xref: /freebsd/sys/netinet/sctp_timer.c (revision 6829dae12bb055451fa467da4589c43bd03b1e64)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * a) Redistributions of source code must retain the above copyright notice,
12  *    this list of conditions and the following disclaimer.
13  *
14  * b) Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the distribution.
17  *
18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
19  *    contributors may be used to endorse or promote products derived
20  *    from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #define _IP_VHL
39 #include <netinet/sctp_os.h>
40 #include <netinet/sctp_pcb.h>
41 #ifdef INET6
42 #endif
43 #include <netinet/sctp_var.h>
44 #include <netinet/sctp_sysctl.h>
45 #include <netinet/sctp_timer.h>
46 #include <netinet/sctputil.h>
47 #include <netinet/sctp_output.h>
48 #include <netinet/sctp_header.h>
49 #include <netinet/sctp_indata.h>
50 #include <netinet/sctp_asconf.h>
51 #include <netinet/sctp_input.h>
52 #include <netinet/sctp.h>
53 #include <netinet/sctp_uio.h>
54 #if defined(INET) || defined(INET6)
55 #include <netinet/udp.h>
56 #endif
57 
58 
59 void
60 sctp_audit_retranmission_queue(struct sctp_association *asoc)
61 {
62 	struct sctp_tmit_chunk *chk;
63 
64 	SCTPDBG(SCTP_DEBUG_TIMER4, "Audit invoked on send queue cnt:%d onqueue:%d\n",
65 	    asoc->sent_queue_retran_cnt,
66 	    asoc->sent_queue_cnt);
67 	asoc->sent_queue_retran_cnt = 0;
68 	asoc->sent_queue_cnt = 0;
69 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
70 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
71 			sctp_ucount_incr(asoc->sent_queue_retran_cnt);
72 		}
73 		asoc->sent_queue_cnt++;
74 	}
75 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
76 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
77 			sctp_ucount_incr(asoc->sent_queue_retran_cnt);
78 		}
79 	}
80 	TAILQ_FOREACH(chk, &asoc->asconf_send_queue, sctp_next) {
81 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
82 			sctp_ucount_incr(asoc->sent_queue_retran_cnt);
83 		}
84 	}
85 	SCTPDBG(SCTP_DEBUG_TIMER4, "Audit completes retran:%d onqueue:%d\n",
86 	    asoc->sent_queue_retran_cnt,
87 	    asoc->sent_queue_cnt);
88 }
89 
90 static int
91 sctp_threshold_management(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
92     struct sctp_nets *net, uint16_t threshold)
93 {
94 	if (net) {
95 		net->error_count++;
96 		SCTPDBG(SCTP_DEBUG_TIMER4, "Error count for %p now %d thresh:%d\n",
97 		    (void *)net, net->error_count,
98 		    net->failure_threshold);
99 		if (net->error_count > net->failure_threshold) {
100 			/* We had a threshold failure */
101 			if (net->dest_state & SCTP_ADDR_REACHABLE) {
102 				net->dest_state &= ~SCTP_ADDR_REACHABLE;
103 				net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
104 				net->dest_state &= ~SCTP_ADDR_PF;
105 				sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
106 				    stcb, 0,
107 				    (void *)net, SCTP_SO_NOT_LOCKED);
108 			}
109 		} else if ((net->pf_threshold < net->failure_threshold) &&
110 		    (net->error_count > net->pf_threshold)) {
111 			if (!(net->dest_state & SCTP_ADDR_PF)) {
112 				net->dest_state |= SCTP_ADDR_PF;
113 				net->last_active = sctp_get_tick_count();
114 				sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
115 				sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
116 				    inp, stcb, net,
117 				    SCTP_FROM_SCTP_TIMER + SCTP_LOC_1);
118 				sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
119 			}
120 		}
121 	}
122 	if (stcb == NULL)
123 		return (0);
124 
125 	if (net) {
126 		if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0) {
127 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
128 				sctp_misc_ints(SCTP_THRESHOLD_INCR,
129 				    stcb->asoc.overall_error_count,
130 				    (stcb->asoc.overall_error_count + 1),
131 				    SCTP_FROM_SCTP_TIMER,
132 				    __LINE__);
133 			}
134 			stcb->asoc.overall_error_count++;
135 		}
136 	} else {
137 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
138 			sctp_misc_ints(SCTP_THRESHOLD_INCR,
139 			    stcb->asoc.overall_error_count,
140 			    (stcb->asoc.overall_error_count + 1),
141 			    SCTP_FROM_SCTP_TIMER,
142 			    __LINE__);
143 		}
144 		stcb->asoc.overall_error_count++;
145 	}
146 	SCTPDBG(SCTP_DEBUG_TIMER4, "Overall error count for %p now %d thresh:%u state:%x\n",
147 	    (void *)&stcb->asoc, stcb->asoc.overall_error_count,
148 	    (uint32_t)threshold,
149 	    ((net == NULL) ? (uint32_t)0 : (uint32_t)net->dest_state));
150 	/*
151 	 * We specifically do not do >= to give the assoc one more change
152 	 * before we fail it.
