xref: /freebsd/sys/netinet/sctp_indata.c (revision fc7284da06408923f7850a0e4e954a903b8ee038)
1 /*-
2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions are met:
8  *
9  * a) Redistributions of source code must retain the above copyright notice,
10  *    this list of conditions and the following disclaimer.
11  *
12  * b) Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in
14  *    the documentation and/or other materials provided with the distribution.
15  *
16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
17  *    contributors may be used to endorse or promote products derived
18  *    from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <netinet/sctp_os.h>
37 #include <netinet/sctp_var.h>
38 #include <netinet/sctp_sysctl.h>
39 #include <netinet/sctp_pcb.h>
40 #include <netinet/sctp_header.h>
41 #include <netinet/sctputil.h>
42 #include <netinet/sctp_output.h>
43 #include <netinet/sctp_input.h>
44 #include <netinet/sctp_indata.h>
45 #include <netinet/sctp_uio.h>
46 #include <netinet/sctp_timer.h>
47 
48 
49 /*
50  * NOTES: On the outbound side of things I need to check the sack timer to
51  * see if I should generate a sack into the chunk queue (if I have data to
52  * send that is and will be sending it .. for bundling.
53  *
54  * The callback in sctp_usrreq.c will get called when the socket is read from.
55  * This will cause sctp_service_queues() to get called on the top entry in
56  * the list.
57  */
58 
59 void
60 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
61 {
62 	asoc->my_rwnd = sctp_calc_rwnd(stcb, asoc);
63 }
64 
65 /* Calculate what the rwnd would be */
66 uint32_t
67 sctp_calc_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
68 {
69 	uint32_t calc = 0;
70 
71 	/*
72 	 * This is really set wrong with respect to a 1-2-m socket. Since
73 	 * the sb_cc is the count that everyone as put up. When we re-write
74 	 * sctp_soreceive then we will fix this so that ONLY this
75 	 * associations data is taken into account.
76 	 */
77 	if (stcb->sctp_socket == NULL)
78 		return (calc);
79 
80 	if (stcb->asoc.sb_cc == 0 &&
81 	    asoc->size_on_reasm_queue == 0 &&
82 	    asoc->size_on_all_streams == 0) {
83 		/* Full rwnd granted */
84 		calc = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket), SCTP_MINIMAL_RWND);
85 		return (calc);
86 	}
87 	/* get actual space */
88 	calc = (uint32_t) sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
89 
90 	/*
91 	 * take out what has NOT been put on socket queue and we yet hold
92 	 * for putting up.
93 	 */
94 	calc = sctp_sbspace_sub(calc, (uint32_t) (asoc->size_on_reasm_queue +
95 	    asoc->cnt_on_reasm_queue * MSIZE));
96 	calc = sctp_sbspace_sub(calc, (uint32_t) (asoc->size_on_all_streams +
97 	    asoc->cnt_on_all_streams * MSIZE));
98 
99 	if (calc == 0) {
100 		/* out of space */
101 		return (calc);
102 	}
103 	/* what is the overhead of all these rwnd's */
104 	calc = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
105 	/*
106 	 * If the window gets too small due to ctrl-stuff, reduce it to 1,
107 	 * even it is 0. SWS engaged
108 	 */
109 	if (calc < stcb->asoc.my_rwnd_control_len) {
110 		calc = 1;
111 	}
112 	return (calc);
113 }
114 
115 
116 
117 /*
118  * Build out our readq entry based on the incoming packet.
119  */
120 struct sctp_queued_to_read *
121 sctp_build_readq_entry(struct sctp_tcb *stcb,
122     struct sctp_nets *net,
123     uint32_t tsn, uint32_t ppid,
124     uint32_t context, uint16_t stream_no,
125     uint16_t stream_seq, uint8_t flags,
126     struct mbuf *dm)
127 {
128 	struct sctp_queued_to_read *read_queue_e = NULL;
129 
130 	sctp_alloc_a_readq(stcb, read_queue_e);
131 	if (read_queue_e == NULL) {
132 		goto failed_build;
133 	}
134 	read_queue_e->sinfo_stream = stream_no;
135 	read_queue_e->sinfo_ssn = stream_seq;
136 	read_queue_e->sinfo_flags = (flags << 8);
137 	read_queue_e->sinfo_ppid = ppid;
138 	read_queue_e->sinfo_context = context;
139 	read_queue_e->sinfo_timetolive = 0;
140 	read_queue_e->sinfo_tsn = tsn;
141 	read_queue_e->sinfo_cumtsn = tsn;
142 	read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
143 	read_queue_e->whoFrom = net;
144 	read_queue_e->length = 0;
145 	atomic_add_int(&net->ref_count, 1);
146 	read_queue_e->data = dm;
147 	read_queue_e->spec_flags = 0;
148 	read_queue_e->tail_mbuf = NULL;
149 	read_queue_e->aux_data = NULL;
150 	read_queue_e->stcb = stcb;
151 	read_queue_e->port_from = stcb->rport;
152 	read_queue_e->do_not_ref_stcb = 0;
153 	read_queue_e->end_added = 0;
154 	read_queue_e->some_taken = 0;
155 	read_queue_e->pdapi_aborted = 0;
156 failed_build:
157 	return (read_queue_e);
158 }
159 
160 
161 /*
162  * Build out our readq entry based on the incoming packet.
163  */
164 static struct sctp_queued_to_read *
165 sctp_build_readq_entry_chk(struct sctp_tcb *stcb,
166     struct sctp_tmit_chunk *chk)
167 {
168 	struct sctp_queued_to_read *read_queue_e = NULL;
169 
170 	sctp_alloc_a_readq(stcb, read_queue_e);
171 	if (read_queue_e == NULL) {
172 		goto failed_build;
173 	}
174 	read_queue_e->sinfo_stream = chk->rec.data.stream_number;
175 	read_queue_e->sinfo_ssn = chk->rec.data.stream_seq;
176 	read_queue_e->sinfo_flags = (chk->rec.data.rcv_flags << 8);
177 	read_queue_e->sinfo_ppid = chk->rec.data.payloadtype;
178 	read_queue_e->sinfo_context = stcb->asoc.context;
179 	read_queue_e->sinfo_timetolive = 0;
180 	read_queue_e->sinfo_tsn = chk->rec.data.TSN_seq;
181 	read_queue_e->sinfo_cumtsn = chk->rec.data.TSN_seq;
182 	read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
183 	read_queue_e->whoFrom = chk->whoTo;
184 	read_queue_e->aux_data = NULL;
185 	read_queue_e->length = 0;
186 	atomic_add_int(&chk->whoTo->ref_count, 1);
187 	read_queue_e->data = chk->data;
188 	read_queue_e->tail_mbuf = NULL;
189 	read_queue_e->stcb = stcb;
190 	read_queue_e->port_from = stcb->rport;
191 	read_queue_e->spec_flags = 0;
192 	read_queue_e->do_not_ref_stcb = 0;
193 	read_queue_e->end_added = 0;
194 	read_queue_e->some_taken = 0;
195 	read_queue_e->pdapi_aborted = 0;
196 failed_build:
197 	return (read_queue_e);
198 }
199 
200 
201 struct mbuf *
202 sctp_build_ctl_nchunk(struct sctp_inpcb *inp, struct sctp_sndrcvinfo *sinfo)
203 {
204 	struct sctp_extrcvinfo *seinfo;
205 	struct sctp_sndrcvinfo *outinfo;
206 	struct sctp_rcvinfo *rcvinfo;
207 	struct sctp_nxtinfo *nxtinfo;
208 	struct cmsghdr *cmh;
209 	struct mbuf *ret;
210 	int len;
211 	int use_extended;
212 	int provide_nxt;
213 
214 	if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
215 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
216 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
217 		/* user does not want any ancillary data */
218 		return (NULL);
219 	}
220 	len = 0;
221 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) {
222 		len += CMSG_SPACE(sizeof(struct sctp_rcvinfo));
223 	}
224 	seinfo = (struct sctp_extrcvinfo *)sinfo;
225 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO) &&
226 	    (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_AVAIL)) {
227 		provide_nxt = 1;
228 		len += CMSG_SPACE(sizeof(struct sctp_nxtinfo));
229 	} else {
230 		provide_nxt = 0;
231 	}
232 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
233 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
234 			use_extended = 1;
235 			len += CMSG_SPACE(sizeof(struct sctp_extrcvinfo));
236 		} else {
237 			use_extended = 0;
238 			len += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
239 		}
240 	} else {
241 		use_extended = 0;
242 	}
243 
244 	ret = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
245 	if (ret == NULL) {
246 		/* No space */
247 		return (ret);
248 	}
249 	SCTP_BUF_LEN(ret) = 0;
250 
251 	/* We need a CMSG header followed by the struct */
252 	cmh = mtod(ret, struct cmsghdr *);
253 	/*
254 	 * Make sure that there is no un-initialized padding between the
255 	 * cmsg header and cmsg data and after the cmsg data.
256 	 */
257 	memset(cmh, 0, len);
258 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) {
259 		cmh->cmsg_level = IPPROTO_SCTP;
260 		cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo));
261 		cmh->cmsg_type = SCTP_RCVINFO;
262 		rcvinfo = (struct sctp_rcvinfo *)CMSG_DATA(cmh);
263 		rcvinfo->rcv_sid = sinfo->sinfo_stream;
264 		rcvinfo->rcv_ssn = sinfo->sinfo_ssn;
265 		rcvinfo->rcv_flags = sinfo->sinfo_flags;
266 		rcvinfo->rcv_ppid = sinfo->sinfo_ppid;
267 		rcvinfo->rcv_tsn = sinfo->sinfo_tsn;
268 		rcvinfo->rcv_cumtsn = sinfo->sinfo_cumtsn;
269 		rcvinfo->rcv_context = sinfo->sinfo_context;
270 		rcvinfo->rcv_assoc_id = sinfo->sinfo_assoc_id;
271 		cmh = (struct cmsghdr *)((caddr_t)cmh + CMSG_SPACE(sizeof(struct sctp_rcvinfo)));
272 		SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_rcvinfo));
273 	}
274 	if (provide_nxt) {
275 		cmh->cmsg_level = IPPROTO_SCTP;
276 		cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_nxtinfo));
277 		cmh->cmsg_type = SCTP_NXTINFO;
278 		nxtinfo = (struct sctp_nxtinfo *)CMSG_DATA(cmh);
279 		nxtinfo->nxt_sid = seinfo->serinfo_next_stream;
280 		nxtinfo->nxt_flags = 0;
281 		if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_IS_UNORDERED) {
282 			nxtinfo->nxt_flags |= SCTP_UNORDERED;
283 		}
284 		if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_IS_NOTIFICATION) {
285 			nxtinfo->nxt_flags |= SCTP_NOTIFICATION;
286 		}
287 		if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_ISCOMPLETE) {
288 			nxtinfo->nxt_flags |= SCTP_COMPLETE;
289 		}
290 		nxtinfo->nxt_ppid = seinfo->serinfo_next_ppid;
291 		nxtinfo->nxt_length = seinfo->serinfo_next_length;
292 		nxtinfo->nxt_assoc_id = seinfo->serinfo_next_aid;
293 		cmh = (struct cmsghdr *)((caddr_t)cmh + CMSG_SPACE(sizeof(struct sctp_nxtinfo)));
294 		SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_nxtinfo));
295 	}
296 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
297 		cmh->cmsg_level = IPPROTO_SCTP;
298 		outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
299 		if (use_extended) {
300 			cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_extrcvinfo));
301 			cmh->cmsg_type = SCTP_EXTRCV;
302 			memcpy(outinfo, sinfo, sizeof(struct sctp_extrcvinfo));
303 			SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_extrcvinfo));
304 		} else {
305 			cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
306 			cmh->cmsg_type = SCTP_SNDRCV;
307 			*outinfo = *sinfo;
308 			SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
309 		}
310 	}
311 	return (ret);
312 }
313 
314 
315 static void
316 sctp_mark_non_revokable(struct sctp_association *asoc, uint32_t tsn)
317 {
318 	uint32_t gap, i, cumackp1;
319 	int fnd = 0;
320 
321 	if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
322 		return;
323 	}
324 	cumackp1 = asoc->cumulative_tsn + 1;
325 	if (SCTP_TSN_GT(cumackp1, tsn)) {
326 		/*
327 		 * this tsn is behind the cum ack and thus we don't need to
328 		 * worry about it being moved from one to the other.
329 		 */
330 		return;
331 	}
332 	SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
333 	if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
334 		SCTP_PRINTF("gap:%x tsn:%x\n", gap, tsn);
335 		sctp_print_mapping_array(asoc);
336 #ifdef INVARIANTS
337 		panic("Things are really messed up now!!");
338 #endif
339 	}
340 	SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
341 	SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
342 	if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
343 		asoc->highest_tsn_inside_nr_map = tsn;
344 	}
345 	if (tsn == asoc->highest_tsn_inside_map) {
346 		/* We must back down to see what the new highest is */
347 		for (i = tsn - 1; SCTP_TSN_GE(i, asoc->mapping_array_base_tsn); i--) {
348 			SCTP_CALC_TSN_TO_GAP(gap, i, asoc->mapping_array_base_tsn);
349 			if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
350 				asoc->highest_tsn_inside_map = i;
351 				fnd = 1;
352 				break;
353 			}
354 		}
355 		if (!fnd) {
356 			asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn - 1;
357 		}
358 	}
359 }
360 
361 
362 /*
363  * We are delivering currently from the reassembly queue. We must continue to
364  * deliver until we either: 1) run out of space. 2) run out of sequential
365  * TSN's 3) hit the SCTP_DATA_LAST_FRAG flag.
366  */
367 static void
368 sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc)
369 {
370 	struct sctp_tmit_chunk *chk, *nchk;
371 	uint16_t nxt_todel;
372 	uint16_t stream_no;
373 	int end = 0;
374 	int cntDel;
375 	struct sctp_queued_to_read *control, *ctl, *nctl;
376 
377 	if (stcb == NULL)
378 		return;
379 
380 	cntDel = stream_no = 0;
381 	if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
382 	    (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) ||
383 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
384 		/* socket above is long gone or going.. */
385 abandon:
386 		asoc->fragmented_delivery_inprogress = 0;
387 		TAILQ_FOREACH_SAFE(chk, &asoc->reasmqueue, sctp_next, nchk) {
388 			TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
389 			asoc->size_on_reasm_queue -= chk->send_size;
390 			sctp_ucount_decr(asoc->cnt_on_reasm_queue);
391 			/*
392 			 * Lose the data pointer, since its in the socket
393 			 * buffer
394 			 */
395 			if (chk->data) {
396 				sctp_m_freem(chk->data);
397 				chk->data = NULL;
398 			}
399 			/* Now free the address and data */
400 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
401 			/* sa_ignore FREED_MEMORY */
402 		}
403 		return;
404 	}
405 	SCTP_TCB_LOCK_ASSERT(stcb);
406 	TAILQ_FOREACH_SAFE(chk, &asoc->reasmqueue, sctp_next, nchk) {
407 		if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) {
408 			/* Can't deliver more :< */
409 			return;
410 		}
411 		stream_no = chk->rec.data.stream_number;
412 		nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1;
413 		if (nxt_todel != chk->rec.data.stream_seq &&
414 		    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
415 			/*
416 			 * Not the next sequence to deliver in its stream OR
417 			 * unordered
418 			 */
419 			return;
420 		}
421 		if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
422 
423 			control = sctp_build_readq_entry_chk(stcb, chk);
424 			if (control == NULL) {
425 				/* out of memory? */
426 				return;
427 			}
428 			/* save it off for our future deliveries */
429 			stcb->asoc.control_pdapi = control;
430 			if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG)
431 				end = 1;
432 			else
433 				end = 0;
434 			sctp_mark_non_revokable(asoc, chk->rec.data.TSN_seq);
435 			sctp_add_to_readq(stcb->sctp_ep,
436 			    stcb, control, &stcb->sctp_socket->so_rcv, end,
437 			    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
438 			cntDel++;
439 		} else {
440 			if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG)
441 				end = 1;
442 			else
443 				end = 0;
444 			sctp_mark_non_revokable(asoc, chk->rec.data.TSN_seq);
445 			if (sctp_append_to_readq(stcb->sctp_ep, stcb,
446 			    stcb->asoc.control_pdapi,
447 			    chk->data, end, chk->rec.data.TSN_seq,
448 			    &stcb->sctp_socket->so_rcv)) {
449 				/*
450 				 * something is very wrong, either
451 				 * control_pdapi is NULL, or the tail_mbuf
452 				 * is corrupt, or there is a EOM already on
453 				 * the mbuf chain.
454 				 */
455 				if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
456 					goto abandon;
457 				} else {
458 #ifdef INVARIANTS
459 					if ((stcb->asoc.control_pdapi == NULL) || (stcb->asoc.control_pdapi->tail_mbuf == NULL)) {
460 						panic("This should not happen control_pdapi NULL?");
461 					}
462 					/* if we did not panic, it was a EOM */
463 					panic("Bad chunking ??");
464 #else
465 					if ((stcb->asoc.control_pdapi == NULL) || (stcb->asoc.control_pdapi->tail_mbuf == NULL)) {
466 						SCTP_PRINTF("This should not happen control_pdapi NULL?\n");
467 					}
468 					SCTP_PRINTF("Bad chunking ??\n");
469 					SCTP_PRINTF("Dumping re-assembly queue this will probably hose the association\n");
470 
471 #endif
472 					goto abandon;
473 				}
474 			}
475 			cntDel++;
476 		}
477 		/* pull it we did it */
478 		TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
479 		if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
480 			asoc->fragmented_delivery_inprogress = 0;
481 			if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) {
482 				asoc->strmin[stream_no].last_sequence_delivered++;
483 			}
484 			if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
485 				SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
486 			}
487 		} else if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
488 			/*
489 			 * turn the flag back on since we just  delivered
490 			 * yet another one.
491 			 */
492 			asoc->fragmented_delivery_inprogress = 1;
493 		}
494 		asoc->tsn_of_pdapi_last_delivered = chk->rec.data.TSN_seq;
495 		asoc->last_flags_delivered = chk->rec.data.rcv_flags;
496 		asoc->last_strm_seq_delivered = chk->rec.data.stream_seq;
497 		asoc->last_strm_no_delivered = chk->rec.data.stream_number;
498 
499 		asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
500 		asoc->size_on_reasm_queue -= chk->send_size;
501 		sctp_ucount_decr(asoc->cnt_on_reasm_queue);
502 		/* free up the chk */
503 		chk->data = NULL;
504 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
505 
506 		if (asoc->fragmented_delivery_inprogress == 0) {
507 			/*
508 			 * Now lets see if we can deliver the next one on
509 			 * the stream
510 			 */
511 			struct sctp_stream_in *strm;
512 
513 			strm = &asoc->strmin[stream_no];
514 			nxt_todel = strm->last_sequence_delivered + 1;
515 			TAILQ_FOREACH_SAFE(ctl, &strm->inqueue, next, nctl) {
516 				/* Deliver more if we can. */
517 				if (nxt_todel == ctl->sinfo_ssn) {
518 					TAILQ_REMOVE(&strm->inqueue, ctl, next);
519 					asoc->size_on_all_streams -= ctl->length;
520 					sctp_ucount_decr(asoc->cnt_on_all_streams);
521 					strm->last_sequence_delivered++;
522 					sctp_mark_non_revokable(asoc, ctl->sinfo_tsn);
523 					sctp_add_to_readq(stcb->sctp_ep, stcb,
524 					    ctl,
525 					    &stcb->sctp_socket->so_rcv, 1,
526 					    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
527 				} else {
528 					break;
529 				}
530 				nxt_todel = strm->last_sequence_delivered + 1;
531 			}
532 			break;
533 		}
534 	}
535 }
536 
537 /*
538  * Queue the chunk either right into the socket buffer if it is the next one
539  * to go OR put it in the correct place in the delivery queue.  If we do
540  * append to the so_buf, keep doing so until we are out of order. One big
541  * question still remains, what to do when the socket buffer is FULL??
542  */
543 static void
544 sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc,
545     struct sctp_queued_to_read *control, int *abort_flag)
546 {
547 	/*
548 	 * FIX-ME maybe? What happens when the ssn wraps? If we are getting
549 	 * all the data in one stream this could happen quite rapidly. One
550 	 * could use the TSN to keep track of things, but this scheme breaks
551 	 * down in the other type of stream useage that could occur. Send a
552 	 * single msg to stream 0, send 4Billion messages to stream 1, now
553 	 * send a message to stream 0. You have a situation where the TSN
554 	 * has wrapped but not in the stream. Is this worth worrying about
555 	 * or should we just change our queue sort at the bottom to be by
556 	 * TSN.
557 	 *
558 	 * Could it also be legal for a peer to send ssn 1 with TSN 2 and ssn 2
559 	 * with TSN 1? If the peer is doing some sort of funky TSN/SSN
560 	 * assignment this could happen... and I don't see how this would be
561 	 * a violation. So for now I am undecided an will leave the sort by
562 	 * SSN alone. Maybe a hybred approach is the answer
563 	 *
564 	 */
565 	struct sctp_stream_in *strm;
566 	struct sctp_queued_to_read *at;
567 	int queue_needed;
568 	uint16_t nxt_todel;
569 	struct mbuf *op_err;
570 	char msg[SCTP_DIAG_INFO_LEN];
571 
572 	queue_needed = 1;
573 	asoc->size_on_all_streams += control->length;
574 	sctp_ucount_incr(asoc->cnt_on_all_streams);
575 	strm = &asoc->strmin[control->sinfo_stream];
576 	nxt_todel = strm->last_sequence_delivered + 1;
577 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
578 		sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
579 	}
580 	SCTPDBG(SCTP_DEBUG_INDATA1,
581 	    "queue to stream called for sid:%u ssn:%u tsn:%u lastdel:%u nxt:%u\n",
582 	    (uint32_t) control->sinfo_stream, (uint32_t) control->sinfo_ssn,
583 	    (uint32_t) control->sinfo_tsn,
584 	    (uint32_t) strm->last_sequence_delivered, (uint32_t) nxt_todel);
585 	if (SCTP_SSN_GE(strm->last_sequence_delivered, control->sinfo_ssn)) {
586 		/* The incoming sseq is behind where we last delivered? */
587 		SCTPDBG(SCTP_DEBUG_INDATA1, "Duplicate S-SEQ:%d delivered:%d from peer, Abort association\n",
588 		    control->sinfo_ssn, strm->last_sequence_delivered);
589 protocol_error:
590 		/*
591 		 * throw it in the stream so it gets cleaned up in
592 		 * association destruction
593 		 */
594 		TAILQ_INSERT_HEAD(&strm->inqueue, control, next);
595 		snprintf(msg, sizeof(msg), "Delivered SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
596 		    strm->last_sequence_delivered, control->sinfo_tsn,
597 		    control->sinfo_stream, control->sinfo_ssn);
598 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
599 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_1;
600 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
601 		*abort_flag = 1;
602 		return;
603 
604 	}
605 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
606 	struct socket *so;
607 
608 	so = SCTP_INP_SO(stcb->sctp_ep);
609 	atomic_add_int(&stcb->asoc.refcnt, 1);
610 	SCTP_TCB_UNLOCK(stcb);
611 	SCTP_SOCKET_LOCK(so, 1);
612 	SCTP_TCB_LOCK(stcb);
613 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
614 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
615 		SCTP_SOCKET_UNLOCK(so, 1);
616 		return;
617 	}
618 #endif
619 	if (nxt_todel == control->sinfo_ssn) {
620 		/* can be delivered right away? */
621 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
622 			sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
623 		}
624 		/* EY it wont be queued if it could be delivered directly */
625 		queue_needed = 0;
626 		asoc->size_on_all_streams -= control->length;
627 		sctp_ucount_decr(asoc->cnt_on_all_streams);
628 		strm->last_sequence_delivered++;
629 
630 		sctp_mark_non_revokable(asoc, control->sinfo_tsn);
631 		sctp_add_to_readq(stcb->sctp_ep, stcb,
632 		    control,
633 		    &stcb->sctp_socket->so_rcv, 1,
634 		    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_LOCKED);
635 		TAILQ_FOREACH_SAFE(control, &strm->inqueue, next, at) {
636 			/* all delivered */
637 			nxt_todel = strm->last_sequence_delivered + 1;
638 			if (nxt_todel == control->sinfo_ssn) {
639 				TAILQ_REMOVE(&strm->inqueue, control, next);
640 				asoc->size_on_all_streams -= control->length;
641 				sctp_ucount_decr(asoc->cnt_on_all_streams);
642 				strm->last_sequence_delivered++;
643 				/*
644 				 * We ignore the return of deliver_data here
645 				 * since we always can hold the chunk on the
646 				 * d-queue. And we have a finite number that
647 				 * can be delivered from the strq.
648 				 */
649 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
650 					sctp_log_strm_del(control, NULL,
651 					    SCTP_STR_LOG_FROM_IMMED_DEL);
652 				}
653 				sctp_mark_non_revokable(asoc, control->sinfo_tsn);
654 				sctp_add_to_readq(stcb->sctp_ep, stcb,
655 				    control,
656 				    &stcb->sctp_socket->so_rcv, 1,
657 				    SCTP_READ_LOCK_NOT_HELD,
658 				    SCTP_SO_LOCKED);
659 				continue;
660 			}
661 			break;
662 		}
663 	}
664 	if (queue_needed) {
665 		/*
666 		 * Ok, we did not deliver this guy, find the correct place
667 		 * to put it on the queue.
