519a5d547adSRandall Stewart 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5520a5d547adSRandall Stewart 			net->flight_size = 0;
5521a5d547adSRandall Stewart 		}
5522a5d547adSRandall Stewart 		asoc->total_flight = 0;
5523a5d547adSRandall Stewart 		asoc->total_flight_count = 0;
5524a5d547adSRandall Stewart 		asoc->sent_queue_retran_cnt = 0;
5525a5d547adSRandall Stewart 		TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5526a5d547adSRandall Stewart 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5527c105859eSRandall Stewart 				sctp_flight_size_increase(tp1);
5528c105859eSRandall Stewart 				sctp_total_flight_increase(stcb, tp1);
5529a5d547adSRandall Stewart 			} else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
5530a5d547adSRandall Stewart 				asoc->sent_queue_retran_cnt++;
5531a5d547adSRandall Stewart 			}
5532a5d547adSRandall Stewart 		}
5533bff64a4dSRandall Stewart 		done_once = 1;
5534a5d547adSRandall Stewart 		goto again;
5535a5d547adSRandall Stewart 	}
5536f8829a4aSRandall Stewart #ifdef SCTP_SACK_RWND_LOGGING
5537f8829a4aSRandall Stewart 	sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
5538f8829a4aSRandall Stewart 	    a_rwnd,
5539f8829a4aSRandall Stewart 	    stcb->asoc.peers_rwnd,
5540f8829a4aSRandall Stewart 	    stcb->asoc.total_flight,
5541f8829a4aSRandall Stewart 	    stcb->asoc.total_output_queue_size);
5542f8829a4aSRandall Stewart 
5543f8829a4aSRandall Stewart #endif
5544f8829a4aSRandall Stewart 
5545f8829a4aSRandall Stewart }
5546f8829a4aSRandall Stewart 
5547f8829a4aSRandall Stewart void
5548f8829a4aSRandall Stewart sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp,
5549f8829a4aSRandall Stewart     struct sctp_nets *netp, int *abort_flag)
5550f8829a4aSRandall Stewart {
5551f8829a4aSRandall Stewart 	/* Copy cum-ack */
5552f8829a4aSRandall Stewart 	uint32_t cum_ack, a_rwnd;
5553f8829a4aSRandall Stewart 
5554f8829a4aSRandall Stewart 	cum_ack = ntohl(cp->cumulative_tsn_ack);
5555f8829a4aSRandall Stewart 	/* Arrange so a_rwnd does NOT change */
5556f8829a4aSRandall Stewart 	a_rwnd = stcb->asoc.peers_rwnd + stcb->asoc.total_flight;
5557f8829a4aSRandall Stewart 
5558f8829a4aSRandall Stewart 	/* Now call the express sack handling */
5559f8829a4aSRandall Stewart 	sctp_express_handle_sack(stcb, cum_ack, a_rwnd, 0, abort_flag);
5560f8829a4aSRandall Stewart }
5561f8829a4aSRandall Stewart 
5562f8829a4aSRandall Stewart static void
5563f8829a4aSRandall Stewart sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb,
5564f8829a4aSRandall Stewart     struct sctp_stream_in *strmin)
5565f8829a4aSRandall Stewart {
5566f8829a4aSRandall Stewart 	struct sctp_queued_to_read *ctl, *nctl;
5567f8829a4aSRandall Stewart 	struct sctp_association *asoc;
5568f8829a4aSRandall Stewart 	int tt;
5569f8829a4aSRandall Stewart 