153 	 */
154 	if (stcb->asoc.overall_error_count > threshold) {
155 		/* Abort notification sends a ULP notify */
156 		struct mbuf *op_err;
157 
158 		op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
159 		    "Association error counter exceeded");
160 		inp->last_abort_code = SCTP_FROM_SCTP_TIMER + SCTP_LOC_2;
161 		sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
162 		return (1);
163 	}
164 	return (0);
165 }
166 
167 /*
168  * sctp_find_alternate_net() returns a non-NULL pointer as long
169  * the argument net is non-NULL.
170  */
171 struct sctp_nets *
172 sctp_find_alternate_net(struct sctp_tcb *stcb,
173     struct sctp_nets *net,
174     int mode)
175 {
176 	/* Find and return an alternate network if possible */
177 	struct sctp_nets *alt, *mnet, *min_errors_net = NULL, *max_cwnd_net = NULL;
178 	int once;
179 
180 	/* JRS 5/14/07 - Initialize min_errors to an impossible value. */
181 	int min_errors = -1;
182 	uint32_t max_cwnd = 0;
183 
184 	if (stcb->asoc.numnets == 1) {
185 		/* No others but net */
186 		return (TAILQ_FIRST(&stcb->asoc.nets));
187 	}
188 	/*
189 	 * JRS 5/14/07 - If mode is set to 2, use the CMT PF find alternate
190 	 * net algorithm. This algorithm chooses the active destination (not
191 	 * in PF state) with the largest cwnd value. If all destinations are
192 	 * in PF state, unreachable, or unconfirmed, choose the desination
193 	 * that is in PF state with the lowest error count. In case of a
194 	 * tie, choose the destination that was most recently active.
195 	 */
196 	if (mode == 2) {
197 		TAILQ_FOREACH(mnet, &stcb->asoc.nets, sctp_next) {
198 			/*
199 			 * JRS 5/14/07 - If the destination is unreachable
200 			 * or unconfirmed, skip it.
201 			 */
202 			if (((mnet->dest_state & SCTP_ADDR_REACHABLE) != SCTP_ADDR_REACHABLE) ||
203 			    (mnet->dest_state & SCTP_ADDR_UNCONFIRMED)) {
204 				continue;
205 			}
206 			/*
207 			 * JRS 5/14/07 -  If the destination is reachable
208 			 * but in PF state, compare the error count of the
209 			 * destination to the minimum error count seen thus
210 			 * far. Store the destination with the lower error
211 			 * count.  If the error counts are equal, store the
212 			 * destination that was most recently active.
213 			 */
214 			if (mnet->dest_state & SCTP_ADDR_PF) {
215 				/*
216 				 * JRS 5/14/07 - If the destination under
217 				 * consideration is the current destination,
218 				 * work as if the error count is one higher.
219 				 * The actual error count will not be
220 				 * incremented until later in the t3
221 				 * handler.