668 		 */
669 		if (SCTP_TSN_GE(asoc->cumulative_tsn, control->sinfo_tsn)) {
670 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
671 			SCTP_SOCKET_UNLOCK(so, 1);
672 #endif
673 			goto protocol_error;
674 		}
675 		if (TAILQ_EMPTY(&strm->inqueue)) {
676 			/* Empty queue */
677 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
678 				sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INSERT_HD);
679 			}
680 			TAILQ_INSERT_HEAD(&strm->inqueue, control, next);
681 		} else {
682 			TAILQ_FOREACH(at, &strm->inqueue, next) {
683 				if (SCTP_SSN_GT(at->sinfo_ssn, control->sinfo_ssn)) {
684 					/*
685 					 * one in queue is bigger than the
686 					 * new one, insert before this one
687 					 */
688 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
689 						sctp_log_strm_del(control, at,
690 						    SCTP_STR_LOG_FROM_INSERT_MD);
691 					}
692 					TAILQ_INSERT_BEFORE(at, control, next);
693 					break;
694 				} else if (at->sinfo_ssn == control->sinfo_ssn) {
695 					/*
696 					 * Gak, He sent me a duplicate str
697 					 * seq number
698 					 */
699 					/*
700 					 * foo bar, I guess I will just free
701 					 * this new guy, should we abort
702 					 * too? FIX ME MAYBE? Or it COULD be
703 					 * that the SSN's have wrapped.
704 					 * Maybe I should compare to TSN
705 					 * somehow... sigh for now just blow
706 					 * away the chunk!
707 					 */
708 
709 					if (control->data)
710 						sctp_m_freem(control->data);
711 					control->data = NULL;
712 					asoc->size_on_all_streams -= control->length;
713 					sctp_ucount_decr(asoc->cnt_on_all_streams);
714 					if (control->whoFrom) {
715 						sctp_free_remote_addr(control->whoFrom);
716 						control->whoFrom = NULL;
717 					}
718 					sctp_free_a_readq(stcb, control);
719 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
720 					SCTP_SOCKET_UNLOCK(so, 1);
721 #endif
722 					return;
723 				} else {
724 					if (TAILQ_NEXT(at, next) == NULL) {
725 						/*
726 						 * We are at the end, insert
727 						 * it after this one
728 						 */
729 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
730 							sctp_log_strm_del(control, at,
731 							    SCTP_STR_LOG_FROM_INSERT_TL);
732 						}
733 						TAILQ_INSERT_AFTER(&strm->inqueue,
734 						    at, control, next);
735 						break;
736 					}
737 				}
738 			}
739 		}
740 	}
741 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
742 	SCTP_SOCKET_UNLOCK(so, 1);
743 #endif
744 }
745 
746 /*
747  * Returns two things: You get the total size of the deliverable parts of the
748  * first fragmented message on the reassembly queue. And you get a 1 back if
749  * all of the message is ready or a 0 back if the message is still incomplete
750  */
751 static int
752 sctp_is_all_msg_on_reasm(struct sctp_association *asoc, uint32_t * t_size)
753 {
754 	struct sctp_tmit_chunk *chk;
755 	uint32_t tsn;
756 
757 	*t_size = 0;
758 	chk = TAILQ_FIRST(&asoc->reasmqueue);
759 	if (chk == NULL) {
760 		/* nothing on the queue */
761 		return (0);
762 	}
763 	if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
764 		/* Not a first on the queue */
765 		return (0);
766 	}
767 	tsn = chk->rec.data.TSN_seq;
768 	TAILQ_FOREACH(chk, &asoc->reasmqueue, sctp_next) {
769 		if (tsn != chk->rec.data.TSN_seq) {
770 			return (0);
771 		}
772 		*t_size += chk->send_size;
773 		if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
774 			return (1);
775 		}
776 		tsn++;
777 	}
778 	return (0);
779 }
780 
781 static void
782 sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc)
783 {
784 	struct sctp_tmit_chunk *chk;
785 	uint16_t nxt_todel;
786 	uint32_t tsize, pd_point;
787 
788 doit_again:
789 	chk = TAILQ_FIRST(&asoc->reasmqueue);
790 	if (chk == NULL) {
791 		/* Huh? */
792 		asoc->size_on_reasm_queue = 0;
793 		asoc->cnt_on_reasm_queue = 0;
794 		return;
795 	}
796 	if (asoc->fragmented_delivery_inprogress == 0) {
797 		nxt_todel =
798 		    asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
799 		if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
800 		    (nxt_todel == chk->rec.data.stream_seq ||
801 		    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
802 			/*
803 			 * Yep the first one is here and its ok to deliver
804 			 * but should we?
805 			 */
806 			if (stcb->sctp_socket) {
807 				pd_point = min(SCTP_SB_LIMIT_RCV(stcb->sctp_socket) >> SCTP_PARTIAL_DELIVERY_SHIFT,
808 				    stcb->sctp_ep->partial_delivery_point);
809 			} else {
810 				pd_point = stcb->sctp_ep->partial_delivery_point;
811 			}
812 			if (sctp_is_all_msg_on_reasm(asoc, &tsize) || (tsize >= pd_point)) {
813 				/*
814 				 * Yes, we setup to start reception, by
815 				 * backing down the TSN just in case we
816 				 * can't deliver. If we
817 				 */
818 				asoc->fragmented_delivery_inprogress = 1;
819 				asoc->tsn_last_delivered =
820 				    chk->rec.data.TSN_seq - 1;
821 				asoc->str_of_pdapi =
822 				    chk->rec.data.stream_number;
823 				asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
824 				asoc->pdapi_ppid = chk->rec.data.payloadtype;
825 				asoc->fragment_flags = chk->rec.data.rcv_flags;
826 				sctp_service_reassembly(stcb, asoc);
827 			}
828 		}
829 	} else {
830 		/*
831 		 * Service re-assembly will deliver stream data queued at
832 		 * the end of fragmented delivery.. but it wont know to go
833 		 * back and call itself again... we do that here with the
834 		 * got doit_again
835 		 */
836 		sctp_service_reassembly(stcb, asoc);
837 		if (asoc->fragmented_delivery_inprogress == 0) {
838 			/*
839 			 * finished our Fragmented delivery, could be more
840 			 * waiting?
841 			 */
842 			goto doit_again;
843 		}
844 	}
845 }
846 
847 /*
848  * Dump onto the re-assembly queue, in its proper place. After dumping on the
849  * queue, see if anthing can be delivered. If so pull it off (or as much as
850  * we can. If we run out of space then we must dump what we can and set the
851  * appropriate flag to say we queued what we could.
852  */
853 static void
854 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
855     struct sctp_tmit_chunk *chk, int *abort_flag)
856 {
857 	struct mbuf *op_err;
858 	char msg[SCTP_DIAG_INFO_LEN];
859 	uint32_t cum_ackp1, prev_tsn, post_tsn;
860 	struct sctp_tmit_chunk *at, *prev, *next;
861 
862 	prev = next = NULL;
863 	cum_ackp1 = asoc->tsn_last_delivered + 1;
864 	if (TAILQ_EMPTY(&asoc->reasmqueue)) {
865 		/* This is the first one on the queue */
866 		TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next);
867 		/*
868 		 * we do not check for delivery of anything when only one
869 		 * fragment is here
870 		 */
871 		asoc->size_on_reasm_queue = chk->send_size;
872 		sctp_ucount_incr(asoc->cnt_on_reasm_queue);
873 		if (chk->rec.data.TSN_seq == cum_ackp1) {
874 			if (asoc->fragmented_delivery_inprogress == 0 &&
875 			    (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) !=
876 			    SCTP_DATA_FIRST_FRAG) {
877 				/*
878 				 * An empty queue, no delivery inprogress,
879 				 * we hit the next one and it does NOT have
880 				 * a FIRST fragment mark.
881 				 */
882 				SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, its not first, no fragmented delivery in progress\n");
883 				snprintf(msg, sizeof(msg),
884 				    "Expected B-bit for TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
885 				    chk->rec.data.TSN_seq,
886 				    chk->rec.data.stream_number,
887 				    chk->rec.data.stream_seq);
888 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
889 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_2;
890 				sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
891 				*abort_flag = 1;
892 			} else if (asoc->fragmented_delivery_inprogress &&
893 			    (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
894 				/*
895 				 * We are doing a partial delivery and the
896 				 * NEXT chunk MUST be either the LAST or
897 				 * MIDDLE fragment NOT a FIRST
898 				 */
899 				SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it IS a first and fragmented delivery in progress\n");
900 				snprintf(msg, sizeof(msg),
901 				    "Didn't expect B-bit for TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
902 				    chk->rec.data.TSN_seq,
903 				    chk->rec.data.stream_number,
904 				    chk->rec.data.stream_seq);
905 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
906 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_3;
907 				sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
908 				*abort_flag = 1;
909 			} else if (asoc->fragmented_delivery_inprogress) {
910 				/*
911 				 * Here we are ok with a MIDDLE or LAST
912 				 * piece
913 				 */
914 				if (chk->rec.data.stream_number !=
915 				    asoc->str_of_pdapi) {
916 					/* Got to be the right STR No */
917 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it IS not same stream number %d vs %d\n",
918 					    chk->rec.data.stream_number,
919 					    asoc->str_of_pdapi);
920 					snprintf(msg, sizeof(msg),
921 					    "Expected SID=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
922 					    asoc->str_of_pdapi,
923 					    chk->rec.data.TSN_seq,
924 					    chk->rec.data.stream_number,
925 					    chk->rec.data.stream_seq);
926 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
927 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_4;
928 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
929 					*abort_flag = 1;
930 				} else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) !=
931 					    SCTP_DATA_UNORDERED &&
932 				    chk->rec.data.stream_seq != asoc->ssn_of_pdapi) {
933 					/* Got to be the right STR Seq */
934 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it IS not same stream seq %d vs %d\n",
935 					    chk->rec.data.stream_seq,
936 					    asoc->ssn_of_pdapi);
937 					snprintf(msg, sizeof(msg),
938 					    "Expected SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
939 					    asoc->ssn_of_pdapi,
940 					    chk->rec.data.TSN_seq,
941 					    chk->rec.data.stream_number,
942 					    chk->rec.data.stream_seq);
943 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
944 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_5;
945 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
946 					*abort_flag = 1;
947 				}
948 			}
949 		}
950 		return;
951 	}
952 	/* Find its place */
953 	TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
954 		if (SCTP_TSN_GT(at->rec.data.TSN_seq, chk->rec.data.TSN_seq)) {
955 			/*
956 			 * one in queue is bigger than the new one, insert
957 			 * before this one
958 			 */
959 			/* A check */
960 			asoc->size_on_reasm_queue += chk->send_size;
961 			sctp_ucount_incr(asoc->cnt_on_reasm_queue);
962 			next = at;
963 			TAILQ_INSERT_BEFORE(at, chk, sctp_next);
964 			break;
965 		} else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) {
966 			/* Gak, He sent me a duplicate str seq number */
967 			/*
968 			 * foo bar, I guess I will just free this new guy,
969 			 * should we abort too? FIX ME MAYBE? Or it COULD be
970 			 * that the SSN's have wrapped. Maybe I should
971 			 * compare to TSN somehow... sigh for now just blow
972 			 * away the chunk!
973 			 */
974 			if (chk->data) {
975 				sctp_m_freem(chk->data);
976 				chk->data = NULL;
977 			}
978 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
979 			return;
980 		} else {
981 			prev = at;
982 			if (TAILQ_NEXT(at, sctp_next) == NULL) {
983 				/*
984 				 * We are at the end, insert it after this
985 				 * one
986 				 */
987 				/* check it first */
988 				asoc->size_on_reasm_queue += chk->send_size;
989 				sctp_ucount_incr(asoc->cnt_on_reasm_queue);
990 				TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next);
991 				break;
992 			}
993 		}
994 	}
995 	/* Now the audits */
996 	if (prev) {
997 		prev_tsn = chk->rec.data.TSN_seq - 1;
998 		if (prev_tsn == prev->rec.data.TSN_seq) {
999 			/*
1000 			 * Ok the one I am dropping onto the end is the
1001 			 * NEXT. A bit of valdiation here.
1002 			 */
1003 			if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1004 			    SCTP_DATA_FIRST_FRAG ||
1005 			    (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1006 			    SCTP_DATA_MIDDLE_FRAG) {
1007 				/*
1008 				 * Insert chk MUST be a MIDDLE or LAST
1009 				 * fragment
1010 				 */
1011 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1012 				    SCTP_DATA_FIRST_FRAG) {
1013 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - It can be a midlle or last but not a first\n");
1014 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, it's a FIRST!\n");
1015 					snprintf(msg, sizeof(msg),
1016 					    "Can't handle B-bit, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1017 					    chk->rec.data.TSN_seq,
1018 					    chk->rec.data.stream_number,
1019 					    chk->rec.data.stream_seq);
1020 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1021 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_6;
1022 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1023 					*abort_flag = 1;
1024 					return;
1025 				}
1026 				if (chk->rec.data.stream_number !=
1027 				    prev->rec.data.stream_number) {
1028 					/*
1029 					 * Huh, need the correct STR here,
1030 					 * they must be the same.
1031 					 */
1032 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - Gak, Evil plot, sid:%d not the same as at:%d\n",
1033 					    chk->rec.data.stream_number,
1034 					    prev->rec.data.stream_number);
1035 					snprintf(msg, sizeof(msg),
1036 					    "Expect SID=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1037 					    prev->rec.data.stream_number,
1038 					    chk->rec.data.TSN_seq,
1039 					    chk->rec.data.stream_number,
1040 					    chk->rec.data.stream_seq);
1041 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1042 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_7;
1043 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1044 					*abort_flag = 1;
1045 					return;
1046 				}
1047 				if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) !=
1048 				    (prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) {
1049 					/*
1050 					 * Huh, need the same ordering here,
1051 					 * they must be the same.
1052 					 */
1053 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - Gak, Evil plot, U-bit not constant\n");
1054 					snprintf(msg, sizeof(msg),
1055 					    "Expect U-bit=%d for TSN=%8.8x, got U-bit=%d",
1056 					    (prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) ? 1 : 0,
1057 					    chk->rec.data.TSN_seq,
1058 					    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) ? 1 : 0);
1059 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1060 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_8;
1061 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1062 					*abort_flag = 1;
1063 					return;
1064 				}
1065 				if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1066 				    chk->rec.data.stream_seq !=
1067 				    prev->rec.data.stream_seq) {
1068 					/*
1069 					 * Huh, need the correct STR here,
1070 					 * they must be the same.
1071 					 */
1072 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1073 					    chk->rec.data.stream_seq,
1074 					    prev->rec.data.stream_seq);
1075 					snprintf(msg, sizeof(msg),
1076 					    "Expect SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1077 					    prev->rec.data.stream_seq,
1078 					    chk->rec.data.TSN_seq,
1079 					    chk->rec.data.stream_number,
1080 					    chk->rec.data.stream_seq);
1081 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1082 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_9;
1083 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1084 					*abort_flag = 1;
1085 					return;
1086 				}
1087 			} else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1088 			    SCTP_DATA_LAST_FRAG) {
1089 				/* Insert chk MUST be a FIRST */
1090 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1091 				    SCTP_DATA_FIRST_FRAG) {
1092 					SCTPDBG(SCTP_DEBUG_INDATA1, "Prev check - Gak, evil plot, its not FIRST and it must be!\n");
1093 					snprintf(msg, sizeof(msg),
1094 					    "Expect B-bit, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1095 					    chk->rec.data.TSN_seq,
1096 					    chk->rec.data.stream_number,
1097 					    chk->rec.data.stream_seq);
1098 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1099 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_10;
1100 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1101 					*abort_flag = 1;
1102 					return;
1103 				}
1104 			}
1105 		}
1106 	}
1107 	if (next) {
1108 		post_tsn = chk->rec.data.TSN_seq + 1;
1109 		if (post_tsn == next->rec.data.TSN_seq) {
1110 			/*
1111 			 * Ok the one I am inserting ahead of is my NEXT
1112 			 * one. A bit of valdiation here.
1113 			 */
1114 			if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1115 				/* Insert chk MUST be a last fragment */
1116 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK)
1117 				    != SCTP_DATA_LAST_FRAG) {
1118 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Next is FIRST, we must be LAST\n");
1119 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, its not a last!\n");
1120 					snprintf(msg, sizeof(msg),
1121 					    "Expect only E-bit, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1122 					    chk->rec.data.TSN_seq,
1123 					    chk->rec.data.stream_number,
1124 					    chk->rec.data.stream_seq);
1125 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1126 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_11;
1127 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1128 					*abort_flag = 1;
1129 					return;
1130 				}
1131 			} else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1132 				    SCTP_DATA_MIDDLE_FRAG ||
1133 				    (next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1134 			    SCTP_DATA_LAST_FRAG) {
1135 				/*
1136 				 * Insert chk CAN be MIDDLE or FIRST NOT
1137 				 * LAST
1138 				 */
1139 				if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) ==
1140 				    SCTP_DATA_LAST_FRAG) {
1141 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Next is a MIDDLE/LAST\n");
1142 					SCTPDBG(SCTP_DEBUG_INDATA1, "Gak, Evil plot, new prev chunk is a LAST\n");
1143 					snprintf(msg, sizeof(msg),
1144 					    "Didn't expect E-bit, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1145 					    chk->rec.data.TSN_seq,
1146 					    chk->rec.data.stream_number,
1147 					    chk->rec.data.stream_seq);
1148 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1149 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_12;
1150 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1151 					*abort_flag = 1;
1152 					return;
1153 				}
1154 				if (chk->rec.data.stream_number !=
1155 				    next->rec.data.stream_number) {
1156 					/*
1157 					 * Huh, need the correct STR here,
1158 					 * they must be the same.
1159 					 */
1160 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n",
1161 					    chk->rec.data.stream_number,
1162 					    next->rec.data.stream_number);
1163 					snprintf(msg, sizeof(msg),
1164 					    "Required SID %4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1165 					    next->rec.data.stream_number,
1166 					    chk->rec.data.TSN_seq,
1167 					    chk->rec.data.stream_number,
1168 					    chk->rec.data.stream_seq);
1169 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1170 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_13;
1171 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1172 					*abort_flag = 1;
1173 					return;
1174 				}
1175 				if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) !=
1176 				    (next->rec.data.rcv_flags & SCTP_DATA_UNORDERED)) {
1177 					/*
1178 					 * Huh, need the same ordering here,
1179 					 * they must be the same.
1180 					 */
1181 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next check - Gak, Evil plot, U-bit not constant\n");
1182 					snprintf(msg, sizeof(msg),
1183 					    "Expect U-bit=%d for TSN=%8.8x, got U-bit=%d",
1184 					    (next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) ? 1 : 0,
1185 					    chk->rec.data.TSN_seq,
1186 					    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) ? 1 : 0);
1187 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1188 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_14;
1189 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1190 					*abort_flag = 1;
1191 					return;
1192 				}
1193 				if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 &&
1194 				    chk->rec.data.stream_seq !=
1195 				    next->rec.data.stream_seq) {
1196 					/*
1197 					 * Huh, need the correct STR here,
1198 					 * they must be the same.
1199 					 */
1200 					SCTPDBG(SCTP_DEBUG_INDATA1, "Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n",
1201 					    chk->rec.data.stream_seq,
1202 					    next->rec.data.stream_seq);
1203 					snprintf(msg, sizeof(msg),
1204 					    "Required SSN %4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1205 					    next->rec.data.stream_seq,
1206 					    chk->rec.data.TSN_seq,
1207 					    chk->rec.data.stream_number,
1208 					    chk->rec.data.stream_seq);
1209 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1210 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_15;
1211 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1212 					*abort_flag = 1;
1213 					return;
1214 				}
1215 			}
1216 		}
1217 	}
1218 	/* Do we need to do some delivery? check */
1219 	sctp_deliver_reasm_check(stcb, asoc);
1220 }
1221 
1222 /*
1223  * This is an unfortunate routine. It checks to make sure a evil guy is not
1224  * stuffing us full of bad packet fragments. A broken peer could also do this
1225  * but this is doubtful. It is to bad I must worry about evil crackers sigh
1226  * :< more cycles.
1227  */
1228 static int
1229 sctp_does_tsn_belong_to_reasm(struct sctp_association *asoc,
1230     uint32_t TSN_seq)
1231 {
1232 	struct sctp_tmit_chunk *at;
1233 	uint32_t tsn_est;
1234 
1235 	TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) {
1236 		if (SCTP_TSN_GT(TSN_seq, at->rec.data.TSN_seq)) {
1237 			/* is it one bigger? */
1238 			tsn_est = at->rec.data.TSN_seq + 1;
1239 			if (tsn_est == TSN_seq) {
1240 				/* yep. It better be a last then */
1241 				if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1242 				    SCTP_DATA_LAST_FRAG) {
1243 					/*
1244 					 * Ok this guy belongs next to a guy
1245 					 * that is NOT last, it should be a
1246 					 * middle/last, not a complete
1247 					 * chunk.
1248 					 */
1249 					return (1);
1250 				} else {
1251 					/*
1252 					 * This guy is ok since its a LAST
1253 					 * and the new chunk is a fully
1254 					 * self- contained one.
1255 					 */
1256 					return (0);
1257 				}
1258 			}
1259 		} else if (TSN_seq == at->rec.data.TSN_seq) {
1260 			/* Software error since I have a dup? */
1261 			return (1);
1262 		} else {
1263 			/*
1264 			 * Ok, 'at' is larger than new chunk but does it
1265 			 * need to be right before it.
1266 			 */
1267 			tsn_est = TSN_seq + 1;
1268 			if (tsn_est == at->rec.data.TSN_seq) {
1269 				/* Yep, It better be a first */
1270 				if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) !=
1271 				    SCTP_DATA_FIRST_FRAG) {
1272 					return (1);
1273 				} else {
1274 					return (0);
1275 				}
1276 			}
1277 		}
1278 	}
1279 	return (0);
1280 }
1281 
1282 static int
1283 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1284     struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length,
1285     struct sctp_nets *net, uint32_t * high_tsn, int *abort_flag,
1286     int *break_flag, int last_chunk)
1287 {
1288 	/* Process a data chunk */
1289 	/* struct sctp_tmit_chunk *chk; */
1290 	struct sctp_tmit_chunk *chk;
1291 	uint32_t tsn, gap;
1292 	struct mbuf *dmbuf;
1293 	int the_len;
1294 	int need_reasm_check = 0;
1295 	uint16_t strmno, strmseq;
1296 	struct mbuf *op_err;
1297 	char msg[SCTP_DIAG_INFO_LEN];
1298 	struct sctp_queued_to_read *control;
1299 	int ordered;
1300 	uint32_t protocol_id;
1301 	uint8_t chunk_flags;
1302 	struct sctp_stream_reset_list *liste;
1303 
1304 	chk = NULL;
1305 	tsn = ntohl(ch->dp.tsn);
1306 	chunk_flags = ch->ch.chunk_flags;
1307 	if ((chunk_flags & SCTP_DATA_SACK_IMMEDIATELY) == SCTP_DATA_SACK_IMMEDIATELY) {
1308 		asoc->send_sack = 1;
1309 	}
1310 	protocol_id = ch->dp.protocol_id;
1311 	ordered = ((chunk_flags & SCTP_DATA_UNORDERED) == 0);
1312 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
1313 		sctp_log_map(tsn, asoc->cumulative_tsn, asoc->highest_tsn_inside_map, SCTP_MAP_TSN_ENTERS);
1314 	}
1315 	if (stcb == NULL) {
1316 		return (0);
1317 	}
1318 	SCTP_LTRACE_CHK(stcb->sctp_ep, stcb, ch->ch.chunk_type, tsn);
1319 	if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
1320 		/* It is a duplicate */
1321 		SCTP_STAT_INCR(sctps_recvdupdata);
1322 		if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1323 			/* Record a dup for the next outbound sack */
1324 			asoc->dup_tsns[asoc->numduptsns] = tsn;
1325 			asoc->numduptsns++;
1326 		}
1327 		asoc->send_sack = 1;
1328 		return (0);
1329 	}
1330 	/* Calculate the number of TSN's between the base and this TSN */
1331 	SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
1332 	if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1333 		/* Can't hold the bit in the mapping at max array, toss it */
1334 		return (0);
1335 	}
1336 	if (gap >= (uint32_t) (asoc->mapping_array_size << 3)) {
1337 		SCTP_TCB_LOCK_ASSERT(stcb);
1338 		if (sctp_expand_mapping_array(asoc, gap)) {
1339 			/* Can't expand, drop it */
1340 			return (0);
1341 		}
1342 	}
1343 	if (SCTP_TSN_GT(tsn, *high_tsn)) {
1344 		*high_tsn = tsn;
1345 	}
1346 	/* See if we have received this one already */
1347 	if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap) ||
1348 	    SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, gap)) {
1349 		SCTP_STAT_INCR(sctps_recvdupdata);
1350 		if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1351 			/* Record a dup for the next outbound sack */
1352 			asoc->dup_tsns[asoc->numduptsns] = tsn;
1353 			asoc->numduptsns++;
1354 		}
1355 		asoc->send_sack = 1;
1356 		return (0);
1357 	}
1358 	/*
1359 	 * Check to see about the GONE flag, duplicates would cause a sack
1360 	 * to be sent up above
1361 	 */
1362 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
1363 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
1364 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET))) {
1365 		/*
1366 		 * wait a minute, this guy is gone, there is no longer a
1367 		 * receiver. Send peer an ABORT!
1368 		 */
1369 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
1370 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1371 		*abort_flag = 1;
1372 		return (0);
1373 	}
1374 	/*
1375 	 * Now before going further we see if there is room. If NOT then we
1376 	 * MAY let one through only IF this TSN is the one we are waiting
1377 	 * for on a partial delivery API.
1378 	 */
1379 
1380 	/* now do the tests */
1381 	if (((asoc->cnt_on_all_streams +
1382 	    asoc->cnt_on_reasm_queue +
1383 	    asoc->cnt_msg_on_sb) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)) ||
1384 	    (((int)asoc->my_rwnd) <= 0)) {
1385 		/*
1386 		 * When we have NO room in the rwnd we check to make sure
1387 		 * the reader is doing its job...