5570f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
5571f8829a4aSRandall Stewart 	tt = strmin->last_sequence_delivered;
5572f8829a4aSRandall Stewart 	/*
5573f8829a4aSRandall Stewart 	 * First deliver anything prior to and including the stream no that
5574f8829a4aSRandall Stewart 	 * came in
5575f8829a4aSRandall Stewart 	 */
5576f8829a4aSRandall Stewart 	ctl = TAILQ_FIRST(&strmin->inqueue);
5577f8829a4aSRandall Stewart 	while (ctl) {
5578f8829a4aSRandall Stewart 		nctl = TAILQ_NEXT(ctl, next);
5579f8829a4aSRandall Stewart 		if (compare_with_wrap(tt, ctl->sinfo_ssn, MAX_SEQ) ||
5580f8829a4aSRandall Stewart 		    (tt == ctl->sinfo_ssn)) {
5581f8829a4aSRandall Stewart 			/* this is deliverable now */
5582f8829a4aSRandall Stewart 			TAILQ_REMOVE(&strmin->inqueue, ctl, next);
5583f8829a4aSRandall Stewart 			/* subtract pending on streams */
5584f8829a4aSRandall Stewart 			asoc->size_on_all_streams -= ctl->length;
5585f8829a4aSRandall Stewart 			sctp_ucount_decr(asoc->cnt_on_all_streams);
5586f8829a4aSRandall Stewart 			/* deliver it to at least the delivery-q */
5587f8829a4aSRandall Stewart 			if (stcb->sctp_socket) {
5588f8829a4aSRandall Stewart 				sctp_add_to_readq(stcb->sctp_ep, stcb,
5589f8829a4aSRandall Stewart 				    ctl,
5590f8829a4aSRandall Stewart 				    &stcb->sctp_socket->so_rcv, 1);
5591f8829a4aSRandall Stewart 			}
5592f8829a4aSRandall Stewart 		} else {
5593f8829a4aSRandall Stewart 			/* no more delivery now. */
5594f8829a4aSRandall Stewart 			break;
5595f8829a4aSRandall Stewart 		}
5596f8829a4aSRandall Stewart 		ctl = nctl;
5597f8829a4aSRandall Stewart 	}
5598f8829a4aSRandall Stewart 	/*
5599f8829a4aSRandall Stewart 	 * now we must deliver things in queue the normal way  if any are
5600f8829a4aSRandall Stewart 	 * now ready.
5601f8829a4aSRandall Stewart 	 */
5602f8829a4aSRandall Stewart 	tt = strmin->last_sequence_delivered + 1;
5603f8829a4aSRandall Stewart 	ctl = TAILQ_FIRST(&strmin->inqueue);
5604f8829a4aSRandall Stewart 	while (ctl) {
5605f8829a4aSRandall Stewart 		nctl = TAILQ_NEXT(ctl, next);
5606f8829a4aSRandall Stewart 		if (tt == ctl->sinfo_ssn) {
5607f8829a4aSRandall Stewart 			/* this is deliverable now */
5608f8829a4aSRandall Stewart 			TAILQ_REMOVE(&strmin->inqueue, ctl, next);
5609f8829a4aSRandall Stewart 			/* subtract pending on streams */
5610f8829a4aSRandall Stewart 			asoc->size_on_all_streams -= ctl->length;
5611f8829a4aSRandall Stewart 			sctp_ucount_decr(asoc->cnt_on_all_streams);
5612f8829a4aSRandall Stewart 			/* deliver it to at least the delivery-q */
5613f8829a4aSRandall Stewart 			strmin->last_sequence_delivered = ctl->sinfo_ssn;
5614f8829a4aSRandall Stewart 			if (stcb->sctp_socket) {
5615f8829a4aSRandall Stewart 				sctp_add_to_readq(stcb->sctp_ep, stcb,
5616f8829a4aSRandall Stewart 				    ctl,
5617f8829a4aSRandall Stewart 				    &stcb->sctp_socket->so_rcv, 1);