222 				 */
223 				if (mnet == net) {
224 					if (min_errors == -1) {
225 						min_errors = mnet->error_count + 1;
226 						min_errors_net = mnet;
227 					} else if (mnet->error_count + 1 < min_errors) {
228 						min_errors = mnet->error_count + 1;
229 						min_errors_net = mnet;
230 					} else if (mnet->error_count + 1 == min_errors
231 					    && mnet->last_active > min_errors_net->last_active) {
232 						min_errors_net = mnet;
233 						min_errors = mnet->error_count + 1;
234 					}
235 					continue;
236 				} else {
237 					if (min_errors == -1) {
238 						min_errors = mnet->error_count;
239 						min_errors_net = mnet;
240 					} else if (mnet->error_count < min_errors) {
241 						min_errors = mnet->error_count;
242 						min_errors_net = mnet;
243 					} else if (mnet->error_count == min_errors
244 					    && mnet->last_active > min_errors_net->last_active) {
245 						min_errors_net = mnet;
246 						min_errors = mnet->error_count;
247 					}
248 					continue;
249 				}
250 			}
251 			/*
252 			 * JRS 5/14/07 - If the destination is reachable and
253 			 * not in PF state, compare the cwnd of the
254 			 * destination to the highest cwnd seen thus far.
255 			 * Store the destination with the higher cwnd value.
256 			 * If the cwnd values are equal, randomly choose one
257 			 * of the two destinations.
258 			 */
259 			if (max_cwnd < mnet->cwnd) {
260 				max_cwnd_net = mnet;
261 				max_cwnd = mnet->cwnd;
262 			} else if (max_cwnd == mnet->cwnd) {
263 				uint32_t rndval;
264 				uint8_t this_random;
265 
266 				if (stcb->asoc.hb_random_idx > 3) {
267 					rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
268 					memcpy(stcb->asoc.hb_random_values, &rndval, sizeof(stcb->asoc.hb_random_values));
269 					this_random = stcb->asoc.hb_random_values[0];
270 					stcb->asoc.hb_random_idx++;
271 					stcb->asoc.hb_ect_randombit = 0;
272 				} else {
273 					this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
274 					stcb->asoc.hb_random_idx++;
275 					stcb->asoc.hb_ect_randombit = 0;
276 				}
277 				if (this_random % 2 == 1) {
278 					max_cwnd_net = mnet;
279 					max_cwnd = mnet->cwnd;	/* Useless? */
280 				}
281 			}
282 		}
283 		if (max_cwnd_net == NULL) {
284 			if (min_errors_net == NULL) {
285 				return (net);
286 			}
287 			return (min_errors_net);
288 		} else {
289 			return (max_cwnd_net);
290 		}
291 	}			/* JRS 5/14/07 - If mode is set to 1, use the
292 				 * CMT policy for choosing an alternate net. */
293 	else if (mode == 1) {
294 		TAILQ_FOREACH(mnet, &stcb->asoc.nets, sctp_next) {
295 			if (((mnet->dest_state & SCTP_ADDR_REACHABLE) != SCTP_ADDR_REACHABLE) ||
296 			    (mnet->dest_state & SCTP_ADDR_UNCONFIRMED)) {
297 				/*
298 				 * will skip ones that are not-reachable or
299 				 * unconfirmed
300 				 */
301 				continue;
302 			}
303 			if (max_cwnd < mnet->cwnd) {
304 				max_cwnd_net = mnet;
305 				max_cwnd = mnet->cwnd;
306 			} else if (max_cwnd == mnet->cwnd) {
307 				uint32_t rndval;
308 				uint8_t this_random;
309 
310 				if (stcb->asoc.hb_random_idx > 3) {
311 					rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
312 					memcpy(stcb->asoc.hb_random_values, &rndval,
313 					    sizeof(stcb->asoc.hb_random_values));
314 					this_random = stcb->asoc.hb_random_values[0];
315 					stcb->asoc.hb_random_idx = 0;
316 					stcb->asoc.hb_ect_randombit = 0;
317 				} else {
318 					this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
319 					stcb->asoc.hb_random_idx++;
320 					stcb->asoc.hb_ect_randombit = 0;
321 				}
322 				if (this_random % 2) {
323 					max_cwnd_net = mnet;
324 					max_cwnd = mnet->cwnd;