1388 		 */
1389 		if (stcb->sctp_socket->so_rcv.sb_cc) {
1390 			/* some to read, wake-up */
1391 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1392 			struct socket *so;
1393 
1394 			so = SCTP_INP_SO(stcb->sctp_ep);
1395 			atomic_add_int(&stcb->asoc.refcnt, 1);
1396 			SCTP_TCB_UNLOCK(stcb);
1397 			SCTP_SOCKET_LOCK(so, 1);
1398 			SCTP_TCB_LOCK(stcb);
1399 			atomic_subtract_int(&stcb->asoc.refcnt, 1);
1400 			if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1401 				/* assoc was freed while we were unlocked */
1402 				SCTP_SOCKET_UNLOCK(so, 1);
1403 				return (0);
1404 			}
1405 #endif
1406 			sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1407 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1408 			SCTP_SOCKET_UNLOCK(so, 1);
1409 #endif
1410 		}
1411 		/* now is it in the mapping array of what we have accepted? */
1412 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_map) &&
1413 		    SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1414 			/* Nope not in the valid range dump it */
1415 			sctp_set_rwnd(stcb, asoc);
1416 			if ((asoc->cnt_on_all_streams +
1417 			    asoc->cnt_on_reasm_queue +
1418 			    asoc->cnt_msg_on_sb) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)) {
1419 				SCTP_STAT_INCR(sctps_datadropchklmt);
1420 			} else {
1421 				SCTP_STAT_INCR(sctps_datadroprwnd);
1422 			}
1423 			*break_flag = 1;
1424 			return (0);
1425 		}
1426 	}
1427 	strmno = ntohs(ch->dp.stream_id);
1428 	if (strmno >= asoc->streamincnt) {
1429 		struct sctp_error_invalid_stream *cause;
1430 
1431 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_invalid_stream),
1432 		    0, M_NOWAIT, 1, MT_DATA);
1433 		if (op_err != NULL) {
1434 			/* add some space up front so prepend will work well */
1435 			SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1436 			cause = mtod(op_err, struct sctp_error_invalid_stream *);
1437 			/*
1438 			 * Error causes are just param's and this one has
1439 			 * two back to back phdr, one with the error type
1440 			 * and size, the other with the streamid and a rsvd
1441 			 */
1442 			SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_invalid_stream);
1443 			cause->cause.code = htons(SCTP_CAUSE_INVALID_STREAM);
1444 			cause->cause.length = htons(sizeof(struct sctp_error_invalid_stream));
1445 			cause->stream_id = ch->dp.stream_id;
1446 			cause->reserved = htons(0);
1447 			sctp_queue_op_err(stcb, op_err);
1448 		}
1449 		SCTP_STAT_INCR(sctps_badsid);
1450 		SCTP_TCB_LOCK_ASSERT(stcb);
1451 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
1452 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1453 			asoc->highest_tsn_inside_nr_map = tsn;
1454 		}
1455 		if (tsn == (asoc->cumulative_tsn + 1)) {
1456 			/* Update cum-ack */
1457 			asoc->cumulative_tsn = tsn;
1458 		}
1459 		return (0);
1460 	}
1461 	/*
1462 	 * Before we continue lets validate that we are not being fooled by
1463 	 * an evil attacker. We can only have 4k chunks based on our TSN
1464 	 * spread allowed by the mapping array 512 * 8 bits, so there is no
1465 	 * way our stream sequence numbers could have wrapped. We of course
1466 	 * only validate the FIRST fragment so the bit must be set.
1467 	 */
1468 	strmseq = ntohs(ch->dp.stream_sequence);
1469 #ifdef SCTP_ASOCLOG_OF_TSNS
1470 	SCTP_TCB_LOCK_ASSERT(stcb);
1471 	if (asoc->tsn_in_at >= SCTP_TSN_LOG_SIZE) {
1472 		asoc->tsn_in_at = 0;
1473 		asoc->tsn_in_wrapped = 1;
1474 	}
1475 	asoc->in_tsnlog[asoc->tsn_in_at].tsn = tsn;
1476 	asoc->in_tsnlog[asoc->tsn_in_at].strm = strmno;
1477 	asoc->in_tsnlog[asoc->tsn_in_at].seq = strmseq;
1478 	asoc->in_tsnlog[asoc->tsn_in_at].sz = chk_length;
1479 	asoc->in_tsnlog[asoc->tsn_in_at].flgs = chunk_flags;
1480 	asoc->in_tsnlog[asoc->tsn_in_at].stcb = (void *)stcb;
1481 	asoc->in_tsnlog[asoc->tsn_in_at].in_pos = asoc->tsn_in_at;
1482 	asoc->in_tsnlog[asoc->tsn_in_at].in_out = 1;
1483 	asoc->tsn_in_at++;
1484 #endif
1485 	if ((chunk_flags & SCTP_DATA_FIRST_FRAG) &&
1486 	    (TAILQ_EMPTY(&asoc->resetHead)) &&
1487 	    (chunk_flags & SCTP_DATA_UNORDERED) == 0 &&
1488 	    SCTP_SSN_GE(asoc->strmin[strmno].last_sequence_delivered, strmseq)) {
1489 		/* The incoming sseq is behind where we last delivered? */
1490 		SCTPDBG(SCTP_DEBUG_INDATA1, "EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n",
1491 		    strmseq, asoc->strmin[strmno].last_sequence_delivered);
1492 
1493 		snprintf(msg, sizeof(msg), "Delivered SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1494 		    asoc->strmin[strmno].last_sequence_delivered,
1495 		    tsn, strmno, strmseq);
1496 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1497 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
1498 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1499 		*abort_flag = 1;
1500 		return (0);
1501 	}
1502 	/************************************
1503 	 * From here down we may find ch-> invalid
1504 	 * so its a good idea NOT to use it.
1505 	 *************************************/
1506 
1507 	the_len = (chk_length - sizeof(struct sctp_data_chunk));
1508 	if (last_chunk == 0) {
1509 		dmbuf = SCTP_M_COPYM(*m,
1510 		    (offset + sizeof(struct sctp_data_chunk)),
1511 		    the_len, M_NOWAIT);
1512 #ifdef SCTP_MBUF_LOGGING
1513 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
1514 			sctp_log_mbc(dmbuf, SCTP_MBUF_ICOPY);
1515 		}
1516 #endif
1517 	} else {
1518 		/* We can steal the last chunk */
1519 		int l_len;
1520 
1521 		dmbuf = *m;
1522 		/* lop off the top part */
1523 		m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
1524 		if (SCTP_BUF_NEXT(dmbuf) == NULL) {
1525 			l_len = SCTP_BUF_LEN(dmbuf);
1526 		} else {
1527 			/*
1528 			 * need to count up the size hopefully does not hit
1529 			 * this to often :-0
1530 			 */
1531 			struct mbuf *lat;
1532 
1533 			l_len = 0;
1534 			for (lat = dmbuf; lat; lat = SCTP_BUF_NEXT(lat)) {
1535 				l_len += SCTP_BUF_LEN(lat);
1536 			}
1537 		}
1538 		if (l_len > the_len) {
1539 			/* Trim the end round bytes off  too */
1540 			m_adj(dmbuf, -(l_len - the_len));
1541 		}
1542 	}
1543 	if (dmbuf == NULL) {
1544 		SCTP_STAT_INCR(sctps_nomem);
1545 		return (0);
1546 	}
1547 	if ((chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
1548 	    asoc->fragmented_delivery_inprogress == 0 &&
1549 	    TAILQ_EMPTY(&asoc->resetHead) &&
1550 	    ((ordered == 0) ||
1551 	    ((uint16_t) (asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq &&
1552 	    TAILQ_EMPTY(&asoc->strmin[strmno].inqueue)))) {
1553 		/* Candidate for express delivery */
1554 		/*
1555 		 * Its not fragmented, No PD-API is up, Nothing in the
1556 		 * delivery queue, Its un-ordered OR ordered and the next to
1557 		 * deliver AND nothing else is stuck on the stream queue,
1558 		 * And there is room for it in the socket buffer. Lets just
1559 		 * stuff it up the buffer....
1560 		 */
1561 
1562 		/* It would be nice to avoid this copy if we could :< */
1563 		sctp_alloc_a_readq(stcb, control);
1564 		sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
1565 		    protocol_id,
1566 		    strmno, strmseq,
1567 		    chunk_flags,
1568 		    dmbuf);
1569 		if (control == NULL) {
1570 			goto failed_express_del;
1571 		}
1572 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
1573 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1574 			asoc->highest_tsn_inside_nr_map = tsn;
1575 		}
1576 		sctp_add_to_readq(stcb->sctp_ep, stcb,
1577 		    control, &stcb->sctp_socket->so_rcv,
1578 		    1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
1579 
1580 		if ((chunk_flags & SCTP_DATA_UNORDERED) == 0) {
1581 			/* for ordered, bump what we delivered */
1582 			asoc->strmin[strmno].last_sequence_delivered++;
1583 		}
1584 		SCTP_STAT_INCR(sctps_recvexpress);
1585 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
1586 			sctp_log_strm_del_alt(stcb, tsn, strmseq, strmno,
1587 			    SCTP_STR_LOG_FROM_EXPRS_DEL);
1588 		}
1589 		control = NULL;
1590 
1591 		goto finish_express_del;
1592 	}
1593 failed_express_del:
1594 	/* If we reach here this is a new chunk */
1595 	chk = NULL;
1596 	control = NULL;
1597 	/* Express for fragmented delivery? */
1598 	if ((asoc->fragmented_delivery_inprogress) &&
1599 	    (stcb->asoc.control_pdapi) &&
1600 	    (asoc->str_of_pdapi == strmno) &&
1601 	    (asoc->ssn_of_pdapi == strmseq)
1602 	    ) {
1603 		control = stcb->asoc.control_pdapi;
1604 		if ((chunk_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) {
1605 			/* Can't be another first? */
1606 			goto failed_pdapi_express_del;
1607 		}
1608 		if (tsn == (control->sinfo_tsn + 1)) {
1609 			/* Yep, we can add it on */
1610 			int end = 0;
1611 
1612 			if (chunk_flags & SCTP_DATA_LAST_FRAG) {
1613 				end = 1;
1614 			}
1615 			if (sctp_append_to_readq(stcb->sctp_ep, stcb, control, dmbuf, end,
1616 			    tsn,
1617 			    &stcb->sctp_socket->so_rcv)) {
1618 				SCTP_PRINTF("Append fails end:%d\n", end);
1619 				goto failed_pdapi_express_del;
1620 			}
1621 			SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
1622 			if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1623 				asoc->highest_tsn_inside_nr_map = tsn;
1624 			}
1625 			SCTP_STAT_INCR(sctps_recvexpressm);
1626 			asoc->tsn_last_delivered = tsn;
1627 			asoc->fragment_flags = chunk_flags;
1628 			asoc->tsn_of_pdapi_last_delivered = tsn;
1629 			asoc->last_flags_delivered = chunk_flags;
1630 			asoc->last_strm_seq_delivered = strmseq;
1631 			asoc->last_strm_no_delivered = strmno;
1632 			if (end) {
1633 				/* clean up the flags and such */
1634 				asoc->fragmented_delivery_inprogress = 0;
1635 				if ((chunk_flags & SCTP_DATA_UNORDERED) == 0) {
1636 					asoc->strmin[strmno].last_sequence_delivered++;
1637 				}
1638 				stcb->asoc.control_pdapi = NULL;
1639 				if (TAILQ_EMPTY(&asoc->reasmqueue) == 0) {
1640 					/*
1641 					 * There could be another message
1642 					 * ready
1643 					 */
1644 					need_reasm_check = 1;
1645 				}
1646 			}
1647 			control = NULL;
1648 			goto finish_express_del;
1649 		}
1650 	}
1651 failed_pdapi_express_del:
1652 	control = NULL;
1653 	if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
1654 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
1655 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1656 			asoc->highest_tsn_inside_nr_map = tsn;
1657 		}
1658 	} else {
1659 		SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
1660 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_map)) {
1661 			asoc->highest_tsn_inside_map = tsn;
1662 		}
1663 	}
1664 	if ((chunk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
1665 		sctp_alloc_a_chunk(stcb, chk);
1666 		if (chk == NULL) {
1667 			/* No memory so we drop the chunk */
1668 			SCTP_STAT_INCR(sctps_nomem);
1669 			if (last_chunk == 0) {
1670 				/* we copied it, free the copy */
1671 				sctp_m_freem(dmbuf);
1672 			}
1673 			return (0);
1674 		}
1675 		chk->rec.data.TSN_seq = tsn;
1676 		chk->no_fr_allowed = 0;
1677 		chk->rec.data.stream_seq = strmseq;
1678 		chk->rec.data.stream_number = strmno;
1679 		chk->rec.data.payloadtype = protocol_id;
1680 		chk->rec.data.context = stcb->asoc.context;
1681 		chk->rec.data.doing_fast_retransmit = 0;
1682 		chk->rec.data.rcv_flags = chunk_flags;
1683 		chk->asoc = asoc;
1684 		chk->send_size = the_len;
1685 		chk->whoTo = net;
1686 		atomic_add_int(&net->ref_count, 1);
1687 		chk->data = dmbuf;
1688 	} else {
1689 		sctp_alloc_a_readq(stcb, control);
1690 		sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
1691 		    protocol_id,
1692 		    strmno, strmseq,
1693 		    chunk_flags,
1694 		    dmbuf);
1695 		if (control == NULL) {
1696 			/* No memory so we drop the chunk */
1697 			SCTP_STAT_INCR(sctps_nomem);
1698 			if (last_chunk == 0) {
1699 				/* we copied it, free the copy */
1700 				sctp_m_freem(dmbuf);
1701 			}
1702 			return (0);
1703 		}
1704 		control->length = the_len;
1705 	}
1706 
1707 	/* Mark it as received */
1708 	/* Now queue it where it belongs */
1709 	if (control != NULL) {
1710 		/* First a sanity check */
1711 		if (asoc->fragmented_delivery_inprogress) {
1712 			/*
1713 			 * Ok, we have a fragmented delivery in progress if
1714 			 * this chunk is next to deliver OR belongs in our
1715 			 * view to the reassembly, the peer is evil or
1716 			 * broken.
1717 			 */
1718 			uint32_t estimate_tsn;
1719 
1720 			estimate_tsn = asoc->tsn_last_delivered + 1;
1721 			if (TAILQ_EMPTY(&asoc->reasmqueue) &&
1722 			    (estimate_tsn == control->sinfo_tsn)) {
1723 				/* Evil/Broke peer */
1724 				sctp_m_freem(control->data);
1725 				control->data = NULL;
1726 				if (control->whoFrom) {
1727 					sctp_free_remote_addr(control->whoFrom);
1728 					control->whoFrom = NULL;
1729 				}
1730 				sctp_free_a_readq(stcb, control);
1731 				snprintf(msg, sizeof(msg), "Reas. queue emtpy, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1732 				    tsn, strmno, strmseq);
1733 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1734 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_17;
1735 				sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1736 				*abort_flag = 1;
1737 				if (last_chunk) {
1738 					*m = NULL;
1739 				}
1740 				return (0);
1741 			} else {
1742 				if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
1743 					sctp_m_freem(control->data);
1744 					control->data = NULL;
1745 					if (control->whoFrom) {
1746 						sctp_free_remote_addr(control->whoFrom);
1747 						control->whoFrom = NULL;
1748 					}
1749 					sctp_free_a_readq(stcb, control);
1750 					snprintf(msg, sizeof(msg), "PD ongoing, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1751 					    tsn, strmno, strmseq);
1752 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1753 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_18;
1754 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1755 					*abort_flag = 1;
1756 					if (last_chunk) {
1757 						*m = NULL;
1758 					}
1759 					return (0);
1760 				}
1761 			}
1762 		} else {
1763 			/* No PDAPI running */
1764 			if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
1765 				/*
1766 				 * Reassembly queue is NOT empty validate
1767 				 * that this tsn does not need to be in
1768 				 * reasembly queue. If it does then our peer
1769 				 * is broken or evil.
1770 				 */
1771 				if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
1772 					sctp_m_freem(control->data);
1773 					control->data = NULL;
1774 					if (control->whoFrom) {
1775 						sctp_free_remote_addr(control->whoFrom);
1776 						control->whoFrom = NULL;
1777 					}
1778 					sctp_free_a_readq(stcb, control);
1779 					snprintf(msg, sizeof(msg), "No PD ongoing, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
1780 					    tsn, strmno, strmseq);
1781 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1782 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_19;
1783 					sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1784 					*abort_flag = 1;
1785 					if (last_chunk) {
1786 						*m = NULL;
1787 					}
1788 					return (0);
1789 				}
1790 			}
1791 		}
1792 		/* ok, if we reach here we have passed the sanity checks */
1793 		if (chunk_flags & SCTP_DATA_UNORDERED) {
1794 			/* queue directly into socket buffer */
1795 			sctp_mark_non_revokable(asoc, control->sinfo_tsn);
1796 			sctp_add_to_readq(stcb->sctp_ep, stcb,
1797 			    control,
1798 			    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
1799 		} else {
1800 			/*
1801 			 * Special check for when streams are resetting. We
1802 			 * could be more smart about this and check the
1803 			 * actual stream to see if it is not being reset..
1804 			 * that way we would not create a HOLB when amongst
1805 			 * streams being reset and those not being reset.
1806 			 *
1807 			 * We take complete messages that have a stream reset
1808 			 * intervening (aka the TSN is after where our
1809 			 * cum-ack needs to be) off and put them on a
1810 			 * pending_reply_queue. The reassembly ones we do
1811 			 * not have to worry about since they are all sorted
1812 			 * and proceessed by TSN order. It is only the
1813 			 * singletons I must worry about.
1814 			 */
1815 			if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
1816 			    SCTP_TSN_GT(tsn, liste->tsn)) {
1817 				/*
1818 				 * yep its past where we need to reset... go
1819 				 * ahead and queue it.
1820 				 */
1821 				if (TAILQ_EMPTY(&asoc->pending_reply_queue)) {
1822 					/* first one on */
1823 					TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
1824 				} else {
1825 					struct sctp_queued_to_read *ctlOn,
1826 					                   *nctlOn;
1827 					unsigned char inserted = 0;
1828 
1829 					TAILQ_FOREACH_SAFE(ctlOn, &asoc->pending_reply_queue, next, nctlOn) {
1830 						if (SCTP_TSN_GT(control->sinfo_tsn, ctlOn->sinfo_tsn)) {
1831 							continue;
1832 						} else {
1833 							/* found it */
1834 							TAILQ_INSERT_BEFORE(ctlOn, control, next);
1835 							inserted = 1;
1836 							break;
1837 						}
1838 					}
1839 					if (inserted == 0) {
1840 						/*
1841 						 * must be put at end, use
1842 						 * prevP (all setup from
1843 						 * loop) to setup nextP.
1844 						 */
1845 						TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
1846 					}
1847 				}
1848 			} else {
1849 				sctp_queue_data_to_stream(stcb, asoc, control, abort_flag);
1850 				if (*abort_flag) {
1851 					if (last_chunk) {
1852 						*m = NULL;
1853 					}
1854 					return (0);
1855 				}
1856 			}
1857 		}
1858 	} else {
1859 		/* Into the re-assembly queue */
1860 		sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag);
1861 		if (*abort_flag) {
1862 			/*
1863 			 * the assoc is now gone and chk was put onto the
1864 			 * reasm queue, which has all been freed.
1865 			 */
1866 			if (last_chunk) {
1867 				*m = NULL;
1868 			}
1869 			return (0);
1870 		}
1871 	}
1872 finish_express_del:
1873 	if (tsn == (asoc->cumulative_tsn + 1)) {
1874 		/* Update cum-ack */
1875 		asoc->cumulative_tsn = tsn;
1876 	}
1877 	if (last_chunk) {
1878 		*m = NULL;
1879 	}
1880 	if (ordered) {
1881 		SCTP_STAT_INCR_COUNTER64(sctps_inorderchunks);
1882 	} else {
1883 		SCTP_STAT_INCR_COUNTER64(sctps_inunorderchunks);
1884 	}
1885 	SCTP_STAT_INCR(sctps_recvdata);
1886 	/* Set it present please */
1887 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
1888 		sctp_log_strm_del_alt(stcb, tsn, strmseq, strmno, SCTP_STR_LOG_FROM_MARK_TSN);
1889 	}
1890 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
1891 		sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
1892 		    asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
1893 	}
1894 	/* check the special flag for stream resets */
1895 	if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
1896 	    SCTP_TSN_GE(asoc->cumulative_tsn, liste->tsn)) {
1897 		/*
1898 		 * we have finished working through the backlogged TSN's now
1899 		 * time to reset streams. 1: call reset function. 2: free
1900 		 * pending_reply space 3: distribute any chunks in
1901 		 * pending_reply_queue.
1902 		 */
1903 		struct sctp_queued_to_read *ctl, *nctl;
1904 
1905 		sctp_reset_in_stream(stcb, liste->number_entries, liste->list_of_streams);
1906 		TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
1907 		sctp_send_deferred_reset_response(stcb, liste, SCTP_STREAM_RESET_RESULT_PERFORMED);
1908 		SCTP_FREE(liste, SCTP_M_STRESET);
1909 		/* sa_ignore FREED_MEMORY */
1910 		liste = TAILQ_FIRST(&asoc->resetHead);
1911 		if (TAILQ_EMPTY(&asoc->resetHead)) {
1912 			/* All can be removed */
1913 			TAILQ_FOREACH_SAFE(ctl, &asoc->pending_reply_queue, next, nctl) {
1914 				TAILQ_REMOVE(&asoc->pending_reply_queue, ctl, next);
1915 				sctp_queue_data_to_stream(stcb, asoc, ctl, abort_flag);
1916 				if (*abort_flag) {
1917 					return (0);
1918 				}
1919 			}
1920 		} else {
1921 			TAILQ_FOREACH_SAFE(ctl, &asoc->pending_reply_queue, next, nctl) {
1922 				if (SCTP_TSN_GT(ctl->sinfo_tsn, liste->tsn)) {
1923 					break;
1924 				}
1925 				/*
1926 				 * if ctl->sinfo_tsn is <= liste->tsn we can
1927 				 * process it which is the NOT of
1928 				 * ctl->sinfo_tsn > liste->tsn
1929 				 */
1930 				TAILQ_REMOVE(&asoc->pending_reply_queue, ctl, next);
1931 				sctp_queue_data_to_stream(stcb, asoc, ctl, abort_flag);
1932 				if (*abort_flag) {
1933 					return (0);
1934 				}
1935 			}
1936 		}
1937 		/*
1938 		 * Now service re-assembly to pick up anything that has been
1939 		 * held on reassembly queue?
1940 		 */
1941 		sctp_deliver_reasm_check(stcb, asoc);
1942 		need_reasm_check = 0;
1943 	}
1944 	if (need_reasm_check) {
1945 		/* Another one waits ? */
1946 		sctp_deliver_reasm_check(stcb, asoc);
1947 	}
1948 	return (1);
1949 }
1950 
1951 int8_t sctp_map_lookup_tab[256] = {
1952 	0, 1, 0, 2, 0, 1, 0, 3,
1953 	0, 1, 0, 2, 0, 1, 0, 4,
1954 	0, 1, 0, 2, 0, 1, 0, 3,
1955 	0, 1, 0, 2, 0, 1, 0, 5,
1956 	0, 1, 0, 2, 0, 1, 0, 3,
1957 	0, 1, 0, 2, 0, 1, 0, 4,
1958 	0, 1, 0, 2, 0, 1, 0, 3,
1959 	0, 1, 0, 2, 0, 1, 0, 6,
1960 	0, 1, 0, 2, 0, 1, 0, 3,
1961 	0, 1, 0, 2, 0, 1, 0, 4,
1962 	0, 1, 0, 2, 0, 1, 0, 3,
1963 	0, 1, 0, 2, 0, 1, 0, 5,
1964 	0, 1, 0, 2, 0, 1, 0, 3,
1965 	0, 1, 0, 2, 0, 1, 0, 4,
1966 	0, 1, 0, 2, 0, 1, 0, 3,
1967 	0, 1, 0, 2, 0, 1, 0, 7,
1968 	0, 1, 0, 2, 0, 1, 0, 3,
1969 	0, 1, 0, 2, 0, 1, 0, 4,
1970 	0, 1, 0, 2, 0, 1, 0, 3,
1971 	0, 1, 0, 2, 0, 1, 0, 5,
1972 	0, 1, 0, 2, 0, 1, 0, 3,
1973 	0, 1, 0, 2, 0, 1, 0, 4,
1974 	0, 1, 0, 2, 0, 1, 0, 3,
1975 	0, 1, 0, 2, 0, 1, 0, 6,
1976 	0, 1, 0, 2, 0, 1, 0, 3,
1977 	0, 1, 0, 2, 0, 1, 0, 4,
1978 	0, 1, 0, 2, 0, 1, 0, 3,
1979 	0, 1, 0, 2, 0, 1, 0, 5,
1980 	0, 1, 0, 2, 0, 1, 0, 3,
1981 	0, 1, 0, 2, 0, 1, 0, 4,
1982 	0, 1, 0, 2, 0, 1, 0, 3,
1983 	0, 1, 0, 2, 0, 1, 0, 8
1984 };
1985 
1986 
1987 void
1988 sctp_slide_mapping_arrays(struct sctp_tcb *stcb)
1989 {
1990 	/*
1991 	 * Now we also need to check the mapping array in a couple of ways.
1992 	 * 1) Did we move the cum-ack point?
1993 	 *
1994 	 * When you first glance at this you might think that all entries that
1995 	 * make up the postion of the cum-ack would be in the nr-mapping
1996 	 * array only.. i.e. things up to the cum-ack are always
1997 	 * deliverable. Thats true with one exception, when its a fragmented
1998 	 * message we may not deliver the data until some threshold (or all
1999 	 * of it) is in place. So we must OR the nr_mapping_array and
2000 	 * mapping_array to get a true picture of the cum-ack.
2001 	 */
2002 	struct sctp_association *asoc;
2003 	int at;
2004 	uint8_t val;
2005 	int slide_from, slide_end, lgap, distance;
2006 	uint32_t old_cumack, old_base, old_highest, highest_tsn;
2007 
2008 	asoc = &stcb->asoc;
2009 
2010 	old_cumack = asoc->cumulative_tsn;
2011 	old_base = asoc->mapping_array_base_tsn;
2012 	old_highest = asoc->highest_tsn_inside_map;
2013 	/*
2014 	 * We could probably improve this a small bit by calculating the
2015 	 * offset of the current cum-ack as the starting point.