5618f8829a4aSRandall Stewart 			}
5619f8829a4aSRandall Stewart 			tt = strmin->last_sequence_delivered + 1;
5620f8829a4aSRandall Stewart 		} else {
5621f8829a4aSRandall Stewart 			break;
5622f8829a4aSRandall Stewart 		}
5623f8829a4aSRandall Stewart 		ctl = nctl;
5624f8829a4aSRandall Stewart 	}
5625f8829a4aSRandall Stewart }
5626f8829a4aSRandall Stewart 
5627f8829a4aSRandall Stewart void
5628f8829a4aSRandall Stewart sctp_handle_forward_tsn(struct sctp_tcb *stcb,
5629f8829a4aSRandall Stewart     struct sctp_forward_tsn_chunk *fwd, int *abort_flag)
5630f8829a4aSRandall Stewart {
5631f8829a4aSRandall Stewart 	/*
5632f8829a4aSRandall Stewart 	 * ISSUES that MUST be fixed for ECN! When we are the sender of the
5633f8829a4aSRandall Stewart 	 * forward TSN, when the SACK comes back that acknowledges the
5634f8829a4aSRandall Stewart 	 * FWD-TSN we must reset the NONCE sum to match correctly. This will
5635f8829a4aSRandall Stewart 	 * get quite tricky since we may have sent more data interveneing
5636f8829a4aSRandall Stewart 	 * and must carefully account for what the SACK says on the nonce
5637f8829a4aSRandall Stewart 	 * and any gaps that are reported. This work will NOT be done here,
5638f8829a4aSRandall Stewart 	 * but I note it here since it is really related to PR-SCTP and
5639f8829a4aSRandall Stewart 	 * FWD-TSN's
5640f8829a4aSRandall Stewart 	 */
5641f8829a4aSRandall Stewart 
5642f8829a4aSRandall Stewart 	/* The pr-sctp fwd tsn */
5643f8829a4aSRandall Stewart 	/*
5644f8829a4aSRandall Stewart 	 * here we will perform all the data receiver side steps for
5645f8829a4aSRandall Stewart 	 * processing FwdTSN, as required in by pr-sctp draft:
5646f8829a4aSRandall Stewart 	 *
5647f8829a4aSRandall Stewart 	 * Assume we get FwdTSN(x):
5648f8829a4aSRandall Stewart 	 *
5649f8829a4aSRandall Stewart 	 * 1) update local cumTSN to x 2) try to further advance cumTSN to x +
5650f8829a4aSRandall Stewart 	 * others we have 3) examine and update re-ordering queue on
5651f8829a4aSRandall Stewart 	 * pr-in-streams 4) clean up re-assembly queue 5) Send a sack to
5652f8829a4aSRandall Stewart 	 * report where we are.
5653f8829a4aSRandall Stewart 	 */
5654f8829a4aSRandall Stewart 	struct sctp_strseq *stseq;
5655f8829a4aSRandall Stewart 	struct sctp_association *asoc;
5656f8829a4aSRandall Stewart 	uint32_t new_cum_tsn, gap, back_out_htsn;
5657f8829a4aSRandall Stewart 	unsigned int i, cnt_gone, fwd_sz, cumack_set_flag, m_size;
5658f8829a4aSRandall Stewart 	struct sctp_stream_in *strm;
5659f8829a4aSRandall Stewart 	struct sctp_tmit_chunk *chk, *at;
5660f8829a4aSRandall Stewart 
5661f8829a4aSRandall Stewart 	cumack_set_flag = 0;
5662f8829a4aSRandall Stewart 	asoc = &stcb->asoc;
5663f8829a4aSRandall Stewart 	cnt_gone = 0;
5664f8829a4aSRandall Stewart 	if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
5665ad81507eSRandall Stewart 		SCTPDBG(SCTP_DEBUG_INDATA1,
5666ad81507eSRandall Stewart 		    "Bad size too small/big fwd-tsn\n");
5667f8829a4aSRandall Stewart 		return;
5668f8829a4aSRandall Stewart 	}
5669f8829a4aSRandall Stewart 	m_size = (stcb->asoc.mapping_array_size << 3);
5670f8829a4aSRandall Stewart 	/*************************************************************/
5671f8829a4aSRandall Stewart 	/* 1. Here we update local cumTSN and shift the bitmap array */
5672f8829a4aSRandall Stewart 	/*************************************************************/
5673f8829a4aSRandall Stewart 	new_cum_tsn = ntohl(fwd->new_cumulative_tsn);
5674f8829a4aSRandall Stewart 
5675f8829a4aSRandall Stewart 	if (compare_with_wrap(asoc->cumulative_tsn, new_cum_tsn, MAX_TSN) ||
5676f8829a4aSRandall Stewart 	    asoc->cumulative_tsn == new_cum_tsn) {
5677f8829a4aSRandall Stewart 		/* Already got there ... */
5678f8829a4aSRandall Stewart 		return;
5679f8829a4aSRandall Stewart 	}
5680f8829a4aSRandall Stewart 	back_out_htsn = asoc->highest_tsn_inside_map;
5681f8829a4aSRandall Stewart 	if (compare_with_wrap(new_cum_tsn, asoc->highest_tsn_inside_map,
5682f8829a4aSRandall Stewart 	    MAX_TSN)) {
5683f8829a4aSRandall Stewart 		asoc->highest_tsn_inside_map = new_cum_tsn;
5684f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
5685f8829a4aSRandall Stewart 		sctp_log_map(0, 0, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5686f8829a4aSRandall Stewart #endif
5687f8829a4aSRandall Stewart 	}
5688f8829a4aSRandall Stewart 	/*
5689f8829a4aSRandall Stewart 	 * now we know the new TSN is more advanced, let's find the actual
5690f8829a4aSRandall Stewart 	 * gap
5691f8829a4aSRandall Stewart 	 */
5692f8829a4aSRandall Stewart 	if ((compare_with_wrap(new_cum_tsn, asoc->mapping_array_base_tsn,
5693f8829a4aSRandall Stewart 	    MAX_TSN)) ||
5694f8829a4aSRandall Stewart 	    (new_cum_tsn == asoc->mapping_array_base_tsn)) {
5695f8829a4aSRandall Stewart 		gap = new_cum_tsn - asoc->mapping_array_base_tsn;
5696f8829a4aSRandall Stewart 	} else {
5697f8829a4aSRandall Stewart 		/* try to prevent underflow here */
5698f8829a4aSRandall Stewart 		gap = new_cum_tsn + (MAX_TSN - asoc->mapping_array_base_tsn) + 1;
5699f8829a4aSRandall Stewart 	}
5700f8829a4aSRandall Stewart 
570117205eccSRandall Stewart 	if (gap > m_size) {
5702f8829a4aSRandall Stewart 		asoc->highest_tsn_inside_map = back_out_htsn;
5703f8829a4aSRandall Stewart 		if ((long)gap > sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv)) {
570417205eccSRandall Stewart 			struct mbuf *oper;
570517205eccSRandall Stewart 
5706f8829a4aSRandall Stewart 			/*
5707f8829a4aSRandall Stewart 			 * out of range (of single byte chunks in the rwnd I
570817205eccSRandall Stewart 			 * give out). This must be an attacker.