2016 	 */
2017 	at = 0;
2018 	for (slide_from = 0; slide_from < stcb->asoc.mapping_array_size; slide_from++) {
2019 		val = asoc->nr_mapping_array[slide_from] | asoc->mapping_array[slide_from];
2020 		if (val == 0xff) {
2021 			at += 8;
2022 		} else {
2023 			/* there is a 0 bit */
2024 			at += sctp_map_lookup_tab[val];
2025 			break;
2026 		}
2027 	}
2028 	asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - 1);
2029 
2030 	if (SCTP_TSN_GT(asoc->cumulative_tsn, asoc->highest_tsn_inside_map) &&
2031 	    SCTP_TSN_GT(asoc->cumulative_tsn, asoc->highest_tsn_inside_nr_map)) {
2032 #ifdef INVARIANTS
2033 		panic("huh, cumack 0x%x greater than high-tsn 0x%x in map",
2034 		    asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
2035 #else
2036 		SCTP_PRINTF("huh, cumack 0x%x greater than high-tsn 0x%x in map - should panic?\n",
2037 		    asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
2038 		sctp_print_mapping_array(asoc);
2039 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2040 			sctp_log_map(0, 6, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2041 		}
2042 		asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2043 		asoc->highest_tsn_inside_nr_map = asoc->cumulative_tsn;
2044 #endif
2045 	}
2046 	if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2047 		highest_tsn = asoc->highest_tsn_inside_nr_map;
2048 	} else {
2049 		highest_tsn = asoc->highest_tsn_inside_map;
2050 	}
2051 	if ((asoc->cumulative_tsn == highest_tsn) && (at >= 8)) {
2052 		/* The complete array was completed by a single FR */
2053 		/* highest becomes the cum-ack */
2054 		int clr;
2055 
2056 #ifdef INVARIANTS
2057 		unsigned int i;
2058 
2059 #endif
2060 
2061 		/* clear the array */
2062 		clr = ((at + 7) >> 3);
2063 		if (clr > asoc->mapping_array_size) {
2064 			clr = asoc->mapping_array_size;
2065 		}
2066 		memset(asoc->mapping_array, 0, clr);
2067 		memset(asoc->nr_mapping_array, 0, clr);
2068 #ifdef INVARIANTS
2069 		for (i = 0; i < asoc->mapping_array_size; i++) {
2070 			if ((asoc->mapping_array[i]) || (asoc->nr_mapping_array[i])) {
2071 				SCTP_PRINTF("Error Mapping array's not clean at clear\n");
2072 				sctp_print_mapping_array(asoc);
2073 			}
2074 		}
2075 #endif
2076 		asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2077 		asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2078 	} else if (at >= 8) {
2079 		/* we can slide the mapping array down */
2080 		/* slide_from holds where we hit the first NON 0xff byte */
2081 
2082 		/*
2083 		 * now calculate the ceiling of the move using our highest
2084 		 * TSN value
2085 		 */
2086 		SCTP_CALC_TSN_TO_GAP(lgap, highest_tsn, asoc->mapping_array_base_tsn);
2087 		slide_end = (lgap >> 3);
2088 		if (slide_end < slide_from) {
2089 			sctp_print_mapping_array(asoc);
2090 #ifdef INVARIANTS
2091 			panic("impossible slide");
2092 #else
2093 			SCTP_PRINTF("impossible slide lgap:%x slide_end:%x slide_from:%x? at:%d\n",
2094 			    lgap, slide_end, slide_from, at);
2095 			return;
2096 #endif
2097 		}
2098 		if (slide_end > asoc->mapping_array_size) {
2099 #ifdef INVARIANTS
2100 			panic("would overrun buffer");
2101 #else
2102 			SCTP_PRINTF("Gak, would have overrun map end:%d slide_end:%d\n",
2103 			    asoc->mapping_array_size, slide_end);
2104 			slide_end = asoc->mapping_array_size;
2105 #endif
2106 		}
2107 		distance = (slide_end - slide_from) + 1;
2108 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2109 			sctp_log_map(old_base, old_cumack, old_highest,
2110 			    SCTP_MAP_PREPARE_SLIDE);
2111 			sctp_log_map((uint32_t) slide_from, (uint32_t) slide_end,
2112 			    (uint32_t) lgap, SCTP_MAP_SLIDE_FROM);
2113 		}
2114 		if (distance + slide_from > asoc->mapping_array_size ||
2115 		    distance < 0) {
2116 			/*
2117 			 * Here we do NOT slide forward the array so that
2118 			 * hopefully when more data comes in to fill it up
2119 			 * we will be able to slide it forward. Really I
2120 			 * don't think this should happen :-0
2121 			 */
2122 
2123 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2124 				sctp_log_map((uint32_t) distance, (uint32_t) slide_from,
2125 				    (uint32_t) asoc->mapping_array_size,
2126 				    SCTP_MAP_SLIDE_NONE);
2127 			}
2128 		} else {
2129 			int ii;
2130 
2131 			for (ii = 0; ii < distance; ii++) {
2132 				asoc->mapping_array[ii] = asoc->mapping_array[slide_from + ii];
2133 				asoc->nr_mapping_array[ii] = asoc->nr_mapping_array[slide_from + ii];
2134 
2135 			}
2136 			for (ii = distance; ii < asoc->mapping_array_size; ii++) {
2137 				asoc->mapping_array[ii] = 0;
2138 				asoc->nr_mapping_array[ii] = 0;
2139 			}
2140 			if (asoc->highest_tsn_inside_map + 1 == asoc->mapping_array_base_tsn) {
2141 				asoc->highest_tsn_inside_map += (slide_from << 3);
2142 			}
2143 			if (asoc->highest_tsn_inside_nr_map + 1 == asoc->mapping_array_base_tsn) {
2144 				asoc->highest_tsn_inside_nr_map += (slide_from << 3);
2145 			}
2146 			asoc->mapping_array_base_tsn += (slide_from << 3);
2147 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2148 				sctp_log_map(asoc->mapping_array_base_tsn,
2149 				    asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2150 				    SCTP_MAP_SLIDE_RESULT);
2151 			}
2152 		}
2153 	}
2154 }
2155 
2156 void
2157 sctp_sack_check(struct sctp_tcb *stcb, int was_a_gap)
2158 {
2159 	struct sctp_association *asoc;
2160 	uint32_t highest_tsn;
2161 
2162 	asoc = &stcb->asoc;
2163 	if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2164 		highest_tsn = asoc->highest_tsn_inside_nr_map;
2165 	} else {
2166 		highest_tsn = asoc->highest_tsn_inside_map;
2167 	}
2168 
2169 	/*
2170 	 * Now we need to see if we need to queue a sack or just start the
2171 	 * timer (if allowed).
2172 	 */
2173 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2174 		/*
2175 		 * Ok special case, in SHUTDOWN-SENT case. here we maker
2176 		 * sure SACK timer is off and instead send a SHUTDOWN and a
2177 		 * SACK
2178 		 */
2179 		if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2180 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2181 			    stcb->sctp_ep, stcb, NULL,
2182 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_20);
2183 		}
2184 		sctp_send_shutdown(stcb,
2185 		    ((stcb->asoc.alternate) ? stcb->asoc.alternate : stcb->asoc.primary_destination));
2186 		sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
2187 	} else {
2188 		int is_a_gap;
2189 
2190 		/* is there a gap now ? */
2191 		is_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
2192 
2193 		/*
2194 		 * CMT DAC algorithm: increase number of packets received
2195 		 * since last ack
2196 		 */
2197 		stcb->asoc.cmt_dac_pkts_rcvd++;
2198 
2199 		if ((stcb->asoc.send_sack == 1) ||	/* We need to send a
2200 							 * SACK */
2201 		    ((was_a_gap) && (is_a_gap == 0)) ||	/* was a gap, but no
2202 							 * longer is one */
2203 		    (stcb->asoc.numduptsns) ||	/* we have dup's */
2204 		    (is_a_gap) ||	/* is still a gap */
2205 		    (stcb->asoc.delayed_ack == 0) ||	/* Delayed sack disabled */
2206 		    (stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq)	/* hit limit of pkts */
2207 		    ) {
2208 
2209 			if ((stcb->asoc.sctp_cmt_on_off > 0) &&
2210 			    (SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) &&
2211 			    (stcb->asoc.send_sack == 0) &&
2212 			    (stcb->asoc.numduptsns == 0) &&
2213 			    (stcb->asoc.delayed_ack) &&
2214 			    (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer))) {
2215 
2216 				/*
2217 				 * CMT DAC algorithm: With CMT, delay acks
2218 				 * even in the face of
2219 				 *
2220 				 * reordering. Therefore, if acks that do not
2221 				 * have to be sent because of the above
2222 				 * reasons, will be delayed. That is, acks
2223 				 * that would have been sent due to gap
2224 				 * reports will be delayed with DAC. Start
2225 				 * the delayed ack timer.
2226 				 */
2227 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2228 				    stcb->sctp_ep, stcb, NULL);
2229 			} else {
2230 				/*
2231 				 * Ok we must build a SACK since the timer
2232 				 * is pending, we got our first packet OR
2233 				 * there are gaps or duplicates.
2234 				 */
2235 				(void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
2236 				sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
2237 			}
2238 		} else {
2239 			if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2240 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2241 				    stcb->sctp_ep, stcb, NULL);
2242 			}
2243 		}
2244 	}
2245 }
2246 
2247 void
2248 sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc)
2249 {
2250 	struct sctp_tmit_chunk *chk;
2251 	uint32_t tsize, pd_point;
2252 	uint16_t nxt_todel;
2253 
2254 	if (asoc->fragmented_delivery_inprogress) {
2255 		sctp_service_reassembly(stcb, asoc);
2256 	}
2257 	/* Can we proceed further, i.e. the PD-API is complete */
2258 	if (asoc->fragmented_delivery_inprogress) {
2259 		/* no */
2260 		return;
2261 	}
2262 	/*
2263 	 * Now is there some other chunk I can deliver from the reassembly
2264 	 * queue.
2265 	 */
2266 doit_again:
2267 	chk = TAILQ_FIRST(&asoc->reasmqueue);
2268 	if (chk == NULL) {
2269 		asoc->size_on_reasm_queue = 0;
2270 		asoc->cnt_on_reasm_queue = 0;
2271 		return;
2272 	}
2273 	nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1;
2274 	if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) &&
2275 	    ((nxt_todel == chk->rec.data.stream_seq) ||
2276 	    (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) {
2277 		/*
2278 		 * Yep the first one is here. We setup to start reception,
2279 		 * by backing down the TSN just in case we can't deliver.
2280 		 */
2281 
2282 		/*
2283 		 * Before we start though either all of the message should
2284 		 * be here or the socket buffer max or nothing on the
2285 		 * delivery queue and something can be delivered.
2286 		 */
2287 		if (stcb->sctp_socket) {
2288 			pd_point = min(SCTP_SB_LIMIT_RCV(stcb->sctp_socket) >> SCTP_PARTIAL_DELIVERY_SHIFT,
2289 			    stcb->sctp_ep->partial_delivery_point);
2290 		} else {
2291 			pd_point = stcb->sctp_ep->partial_delivery_point;
2292 		}
2293 		if (sctp_is_all_msg_on_reasm(asoc, &tsize) || (tsize >= pd_point)) {
2294 			asoc->fragmented_delivery_inprogress = 1;
2295 			asoc->tsn_last_delivered = chk->rec.data.TSN_seq - 1;
2296 			asoc->str_of_pdapi = chk->rec.data.stream_number;
2297 			asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
2298 			asoc->pdapi_ppid = chk->rec.data.payloadtype;
2299 			asoc->fragment_flags = chk->rec.data.rcv_flags;
2300 			sctp_service_reassembly(stcb, asoc);
2301 			if (asoc->fragmented_delivery_inprogress == 0) {
2302 				goto doit_again;
2303 			}
2304 		}
2305 	}
2306 }
2307 
2308 int
2309 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2310     struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2311     struct sctp_nets *net, uint32_t * high_tsn)
2312 {
2313 	struct sctp_data_chunk *ch, chunk_buf;
2314 	struct sctp_association *asoc;
2315 	int num_chunks = 0;	/* number of control chunks processed */
2316 	int stop_proc = 0;
2317 	int chk_length, break_flag, last_chunk;
2318 	int abort_flag = 0, was_a_gap;
2319 	struct mbuf *m;
2320 	uint32_t highest_tsn;
2321 
2322 	/* set the rwnd */
2323 	sctp_set_rwnd(stcb, &stcb->asoc);
2324 
2325 	m = *mm;
2326 	SCTP_TCB_LOCK_ASSERT(stcb);
2327 	asoc = &stcb->asoc;
2328 	if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2329 		highest_tsn = asoc->highest_tsn_inside_nr_map;
2330 	} else {
2331 		highest_tsn = asoc->highest_tsn_inside_map;
2332 	}
2333 	was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
2334 	/*
2335 	 * setup where we got the last DATA packet from for any SACK that
2336 	 * may need to go out. Don't bump the net. This is done ONLY when a
2337 	 * chunk is assigned.
2338 	 */
2339 	asoc->last_data_chunk_from = net;
2340 
2341 	/*-
2342 	 * Now before we proceed we must figure out if this is a wasted
2343 	 * cluster... i.e. it is a small packet sent in and yet the driver
2344 	 * underneath allocated a full cluster for it. If so we must copy it
2345 	 * to a smaller mbuf and free up the cluster mbuf. This will help
2346 	 * with cluster starvation. Note for __Panda__ we don't do this
2347 	 * since it has clusters all the way down to 64 bytes.
2348 	 */
2349 	if (SCTP_BUF_LEN(m) < (long)MLEN && SCTP_BUF_NEXT(m) == NULL) {
2350 		/* we only handle mbufs that are singletons.. not chains */
2351 		m = sctp_get_mbuf_for_msg(SCTP_BUF_LEN(m), 0, M_NOWAIT, 1, MT_DATA);
2352 		if (m) {
2353 			/* ok lets see if we can copy the data up */
2354 			caddr_t *from, *to;
2355 
2356 			/* get the pointers and copy */
2357 			to = mtod(m, caddr_t *);
2358 			from = mtod((*mm), caddr_t *);
2359 			memcpy(to, from, SCTP_BUF_LEN((*mm)));
2360 			/* copy the length and free up the old */
2361 			SCTP_BUF_LEN(m) = SCTP_BUF_LEN((*mm));
2362 			sctp_m_freem(*mm);
2363 			/* sucess, back copy */
2364 			*mm = m;
2365 		} else {
2366 			/* We are in trouble in the mbuf world .. yikes */
2367 			m = *mm;
2368 		}
2369 	}
2370 	/* get pointer to the first chunk header */
2371 	ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2372 	    sizeof(struct sctp_data_chunk), (uint8_t *) & chunk_buf);
2373 	if (ch == NULL) {
2374 		return (1);
2375 	}
2376 	/*
2377 	 * process all DATA chunks...
2378 	 */
2379 	*high_tsn = asoc->cumulative_tsn;
2380 	break_flag = 0;
2381 	asoc->data_pkts_seen++;
2382 	while (stop_proc == 0) {
2383 		/* validate chunk length */
2384 		chk_length = ntohs(ch->ch.chunk_length);
2385 		if (length - *offset < chk_length) {
2386 			/* all done, mutulated chunk */
2387 			stop_proc = 1;
2388 			continue;
2389 		}
2390 		if (ch->ch.chunk_type == SCTP_DATA) {
2391 			if ((size_t)chk_length < sizeof(struct sctp_data_chunk)) {
2392 				/*
2393 				 * Need to send an abort since we had a
2394 				 * invalid data chunk.
2395 				 */
2396 				struct mbuf *op_err;
2397 				char msg[SCTP_DIAG_INFO_LEN];
2398 
2399 				snprintf(msg, sizeof(msg), "DATA chunk of length %d",
2400 				    chk_length);
2401 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2402 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_21;
2403 				sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2404 				return (2);
2405 			}
2406 			if ((size_t)chk_length == sizeof(struct sctp_data_chunk)) {
2407 				/*
2408 				 * Need to send an abort since we had an
2409 				 * empty data chunk.
2410 				 */
2411 				struct mbuf *op_err;
2412 
2413 				op_err = sctp_generate_no_user_data_cause(ch->dp.tsn);
2414 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_22;
2415 				sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2416 				return (2);
2417 			}
2418 #ifdef SCTP_AUDITING_ENABLED
2419 			sctp_audit_log(0xB1, 0);
2420 #endif
2421 			if (SCTP_SIZE32(chk_length) == (length - *offset)) {
2422 				last_chunk = 1;
2423 			} else {
2424 				last_chunk = 0;
2425 			}
2426 			if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch,
2427 			    chk_length, net, high_tsn, &abort_flag, &break_flag,
2428 			    last_chunk)) {
2429 				num_chunks++;
2430 			}
2431 			if (abort_flag)
2432 				return (2);
2433 
2434 			if (break_flag) {
2435 				/*
2436 				 * Set because of out of rwnd space and no
2437 				 * drop rep space left.
2438 				 */
2439 				stop_proc = 1;
2440 				continue;
2441 			}
2442 		} else {
2443 			/* not a data chunk in the data region */
2444 			switch (ch->ch.chunk_type) {
2445 			case SCTP_INITIATION:
2446 			case SCTP_INITIATION_ACK:
2447 			case SCTP_SELECTIVE_ACK:
2448 			case SCTP_NR_SELECTIVE_ACK:
2449 			case SCTP_HEARTBEAT_REQUEST:
2450 			case SCTP_HEARTBEAT_ACK:
2451 			case SCTP_ABORT_ASSOCIATION:
2452 			case SCTP_SHUTDOWN:
2453 			case SCTP_SHUTDOWN_ACK:
2454 			case SCTP_OPERATION_ERROR:
2455 			case SCTP_COOKIE_ECHO:
2456 			case SCTP_COOKIE_ACK:
2457 			case SCTP_ECN_ECHO:
2458 			case SCTP_ECN_CWR:
2459 			case SCTP_SHUTDOWN_COMPLETE:
2460 			case SCTP_AUTHENTICATION:
2461 			case SCTP_ASCONF_ACK:
2462 			case SCTP_PACKET_DROPPED:
2463 			case SCTP_STREAM_RESET:
2464 			case SCTP_FORWARD_CUM_TSN:
2465 			case SCTP_ASCONF:
2466 				/*
2467 				 * Now, what do we do with KNOWN chunks that
2468 				 * are NOT in the right place?
2469 				 *
2470 				 * For now, I do nothing but ignore them. We
2471 				 * may later want to add sysctl stuff to
2472 				 * switch out and do either an ABORT() or
2473 				 * possibly process them.
2474 				 */
2475 				if (SCTP_BASE_SYSCTL(sctp_strict_data_order)) {
2476 					struct mbuf *op_err;
2477 					char msg[SCTP_DIAG_INFO_LEN];
2478 
2479 					snprintf(msg, sizeof(msg), "DATA chunk followed by chunk of type %2.2x",
2480 					    ch->ch.chunk_type);
2481 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2482 					sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2483 					return (2);
2484 				}
2485 				break;
2486 			default:
2487 				/* unknown chunk type, use bit rules */
2488 				if (ch->ch.chunk_type & 0x40) {
2489 					/* Add a error report to the queue */
2490 					struct mbuf *op_err;
2491 					struct sctp_gen_error_cause *cause;
2492 
2493 					op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
2494 					    0, M_NOWAIT, 1, MT_DATA);
2495 					if (op_err != NULL) {
2496 						cause = mtod(op_err, struct sctp_gen_error_cause *);
2497 						cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
2498 						cause->length = htons(chk_length + sizeof(struct sctp_gen_error_cause));
2499 						SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
2500 						SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, chk_length, M_NOWAIT);
2501 						if (SCTP_BUF_NEXT(op_err) != NULL) {
2502 							sctp_queue_op_err(stcb, op_err);
2503 						} else {
2504 							sctp_m_freem(op_err);
2505 						}
2506 					}
2507 				}
2508 				if ((ch->ch.chunk_type & 0x80) == 0) {
2509 					/* discard the rest of this packet */
2510 					stop_proc = 1;
2511 				}	/* else skip this bad chunk and
2512 					 * continue... */
2513 				break;
2514 			}	/* switch of chunk type */
2515 		}
2516 		*offset += SCTP_SIZE32(chk_length);
2517 		if ((*offset >= length) || stop_proc) {
2518 			/* no more data left in the mbuf chain */
2519 			stop_proc = 1;
2520 			continue;
2521 		}
2522 		ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset,
2523 		    sizeof(struct sctp_data_chunk), (uint8_t *) & chunk_buf);
2524 		if (ch == NULL) {
2525 			*offset = length;
2526 			stop_proc = 1;
2527 			continue;
2528 		}
2529 	}
2530 	if (break_flag) {
2531 		/*
2532 		 * we need to report rwnd overrun drops.
2533 		 */
2534 		sctp_send_packet_dropped(stcb, net, *mm, length, iphlen, 0);
2535 	}
2536 	if (num_chunks) {
2537 		/*
2538 		 * Did we get data, if so update the time for auto-close and
2539 		 * give peer credit for being alive.
2540 		 */
2541 		SCTP_STAT_INCR(sctps_recvpktwithdata);
2542 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
2543 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
2544 			    stcb->asoc.overall_error_count,
2545 			    0,
2546 			    SCTP_FROM_SCTP_INDATA,
2547 			    __LINE__);
2548 		}
2549 		stcb->asoc.overall_error_count = 0;
2550 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2551 	}
2552 	/* now service all of the reassm queue if needed */
2553 	if (!(TAILQ_EMPTY(&asoc->reasmqueue)))
2554 		sctp_service_queues(stcb, asoc);
2555 
2556 	if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
2557 		/* Assure that we ack right away */
2558 		stcb->asoc.send_sack = 1;
2559 	}
2560 	/* Start a sack timer or QUEUE a SACK for sending */
2561 	sctp_sack_check(stcb, was_a_gap);
2562 	return (0);
2563 }
2564 
2565 static int
2566 sctp_process_segment_range(struct sctp_tcb *stcb, struct sctp_tmit_chunk **p_tp1, uint32_t last_tsn,
2567     uint16_t frag_strt, uint16_t frag_end, int nr_sacking,
2568     int *num_frs,
2569     uint32_t * biggest_newly_acked_tsn,
2570     uint32_t * this_sack_lowest_newack,
2571     int *rto_ok)
2572 {
2573 	struct sctp_tmit_chunk *tp1;
2574 	unsigned int theTSN;
2575 	int j, wake_him = 0, circled = 0;
2576 
2577 	/* Recover the tp1 we last saw */
2578 	tp1 = *p_tp1;
2579 	if (tp1 == NULL) {
2580 		tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2581 	}
2582 	for (j = frag_strt; j <= frag_end; j++) {
2583 		theTSN = j + last_tsn;
2584 		while (tp1) {
2585 			if (tp1->rec.data.doing_fast_retransmit)
2586 				(*num_frs) += 1;
2587 
2588 			/*-
2589 			 * CMT: CUCv2 algorithm. For each TSN being
2590 			 * processed from the sent queue, track the
2591 			 * next expected pseudo-cumack, or
2592 			 * rtx_pseudo_cumack, if required. Separate
2593 			 * cumack trackers for first transmissions,
2594 			 * and retransmissions.
2595 			 */
2596 			if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
2597 			    (tp1->whoTo->find_pseudo_cumack == 1) &&
2598 			    (tp1->snd_count == 1)) {
2599 				tp1->whoTo->pseudo_cumack = tp1->rec.data.TSN_seq;
2600 				tp1->whoTo->find_pseudo_cumack = 0;
2601 			}
2602 			if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
2603 			    (tp1->whoTo->find_rtx_pseudo_cumack == 1) &&
2604 			    (tp1->snd_count > 1)) {
2605 				tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.TSN_seq;
2606 				tp1->whoTo->find_rtx_pseudo_cumack = 0;
2607 			}
2608 			if (tp1->rec.data.TSN_seq == theTSN) {
2609 				if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2610 					/*-
2611 					 * must be held until
2612 					 * cum-ack passes
2613 					 */
2614 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
2615 						/*-
2616 						 * If it is less than RESEND, it is
2617 						 * now no-longer in flight.
2618 						 * Higher values may already be set
2619 						 * via previous Gap Ack Blocks...
2620 						 * i.e. ACKED or RESEND.
2621 						 */
2622 						if (SCTP_TSN_GT(tp1->rec.data.TSN_seq,
2623 						    *biggest_newly_acked_tsn)) {
2624 							*biggest_newly_acked_tsn = tp1->rec.data.TSN_seq;
2625 						}
2626 						/*-
2627 						 * CMT: SFR algo (and HTNA) - set
2628 						 * saw_newack to 1 for dest being
2629 						 * newly acked. update
2630 						 * this_sack_highest_newack if
2631 						 * appropriate.
2632 						 */
2633 						if (tp1->rec.data.chunk_was_revoked == 0)
2634 							tp1->whoTo->saw_newack = 1;
2635 
2636 						if (SCTP_TSN_GT(tp1->rec.data.TSN_seq,
2637 						    tp1->whoTo->this_sack_highest_newack)) {
2638 							tp1->whoTo->this_sack_highest_newack =
2639 							    tp1->rec.data.TSN_seq;
2640 						}
2641 						/*-
2642 						 * CMT DAC algo: also update
2643 						 * this_sack_lowest_newack
2644 						 */
2645 						if (*this_sack_lowest_newack == 0) {
2646 							if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
2647 								sctp_log_sack(*this_sack_lowest_newack,
2648 								    last_tsn,
2649 								    tp1->rec.data.TSN_seq,
2650 								    0,
2651 								    0,
2652 								    SCTP_LOG_TSN_ACKED);
2653 							}
2654 							*this_sack_lowest_newack = tp1->rec.data.TSN_seq;
2655 						}
2656 						/*-
2657 						 * CMT: CUCv2 algorithm. If (rtx-)pseudo-cumack for corresp
2658 						 * dest is being acked, then we have a new (rtx-)pseudo-cumack. Set
2659 						 * new_(rtx_)pseudo_cumack to TRUE so that the cwnd for this dest can be
2660 						 * updated. Also trigger search for the next expected (rtx-)pseudo-cumack.
2661 						 * Separate pseudo_cumack trackers for first transmissions and
2662 						 * retransmissions.
2663 						 */
2664 						if (tp1->rec.data.TSN_seq == tp1->whoTo->pseudo_cumack) {
2665 							if (tp1->rec.data.chunk_was_revoked == 0) {
2666 								tp1->whoTo->new_pseudo_cumack = 1;
2667 							}
2668 							tp1->whoTo->find_pseudo_cumack = 1;
2669 						}
2670 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
2671 							sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
2672 						}
2673 						if (tp1->rec.data.TSN_seq == tp1->whoTo->rtx_pseudo_cumack) {
2674 							if (tp1->rec.data.chunk_was_revoked == 0) {
2675 								tp1->whoTo->new_pseudo_cumack = 1;
2676 							}
2677 							tp1->whoTo->find_rtx_pseudo_cumack = 1;
2678 						}
2679 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
2680 							sctp_log_sack(*biggest_newly_acked_tsn,
2681 							    last_tsn,
2682 							    tp1->rec.data.TSN_seq,
2683 							    frag_strt,
2684 							    frag_end,
2685 							    SCTP_LOG_TSN_ACKED);
2686 						}
2687 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
2688 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_GAP,
2689 							    tp1->whoTo->flight_size,
2690 							    tp1->book_size,
2691 							    (uintptr_t) tp1->whoTo,
2692 							    tp1->rec.data.TSN_seq);
2693 						}
2694 						sctp_flight_size_decrease(tp1);
2695 						if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
2696 							(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
2697 							    tp1);
2698 						}
2699 						sctp_total_flight_decrease(stcb, tp1);
2700 
2701 						tp1->whoTo->net_ack += tp1->send_size;
2702 						if (tp1->snd_count < 2) {
2703 							/*-
2704 							 * True non-retransmited chunk
2705 							 */
2706 							tp1->whoTo->net_ack2 += tp1->send_size;
2707 
2708 							/*-
2709 							 * update RTO too ?
2710 							 */
2711 							if (tp1->do_rtt) {
2712 								if (*rto_ok) {
2713 									tp1->whoTo->RTO =
2714 									    sctp_calculate_rto(stcb,
2715 									    &stcb->asoc,
2716 									    tp1->whoTo,
2717 									    &tp1->sent_rcv_time,
2718 									    sctp_align_safe_nocopy,
2719 									    SCTP_RTT_FROM_DATA);
2720 									*rto_ok = 0;
2721 								}
2722 								if (tp1->whoTo->rto_needed == 0) {
2723 									tp1->whoTo->rto_needed = 1;
2724 								}
2725 								tp1->do_rtt = 0;
2726 							}
2727 						}
2728 					}
2729 					if (tp1->sent <= SCTP_DATAGRAM_RESEND) {
2730 						if (SCTP_TSN_GT(tp1->rec.data.TSN_seq,
2731 						    stcb->asoc.this_sack_highest_gap)) {
2732 							stcb->asoc.this_sack_highest_gap =
2733 							    tp1->rec.data.TSN_seq;
2734 						}
2735 						if (tp1->sent == SCTP_DATAGRAM_RESEND) {
2736 							sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt);
2737 #ifdef SCTP_AUDITING_ENABLED
2738 							sctp_audit_log(0xB2,
2739 							    (stcb->asoc.sent_queue_retran_cnt & 0x000000ff));
2740 #endif
2741 						}
2742 					}
2743 					/*-
2744 					 * All chunks NOT UNSENT fall through here and are marked
2745 					 * (leave PR-SCTP ones that are to skip alone though)
2746 					 */
2747 					if ((tp1->sent != SCTP_FORWARD_TSN_SKIP) &&
2748 					    (tp1->sent != SCTP_DATAGRAM_NR_ACKED)) {
2749 						tp1->sent = SCTP_DATAGRAM_MARKED;
2750 					}
2751 					if (tp1->rec.data.chunk_was_revoked) {
2752 						/* deflate the cwnd */
2753 						tp1->whoTo->cwnd -= tp1->book_size;
2754 						tp1->rec.data.chunk_was_revoked = 0;
2755 					}
2756 					/* NR Sack code here */
2757 					if (nr_sacking &&
2758 					    (tp1->sent != SCTP_DATAGRAM_NR_ACKED)) {
2759 						if (stcb->asoc.strmout[tp1->rec.data.stream_number].chunks_on_queues > 0) {
2760 							stcb->asoc.strmout[tp1->rec.data.stream_number].chunks_on_queues--;
2761 #ifdef INVARIANTS
2762 						} else {
2763 							panic("No chunks on the queues for sid %u.", tp1->rec.data.stream_number);
2764 #endif
2765 						}
2766 						if ((stcb->asoc.strmout[tp1->rec.data.stream_number].chunks_on_queues == 0) &&
2767 						    (stcb->asoc.strmout[tp1->rec.data.stream_number].state == SCTP_STREAM_RESET_PENDING) &&
2768 						    TAILQ_EMPTY(&stcb->asoc.strmout[tp1->rec.data.stream_number].outqueue)) {
2769 							stcb->asoc.trigger_reset = 1;
2770 						}
2771 						tp1->sent = SCTP_DATAGRAM_NR_ACKED;
2772 						if (tp1->data) {
2773 							/*
2774 							 * sa_ignore
2775 							 * NO_NULL_CHK
2776 							 */
2777 							sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
2778 							sctp_m_freem(tp1->data);
2779 							tp1->data = NULL;
2780 						}
2781 						wake_him++;
2782 					}
2783 				}
2784 				break;
2785 			}	/* if (tp1->TSN_seq == theTSN) */
2786 			if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, theTSN)) {
2787 				break;
2788 			}
2789 			tp1 = TAILQ_NEXT(tp1, sctp_next);
2790 			if ((tp1 == NULL) && (circled == 0)) {
2791 				circled++;
2792 				tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2793 			}
2794 		}		/* end while (tp1) */
2795 		if (tp1 == NULL) {
2796 			circled = 0;
2797 			tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2798 		}
2799 		/* In case the fragments were not in order we must reset */
2800 	}			/* end for (j = fragStart */
2801 	*p_tp1 = tp1;
2802 	return (wake_him);	/* Return value only used for nr-sack */
2803 }
2804 
2805 
2806 static int
2807 sctp_handle_segments(struct mbuf *m, int *offset, struct sctp_tcb *stcb, struct sctp_association *asoc,
2808     uint32_t last_tsn, uint32_t * biggest_tsn_acked,
2809     uint32_t * biggest_newly_acked_tsn, uint32_t * this_sack_lowest_newack,
2810     int num_seg, int num_nr_seg, int *rto_ok)
2811 {
2812 	struct sctp_gap_ack_block *frag, block;
2813 	struct sctp_tmit_chunk *tp1;
2814 	int i;
2815 	int num_frs = 0;
2816 	int chunk_freed;
2817 	int non_revocable;
2818 	uint16_t frag_strt, frag_end, prev_frag_end;
2819 
2820 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
2821 	prev_frag_end = 0;
2822 	chunk_freed = 0;
2823 
2824 	for (i = 0; i < (num_seg + num_nr_seg); i++) {
2825 		if (i == num_seg) {
2826 			prev_frag_end = 0;
2827 			tp1 = TAILQ_FIRST(&asoc->sent_queue);
2828 		}
2829 		frag = (struct sctp_gap_ack_block *)sctp_m_getptr(m, *offset,
2830 		    sizeof(struct sctp_gap_ack_block), (uint8_t *) & block);
2831 		*offset += sizeof(block);
2832 		if (frag == NULL) {
2833 			return (chunk_freed);
2834 		}
2835 		frag_strt = ntohs(frag->start);
2836 		frag_end = ntohs(frag->end);
2837 
2838 		if (frag_strt > frag_end) {
2839 			/* This gap report is malformed, skip it. */
2840 			continue;
2841 		}
2842 		if (frag_strt <= prev_frag_end) {
2843 			/* This gap report is not in order, so restart. */
2844 			tp1 = TAILQ_FIRST(&asoc->sent_queue);
2845 		}
2846 		if (SCTP_TSN_GT((last_tsn + frag_end), *biggest_tsn_acked)) {
2847 			*biggest_tsn_acked = last_tsn + frag_end;
2848 		}
2849 		if (i < num_seg) {
2850 			non_revocable = 0;
2851 		} else {
2852 			non_revocable = 1;
2853 		}
2854 		if (sctp_process_segment_range(stcb, &tp1, last_tsn, frag_strt, frag_end,
2855 		    non_revocable, &num_frs, biggest_newly_acked_tsn,
2856 		    this_sack_lowest_newack, rto_ok)) {
2857 			chunk_freed = 1;
2858 		}
2859 		prev_frag_end = frag_end;
2860 	}
2861 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
2862 		if (num_frs)
2863 			sctp_log_fr(*biggest_tsn_acked,
2864 			    *biggest_newly_acked_tsn,
2865 			    last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
2866 	}
2867 	return (chunk_freed);
2868 }
2869 
2870 static void
2871 sctp_check_for_revoked(struct sctp_tcb *stcb,
2872     struct sctp_association *asoc, uint32_t cumack,
2873     uint32_t biggest_tsn_acked)
2874 {
2875 	struct sctp_tmit_chunk *tp1;
2876 
2877 	TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
2878 		if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, cumack)) {
2879 			/*
2880 			 * ok this guy is either ACK or MARKED. If it is
2881 			 * ACKED it has been previously acked but not this
2882 			 * time i.e. revoked.  If it is MARKED it was ACK'ed
2883 			 * again.
2884 			 */
2885 			if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, biggest_tsn_acked)) {
2886 				break;
2887 			}
2888 			if (tp1->sent == SCTP_DATAGRAM_ACKED) {
2889 				/* it has been revoked */
2890 				tp1->sent = SCTP_DATAGRAM_SENT;
2891 				tp1->rec.data.chunk_was_revoked = 1;
2892 				/*
2893 				 * We must add this stuff back in to assure
2894 				 * timers and such get started.
2895 				 */
2896 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
2897 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
2898 					    tp1->whoTo->flight_size,
2899 					    tp1->book_size,
2900 					    (uintptr_t) tp1->whoTo,
2901 					    tp1->rec.data.TSN_seq);
2902 				}
2903 				sctp_flight_size_increase(tp1);
2904 				sctp_total_flight_increase(stcb, tp1);
2905 				/*
2906 				 * We inflate the cwnd to compensate for our
2907 				 * artificial inflation of the flight_size.
2908 				 */
2909 				tp1->whoTo->cwnd += tp1->book_size;
2910 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
2911 					sctp_log_sack(asoc->last_acked_seq,
2912 					    cumack,
2913 					    tp1->rec.data.TSN_seq,
2914 					    0,
2915 					    0,
2916 					    SCTP_LOG_TSN_REVOKED);
2917 				}
2918 			} else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
2919 				/* it has been re-acked in this SACK */
2920 				tp1->sent = SCTP_DATAGRAM_ACKED;
2921 			}
2922 		}
2923 		if (tp1->sent == SCTP_DATAGRAM_UNSENT)
2924 			break;
2925 	}
2926 }
2927 
2928 
2929 static void
2930 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
2931     uint32_t biggest_tsn_acked, uint32_t biggest_tsn_newly_acked, uint32_t this_sack_lowest_newack, int accum_moved)
2932 {
2933 	struct sctp_tmit_chunk *tp1;
2934 	int strike_flag = 0;
2935 	struct timeval now;
2936 	int tot_retrans = 0;
2937 	uint32_t sending_seq;
2938 	struct sctp_nets *net;
2939 	int num_dests_sacked = 0;
2940 
2941 	/*
2942 	 * select the sending_seq, this is either the next thing ready to be
2943 	 * sent but not transmitted, OR, the next seq we assign.
2944 	 */
2945 	tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
2946 	if (tp1 == NULL) {
2947 		sending_seq = asoc->sending_seq;
2948 	} else {
2949 		sending_seq = tp1->rec.data.TSN_seq;
2950 	}
2951 
2952 	/* CMT DAC algo: finding out if SACK is a mixed SACK */
2953 	if ((asoc->sctp_cmt_on_off > 0) &&
2954 	    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
2955 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
2956 			if (net->saw_newack)
2957 				num_dests_sacked++;
2958 		}
2959 	}
2960 	if (stcb->asoc.prsctp_supported) {
2961 		(void)SCTP_GETTIME_TIMEVAL(&now);
2962 	}
2963 	TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
2964 		strike_flag = 0;
2965 		if (tp1->no_fr_allowed) {
2966 			/* this one had a timeout or something */
2967 			continue;
2968 		}
2969 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
2970 			if (tp1->sent < SCTP_DATAGRAM_RESEND)
2971 				sctp_log_fr(biggest_tsn_newly_acked,
2972 				    tp1->rec.data.TSN_seq,
2973 				    tp1->sent,
2974 				    SCTP_FR_LOG_CHECK_STRIKE);
2975 		}
2976 		if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, biggest_tsn_acked) ||
2977 		    tp1->sent == SCTP_DATAGRAM_UNSENT) {
2978 			/* done */
2979 			break;
2980 		}
2981 		if (stcb->asoc.prsctp_supported) {
2982 			if ((PR_SCTP_TTL_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
2983 				/* Is it expired? */
2984 				if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
2985 					/* Yes so drop it */
2986 					if (tp1->data != NULL) {
2987 						(void)sctp_release_pr_sctp_chunk(stcb, tp1, 1,
2988 						    SCTP_SO_NOT_LOCKED);
2989 					}
2990 					continue;
2991 				}
2992 			}
2993 		}
2994 		if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, asoc->this_sack_highest_gap)) {
2995 			/* we are beyond the tsn in the sack  */
2996 			break;
2997 		}
2998 		if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
2999 			/* either a RESEND, ACKED, or MARKED */
3000 			/* skip */
3001 			if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3002 				/* Continue strikin FWD-TSN chunks */
3003 				tp1->rec.data.fwd_tsn_cnt++;
3004 			}
3005 			continue;
3006 		}
3007 		/*
3008 		 * CMT : SFR algo (covers part of DAC and HTNA as well)
3009 		 */
3010 		if (tp1->whoTo && tp1->whoTo->saw_newack == 0) {
3011 			/*
3012 			 * No new acks were receieved for data sent to this
3013 			 * dest. Therefore, according to the SFR algo for
3014 			 * CMT, no data sent to this dest can be marked for
3015 			 * FR using this SACK.
3016 			 */
3017 			continue;
3018 		} else if (tp1->whoTo && SCTP_TSN_GT(tp1->rec.data.TSN_seq,
3019 		    tp1->whoTo->this_sack_highest_newack)) {
3020 			/*
3021 			 * CMT: New acks were receieved for data sent to
3022 			 * this dest. But no new acks were seen for data
3023 			 * sent after tp1. Therefore, according to the SFR
3024 			 * algo for CMT, tp1 cannot be marked for FR using
3025 			 * this SACK. This step covers part of the DAC algo
3026 			 * and the HTNA algo as well.
3027 			 */
3028 			continue;
3029 		}
3030 		/*
3031 		 * Here we check to see if we were have already done a FR
3032 		 * and if so we see if the biggest TSN we saw in the sack is
3033 		 * smaller than the recovery point. If so we don't strike
3034 		 * the tsn... otherwise we CAN strike the TSN.
3035 		 */
3036 		/*
3037 		 * @@@ JRI: Check for CMT if (accum_moved &&
3038 		 * asoc->fast_retran_loss_recovery && (sctp_cmt_on_off ==
3039 		 * 0)) {
3040 		 */
3041 		if (accum_moved && asoc->fast_retran_loss_recovery) {
3042 			/*
3043 			 * Strike the TSN if in fast-recovery and cum-ack
3044 			 * moved.
3045 			 */
3046 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3047 				sctp_log_fr(biggest_tsn_newly_acked,
3048 				    tp1->rec.data.TSN_seq,
3049 				    tp1->sent,
3050 				    SCTP_FR_LOG_STRIKE_CHUNK);
3051 			}
3052 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3053 				tp1->sent++;
3054 			}
3055 			if ((asoc->sctp_cmt_on_off > 0) &&
3056 			    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3057 				/*
3058 				 * CMT DAC algorithm: If SACK flag is set to
3059 				 * 0, then lowest_newack test will not pass
3060 				 * because it would have been set to the
3061 				 * cumack earlier. If not already to be
3062 				 * rtx'd, If not a mixed sack and if tp1 is
3063 				 * not between two sacked TSNs, then mark by
3064 				 * one more. NOTE that we are marking by one
3065 				 * additional time since the SACK DAC flag
3066 				 * indicates that two packets have been
3067 				 * received after this missing TSN.
3068 				 */
3069 				if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3070 				    SCTP_TSN_GT(this_sack_lowest_newack, tp1->rec.data.TSN_seq)) {
3071 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3072 						sctp_log_fr(16 + num_dests_sacked,
3073 						    tp1->rec.data.TSN_seq,
3074 						    tp1->sent,
3075 						    SCTP_FR_LOG_STRIKE_CHUNK);
3076 					}
3077 					tp1->sent++;
3078 				}
3079 			}
3080 		} else if ((tp1->rec.data.doing_fast_retransmit) &&
3081 		    (asoc->sctp_cmt_on_off == 0)) {
3082 			/*
3083 			 * For those that have done a FR we must take
3084 			 * special consideration if we strike. I.e the
3085 			 * biggest_newly_acked must be higher than the
3086 			 * sending_seq at the time we did the FR.
3087 			 */
3088 			if (
3089 #ifdef SCTP_FR_TO_ALTERNATE
3090 			/*
3091 			 * If FR's go to new networks, then we must only do
3092 			 * this for singly homed asoc's. However if the FR's
3093 			 * go to the same network (Armando's work) then its
3094 			 * ok to FR multiple times.
3095 			 */
3096 			    (asoc->numnets < 2)
3097 #else
3098 			    (1)
3099 #endif
3100 			    ) {
3101 
3102 				if (SCTP_TSN_GE(biggest_tsn_newly_acked,
3103 				    tp1->rec.data.fast_retran_tsn)) {
3104 					/*
3105 					 * Strike the TSN, since this ack is
3106 					 * beyond where things were when we
3107 					 * did a FR.
3108 					 */
3109 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3110 						sctp_log_fr(biggest_tsn_newly_acked,
3111 						    tp1->rec.data.TSN_seq,
3112 						    tp1->sent,
3113 						    SCTP_FR_LOG_STRIKE_CHUNK);
3114 					}
3115 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3116 						tp1->sent++;
3117 					}
3118 					strike_flag = 1;
3119 					if ((asoc->sctp_cmt_on_off > 0) &&
3120 					    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3121 						/*
3122 						 * CMT DAC algorithm: If
3123 						 * SACK flag is set to 0,
3124 						 * then lowest_newack test
3125 						 * will not pass because it
3126 						 * would have been set to
3127 						 * the cumack earlier. If
3128 						 * not already to be rtx'd,
3129 						 * If not a mixed sack and
3130 						 * if tp1 is not between two
3131 						 * sacked TSNs, then mark by
3132 						 * one more. NOTE that we
3133 						 * are marking by one
3134 						 * additional time since the
3135 						 * SACK DAC flag indicates
3136 						 * that two packets have
3137 						 * been received after this
3138 						 * missing TSN.
3139 						 */
3140 						if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
3141 						    (num_dests_sacked == 1) &&
3142 						    SCTP_TSN_GT(this_sack_lowest_newack,
3143 						    tp1->rec.data.TSN_seq)) {
3144 							if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3145 								sctp_log_fr(32 + num_dests_sacked,
3146 								    tp1->rec.data.TSN_seq,
3147 								    tp1->sent,
3148 								    SCTP_FR_LOG_STRIKE_CHUNK);
3149 							}
3150 							if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3151 								tp1->sent++;
3152 							}
3153 						}
3154 					}
3155 				}
3156 			}
3157 			/*
3158 			 * JRI: TODO: remove code for HTNA algo. CMT's SFR
3159 			 * algo covers HTNA.
3160 			 */
3161 		} else if (SCTP_TSN_GT(tp1->rec.data.TSN_seq,
3162 		    biggest_tsn_newly_acked)) {
3163 			/*
3164 			 * We don't strike these: This is the  HTNA
3165 			 * algorithm i.e. we don't strike If our TSN is
3166 			 * larger than the Highest TSN Newly Acked.
3167 			 */
3168 			;
3169 		} else {
3170 			/* Strike the TSN */
3171 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3172 				sctp_log_fr(biggest_tsn_newly_acked,
3173 				    tp1->rec.data.TSN_seq,
3174 				    tp1->sent,
3175 				    SCTP_FR_LOG_STRIKE_CHUNK);
3176 			}
3177 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3178 				tp1->sent++;
3179 			}
3180 			if ((asoc->sctp_cmt_on_off > 0) &&
3181 			    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3182 				/*
3183 				 * CMT DAC algorithm: If SACK flag is set to
3184 				 * 0, then lowest_newack test will not pass
3185 				 * because it would have been set to the
3186 				 * cumack earlier. If not already to be
3187 				 * rtx'd, If not a mixed sack and if tp1 is
3188 				 * not between two sacked TSNs, then mark by
3189 				 * one more. NOTE that we are marking by one
3190 				 * additional time since the SACK DAC flag
3191 				 * indicates that two packets have been
3192 				 * received after this missing TSN.
3193 				 */
3194 				if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3195 				    SCTP_TSN_GT(this_sack_lowest_newack, tp1->rec.data.TSN_seq)) {
3196 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3197 						sctp_log_fr(48 + num_dests_sacked,
3198 						    tp1->rec.data.TSN_seq,
3199 						    tp1->sent,
3200 						    SCTP_FR_LOG_STRIKE_CHUNK);
3201 					}
3202 					tp1->sent++;
3203 				}
3204 			}
3205 		}
3206 		if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3207 			struct sctp_nets *alt;
3208 
3209 			/* fix counts and things */
3210 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3211 				sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND,
3212 				    (tp1->whoTo ? (tp1->whoTo->flight_size) : 0),
3213 				    tp1->book_size,
3214 				    (uintptr_t) tp1->whoTo,
3215 				    tp1->rec.data.TSN_seq);
3216 			}
3217 			if (tp1->whoTo) {
3218 				tp1->whoTo->net_ack++;
3219 				sctp_flight_size_decrease(tp1);
3220 				if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3221 					(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3222 					    tp1);
3223 				}
3224 			}
3225 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
3226 				sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3227 				    asoc->peers_rwnd, tp1->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
3228 			}
3229 			/* add back to the rwnd */
3230 			asoc->peers_rwnd += (tp1->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
3231 
3232 			/* remove from the total flight */
3233 			sctp_total_flight_decrease(stcb, tp1);
3234 
3235 			if ((stcb->asoc.prsctp_supported) &&
3236 			    (PR_SCTP_RTX_ENABLED(tp1->flags))) {
3237 				/*
3238 				 * Has it been retransmitted tv_sec times? -
3239 				 * we store the retran count there.
3240 				 */
3241 				if (tp1->snd_count > tp1->rec.data.timetodrop.tv_sec) {
3242 					/* Yes, so drop it */
3243 					if (tp1->data != NULL) {
3244 						(void)sctp_release_pr_sctp_chunk(stcb, tp1, 1,
3245 						    SCTP_SO_NOT_LOCKED);
3246 					}
3247 					/* Make sure to flag we had a FR */
3248 					tp1->whoTo->net_ack++;
3249 					continue;
3250 				}
3251 			}
3252 			/*
3253 			 * SCTP_PRINTF("OK, we are now ready to FR this
3254 			 * guy\n");
3255 			 */
3256 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3257 				sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count,
3258 				    0, SCTP_FR_MARKED);
3259 			}
3260 			if (strike_flag) {
3261 				/* This is a subsequent FR */
3262 				SCTP_STAT_INCR(sctps_sendmultfastretrans);
3263 			}
3264 			sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3265 			if (asoc->sctp_cmt_on_off > 0) {
3266 				/*
3267 				 * CMT: Using RTX_SSTHRESH policy for CMT.
3268 				 * If CMT is being used, then pick dest with
3269 				 * largest ssthresh for any retransmission.
3270 				 */
3271 				tp1->no_fr_allowed = 1;
3272 				alt = tp1->whoTo;
3273 				/* sa_ignore NO_NULL_CHK */
3274 				if (asoc->sctp_cmt_pf > 0) {
3275 					/*
3276 					 * JRS 5/18/07 - If CMT PF is on,
3277 					 * use the PF version of
3278 					 * find_alt_net()
3279 					 */
3280 					alt = sctp_find_alternate_net(stcb, alt, 2);
3281 				} else {
3282 					/*
3283 					 * JRS 5/18/07 - If only CMT is on,
3284 					 * use the CMT version of
3285 					 * find_alt_net()
3286 					 */
3287 					/* sa_ignore NO_NULL_CHK */
3288 					alt = sctp_find_alternate_net(stcb, alt, 1);
3289 				}
3290 				if (alt == NULL) {
3291 					alt = tp1->whoTo;
3292 				}
3293 				/*
3294 				 * CUCv2: If a different dest is picked for
3295 				 * the retransmission, then new
3296 				 * (rtx-)pseudo_cumack needs to be tracked
3297 				 * for orig dest. Let CUCv2 track new (rtx-)
3298 				 * pseudo-cumack always.
3299 				 */
3300 				if (tp1->whoTo) {
3301 					tp1->whoTo->find_pseudo_cumack = 1;
3302 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
3303 				}
3304 			} else {/* CMT is OFF */
3305 
3306 #ifdef SCTP_FR_TO_ALTERNATE
3307 				/* Can we find an alternate? */
3308 				alt = sctp_find_alternate_net(stcb, tp1->whoTo, 0);
3309 #else
3310 				/*
3311 				 * default behavior is to NOT retransmit
3312 				 * FR's to an alternate. Armando Caro's
3313 				 * paper details why.