5709f8829a4aSRandall Stewart 			 */
571017205eccSRandall Stewart 			*abort_flag = 1;
571117205eccSRandall Stewart 			oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + 3 * sizeof(uint32_t)),
571217205eccSRandall Stewart 			    0, M_DONTWAIT, 1, MT_DATA);
571317205eccSRandall Stewart 			if (oper) {
571417205eccSRandall Stewart 				struct sctp_paramhdr *ph;
571517205eccSRandall Stewart 				uint32_t *ippp;
571617205eccSRandall Stewart 
571717205eccSRandall Stewart 				SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
571817205eccSRandall Stewart 				    (sizeof(uint32_t) * 3);
571917205eccSRandall Stewart 				ph = mtod(oper, struct sctp_paramhdr *);
572017205eccSRandall Stewart 				ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
572117205eccSRandall Stewart 				ph->param_length = htons(SCTP_BUF_LEN(oper));
572217205eccSRandall Stewart 				ippp = (uint32_t *) (ph + 1);
572317205eccSRandall Stewart 				*ippp = htonl(SCTP_FROM_SCTP_INDATA + SCTP_LOC_33);
572417205eccSRandall Stewart 				ippp++;
572517205eccSRandall Stewart 				*ippp = asoc->highest_tsn_inside_map;
572617205eccSRandall Stewart 				ippp++;
572717205eccSRandall Stewart 				*ippp = new_cum_tsn;
572817205eccSRandall Stewart 			}
572917205eccSRandall Stewart 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_33;
573017205eccSRandall Stewart 			sctp_abort_an_association(stcb->sctp_ep, stcb,
573117205eccSRandall Stewart 			    SCTP_PEER_FAULTY, oper);
5732f8829a4aSRandall Stewart 			return;
5733f8829a4aSRandall Stewart 		}
5734f8829a4aSRandall Stewart 		if (asoc->highest_tsn_inside_map >
5735f8829a4aSRandall Stewart 		    asoc->mapping_array_base_tsn) {
5736f8829a4aSRandall Stewart 			gap = asoc->highest_tsn_inside_map -
5737f8829a4aSRandall Stewart 			    asoc->mapping_array_base_tsn;
5738f8829a4aSRandall Stewart 		} else {
5739f8829a4aSRandall Stewart 			gap = asoc->highest_tsn_inside_map +
5740f8829a4aSRandall Stewart 			    (MAX_TSN - asoc->mapping_array_base_tsn) + 1;
5741f8829a4aSRandall Stewart 		}
5742f8829a4aSRandall Stewart 		cumack_set_flag = 1;
5743f8829a4aSRandall Stewart 	}
5744f8829a4aSRandall Stewart 	for (i = 0; i <= gap; i++) {
5745f8829a4aSRandall Stewart 		SCTP_SET_TSN_PRESENT(asoc->mapping_array, i);
5746f8829a4aSRandall Stewart 	}
5747f8829a4aSRandall Stewart 	/*
5748f8829a4aSRandall Stewart 	 * Now after marking all, slide thing forward but no sack please.
5749f8829a4aSRandall Stewart 	 */
5750f8829a4aSRandall Stewart 	sctp_sack_check(stcb, 0, 0, abort_flag);
5751f8829a4aSRandall Stewart 	if (*abort_flag)
5752f8829a4aSRandall Stewart 		return;
5753f8829a4aSRandall Stewart 
5754f8829a4aSRandall Stewart 	if (cumack_set_flag) {
5755f8829a4aSRandall Stewart 		/*
5756f8829a4aSRandall Stewart 		 * fwd-tsn went outside my gap array - not a common
5757f8829a4aSRandall Stewart 		 * occurance. Do the same thing we do when a cookie-echo
5758f8829a4aSRandall Stewart 		 * arrives.
5759f8829a4aSRandall Stewart 		 */
5760f8829a4aSRandall Stewart 		asoc->highest_tsn_inside_map = new_cum_tsn - 1;
5761f8829a4aSRandall Stewart 		asoc->mapping_array_base_tsn = new_cum_tsn;
5762f8829a4aSRandall Stewart 		asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
5763f8829a4aSRandall Stewart #ifdef SCTP_MAP_LOGGING
5764f8829a4aSRandall Stewart 		sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5765f8829a4aSRandall Stewart #endif
5766f8829a4aSRandall Stewart 		asoc->last_echo_tsn = asoc->highest_tsn_inside_map;
5767f8829a4aSRandall Stewart 	}
5768f8829a4aSRandall Stewart 	/*************************************************************/
5769f8829a4aSRandall Stewart 	/* 2. Clear up re-assembly queue                             */
5770f8829a4aSRandall Stewart 	/*************************************************************/
5771f8829a4aSRandall Stewart 
5772f8829a4aSRandall Stewart 	/*
5773f8829a4aSRandall Stewart 	 * First service it if pd-api is up, just in case we can progress it
5774f8829a4aSRandall Stewart 	 * forward
5775f8829a4aSRandall Stewart 	 */
5776f8829a4aSRandall Stewart 	if (asoc->fragmented_delivery_inprogress) {
5777f8829a4aSRandall Stewart 		sctp_service_reassembly(stcb, asoc);
5778f8829a4aSRandall Stewart 	}
5779f8829a4aSRandall Stewart 	if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
5780f8829a4aSRandall Stewart 		/* For each one on here see if we need to toss it */
5781f8829a4aSRandall Stewart 		/*
5782f8829a4aSRandall Stewart 		 * For now large messages held on the reasmqueue that are
5783f8829a4aSRandall Stewart 		 * complete will be tossed too. We could in theory do more
5784f8829a4aSRandall Stewart 		 * work to spin through and stop after dumping one msg aka
5785f8829a4aSRandall Stewart 		 * seeing the start of a new msg at the head, and call the
5786f8829a4aSRandall Stewart 		 * delivery function... to see if it can be delivered... But
5787f8829a4aSRandall Stewart 		 * for now we just dump everything on the queue.