3314 				 */
3315 				alt = tp1->whoTo;
3316 #endif
3317 			}
3318 
3319 			tp1->rec.data.doing_fast_retransmit = 1;
3320 			tot_retrans++;
3321 			/* mark the sending seq for possible subsequent FR's */
3322 			/*
3323 			 * SCTP_PRINTF("Marking TSN for FR new value %x\n",
3324 			 * (uint32_t)tpi->rec.data.TSN_seq);
3325 			 */
3326 			if (TAILQ_EMPTY(&asoc->send_queue)) {
3327 				/*
3328 				 * If the queue of send is empty then its
3329 				 * the next sequence number that will be
3330 				 * assigned so we subtract one from this to
3331 				 * get the one we last sent.
3332 				 */
3333 				tp1->rec.data.fast_retran_tsn = sending_seq;
3334 			} else {
3335 				/*
3336 				 * If there are chunks on the send queue
3337 				 * (unsent data that has made it from the
3338 				 * stream queues but not out the door, we
3339 				 * take the first one (which will have the
3340 				 * lowest TSN) and subtract one to get the
3341 				 * one we last sent.
3342 				 */
3343 				struct sctp_tmit_chunk *ttt;
3344 
3345 				ttt = TAILQ_FIRST(&asoc->send_queue);
3346 				tp1->rec.data.fast_retran_tsn =
3347 				    ttt->rec.data.TSN_seq;
3348 			}
3349 
3350 			if (tp1->do_rtt) {
3351 				/*
3352 				 * this guy had a RTO calculation pending on
3353 				 * it, cancel it
3354 				 */
3355 				if ((tp1->whoTo != NULL) &&
3356 				    (tp1->whoTo->rto_needed == 0)) {
3357 					tp1->whoTo->rto_needed = 1;
3358 				}
3359 				tp1->do_rtt = 0;
3360 			}
3361 			if (alt != tp1->whoTo) {
3362 				/* yes, there is an alternate. */
3363 				sctp_free_remote_addr(tp1->whoTo);
3364 				/* sa_ignore FREED_MEMORY */
3365 				tp1->whoTo = alt;
3366 				atomic_add_int(&alt->ref_count, 1);
3367 			}
3368 		}
3369 	}
3370 }
3371 
3372 struct sctp_tmit_chunk *
3373 sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3374     struct sctp_association *asoc)
3375 {
3376 	struct sctp_tmit_chunk *tp1, *tp2, *a_adv = NULL;
3377 	struct timeval now;
3378 	int now_filled = 0;
3379 
3380 	if (asoc->prsctp_supported == 0) {
3381 		return (NULL);
3382 	}
3383 	TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
3384 		if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3385 		    tp1->sent != SCTP_DATAGRAM_RESEND &&
3386 		    tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
3387 			/* no chance to advance, out of here */
3388 			break;
3389 		}
3390 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) {
3391 			if ((tp1->sent == SCTP_FORWARD_TSN_SKIP) ||
3392 			    (tp1->sent == SCTP_DATAGRAM_NR_ACKED)) {
3393 				sctp_misc_ints(SCTP_FWD_TSN_CHECK,
3394 				    asoc->advanced_peer_ack_point,
3395 				    tp1->rec.data.TSN_seq, 0, 0);
3396 			}
3397 		}
3398 		if (!PR_SCTP_ENABLED(tp1->flags)) {
3399 			/*
3400 			 * We can't fwd-tsn past any that are reliable aka
3401 			 * retransmitted until the asoc fails.
3402 			 */
3403 			break;
3404 		}
3405 		if (!now_filled) {
3406 			(void)SCTP_GETTIME_TIMEVAL(&now);
3407 			now_filled = 1;
3408 		}
3409 		/*
3410 		 * now we got a chunk which is marked for another
3411 		 * retransmission to a PR-stream but has run out its chances
3412 		 * already maybe OR has been marked to skip now. Can we skip
3413 		 * it if its a resend?
3414 		 */
3415 		if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3416 		    (PR_SCTP_TTL_ENABLED(tp1->flags))) {
3417 			/*
3418 			 * Now is this one marked for resend and its time is
3419 			 * now up?
3420 			 */
3421 			if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3422 				/* Yes so drop it */
3423 				if (tp1->data) {
3424 					(void)sctp_release_pr_sctp_chunk(stcb, tp1,
3425 					    1, SCTP_SO_NOT_LOCKED);
3426 				}
3427 			} else {
3428 				/*
3429 				 * No, we are done when hit one for resend
3430 				 * whos time as not expired.
3431 				 */
3432 				break;
3433 			}
3434 		}
3435 		/*
3436 		 * Ok now if this chunk is marked to drop it we can clean up
3437 		 * the chunk, advance our peer ack point and we can check
3438 		 * the next chunk.
3439 		 */
3440 		if ((tp1->sent == SCTP_FORWARD_TSN_SKIP) ||
3441 		    (tp1->sent == SCTP_DATAGRAM_NR_ACKED)) {
3442 			/* advance PeerAckPoint goes forward */
3443 			if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, asoc->advanced_peer_ack_point)) {
3444 				asoc->advanced_peer_ack_point = tp1->rec.data.TSN_seq;
3445 				a_adv = tp1;
3446 			} else if (tp1->rec.data.TSN_seq == asoc->advanced_peer_ack_point) {
3447 				/* No update but we do save the chk */
3448 				a_adv = tp1;
3449 			}
3450 		} else {
3451 			/*
3452 			 * If it is still in RESEND we can advance no
3453 			 * further
3454 			 */
3455 			break;
3456 		}
3457 	}
3458 	return (a_adv);
3459 }
3460 
3461 static int
3462 sctp_fs_audit(struct sctp_association *asoc)
3463 {
3464 	struct sctp_tmit_chunk *chk;
3465 	int inflight = 0, resend = 0, inbetween = 0, acked = 0, above = 0;
3466 	int ret;
3467 
3468 #ifndef INVARIANTS
3469 	int entry_flight, entry_cnt;
3470 
3471 #endif
3472 
3473 	ret = 0;
3474 #ifndef INVARIANTS
3475 	entry_flight = asoc->total_flight;
3476 	entry_cnt = asoc->total_flight_count;
3477 #endif
3478 	if (asoc->pr_sctp_cnt >= asoc->sent_queue_cnt)
3479 		return (0);
3480 
3481 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
3482 		if (chk->sent < SCTP_DATAGRAM_RESEND) {
3483 			SCTP_PRINTF("Chk TSN:%u size:%d inflight cnt:%d\n",
3484 			    chk->rec.data.TSN_seq,
3485 			    chk->send_size,
3486 			    chk->snd_count);
3487 			inflight++;
3488 		} else if (chk->sent == SCTP_DATAGRAM_RESEND) {
3489 			resend++;
3490 		} else if (chk->sent < SCTP_DATAGRAM_ACKED) {
3491 			inbetween++;
3492 		} else if (chk->sent > SCTP_DATAGRAM_ACKED) {
3493 			above++;
3494 		} else {
3495 			acked++;
3496 		}
3497 	}
3498 
3499 	if ((inflight > 0) || (inbetween > 0)) {
3500 #ifdef INVARIANTS
3501 		panic("Flight size-express incorrect? \n");
3502 #else
3503 		SCTP_PRINTF("asoc->total_flight:%d cnt:%d\n",
3504 		    entry_flight, entry_cnt);
3505 
3506 		SCTP_PRINTF("Flight size-express incorrect F:%d I:%d R:%d Ab:%d ACK:%d\n",
3507 		    inflight, inbetween, resend, above, acked);
3508 		ret = 1;
3509 #endif
3510 	}
3511 	return (ret);
3512 }
3513 
3514 
3515 static void
3516 sctp_window_probe_recovery(struct sctp_tcb *stcb,
3517     struct sctp_association *asoc,
3518     struct sctp_tmit_chunk *tp1)
3519 {
3520 	tp1->window_probe = 0;
3521 	if ((tp1->sent >= SCTP_DATAGRAM_ACKED) || (tp1->data == NULL)) {
3522 		/* TSN's skipped we do NOT move back. */
3523 		sctp_misc_ints(SCTP_FLIGHT_LOG_DWN_WP_FWD,
3524 		    tp1->whoTo ? tp1->whoTo->flight_size : 0,
3525 		    tp1->book_size,
3526 		    (uintptr_t) tp1->whoTo,
3527 		    tp1->rec.data.TSN_seq);
3528 		return;
3529 	}
3530 	/* First setup this by shrinking flight */
3531 	if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3532 		(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3533 		    tp1);
3534 	}
3535 	sctp_flight_size_decrease(tp1);
3536 	sctp_total_flight_decrease(stcb, tp1);
3537 	/* Now mark for resend */
3538 	tp1->sent = SCTP_DATAGRAM_RESEND;
3539 	sctp_ucount_incr(asoc->sent_queue_retran_cnt);
3540 
3541 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3542 		sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_WP,
3543 		    tp1->whoTo->flight_size,
3544 		    tp1->book_size,
3545 		    (uintptr_t) tp1->whoTo,
3546 		    tp1->rec.data.TSN_seq);
3547 	}
3548 }
3549 
3550 void
3551 sctp_express_handle_sack(struct sctp_tcb *stcb, uint32_t cumack,
3552     uint32_t rwnd, int *abort_now, int ecne_seen)
3553 {
3554 	struct sctp_nets *net;
3555 	struct sctp_association *asoc;
3556 	struct sctp_tmit_chunk *tp1, *tp2;
3557 	uint32_t old_rwnd;
3558 	int win_probe_recovery = 0;
3559 	int win_probe_recovered = 0;
3560 	int j, done_once = 0;
3561 	int rto_ok = 1;
3562 
3563 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_SACK_ARRIVALS_ENABLE) {
3564 		sctp_misc_ints(SCTP_SACK_LOG_EXPRESS, cumack,
3565 		    rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
3566 	}
3567 	SCTP_TCB_LOCK_ASSERT(stcb);
3568 #ifdef SCTP_ASOCLOG_OF_TSNS
3569 	stcb->asoc.cumack_log[stcb->asoc.cumack_log_at] = cumack;
3570 	stcb->asoc.cumack_log_at++;
3571 	if (stcb->asoc.cumack_log_at > SCTP_TSN_LOG_SIZE) {
3572 		stcb->asoc.cumack_log_at = 0;
3573 	}
3574 #endif
3575 	asoc = &stcb->asoc;
3576 	old_rwnd = asoc->peers_rwnd;
3577 	if (SCTP_TSN_GT(asoc->last_acked_seq, cumack)) {
3578 		/* old ack */
3579 		return;
3580 	} else if (asoc->last_acked_seq == cumack) {
3581 		/* Window update sack */
3582 		asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
3583 		    (uint32_t) (asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
3584 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3585 			/* SWS sender side engages */
3586 			asoc->peers_rwnd = 0;
3587 		}
3588 		if (asoc->peers_rwnd > old_rwnd) {
3589 			goto again;
3590 		}
3591 		return;
3592 	}
3593 	/* First setup for CC stuff */
3594 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3595 		if (SCTP_TSN_GT(cumack, net->cwr_window_tsn)) {
3596 			/* Drag along the window_tsn for cwr's */
3597 			net->cwr_window_tsn = cumack;
3598 		}
3599 		net->prev_cwnd = net->cwnd;
3600 		net->net_ack = 0;
3601 		net->net_ack2 = 0;
3602 
3603 		/*
3604 		 * CMT: Reset CUC and Fast recovery algo variables before
3605 		 * SACK processing
3606 		 */
3607 		net->new_pseudo_cumack = 0;
3608 		net->will_exit_fast_recovery = 0;
3609 		if (stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) {
3610 			(*stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) (stcb, net);
3611 		}
3612 	}
3613 	if (SCTP_BASE_SYSCTL(sctp_strict_sacks)) {
3614 		uint32_t send_s;
3615 
3616 		if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3617 			tp1 = TAILQ_LAST(&asoc->sent_queue,
3618 			    sctpchunk_listhead);
3619 			send_s = tp1->rec.data.TSN_seq + 1;
3620 		} else {
3621 			send_s = asoc->sending_seq;
3622 		}
3623 		if (SCTP_TSN_GE(cumack, send_s)) {
3624 			struct mbuf *op_err;
3625 			char msg[SCTP_DIAG_INFO_LEN];
3626 
3627 			*abort_now = 1;
3628 			/* XXX */
3629 			snprintf(msg, sizeof(msg), "Cum ack %8.8x greater or equal than TSN %8.8x",
3630 			    cumack, send_s);
3631 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
3632 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_23;
3633 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
3634 			return;
3635 		}
3636 	}
3637 	asoc->this_sack_highest_gap = cumack;
3638 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
3639 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
3640 		    stcb->asoc.overall_error_count,
3641 		    0,
3642 		    SCTP_FROM_SCTP_INDATA,
3643 		    __LINE__);
3644 	}
3645 	stcb->asoc.overall_error_count = 0;
3646 	if (SCTP_TSN_GT(cumack, asoc->last_acked_seq)) {
3647 		/* process the new consecutive TSN first */
3648 		TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
3649 			if (SCTP_TSN_GE(cumack, tp1->rec.data.TSN_seq)) {
3650 				if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
3651 					SCTP_PRINTF("Warning, an unsent is now acked?\n");
3652 				}
3653 				if (tp1->sent < SCTP_DATAGRAM_ACKED) {
3654 					/*
3655 					 * If it is less than ACKED, it is
3656 					 * now no-longer in flight. Higher
3657 					 * values may occur during marking
3658 					 */
3659 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3660 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3661 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
3662 							    tp1->whoTo->flight_size,
3663 							    tp1->book_size,
3664 							    (uintptr_t) tp1->whoTo,
3665 							    tp1->rec.data.TSN_seq);
3666 						}
3667 						sctp_flight_size_decrease(tp1);
3668 						if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3669 							(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3670 							    tp1);
3671 						}
3672 						/* sa_ignore NO_NULL_CHK */
3673 						sctp_total_flight_decrease(stcb, tp1);
3674 					}
3675 					tp1->whoTo->net_ack += tp1->send_size;
3676 					if (tp1->snd_count < 2) {
3677 						/*
3678 						 * True non-retransmited
3679 						 * chunk
3680 						 */
3681 						tp1->whoTo->net_ack2 +=
3682 						    tp1->send_size;
3683 
3684 						/* update RTO too? */
3685 						if (tp1->do_rtt) {
3686 							if (rto_ok) {
3687 								tp1->whoTo->RTO =
3688 								/*
3689 								 * sa_ignore
3690 								 * NO_NULL_CH
3691 								 * K
3692 								 */
3693 								    sctp_calculate_rto(stcb,
3694 								    asoc, tp1->whoTo,
3695 								    &tp1->sent_rcv_time,
3696 								    sctp_align_safe_nocopy,
3697 								    SCTP_RTT_FROM_DATA);
3698 								rto_ok = 0;
3699 							}
3700 							if (tp1->whoTo->rto_needed == 0) {
3701 								tp1->whoTo->rto_needed = 1;
3702 							}
3703 							tp1->do_rtt = 0;
3704 						}
3705 					}
3706 					/*
3707 					 * CMT: CUCv2 algorithm. From the
3708 					 * cumack'd TSNs, for each TSN being
3709 					 * acked for the first time, set the
3710 					 * following variables for the
3711 					 * corresp destination.
3712 					 * new_pseudo_cumack will trigger a
3713 					 * cwnd update.
3714 					 * find_(rtx_)pseudo_cumack will
3715 					 * trigger search for the next
3716 					 * expected (rtx-)pseudo-cumack.
3717 					 */
3718 					tp1->whoTo->new_pseudo_cumack = 1;
3719 					tp1->whoTo->find_pseudo_cumack = 1;
3720 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
3721 
3722 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
3723 						/* sa_ignore NO_NULL_CHK */
3724 						sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
3725 					}
3726 				}
3727 				if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3728 					sctp_ucount_decr(asoc->sent_queue_retran_cnt);
3729 				}
3730 				if (tp1->rec.data.chunk_was_revoked) {
3731 					/* deflate the cwnd */
3732 					tp1->whoTo->cwnd -= tp1->book_size;
3733 					tp1->rec.data.chunk_was_revoked = 0;
3734 				}
3735 				if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
3736 					if (asoc->strmout[tp1->rec.data.stream_number].chunks_on_queues > 0) {
3737 						asoc->strmout[tp1->rec.data.stream_number].chunks_on_queues--;
3738 #ifdef INVARIANTS
3739 					} else {
3740 						panic("No chunks on the queues for sid %u.", tp1->rec.data.stream_number);
3741 #endif
3742 					}
3743 				}
3744 				if ((asoc->strmout[tp1->rec.data.stream_number].chunks_on_queues == 0) &&
3745 				    (asoc->strmout[tp1->rec.data.stream_number].state == SCTP_STREAM_RESET_PENDING) &&
3746 				    TAILQ_EMPTY(&asoc->strmout[tp1->rec.data.stream_number].outqueue)) {
3747 					asoc->trigger_reset = 1;
3748 				}
3749 				TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
3750 				if (tp1->data) {
3751 					/* sa_ignore NO_NULL_CHK */
3752 					sctp_free_bufspace(stcb, asoc, tp1, 1);
3753 					sctp_m_freem(tp1->data);
3754 					tp1->data = NULL;
3755 				}
3756 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3757 					sctp_log_sack(asoc->last_acked_seq,
3758 					    cumack,
3759 					    tp1->rec.data.TSN_seq,
3760 					    0,
3761 					    0,
3762 					    SCTP_LOG_FREE_SENT);
3763 				}
3764 				asoc->sent_queue_cnt--;
3765 				sctp_free_a_chunk(stcb, tp1, SCTP_SO_NOT_LOCKED);
3766 			} else {
3767 				break;
3768 			}
3769 		}
3770 
3771 	}
3772 	/* sa_ignore NO_NULL_CHK */
3773 	if (stcb->sctp_socket) {
3774 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3775 		struct socket *so;
3776 
3777 #endif
3778 		SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
3779 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
3780 			/* sa_ignore NO_NULL_CHK */
3781 			sctp_wakeup_log(stcb, 1, SCTP_WAKESND_FROM_SACK);
3782 		}
3783 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3784 		so = SCTP_INP_SO(stcb->sctp_ep);
3785 		atomic_add_int(&stcb->asoc.refcnt, 1);
3786 		SCTP_TCB_UNLOCK(stcb);
3787 		SCTP_SOCKET_LOCK(so, 1);
3788 		SCTP_TCB_LOCK(stcb);
3789 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
3790 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3791 			/* assoc was freed while we were unlocked */
3792 			SCTP_SOCKET_UNLOCK(so, 1);
3793 			return;
3794 		}
3795 #endif
3796 		sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
3797 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3798 		SCTP_SOCKET_UNLOCK(so, 1);
3799 #endif
3800 	} else {
3801 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
3802 			sctp_wakeup_log(stcb, 1, SCTP_NOWAKE_FROM_SACK);
3803 		}
3804 	}
3805 
3806 	/* JRS - Use the congestion control given in the CC module */
3807 	if ((asoc->last_acked_seq != cumack) && (ecne_seen == 0)) {
3808 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3809 			if (net->net_ack2 > 0) {
3810 				/*
3811 				 * Karn's rule applies to clearing error
3812 				 * count, this is optional.
3813 				 */
3814 				net->error_count = 0;
3815 				if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
3816 					/* addr came good */
3817 					net->dest_state |= SCTP_ADDR_REACHABLE;
3818 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
3819 					    0, (void *)net, SCTP_SO_NOT_LOCKED);
3820 				}
3821 				if (net == stcb->asoc.primary_destination) {
3822 					if (stcb->asoc.alternate) {
3823 						/*
3824 						 * release the alternate,
3825 						 * primary is good
3826 						 */
3827 						sctp_free_remote_addr(stcb->asoc.alternate);
3828 						stcb->asoc.alternate = NULL;
3829 					}
3830 				}
3831 				if (net->dest_state & SCTP_ADDR_PF) {
3832 					net->dest_state &= ~SCTP_ADDR_PF;
3833 					sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
3834 					    stcb->sctp_ep, stcb, net,
3835 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_24);
3836 					sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
3837 					asoc->cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
3838 					/* Done with this net */
3839 					net->net_ack = 0;
3840 				}
3841 				/* restore any doubled timers */
3842 				net->RTO = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
3843 				if (net->RTO < stcb->asoc.minrto) {
3844 					net->RTO = stcb->asoc.minrto;
3845 				}
3846 				if (net->RTO > stcb->asoc.maxrto) {
3847 					net->RTO = stcb->asoc.maxrto;
3848 				}
3849 			}
3850 		}
3851 		asoc->cc_functions.sctp_cwnd_update_after_sack(stcb, asoc, 1, 0, 0);
3852 	}
3853 	asoc->last_acked_seq = cumack;
3854 
3855 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
3856 		/* nothing left in-flight */
3857 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3858 			net->flight_size = 0;
3859 			net->partial_bytes_acked = 0;
3860 		}
3861 		asoc->total_flight = 0;
3862 		asoc->total_flight_count = 0;
3863 	}
3864 	/* RWND update */
3865 	asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
3866 	    (uint32_t) (asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
3867 	if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3868 		/* SWS sender side engages */
3869 		asoc->peers_rwnd = 0;
3870 	}
3871 	if (asoc->peers_rwnd > old_rwnd) {
3872 		win_probe_recovery = 1;
3873 	}
3874 	/* Now assure a timer where data is queued at */
3875 again:
3876 	j = 0;
3877 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3878 		int to_ticks;
3879 
3880 		if (win_probe_recovery && (net->window_probe)) {
3881 			win_probe_recovered = 1;
3882 			/*
3883 			 * Find first chunk that was used with window probe
3884 			 * and clear the sent
3885 			 */
3886 			/* sa_ignore FREED_MEMORY */
3887 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
3888 				if (tp1->window_probe) {
3889 					/* move back to data send queue */
3890 					sctp_window_probe_recovery(stcb, asoc, tp1);
3891 					break;
3892 				}
3893 			}
3894 		}
3895 		if (net->RTO == 0) {
3896 			to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
3897 		} else {
3898 			to_ticks = MSEC_TO_TICKS(net->RTO);
3899 		}
3900 		if (net->flight_size) {
3901 			j++;
3902 			(void)SCTP_OS_TIMER_START(&net->rxt_timer.timer, to_ticks,
3903 			    sctp_timeout_handler, &net->rxt_timer);
3904 			if (net->window_probe) {
3905 				net->window_probe = 0;
3906 			}
3907 		} else {
3908 			if (net->window_probe) {
3909 				/*
3910 				 * In window probes we must assure a timer
3911 				 * is still running there
3912 				 */
3913 				net->window_probe = 0;
3914 				if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
3915 					SCTP_OS_TIMER_START(&net->rxt_timer.timer, to_ticks,
3916 					    sctp_timeout_handler, &net->rxt_timer);
3917 				}
3918 			} else if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
3919 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3920 				    stcb, net,
3921 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_25);
3922 			}
3923 		}
3924 	}
3925 	if ((j == 0) &&
3926 	    (!TAILQ_EMPTY(&asoc->sent_queue)) &&
3927 	    (asoc->sent_queue_retran_cnt == 0) &&
3928 	    (win_probe_recovered == 0) &&
3929 	    (done_once == 0)) {
3930 		/*
3931 		 * huh, this should not happen unless all packets are
3932 		 * PR-SCTP and marked to skip of course.
3933 		 */
3934 		if (sctp_fs_audit(asoc)) {
3935 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3936 				net->flight_size = 0;
3937 			}
3938 			asoc->total_flight = 0;
3939 			asoc->total_flight_count = 0;
3940 			asoc->sent_queue_retran_cnt = 0;
3941 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
3942 				if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3943 					sctp_flight_size_increase(tp1);
3944 					sctp_total_flight_increase(stcb, tp1);
3945 				} else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3946 					sctp_ucount_incr(asoc->sent_queue_retran_cnt);
3947 				}
3948 			}
3949 		}
3950 		done_once = 1;
3951 		goto again;
3952 	}
3953 	/**********************************/
3954 	/* Now what about shutdown issues */
3955 	/**********************************/
3956 	if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
3957 		/* nothing left on sendqueue.. consider done */
3958 		/* clean up */
3959 		if ((asoc->stream_queue_cnt == 1) &&
3960 		    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
3961 		    (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
3962 		    (asoc->locked_on_sending)
3963 		    ) {
3964 			struct sctp_stream_queue_pending *sp;
3965 
3966 			/*
3967 			 * I may be in a state where we got all across.. but
3968 			 * cannot write more due to a shutdown... we abort
3969 			 * since the user did not indicate EOR in this case.
3970 			 * The sp will be cleaned during free of the asoc.
3971 			 */
3972 			sp = TAILQ_LAST(&((asoc->locked_on_sending)->outqueue),
3973 			    sctp_streamhead);
3974 			if ((sp) && (sp->length == 0)) {
3975 				/* Let cleanup code purge it */
3976 				if (sp->msg_is_complete) {
3977 					asoc->stream_queue_cnt--;
3978 				} else {
3979 					asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
3980 					asoc->locked_on_sending = NULL;
3981 					asoc->stream_queue_cnt--;
3982 				}
3983 			}
3984 		}
3985 		if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
3986 		    (asoc->stream_queue_cnt == 0)) {
3987 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
3988 				/* Need to abort here */
3989 				struct mbuf *op_err;
3990 
3991 		abort_out_now:
3992 				*abort_now = 1;
3993 				/* XXX */
3994 				op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3995 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_26;
3996 				sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
3997 			} else {
3998 				struct sctp_nets *netp;
3999 
4000 				if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
4001 				    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4002 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4003 				}
4004 				SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
4005 				SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
4006 				sctp_stop_timers_for_shutdown(stcb);
4007 				if (asoc->alternate) {
4008 					netp = asoc->alternate;
4009 				} else {
4010 					netp = asoc->primary_destination;
4011 				}
4012 				sctp_send_shutdown(stcb, netp);
4013 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4014 				    stcb->sctp_ep, stcb, netp);
4015 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4016 				    stcb->sctp_ep, stcb, netp);
4017 			}
4018 		} else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
4019 		    (asoc->stream_queue_cnt == 0)) {
4020 			struct sctp_nets *netp;
4021 
4022 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4023 				goto abort_out_now;
4024 			}
4025 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4026 			SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
4027 			SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
4028 			sctp_stop_timers_for_shutdown(stcb);
4029 			if (asoc->alternate) {
4030 				netp = asoc->alternate;
4031 			} else {
4032 				netp = asoc->primary_destination;
4033 			}
4034 			sctp_send_shutdown_ack(stcb, netp);
4035 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4036 			    stcb->sctp_ep, stcb, netp);
4037 		}
4038 	}
4039 	/*********************************************/
4040 	/* Here we perform PR-SCTP procedures        */
4041 	/* (section 4.2)                             */
4042 	/*********************************************/
4043 	/* C1. update advancedPeerAckPoint */
4044 	if (SCTP_TSN_GT(cumack, asoc->advanced_peer_ack_point)) {
4045 		asoc->advanced_peer_ack_point = cumack;
4046 	}
4047 	/* PR-Sctp issues need to be addressed too */
4048 	if ((asoc->prsctp_supported) && (asoc->pr_sctp_cnt > 0)) {
4049 		struct sctp_tmit_chunk *lchk;
4050 		uint32_t old_adv_peer_ack_point;
4051 
4052 		old_adv_peer_ack_point = asoc->advanced_peer_ack_point;
4053 		lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
4054 		/* C3. See if we need to send a Fwd-TSN */
4055 		if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, cumack)) {
4056 			/*
4057 			 * ISSUE with ECN, see FWD-TSN processing.