5788f8829a4aSRandall Stewart 		 */
5789f8829a4aSRandall Stewart 		chk = TAILQ_FIRST(&asoc->reasmqueue);
5790f8829a4aSRandall Stewart 		while (chk) {
5791f8829a4aSRandall Stewart 			at = TAILQ_NEXT(chk, sctp_next);
5792f8829a4aSRandall Stewart 			if (compare_with_wrap(asoc->cumulative_tsn,
5793f8829a4aSRandall Stewart 			    chk->rec.data.TSN_seq, MAX_TSN) ||
5794f8829a4aSRandall Stewart 			    asoc->cumulative_tsn == chk->rec.data.TSN_seq) {
5795f8829a4aSRandall Stewart 				/* It needs to be tossed */
5796f8829a4aSRandall Stewart 				TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5797f8829a4aSRandall Stewart 				if (compare_with_wrap(chk->rec.data.TSN_seq,
5798f8829a4aSRandall Stewart 				    asoc->tsn_last_delivered, MAX_TSN)) {
5799f8829a4aSRandall Stewart 					asoc->tsn_last_delivered =
5800f8829a4aSRandall Stewart 					    chk->rec.data.TSN_seq;
5801f8829a4aSRandall Stewart 					asoc->str_of_pdapi =
5802f8829a4aSRandall Stewart 					    chk->rec.data.stream_number;
5803f8829a4aSRandall Stewart 					asoc->ssn_of_pdapi =
5804f8829a4aSRandall Stewart 					    chk->rec.data.stream_seq;
5805f8829a4aSRandall Stewart 					asoc->fragment_flags =
5806f8829a4aSRandall Stewart 					    chk->rec.data.rcv_flags;
5807f8829a4aSRandall Stewart 				}
5808f8829a4aSRandall Stewart 				asoc->size_on_reasm_queue -= chk->send_size;
5809f8829a4aSRandall Stewart 				sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5810f8829a4aSRandall Stewart 				cnt_gone++;
5811f8829a4aSRandall Stewart 
5812f8829a4aSRandall Stewart 				/* Clear up any stream problem */
5813f8829a4aSRandall Stewart 				if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) !=
5814f8829a4aSRandall Stewart 				    SCTP_DATA_UNORDERED &&
5815f8829a4aSRandall Stewart 				    (compare_with_wrap(chk->rec.data.stream_seq,
5816f8829a4aSRandall Stewart 				    asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered,
5817f8829a4aSRandall Stewart 				    MAX_SEQ))) {
5818f8829a4aSRandall Stewart 					/*
5819f8829a4aSRandall Stewart 					 * We must dump forward this streams
5820f8829a4aSRandall Stewart 					 * sequence number if the chunk is
5821f8829a4aSRandall Stewart 					 * not unordered that is being
5822f8829a4aSRandall Stewart 					 * skipped. There is a chance that
5823f8829a4aSRandall Stewart 					 * if the peer does not include the
5824f8829a4aSRandall Stewart 					 * last fragment in its FWD-TSN we
5825f8829a4aSRandall Stewart 					 * WILL have a problem here since
5826f8829a4aSRandall Stewart 					 * you would have a partial chunk in
5827f8829a4aSRandall Stewart 					 * queue that may not be
5828f8829a4aSRandall Stewart 					 * deliverable. Also if a Partial
5829f8829a4aSRandall Stewart 					 * delivery API as started the user
5830f8829a4aSRandall Stewart 					 * may get a partial chunk. The next
5831f8829a4aSRandall Stewart 					 * read returning a new chunk...
5832f8829a4aSRandall Stewart 					 * really ugly but I see no way
5833f8829a4aSRandall Stewart 					 * around it! Maybe a notify??
5834f8829a4aSRandall Stewart 					 */
5835f8829a4aSRandall Stewart 					asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered =
5836f8829a4aSRandall Stewart 					    chk->rec.data.stream_seq;
5837f8829a4aSRandall Stewart 				}
5838f8829a4aSRandall Stewart 				if (chk->data) {
5839f8829a4aSRandall Stewart 					sctp_m_freem(chk->data);
5840f8829a4aSRandall Stewart 					chk->data = NULL;
5841f8829a4aSRandall Stewart 				}
5842f8829a4aSRandall Stewart 				sctp_free_remote_addr(chk->whoTo);
5843f8829a4aSRandall Stewart 				sctp_free_a_chunk(stcb, chk);
5844f8829a4aSRandall Stewart 			} else {
5845f8829a4aSRandall Stewart 				/*
5846f8829a4aSRandall Stewart 				 * Ok we have gone beyond the end of the
5847f8829a4aSRandall Stewart 				 * fwd-tsn's mark. Some checks...
5848f8829a4aSRandall Stewart 				 */
5849f8829a4aSRandall Stewart 				if ((asoc->fragmented_delivery_inprogress) &&
5850f8829a4aSRandall Stewart 				    (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
58519a6142d8SRandall Stewart 					uint32_t str_seq;
58529a6142d8SRandall Stewart 
5853f8829a4aSRandall Stewart 					/*
5854f8829a4aSRandall Stewart 					 * Special case PD-API is up and
5855f8829a4aSRandall Stewart 					 * what we fwd-tsn' over includes
5856f8829a4aSRandall Stewart 					 * one that had the LAST_FRAG. We no
5857f8829a4aSRandall Stewart 					 * longer need to do the PD-API.
5858f8829a4aSRandall Stewart 					 */
5859f8829a4aSRandall Stewart 					asoc->fragmented_delivery_inprogress = 0;
58609a6142d8SRandall Stewart 
58619a6142d8SRandall Stewart 					str_seq = (asoc->str_of_pdapi << 16) | asoc->ssn_of_pdapi;
5862f8829a4aSRandall Stewart 					sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
58639a6142d8SRandall Stewart 					    stcb, SCTP_PARTIAL_DELIVERY_ABORTED, (void *)&str_seq);
5864f8829a4aSRandall Stewart 
5865f8829a4aSRandall Stewart 				}
5866f8829a4aSRandall Stewart 				break;
5867f8829a4aSRandall Stewart 			}
5868f8829a4aSRandall Stewart 			chk = at;
5869f8829a4aSRandall Stewart 		}
5870f8829a4aSRandall Stewart 	}
5871f8829a4aSRandall Stewart 	if (asoc->fragmented_delivery_inprogress) {
5872f8829a4aSRandall Stewart 		/*
5873f8829a4aSRandall Stewart 		 * Ok we removed cnt_gone chunks in the PD-API queue that
5874f8829a4aSRandall Stewart 		 * were being delivered. So now we must turn off the flag.