4058 			 */
4059 			if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, old_adv_peer_ack_point)) {
4060 				send_forward_tsn(stcb, asoc);
4061 			} else if (lchk) {
4062 				/* try to FR fwd-tsn's that get lost too */
4063 				if (lchk->rec.data.fwd_tsn_cnt >= 3) {
4064 					send_forward_tsn(stcb, asoc);
4065 				}
4066 			}
4067 		}
4068 		if (lchk) {
4069 			/* Assure a timer is up */
4070 			sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4071 			    stcb->sctp_ep, stcb, lchk->whoTo);
4072 		}
4073 	}
4074 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_RWND_LOGGING_ENABLE) {
4075 		sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
4076 		    rwnd,
4077 		    stcb->asoc.peers_rwnd,
4078 		    stcb->asoc.total_flight,
4079 		    stcb->asoc.total_output_queue_size);
4080 	}
4081 }
4082 
4083 void
4084 sctp_handle_sack(struct mbuf *m, int offset_seg, int offset_dup,
4085     struct sctp_tcb *stcb,
4086     uint16_t num_seg, uint16_t num_nr_seg, uint16_t num_dup,
4087     int *abort_now, uint8_t flags,
4088     uint32_t cum_ack, uint32_t rwnd, int ecne_seen)
4089 {
4090 	struct sctp_association *asoc;
4091 	struct sctp_tmit_chunk *tp1, *tp2;
4092 	uint32_t last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked, this_sack_lowest_newack;
4093 	uint16_t wake_him = 0;
4094 	uint32_t send_s = 0;
4095 	long j;
4096 	int accum_moved = 0;
4097 	int will_exit_fast_recovery = 0;
4098 	uint32_t a_rwnd, old_rwnd;
4099 	int win_probe_recovery = 0;
4100 	int win_probe_recovered = 0;
4101 	struct sctp_nets *net = NULL;
4102 	int done_once;
4103 	int rto_ok = 1;
4104 	uint8_t reneged_all = 0;
4105 	uint8_t cmt_dac_flag;
4106 
4107 	/*
4108 	 * we take any chance we can to service our queues since we cannot
4109 	 * get awoken when the socket is read from :<
4110 	 */
4111 	/*
4112 	 * Now perform the actual SACK handling: 1) Verify that it is not an
4113 	 * old sack, if so discard. 2) If there is nothing left in the send
4114 	 * queue (cum-ack is equal to last acked) then you have a duplicate
4115 	 * too, update any rwnd change and verify no timers are running.
4116 	 * then return. 3) Process any new consequtive data i.e. cum-ack
4117 	 * moved process these first and note that it moved. 4) Process any
4118 	 * sack blocks. 5) Drop any acked from the queue. 6) Check for any
4119 	 * revoked blocks and mark. 7) Update the cwnd. 8) Nothing left,
4120 	 * sync up flightsizes and things, stop all timers and also check
4121 	 * for shutdown_pending state. If so then go ahead and send off the
4122 	 * shutdown. If in shutdown recv, send off the shutdown-ack and
4123 	 * start that timer, Ret. 9) Strike any non-acked things and do FR
4124 	 * procedure if needed being sure to set the FR flag. 10) Do pr-sctp
4125 	 * procedures. 11) Apply any FR penalties. 12) Assure we will SACK
4126 	 * if in shutdown_recv state.
4127 	 */
4128 	SCTP_TCB_LOCK_ASSERT(stcb);
4129 	/* CMT DAC algo */
4130 	this_sack_lowest_newack = 0;
4131 	SCTP_STAT_INCR(sctps_slowpath_sack);
4132 	last_tsn = cum_ack;
4133 	cmt_dac_flag = flags & SCTP_SACK_CMT_DAC;
4134 #ifdef SCTP_ASOCLOG_OF_TSNS
4135 	stcb->asoc.cumack_log[stcb->asoc.cumack_log_at] = cum_ack;
4136 	stcb->asoc.cumack_log_at++;
4137 	if (stcb->asoc.cumack_log_at > SCTP_TSN_LOG_SIZE) {
4138 		stcb->asoc.cumack_log_at = 0;
4139 	}
4140 #endif
4141 	a_rwnd = rwnd;
4142 
4143 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_SACK_ARRIVALS_ENABLE) {
4144 		sctp_misc_ints(SCTP_SACK_LOG_NORMAL, cum_ack,
4145 		    rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
4146 	}
4147 	old_rwnd = stcb->asoc.peers_rwnd;
4148 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4149 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4150 		    stcb->asoc.overall_error_count,
4151 		    0,
4152 		    SCTP_FROM_SCTP_INDATA,
4153 		    __LINE__);
4154 	}
4155 	stcb->asoc.overall_error_count = 0;
4156 	asoc = &stcb->asoc;
4157 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4158 		sctp_log_sack(asoc->last_acked_seq,
4159 		    cum_ack,
4160 		    0,
4161 		    num_seg,
4162 		    num_dup,
4163 		    SCTP_LOG_NEW_SACK);
4164 	}
4165 	if ((num_dup) && (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE)) {
4166 		uint16_t i;
4167 		uint32_t *dupdata, dblock;
4168 
4169 		for (i = 0; i < num_dup; i++) {
4170 			dupdata = (uint32_t *) sctp_m_getptr(m, offset_dup + i * sizeof(uint32_t),
4171 			    sizeof(uint32_t), (uint8_t *) & dblock);
4172 			if (dupdata == NULL) {
4173 				break;
4174 			}
4175 			sctp_log_fr(*dupdata, 0, 0, SCTP_FR_DUPED);
4176 		}
4177 	}
4178 	if (SCTP_BASE_SYSCTL(sctp_strict_sacks)) {
4179 		/* reality check */
4180 		if (!TAILQ_EMPTY(&asoc->sent_queue)) {
4181 			tp1 = TAILQ_LAST(&asoc->sent_queue,
4182 			    sctpchunk_listhead);
4183 			send_s = tp1->rec.data.TSN_seq + 1;
4184 		} else {
4185 			tp1 = NULL;
4186 			send_s = asoc->sending_seq;
4187 		}
4188 		if (SCTP_TSN_GE(cum_ack, send_s)) {
4189 			struct mbuf *op_err;
4190 			char msg[SCTP_DIAG_INFO_LEN];
4191 
4192 			/*
4193 			 * no way, we have not even sent this TSN out yet.
4194 			 * Peer is hopelessly messed up with us.
4195 			 */
4196 			SCTP_PRINTF("NEW cum_ack:%x send_s:%x is smaller or equal\n",
4197 			    cum_ack, send_s);
4198 			if (tp1) {
4199 				SCTP_PRINTF("Got send_s from tsn:%x + 1 of tp1:%p\n",
4200 				    tp1->rec.data.TSN_seq, (void *)tp1);
4201 			}
4202 	hopeless_peer:
4203 			*abort_now = 1;
4204 			/* XXX */
4205 			snprintf(msg, sizeof(msg), "Cum ack %8.8x greater or equal than TSN %8.8x",
4206 			    cum_ack, send_s);
4207 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
4208 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_27;
4209 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4210 			return;
4211 		}
4212 	}
4213 	/**********************/
4214 	/* 1) check the range */
4215 	/**********************/
4216 	if (SCTP_TSN_GT(asoc->last_acked_seq, last_tsn)) {
4217 		/* acking something behind */
4218 		return;
4219 	}
4220 	/* update the Rwnd of the peer */
4221 	if (TAILQ_EMPTY(&asoc->sent_queue) &&
4222 	    TAILQ_EMPTY(&asoc->send_queue) &&
4223 	    (asoc->stream_queue_cnt == 0)) {
4224 		/* nothing left on send/sent and strmq */
4225 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4226 			sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4227 			    asoc->peers_rwnd, 0, 0, a_rwnd);
4228 		}
4229 		asoc->peers_rwnd = a_rwnd;
4230 		if (asoc->sent_queue_retran_cnt) {
4231 			asoc->sent_queue_retran_cnt = 0;
4232 		}
4233 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4234 			/* SWS sender side engages */
4235 			asoc->peers_rwnd = 0;
4236 		}
4237 		/* stop any timers */
4238 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4239 			sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4240 			    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_28);
4241 			net->partial_bytes_acked = 0;
4242 			net->flight_size = 0;
4243 		}
4244 		asoc->total_flight = 0;
4245 		asoc->total_flight_count = 0;
4246 		return;
4247 	}
4248 	/*
4249 	 * We init netAckSz and netAckSz2 to 0. These are used to track 2
4250 	 * things. The total byte count acked is tracked in netAckSz AND
4251 	 * netAck2 is used to track the total bytes acked that are un-
4252 	 * amibguious and were never retransmitted. We track these on a per
4253 	 * destination address basis.
4254 	 */
4255 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4256 		if (SCTP_TSN_GT(cum_ack, net->cwr_window_tsn)) {
4257 			/* Drag along the window_tsn for cwr's */
4258 			net->cwr_window_tsn = cum_ack;
4259 		}
4260 		net->prev_cwnd = net->cwnd;
4261 		net->net_ack = 0;
4262 		net->net_ack2 = 0;
4263 
4264 		/*
4265 		 * CMT: Reset CUC and Fast recovery algo variables before
4266 		 * SACK processing
4267 		 */
4268 		net->new_pseudo_cumack = 0;
4269 		net->will_exit_fast_recovery = 0;
4270 		if (stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) {
4271 			(*stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) (stcb, net);
4272 		}
4273 	}
4274 	/* process the new consecutive TSN first */
4275 	TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4276 		if (SCTP_TSN_GE(last_tsn, tp1->rec.data.TSN_seq)) {
4277 			if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4278 				accum_moved = 1;
4279 				if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4280 					/*
4281 					 * If it is less than ACKED, it is
4282 					 * now no-longer in flight. Higher
4283 					 * values may occur during marking
4284 					 */
4285 					if ((tp1->whoTo->dest_state &
4286 					    SCTP_ADDR_UNCONFIRMED) &&
4287 					    (tp1->snd_count < 2)) {
4288 						/*
4289 						 * If there was no retran
4290 						 * and the address is
4291 						 * un-confirmed and we sent
4292 						 * there and are now
4293 						 * sacked.. its confirmed,
4294 						 * mark it so.
4295 						 */
4296 						tp1->whoTo->dest_state &=
4297 						    ~SCTP_ADDR_UNCONFIRMED;
4298 					}
4299 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4300 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4301 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4302 							    tp1->whoTo->flight_size,
4303 							    tp1->book_size,
4304 							    (uintptr_t) tp1->whoTo,
4305 							    tp1->rec.data.TSN_seq);
4306 						}
4307 						sctp_flight_size_decrease(tp1);
4308 						sctp_total_flight_decrease(stcb, tp1);
4309 						if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
4310 							(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
4311 							    tp1);
4312 						}
4313 					}
4314 					tp1->whoTo->net_ack += tp1->send_size;
4315 
4316 					/* CMT SFR and DAC algos */
4317 					this_sack_lowest_newack = tp1->rec.data.TSN_seq;
4318 					tp1->whoTo->saw_newack = 1;
4319 
4320 					if (tp1->snd_count < 2) {
4321 						/*
4322 						 * True non-retransmited
4323 						 * chunk
4324 						 */
4325 						tp1->whoTo->net_ack2 +=
4326 						    tp1->send_size;
4327 
4328 						/* update RTO too? */
4329 						if (tp1->do_rtt) {
4330 							if (rto_ok) {
4331 								tp1->whoTo->RTO =
4332 								    sctp_calculate_rto(stcb,
4333 								    asoc, tp1->whoTo,
4334 								    &tp1->sent_rcv_time,
4335 								    sctp_align_safe_nocopy,
4336 								    SCTP_RTT_FROM_DATA);
4337 								rto_ok = 0;
4338 							}
4339 							if (tp1->whoTo->rto_needed == 0) {
4340 								tp1->whoTo->rto_needed = 1;
4341 							}
4342 							tp1->do_rtt = 0;
4343 						}
4344 					}
4345 					/*
4346 					 * CMT: CUCv2 algorithm. From the
4347 					 * cumack'd TSNs, for each TSN being
4348 					 * acked for the first time, set the
4349 					 * following variables for the
4350 					 * corresp destination.
4351 					 * new_pseudo_cumack will trigger a
4352 					 * cwnd update.
4353 					 * find_(rtx_)pseudo_cumack will
4354 					 * trigger search for the next
4355 					 * expected (rtx-)pseudo-cumack.
4356 					 */
4357 					tp1->whoTo->new_pseudo_cumack = 1;
4358 					tp1->whoTo->find_pseudo_cumack = 1;
4359 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
4360 
4361 
4362 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4363 						sctp_log_sack(asoc->last_acked_seq,
4364 						    cum_ack,
4365 						    tp1->rec.data.TSN_seq,
4366 						    0,
4367 						    0,
4368 						    SCTP_LOG_TSN_ACKED);
4369 					}
4370 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
4371 						sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.TSN_seq, SCTP_CWND_LOG_FROM_SACK);
4372 					}
4373 				}
4374 				if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4375 					sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4376 #ifdef SCTP_AUDITING_ENABLED
4377 					sctp_audit_log(0xB3,
4378 					    (asoc->sent_queue_retran_cnt & 0x000000ff));
4379 #endif
4380 				}
4381 				if (tp1->rec.data.chunk_was_revoked) {
4382 					/* deflate the cwnd */
4383 					tp1->whoTo->cwnd -= tp1->book_size;
4384 					tp1->rec.data.chunk_was_revoked = 0;
4385 				}
4386 				if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4387 					tp1->sent = SCTP_DATAGRAM_ACKED;
4388 				}
4389 			}
4390 		} else {
4391 			break;
4392 		}
4393 	}
4394 	biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
4395 	/* always set this up to cum-ack */
4396 	asoc->this_sack_highest_gap = last_tsn;
4397 
4398 	if ((num_seg > 0) || (num_nr_seg > 0)) {
4399 
4400 		/*
4401 		 * CMT: SFR algo (and HTNA) - this_sack_highest_newack has
4402 		 * to be greater than the cumack. Also reset saw_newack to 0
4403 		 * for all dests.
4404 		 */
4405 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4406 			net->saw_newack = 0;
4407 			net->this_sack_highest_newack = last_tsn;
4408 		}
4409 
4410 		/*
4411 		 * thisSackHighestGap will increase while handling NEW
4412 		 * segments this_sack_highest_newack will increase while
4413 		 * handling NEWLY ACKED chunks. this_sack_lowest_newack is
4414 		 * used for CMT DAC algo. saw_newack will also change.
4415 		 */
4416 		if (sctp_handle_segments(m, &offset_seg, stcb, asoc, last_tsn, &biggest_tsn_acked,
4417 		    &biggest_tsn_newly_acked, &this_sack_lowest_newack,
4418 		    num_seg, num_nr_seg, &rto_ok)) {
4419 			wake_him++;
4420 		}
4421 		if (SCTP_BASE_SYSCTL(sctp_strict_sacks)) {
4422 			/*
4423 			 * validate the biggest_tsn_acked in the gap acks if
4424 			 * strict adherence is wanted.
4425 			 */
4426 			if (SCTP_TSN_GE(biggest_tsn_acked, send_s)) {
4427 				/*
4428 				 * peer is either confused or we are under
4429 				 * attack. We must abort.
4430 				 */
4431 				SCTP_PRINTF("Hopeless peer! biggest_tsn_acked:%x largest seq:%x\n",
4432 				    biggest_tsn_acked, send_s);
4433 				goto hopeless_peer;
4434 			}
4435 		}
4436 	}
4437 	/*******************************************/
4438 	/* cancel ALL T3-send timer if accum moved */
4439 	/*******************************************/
4440 	if (asoc->sctp_cmt_on_off > 0) {
4441 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4442 			if (net->new_pseudo_cumack)
4443 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4444 				    stcb, net,
4445 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_29);
4446 
4447 		}
4448 	} else {
4449 		if (accum_moved) {
4450 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4451 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4452 				    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_30);
4453 			}
4454 		}
4455 	}
4456 	/********************************************/
4457 	/* drop the acked chunks from the sentqueue */
4458 	/********************************************/
4459 	asoc->last_acked_seq = cum_ack;
4460 
4461 	TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
4462 		if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, cum_ack)) {
4463 			break;
4464 		}
4465 		if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4466 			if (asoc->strmout[tp1->rec.data.stream_number].chunks_on_queues > 0) {
4467 				asoc->strmout[tp1->rec.data.stream_number].chunks_on_queues--;
4468 #ifdef INVARIANTS
4469 			} else {
4470 				panic("No chunks on the queues for sid %u.", tp1->rec.data.stream_number);
4471 #endif
4472 			}
4473 		}
4474 		if ((asoc->strmout[tp1->rec.data.stream_number].chunks_on_queues == 0) &&
4475 		    (asoc->strmout[tp1->rec.data.stream_number].state == SCTP_STREAM_RESET_PENDING) &&
4476 		    TAILQ_EMPTY(&asoc->strmout[tp1->rec.data.stream_number].outqueue)) {
4477 			asoc->trigger_reset = 1;
4478 		}
4479 		TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4480 		if (PR_SCTP_ENABLED(tp1->flags)) {
4481 			if (asoc->pr_sctp_cnt != 0)
4482 				asoc->pr_sctp_cnt--;
4483 		}
4484 		asoc->sent_queue_cnt--;
4485 		if (tp1->data) {
4486 			/* sa_ignore NO_NULL_CHK */
4487 			sctp_free_bufspace(stcb, asoc, tp1, 1);
4488 			sctp_m_freem(tp1->data);
4489 			tp1->data = NULL;
4490 			if (asoc->prsctp_supported && PR_SCTP_BUF_ENABLED(tp1->flags)) {
4491 				asoc->sent_queue_cnt_removeable--;
4492 			}
4493 		}
4494 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4495 			sctp_log_sack(asoc->last_acked_seq,
4496 			    cum_ack,
4497 			    tp1->rec.data.TSN_seq,
4498 			    0,
4499 			    0,
4500 			    SCTP_LOG_FREE_SENT);
4501 		}
4502 		sctp_free_a_chunk(stcb, tp1, SCTP_SO_NOT_LOCKED);
4503 		wake_him++;
4504 	}
4505 	if (TAILQ_EMPTY(&asoc->sent_queue) && (asoc->total_flight > 0)) {
4506 #ifdef INVARIANTS
4507 		panic("Warning flight size is postive and should be 0");
4508 #else
4509 		SCTP_PRINTF("Warning flight size incorrect should be 0 is %d\n",
4510 		    asoc->total_flight);
4511 #endif
4512 		asoc->total_flight = 0;
4513 	}
4514 	/* sa_ignore NO_NULL_CHK */
4515 	if ((wake_him) && (stcb->sctp_socket)) {
4516 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4517 		struct socket *so;
4518 
4519 #endif
4520 		SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4521 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4522 			sctp_wakeup_log(stcb, wake_him, SCTP_WAKESND_FROM_SACK);
4523 		}
4524 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4525 		so = SCTP_INP_SO(stcb->sctp_ep);
4526 		atomic_add_int(&stcb->asoc.refcnt, 1);
4527 		SCTP_TCB_UNLOCK(stcb);
4528 		SCTP_SOCKET_LOCK(so, 1);
4529 		SCTP_TCB_LOCK(stcb);
4530 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
4531 		if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4532 			/* assoc was freed while we were unlocked */
4533 			SCTP_SOCKET_UNLOCK(so, 1);
4534 			return;
4535 		}
4536 #endif
4537 		sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4538 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4539 		SCTP_SOCKET_UNLOCK(so, 1);
4540 #endif
4541 	} else {
4542 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4543 			sctp_wakeup_log(stcb, wake_him, SCTP_NOWAKE_FROM_SACK);
4544 		}
4545 	}
4546 
4547 	if (asoc->fast_retran_loss_recovery && accum_moved) {
4548 		if (SCTP_TSN_GE(asoc->last_acked_seq, asoc->fast_recovery_tsn)) {
4549 			/* Setup so we will exit RFC2582 fast recovery */
4550 			will_exit_fast_recovery = 1;
4551 		}
4552 	}
4553 	/*
4554 	 * Check for revoked fragments:
4555 	 *
4556 	 * if Previous sack - Had no frags then we can't have any revoked if
4557 	 * Previous sack - Had frag's then - If we now have frags aka
4558 	 * num_seg > 0 call sctp_check_for_revoked() to tell if peer revoked
4559 	 * some of them. else - The peer revoked all ACKED fragments, since
4560 	 * we had some before and now we have NONE.
4561 	 */
4562 
4563 	if (num_seg) {
4564 		sctp_check_for_revoked(stcb, asoc, cum_ack, biggest_tsn_acked);
4565 		asoc->saw_sack_with_frags = 1;
4566 	} else if (asoc->saw_sack_with_frags) {
4567 		int cnt_revoked = 0;
4568 
4569 		/* Peer revoked all dg's marked or acked */
4570 		TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4571 			if (tp1->sent == SCTP_DATAGRAM_ACKED) {
4572 				tp1->sent = SCTP_DATAGRAM_SENT;
4573 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4574 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
4575 					    tp1->whoTo->flight_size,
4576 					    tp1->book_size,
4577 					    (uintptr_t) tp1->whoTo,
4578 					    tp1->rec.data.TSN_seq);
4579 				}
4580 				sctp_flight_size_increase(tp1);
4581 				sctp_total_flight_increase(stcb, tp1);
4582 				tp1->rec.data.chunk_was_revoked = 1;
4583 				/*
4584 				 * To ensure that this increase in
4585 				 * flightsize, which is artificial, does not
4586 				 * throttle the sender, we also increase the
4587 				 * cwnd artificially.
4588 				 */
4589 				tp1->whoTo->cwnd += tp1->book_size;
4590 				cnt_revoked++;
4591 			}
4592 		}
4593 		if (cnt_revoked) {
4594 			reneged_all = 1;
4595 		}
4596 		asoc->saw_sack_with_frags = 0;
4597 	}
4598 	if (num_nr_seg > 0)
4599 		asoc->saw_sack_with_nr_frags = 1;
4600 	else
4601 		asoc->saw_sack_with_nr_frags = 0;
4602 
4603 	/* JRS - Use the congestion control given in the CC module */
4604 	if (ecne_seen == 0) {
4605 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4606 			if (net->net_ack2 > 0) {
4607 				/*
4608 				 * Karn's rule applies to clearing error
4609 				 * count, this is optional.
4610 				 */
4611 				net->error_count = 0;
4612 				if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
4613 					/* addr came good */
4614 					net->dest_state |= SCTP_ADDR_REACHABLE;
4615 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
4616 					    0, (void *)net, SCTP_SO_NOT_LOCKED);
4617 				}
4618 				if (net == stcb->asoc.primary_destination) {
4619 					if (stcb->asoc.alternate) {
4620 						/*
4621 						 * release the alternate,
4622 						 * primary is good
4623 						 */
4624 						sctp_free_remote_addr(stcb->asoc.alternate);
4625 						stcb->asoc.alternate = NULL;
4626 					}
4627 				}
4628 				if (net->dest_state & SCTP_ADDR_PF) {
4629 					net->dest_state &= ~SCTP_ADDR_PF;
4630 					sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
4631 					    stcb->sctp_ep, stcb, net,
4632 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_31);
4633 					sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
4634 					asoc->cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
4635 					/* Done with this net */
4636 					net->net_ack = 0;
4637 				}
4638 				/* restore any doubled timers */
4639 				net->RTO = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
4640 				if (net->RTO < stcb->asoc.minrto) {
4641 					net->RTO = stcb->asoc.minrto;
4642 				}
4643 				if (net->RTO > stcb->asoc.maxrto) {
4644 					net->RTO = stcb->asoc.maxrto;
4645 				}
4646 			}
4647 		}
4648 		asoc->cc_functions.sctp_cwnd_update_after_sack(stcb, asoc, accum_moved, reneged_all, will_exit_fast_recovery);
4649 	}
4650 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
4651 		/* nothing left in-flight */
4652 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4653 			/* stop all timers */
4654 			sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4655 			    stcb, net,
4656 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_32);
4657 			net->flight_size = 0;
4658 			net->partial_bytes_acked = 0;
4659 		}
4660 		asoc->total_flight = 0;
4661 		asoc->total_flight_count = 0;
4662 	}
4663 	/**********************************/
4664 	/* Now what about shutdown issues */
4665 	/**********************************/
4666 	if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4667 		/* nothing left on sendqueue.. consider done */
4668 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4669 			sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4670 			    asoc->peers_rwnd, 0, 0, a_rwnd);
4671 		}
4672 		asoc->peers_rwnd = a_rwnd;
4673 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4674 			/* SWS sender side engages */
4675 			asoc->peers_rwnd = 0;
4676 		}
4677 		/* clean up */
4678 		if ((asoc->stream_queue_cnt == 1) &&
4679 		    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4680 		    (asoc->state & SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4681 		    (asoc->locked_on_sending)
4682 		    ) {
4683 			struct sctp_stream_queue_pending *sp;
4684 
4685 			/*
4686 			 * I may be in a state where we got all across.. but
4687 			 * cannot write more due to a shutdown... we abort
4688 			 * since the user did not indicate EOR in this case.