5875f8829a4aSRandall Stewart 		 */
58769a6142d8SRandall Stewart 		uint32_t str_seq;
58779a6142d8SRandall Stewart 
58789a6142d8SRandall Stewart 		str_seq = (asoc->str_of_pdapi << 16) | asoc->ssn_of_pdapi;
5879f8829a4aSRandall Stewart 		sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
58809a6142d8SRandall Stewart 		    stcb, SCTP_PARTIAL_DELIVERY_ABORTED, (void *)&str_seq);
5881f8829a4aSRandall Stewart 		asoc->fragmented_delivery_inprogress = 0;
5882f8829a4aSRandall Stewart 	}
5883f8829a4aSRandall Stewart 	/*************************************************************/
5884f8829a4aSRandall Stewart 	/* 3. Update the PR-stream re-ordering queues                */
5885f8829a4aSRandall Stewart 	/*************************************************************/
5886f8829a4aSRandall Stewart 	stseq = (struct sctp_strseq *)((caddr_t)fwd + sizeof(*fwd));
5887f8829a4aSRandall Stewart 	fwd_sz -= sizeof(*fwd);
5888f8829a4aSRandall Stewart 	{
5889f8829a4aSRandall Stewart 		/* New method. */
5890f8829a4aSRandall Stewart 		int num_str, i;
5891f8829a4aSRandall Stewart 
5892f8829a4aSRandall Stewart 		num_str = fwd_sz / sizeof(struct sctp_strseq);
5893f8829a4aSRandall Stewart 		for (i = 0; i < num_str; i++) {
5894f8829a4aSRandall Stewart 			uint16_t st;
5895f8829a4aSRandall Stewart 			unsigned char *xx;
5896f8829a4aSRandall Stewart 
5897f8829a4aSRandall Stewart 			/* Convert */
5898f8829a4aSRandall Stewart 			xx = (unsigned char *)&stseq[i];
5899f8829a4aSRandall Stewart 			st = ntohs(stseq[i].stream);
5900f8829a4aSRandall Stewart 			stseq[i].stream = st;
5901f8829a4aSRandall Stewart 			st = ntohs(stseq[i].sequence);
5902f8829a4aSRandall Stewart 			stseq[i].sequence = st;
5903f8829a4aSRandall Stewart 			/* now process */
5904f8829a4aSRandall Stewart 			if (stseq[i].stream > asoc->streamincnt) {
5905f8829a4aSRandall Stewart 				/*
5906f8829a4aSRandall Stewart 				 * It is arguable if we should continue.
5907f8829a4aSRandall Stewart 				 * Since the peer sent bogus stream info we
5908f8829a4aSRandall Stewart 				 * may be in deep trouble.. a return may be
5909f8829a4aSRandall Stewart 				 * a better choice?
5910f8829a4aSRandall Stewart 				 */
5911f8829a4aSRandall Stewart 				continue;
5912f8829a4aSRandall Stewart 			}
5913f8829a4aSRandall Stewart 			strm = &asoc->strmin[stseq[i].stream];
5914f8829a4aSRandall Stewart 			if (compare_with_wrap(stseq[i].sequence,
5915f8829a4aSRandall Stewart 			    strm->last_sequence_delivered, MAX_SEQ)) {
5916f8829a4aSRandall Stewart 				/* Update the sequence number */
5917f8829a4aSRandall Stewart 				strm->last_sequence_delivered =
5918f8829a4aSRandall Stewart 				    stseq[i].sequence;
5919f8829a4aSRandall Stewart 			}
5920f8829a4aSRandall Stewart 			/* now kick the stream the new way */
5921f8829a4aSRandall Stewart 			sctp_kick_prsctp_reorder_queue(stcb, strm);
5922f8829a4aSRandall Stewart 		}
5923f8829a4aSRandall Stewart 	}
5924139bc87fSRandall Stewart 	if (TAILQ_FIRST(&asoc->reasmqueue)) {
5925139bc87fSRandall Stewart 		/* now lets kick out and check for more fragmented delivery */
5926139bc87fSRandall Stewart 		sctp_deliver_reasm_check(stcb, &stcb->asoc);
5927139bc87fSRandall Stewart 	}
5928f8829a4aSRandall Stewart }
5929