4689 			 */
4690 			sp = TAILQ_LAST(&((asoc->locked_on_sending)->outqueue),
4691 			    sctp_streamhead);
4692 			if ((sp) && (sp->length == 0)) {
4693 				asoc->locked_on_sending = NULL;
4694 				if (sp->msg_is_complete) {
4695 					asoc->stream_queue_cnt--;
4696 				} else {
4697 					asoc->state |= SCTP_STATE_PARTIAL_MSG_LEFT;
4698 					asoc->stream_queue_cnt--;
4699 				}
4700 			}
4701 		}
4702 		if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
4703 		    (asoc->stream_queue_cnt == 0)) {
4704 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4705 				/* Need to abort here */
4706 				struct mbuf *op_err;
4707 
4708 		abort_out_now:
4709 				*abort_now = 1;
4710 				/* XXX */
4711 				op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
4712 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_33;
4713 				sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4714 				return;
4715 			} else {
4716 				struct sctp_nets *netp;
4717 
4718 				if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
4719 				    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4720 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4721 				}
4722 				SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
4723 				SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
4724 				sctp_stop_timers_for_shutdown(stcb);
4725 				if (asoc->alternate) {
4726 					netp = asoc->alternate;
4727 				} else {
4728 					netp = asoc->primary_destination;
4729 				}
4730 				sctp_send_shutdown(stcb, netp);
4731 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4732 				    stcb->sctp_ep, stcb, netp);
4733 				sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4734 				    stcb->sctp_ep, stcb, netp);
4735 			}
4736 			return;
4737 		} else if ((SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
4738 		    (asoc->stream_queue_cnt == 0)) {
4739 			struct sctp_nets *netp;
4740 
4741 			if (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT) {
4742 				goto abort_out_now;
4743 			}
4744 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4745 			SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
4746 			SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
4747 			sctp_stop_timers_for_shutdown(stcb);
4748 			if (asoc->alternate) {
4749 				netp = asoc->alternate;
4750 			} else {
4751 				netp = asoc->primary_destination;
4752 			}
4753 			sctp_send_shutdown_ack(stcb, netp);
4754 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4755 			    stcb->sctp_ep, stcb, netp);
4756 			return;
4757 		}
4758 	}
4759 	/*
4760 	 * Now here we are going to recycle net_ack for a different use...
4761 	 * HEADS UP.
4762 	 */
4763 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4764 		net->net_ack = 0;
4765 	}
4766 
4767 	/*
4768 	 * CMT DAC algorithm: If SACK DAC flag was 0, then no extra marking
4769 	 * to be done. Setting this_sack_lowest_newack to the cum_ack will
4770 	 * automatically ensure that.
4771 	 */
4772 	if ((asoc->sctp_cmt_on_off > 0) &&
4773 	    SCTP_BASE_SYSCTL(sctp_cmt_use_dac) &&
4774 	    (cmt_dac_flag == 0)) {
4775 		this_sack_lowest_newack = cum_ack;
4776 	}
4777 	if ((num_seg > 0) || (num_nr_seg > 0)) {
4778 		sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked,
4779 		    biggest_tsn_newly_acked, this_sack_lowest_newack, accum_moved);
4780 	}
4781 	/* JRS - Use the congestion control given in the CC module */
4782 	asoc->cc_functions.sctp_cwnd_update_after_fr(stcb, asoc);
4783 
4784 	/* Now are we exiting loss recovery ? */
4785 	if (will_exit_fast_recovery) {
4786 		/* Ok, we must exit fast recovery */
4787 		asoc->fast_retran_loss_recovery = 0;
4788 	}
4789 	if ((asoc->sat_t3_loss_recovery) &&
4790 	    SCTP_TSN_GE(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn)) {
4791 		/* end satellite t3 loss recovery */
4792 		asoc->sat_t3_loss_recovery = 0;
4793 	}
4794 	/*
4795 	 * CMT Fast recovery
4796 	 */
4797 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4798 		if (net->will_exit_fast_recovery) {
4799 			/* Ok, we must exit fast recovery */
4800 			net->fast_retran_loss_recovery = 0;
4801 		}
4802 	}
4803 
4804 	/* Adjust and set the new rwnd value */
4805 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4806 		sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4807 		    asoc->peers_rwnd, asoc->total_flight, (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)), a_rwnd);
4808 	}
4809 	asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd,
4810 	    (uint32_t) (asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
4811 	if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4812 		/* SWS sender side engages */
4813 		asoc->peers_rwnd = 0;
4814 	}
4815 	if (asoc->peers_rwnd > old_rwnd) {
4816 		win_probe_recovery = 1;
4817 	}
4818 	/*
4819 	 * Now we must setup so we have a timer up for anyone with
4820 	 * outstanding data.
4821 	 */
4822 	done_once = 0;
4823 again:
4824 	j = 0;
4825 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4826 		if (win_probe_recovery && (net->window_probe)) {
4827 			win_probe_recovered = 1;
4828 			/*-
4829 			 * Find first chunk that was used with
4830 			 * window probe and clear the event. Put
4831 			 * it back into the send queue as if has
4832 			 * not been sent.
4833 			 */
4834 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4835 				if (tp1->window_probe) {
4836 					sctp_window_probe_recovery(stcb, asoc, tp1);
4837 					break;
4838 				}
4839 			}
4840 		}
4841 		if (net->flight_size) {
4842 			j++;
4843 			if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4844 				sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4845 				    stcb->sctp_ep, stcb, net);
4846 			}
4847 			if (net->window_probe) {
4848 				net->window_probe = 0;
4849 			}
4850 		} else {
4851 			if (net->window_probe) {
4852 				/*
4853 				 * In window probes we must assure a timer
4854 				 * is still running there
4855 				 */
4856 				if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4857 					sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4858 					    stcb->sctp_ep, stcb, net);
4859 
4860 				}
4861 			} else if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4862 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4863 				    stcb, net,
4864 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_34);
4865 			}
4866 		}
4867 	}
4868 	if ((j == 0) &&
4869 	    (!TAILQ_EMPTY(&asoc->sent_queue)) &&
4870 	    (asoc->sent_queue_retran_cnt == 0) &&
4871 	    (win_probe_recovered == 0) &&
4872 	    (done_once == 0)) {
4873 		/*
4874 		 * huh, this should not happen unless all packets are
4875 		 * PR-SCTP and marked to skip of course.
4876 		 */
4877 		if (sctp_fs_audit(asoc)) {
4878 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4879 				net->flight_size = 0;
4880 			}
4881 			asoc->total_flight = 0;
4882 			asoc->total_flight_count = 0;
4883 			asoc->sent_queue_retran_cnt = 0;
4884 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4885 				if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4886 					sctp_flight_size_increase(tp1);
4887 					sctp_total_flight_increase(stcb, tp1);
4888 				} else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4889 					sctp_ucount_incr(asoc->sent_queue_retran_cnt);
4890 				}
4891 			}
4892 		}
4893 		done_once = 1;
4894 		goto again;
4895 	}
4896 	/*********************************************/
4897 	/* Here we perform PR-SCTP procedures        */
4898 	/* (section 4.2)                             */
4899 	/*********************************************/
4900 	/* C1. update advancedPeerAckPoint */
4901 	if (SCTP_TSN_GT(cum_ack, asoc->advanced_peer_ack_point)) {
4902 		asoc->advanced_peer_ack_point = cum_ack;
4903 	}
4904 	/* C2. try to further move advancedPeerAckPoint ahead */
4905 	if ((asoc->prsctp_supported) && (asoc->pr_sctp_cnt > 0)) {
4906 		struct sctp_tmit_chunk *lchk;
4907 		uint32_t old_adv_peer_ack_point;
4908 
4909 		old_adv_peer_ack_point = asoc->advanced_peer_ack_point;
4910 		lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
4911 		/* C3. See if we need to send a Fwd-TSN */
4912 		if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, cum_ack)) {
4913 			/*
4914 			 * ISSUE with ECN, see FWD-TSN processing.
4915 			 */
4916 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) {
4917 				sctp_misc_ints(SCTP_FWD_TSN_CHECK,
4918 				    0xee, cum_ack, asoc->advanced_peer_ack_point,
4919 				    old_adv_peer_ack_point);
4920 			}
4921 			if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, old_adv_peer_ack_point)) {
4922 				send_forward_tsn(stcb, asoc);
4923 			} else if (lchk) {
4924 				/* try to FR fwd-tsn's that get lost too */
4925 				if (lchk->rec.data.fwd_tsn_cnt >= 3) {
4926 					send_forward_tsn(stcb, asoc);
4927 				}
4928 			}
4929 		}
4930 		if (lchk) {
4931 			/* Assure a timer is up */
4932 			sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4933 			    stcb->sctp_ep, stcb, lchk->whoTo);
4934 		}
4935 	}
4936 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_RWND_LOGGING_ENABLE) {
4937 		sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
4938 		    a_rwnd,
4939 		    stcb->asoc.peers_rwnd,
4940 		    stcb->asoc.total_flight,
4941 		    stcb->asoc.total_output_queue_size);
4942 	}
4943 }
4944 
4945 void
4946 sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp, int *abort_flag)
4947 {
4948 	/* Copy cum-ack */
4949 	uint32_t cum_ack, a_rwnd;
4950 
4951 	cum_ack = ntohl(cp->cumulative_tsn_ack);
4952 	/* Arrange so a_rwnd does NOT change */
4953 	a_rwnd = stcb->asoc.peers_rwnd + stcb->asoc.total_flight;
4954 
4955 	/* Now call the express sack handling */
4956 	sctp_express_handle_sack(stcb, cum_ack, a_rwnd, abort_flag, 0);
4957 }
4958 
4959 static void
4960 sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb,
4961     struct sctp_stream_in *strmin)
4962 {
4963 	struct sctp_queued_to_read *ctl, *nctl;
4964 	struct sctp_association *asoc;
4965 	uint16_t tt;
4966 
4967 	asoc = &stcb->asoc;
4968 	tt = strmin->last_sequence_delivered;
4969 	/*
4970 	 * First deliver anything prior to and including the stream no that
4971 	 * came in
4972 	 */
4973 	TAILQ_FOREACH_SAFE(ctl, &strmin->inqueue, next, nctl) {
4974 		if (SCTP_SSN_GE(tt, ctl->sinfo_ssn)) {
4975 			/* this is deliverable now */
4976 			TAILQ_REMOVE(&strmin->inqueue, ctl, next);
4977 			/* subtract pending on streams */
4978 			asoc->size_on_all_streams -= ctl->length;
4979 			sctp_ucount_decr(asoc->cnt_on_all_streams);
4980 			/* deliver it to at least the delivery-q */
4981 			if (stcb->sctp_socket) {
4982 				sctp_mark_non_revokable(asoc, ctl->sinfo_tsn);
4983 				sctp_add_to_readq(stcb->sctp_ep, stcb,
4984 				    ctl,
4985 				    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_HELD, SCTP_SO_NOT_LOCKED);
4986 			}
4987 		} else {
4988 			/* no more delivery now. */
4989 			break;
4990 		}
4991 	}
4992 	/*
4993 	 * now we must deliver things in queue the normal way  if any are
4994 	 * now ready.
4995 	 */
4996 	tt = strmin->last_sequence_delivered + 1;
4997 	TAILQ_FOREACH_SAFE(ctl, &strmin->inqueue, next, nctl) {
4998 		if (tt == ctl->sinfo_ssn) {
4999 			/* this is deliverable now */
5000 			TAILQ_REMOVE(&strmin->inqueue, ctl, next);
5001 			/* subtract pending on streams */
5002 			asoc->size_on_all_streams -= ctl->length;
5003 			sctp_ucount_decr(asoc->cnt_on_all_streams);
5004 			/* deliver it to at least the delivery-q */
5005 			strmin->last_sequence_delivered = ctl->sinfo_ssn;
5006 			if (stcb->sctp_socket) {
5007 				sctp_mark_non_revokable(asoc, ctl->sinfo_tsn);
5008 				sctp_add_to_readq(stcb->sctp_ep, stcb,
5009 				    ctl,
5010 				    &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_HELD, SCTP_SO_NOT_LOCKED);
5011 
5012 			}
5013 			tt = strmin->last_sequence_delivered + 1;
5014 		} else {
5015 			break;
5016 		}
5017 	}
5018 }
5019 
5020 static void
5021 sctp_flush_reassm_for_str_seq(struct sctp_tcb *stcb,
5022     struct sctp_association *asoc,
5023     uint16_t stream, uint16_t seq)
5024 {
5025 	struct sctp_tmit_chunk *chk, *nchk;
5026 
5027 	/* For each one on here see if we need to toss it */
5028 	/*
5029 	 * For now large messages held on the reasmqueue that are complete
5030 	 * will be tossed too. We could in theory do more work to spin
5031 	 * through and stop after dumping one msg aka seeing the start of a
5032 	 * new msg at the head, and call the delivery function... to see if
5033 	 * it can be delivered... But for now we just dump everything on the
5034 	 * queue.
5035 	 */
5036 	TAILQ_FOREACH_SAFE(chk, &asoc->reasmqueue, sctp_next, nchk) {
5037 		/*
5038 		 * Do not toss it if on a different stream or marked for
5039 		 * unordered delivery in which case the stream sequence
5040 		 * number has no meaning.
5041 		 */
5042 		if ((chk->rec.data.stream_number != stream) ||
5043 		    ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == SCTP_DATA_UNORDERED)) {
5044 			continue;
5045 		}
5046 		if (chk->rec.data.stream_seq == seq) {
5047 			/* It needs to be tossed */
5048 			TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5049 			if (SCTP_TSN_GT(chk->rec.data.TSN_seq, asoc->tsn_last_delivered)) {
5050 				asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
5051 				asoc->str_of_pdapi = chk->rec.data.stream_number;
5052 				asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
5053 				asoc->fragment_flags = chk->rec.data.rcv_flags;
5054 			}
5055 			asoc->size_on_reasm_queue -= chk->send_size;
5056 			sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5057 
5058 			/* Clear up any stream problem */
5059 			if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) != SCTP_DATA_UNORDERED &&
5060 			    SCTP_SSN_GT(chk->rec.data.stream_seq, asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered)) {
5061 				/*
5062 				 * We must dump forward this streams
5063 				 * sequence number if the chunk is not
5064 				 * unordered that is being skipped. There is
5065 				 * a chance that if the peer does not
5066 				 * include the last fragment in its FWD-TSN
5067 				 * we WILL have a problem here since you
5068 				 * would have a partial chunk in queue that
5069 				 * may not be deliverable. Also if a Partial
5070 				 * delivery API as started the user may get
5071 				 * a partial chunk. The next read returning
5072 				 * a new chunk... really ugly but I see no
5073 				 * way around it! Maybe a notify??
5074 				 */
5075 				asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered = chk->rec.data.stream_seq;
5076 			}
5077 			if (chk->data) {
5078 				sctp_m_freem(chk->data);
5079 				chk->data = NULL;
5080 			}
5081 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
5082 		} else if (SCTP_SSN_GT(chk->rec.data.stream_seq, seq)) {
5083 			/*
5084 			 * If the stream_seq is > than the purging one, we
5085 			 * are done
5086 			 */
5087 			break;
5088 		}
5089 	}
5090 }
5091 
5092 
5093 void
5094 sctp_handle_forward_tsn(struct sctp_tcb *stcb,
5095     struct sctp_forward_tsn_chunk *fwd,
5096     int *abort_flag, struct mbuf *m, int offset)
5097 {
5098 	/* The pr-sctp fwd tsn */
5099 	/*
5100 	 * here we will perform all the data receiver side steps for
5101 	 * processing FwdTSN, as required in by pr-sctp draft:
5102 	 *
5103 	 * Assume we get FwdTSN(x):
5104 	 *
5105 	 * 1) update local cumTSN to x 2) try to further advance cumTSN to x +
5106 	 * others we have 3) examine and update re-ordering queue on
5107 	 * pr-in-streams 4) clean up re-assembly queue 5) Send a sack to
5108 	 * report where we are.
5109 	 */
5110 	struct sctp_association *asoc;
5111 	uint32_t new_cum_tsn, gap;
5112 	unsigned int i, fwd_sz, m_size;
5113 	uint32_t str_seq;
5114 	struct sctp_stream_in *strm;
5115 	struct sctp_tmit_chunk *chk, *nchk;
5116 	struct sctp_queued_to_read *ctl, *sv;
5117 
5118 	asoc = &stcb->asoc;
5119 	if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
5120 		SCTPDBG(SCTP_DEBUG_INDATA1,
5121 		    "Bad size too small/big fwd-tsn\n");
5122 		return;
5123 	}
5124 	m_size = (stcb->asoc.mapping_array_size << 3);
5125 	/*************************************************************/
5126 	/* 1. Here we update local cumTSN and shift the bitmap array */
5127 	/*************************************************************/
5128 	new_cum_tsn = ntohl(fwd->new_cumulative_tsn);
5129 
5130 	if (SCTP_TSN_GE(asoc->cumulative_tsn, new_cum_tsn)) {
5131 		/* Already got there ... */
5132 		return;
5133 	}
5134 	/*
5135 	 * now we know the new TSN is more advanced, let's find the actual
5136 	 * gap
5137 	 */
5138 	SCTP_CALC_TSN_TO_GAP(gap, new_cum_tsn, asoc->mapping_array_base_tsn);
5139 	asoc->cumulative_tsn = new_cum_tsn;
5140 	if (gap >= m_size) {
5141 		if ((long)gap > sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv)) {
5142 			struct mbuf *op_err;
5143 			char msg[SCTP_DIAG_INFO_LEN];
5144 
5145 			/*
5146 			 * out of range (of single byte chunks in the rwnd I
5147 			 * give out). This must be an attacker.
5148 			 */
5149 			*abort_flag = 1;
5150 			snprintf(msg, sizeof(msg),
5151 			    "New cum ack %8.8x too high, highest TSN %8.8x",
5152 			    new_cum_tsn, asoc->highest_tsn_inside_map);
5153 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
5154 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_35;
5155 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
5156 			return;
5157 		}
5158 		SCTP_STAT_INCR(sctps_fwdtsn_map_over);
5159 
5160 		memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
5161 		asoc->mapping_array_base_tsn = new_cum_tsn + 1;
5162 		asoc->highest_tsn_inside_map = new_cum_tsn;
5163 
5164 		memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
5165 		asoc->highest_tsn_inside_nr_map = new_cum_tsn;
5166 
5167 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
5168 			sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5169 		}
5170 	} else {
5171 		SCTP_TCB_LOCK_ASSERT(stcb);
5172 		for (i = 0; i <= gap; i++) {
5173 			if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) &&
5174 			    !SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, i)) {
5175 				SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, i);
5176 				if (SCTP_TSN_GT(asoc->mapping_array_base_tsn + i, asoc->highest_tsn_inside_nr_map)) {
5177 					asoc->highest_tsn_inside_nr_map = asoc->mapping_array_base_tsn + i;
5178 				}
5179 			}
5180 		}
5181 	}
5182 	/*************************************************************/
5183 	/* 2. Clear up re-assembly queue                             */
5184 	/*************************************************************/
5185 	/*
5186 	 * First service it if pd-api is up, just in case we can progress it
5187 	 * forward
5188 	 */
5189 	if (asoc->fragmented_delivery_inprogress) {
5190 		sctp_service_reassembly(stcb, asoc);
5191 	}
5192 	/* For each one on here see if we need to toss it */
5193 	/*
5194 	 * For now large messages held on the reasmqueue that are complete
5195 	 * will be tossed too. We could in theory do more work to spin
5196 	 * through and stop after dumping one msg aka seeing the start of a
5197 	 * new msg at the head, and call the delivery function... to see if
5198 	 * it can be delivered... But for now we just dump everything on the
5199 	 * queue.
5200 	 */
5201 	TAILQ_FOREACH_SAFE(chk, &asoc->reasmqueue, sctp_next, nchk) {
5202 		if (SCTP_TSN_GE(new_cum_tsn, chk->rec.data.TSN_seq)) {
5203 			/* It needs to be tossed */
5204 			TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5205 			if (SCTP_TSN_GT(chk->rec.data.TSN_seq, asoc->tsn_last_delivered)) {
5206 				asoc->tsn_last_delivered = chk->rec.data.TSN_seq;
5207 				asoc->str_of_pdapi = chk->rec.data.stream_number;
5208 				asoc->ssn_of_pdapi = chk->rec.data.stream_seq;
5209 				asoc->fragment_flags = chk->rec.data.rcv_flags;
5210 			}
5211 			asoc->size_on_reasm_queue -= chk->send_size;
5212 			sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5213 
5214 			/* Clear up any stream problem */
5215 			if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) != SCTP_DATA_UNORDERED &&
5216 			    SCTP_SSN_GT(chk->rec.data.stream_seq, asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered)) {
5217 				/*
5218 				 * We must dump forward this streams
5219 				 * sequence number if the chunk is not
5220 				 * unordered that is being skipped. There is
5221 				 * a chance that if the peer does not
5222 				 * include the last fragment in its FWD-TSN
5223 				 * we WILL have a problem here since you
5224 				 * would have a partial chunk in queue that
5225 				 * may not be deliverable. Also if a Partial
5226 				 * delivery API as started the user may get
5227 				 * a partial chunk. The next read returning
5228 				 * a new chunk... really ugly but I see no
5229 				 * way around it! Maybe a notify??
5230 				 */
5231 				asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered = chk->rec.data.stream_seq;
5232 			}
5233 			if (chk->data) {
5234 				sctp_m_freem(chk->data);
5235 				chk->data = NULL;
5236 			}
5237 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
5238 		} else {
5239 			/*
5240 			 * Ok we have gone beyond the end of the fwd-tsn's
5241 			 * mark.
5242 			 */
5243 			break;
5244 		}
5245 	}
5246 	/*******************************************************/
5247 	/* 3. Update the PR-stream re-ordering queues and fix  */
5248 	/* delivery issues as needed.                       */
5249 	/*******************************************************/
5250 	fwd_sz -= sizeof(*fwd);
5251 	if (m && fwd_sz) {
5252 		/* New method. */
5253 		unsigned int num_str;
5254 		struct sctp_strseq *stseq, strseqbuf;
5255 
5256 		offset += sizeof(*fwd);
5257 
5258 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
5259 		num_str = fwd_sz / sizeof(struct sctp_strseq);
5260 		for (i = 0; i < num_str; i++) {
5261 			uint16_t st;
5262 
5263 			stseq = (struct sctp_strseq *)sctp_m_getptr(m, offset,
5264 			    sizeof(struct sctp_strseq),
5265 			    (uint8_t *) & strseqbuf);
5266 			offset += sizeof(struct sctp_strseq);
5267 			if (stseq == NULL) {
5268 				break;
5269 			}
5270 			/* Convert */
5271 			st = ntohs(stseq->stream);
5272 			stseq->stream = st;
5273 			st = ntohs(stseq->sequence);
5274 			stseq->sequence = st;
5275 
5276 			/* now process */
5277 
5278 			/*
5279 			 * Ok we now look for the stream/seq on the read
5280 			 * queue where its not all delivered. If we find it
5281 			 * we transmute the read entry into a PDI_ABORTED.
5282 			 */
5283 			if (stseq->stream >= asoc->streamincnt) {
5284 				/* screwed up streams, stop!  */
5285 				break;
5286 			}
5287 			if ((asoc->str_of_pdapi == stseq->stream) &&
5288 			    (asoc->ssn_of_pdapi == stseq->sequence)) {
5289 				/*
5290 				 * If this is the one we were partially
5291 				 * delivering now then we no longer are.
5292 				 * Note this will change with the reassembly
5293 				 * re-write.
5294 				 */
5295 				asoc->fragmented_delivery_inprogress = 0;
5296 			}
5297 			sctp_flush_reassm_for_str_seq(stcb, asoc, stseq->stream, stseq->sequence);
5298 			TAILQ_FOREACH(ctl, &stcb->sctp_ep->read_queue, next) {
5299 				if ((ctl->sinfo_stream == stseq->stream) &&
5300 				    (ctl->sinfo_ssn == stseq->sequence)) {
5301 					str_seq = (stseq->stream << 16) | stseq->sequence;
5302 					ctl->end_added = 1;
5303 					ctl->pdapi_aborted = 1;
5304 					sv = stcb->asoc.control_pdapi;
5305 					stcb->asoc.control_pdapi = ctl;
5306 					sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
5307 					    stcb,
5308 					    SCTP_PARTIAL_DELIVERY_ABORTED,
5309 					    (void *)&str_seq,
5310 					    SCTP_SO_NOT_LOCKED);
5311 					stcb->asoc.control_pdapi = sv;
5312 					break;
5313 				} else if ((ctl->sinfo_stream == stseq->stream) &&
5314 				    SCTP_SSN_GT(ctl->sinfo_ssn, stseq->sequence)) {
5315 					/* We are past our victim SSN */
5316 					break;
5317 				}
5318 			}
5319 			strm = &asoc->strmin[stseq->stream];
5320 			if (SCTP_SSN_GT(stseq->sequence, strm->last_sequence_delivered)) {
5321 				/* Update the sequence number */
5322 				strm->last_sequence_delivered = stseq->sequence;
5323 			}
5324 			/* now kick the stream the new way */
5325 			/* sa_ignore NO_NULL_CHK */
5326 			sctp_kick_prsctp_reorder_queue(stcb, strm);
5327 		}
5328 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5329 	}
5330 	/*
5331 	 * Now slide thing forward.
5332 	 */
5333 	sctp_slide_mapping_arrays(stcb);
5334 
5335 	if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
5336 		/* now lets kick out and check for more fragmented delivery */
5337 		/* sa_ignore NO_NULL_CHK */
5338 		sctp_deliver_reasm_check(stcb, &stcb->asoc);
5339 	}
5340 }
5341