325 				}
326 			}
327 		}
328 		if (max_cwnd_net) {
329 			return (max_cwnd_net);
330 		}
331 	}
332 	mnet = net;
333 	once = 0;
334 
335 	if (mnet == NULL) {
336 		mnet = TAILQ_FIRST(&stcb->asoc.nets);
337 		if (mnet == NULL) {
338 			return (NULL);
339 		}
340 	}
341 	for (;;) {
342 		alt = TAILQ_NEXT(mnet, sctp_next);
343 		if (alt == NULL) {
344 			once++;
345 			if (once > 1) {
346 				break;
347 			}
348 			alt = TAILQ_FIRST(&stcb->asoc.nets);
349 			if (alt == NULL) {
350 				return (NULL);
351 			}
352 		}
353 		if (alt->ro.ro_rt == NULL) {
354 			if (alt->ro._s_addr) {
355 				sctp_free_ifa(alt->ro._s_addr);
356 				alt->ro._s_addr = NULL;
357 			}
358 			alt->src_addr_selected = 0;
359 		}
360 		if (((alt->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE) &&
361 		    (alt->ro.ro_rt != NULL) &&
362 		    (!(alt->dest_state & SCTP_ADDR_UNCONFIRMED))) {
363 			/* Found a reachable address */
364 			break;
365 		}
366 		mnet = alt;
367 	}
368 
369 	if (alt == NULL) {
370 		/* Case where NO insv network exists (dormant state) */
371 		/* we rotate destinations */
372 		once = 0;
373 		mnet = net;
374 		for (;;) {
375 			if (mnet == NULL) {
376 				return (TAILQ_FIRST(&stcb->asoc.nets));
377 			}
378 			alt = TAILQ_NEXT(mnet, sctp_next);
379 			if (alt == NULL) {
380 				once++;
381 				if (once > 1) {
382 					break;
383 				}
384 				alt = TAILQ_FIRST(&stcb->asoc.nets);
385 				if (alt == NULL) {
386 					break;
387 				}
388 			}
389 			if ((!(alt->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
390 			    (alt != net)) {
391 				/* Found an alternate address */
392 				break;
393 			}
394 			mnet = alt;
395 		}
396 	}
397 	if (alt == NULL) {
398 		return (net);
399 	}
400 	return (alt);
401 }
402 
403 static void
404 sctp_backoff_on_timeout(struct sctp_tcb *stcb,
405     struct sctp_nets *net,
406     int win_probe,
407     int num_marked, int num_abandoned)
408 {
409 	if (net->RTO == 0) {
410 		if (net->RTO_measured) {
411 			net->RTO = stcb->asoc.minrto;
412 		} else {
413 			net->RTO = stcb->asoc.initial_rto;
414 		}
415 	}
416 	net->RTO <<= 1;
417 	if (net->RTO > stcb->asoc.maxrto) {
418 		net->RTO = stcb->asoc.maxrto;
419 	}
420 	if ((win_probe == 0) && (num_marked || num_abandoned)) {
421 		/* We don't apply penalty to window probe scenarios */
422 		/* JRS - Use the congestion control given in the CC module */
423 		stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout(stcb, net);
424 	}
425 }
426 
427 #ifndef INVARIANTS
428 static void
429 sctp_recover_sent_list(struct sctp_tcb *stcb)
430 {
431 	struct sctp_tmit_chunk *chk, *nchk;
432 	struct sctp_association *asoc;
433 
434 	asoc = &stcb->asoc;
435 	TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
436 		if (SCTP_TSN_GE(asoc->last_acked_seq, chk->rec.data.tsn)) {
437 			SCTP_PRINTF("Found chk:%p tsn:%x <= last_acked_seq:%x\n",
438 			    (void *)chk, chk->rec.data.tsn, asoc->last_acked_seq);
439 			if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
440 				if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
441 					asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
442 				}
443 			}
444 			if ((asoc->strmout[chk->rec.data.sid].chunks_on_queues == 0) &&
445 			    (asoc->strmout[chk->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
446 			    TAILQ_EMPTY(&asoc->strmout[chk->rec.data.sid].outqueue)) {
447 				asoc->trigger_reset = 1;
448 			}
449 			TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
450 			if (PR_SCTP_ENABLED(chk->flags)) {
451 				if (asoc->pr_sctp_cnt != 0)
452 					asoc->pr_sctp_cnt--;
453 			}
454 			if (chk->data) {
455 				/* sa_ignore NO_NULL_CHK */
456 				sctp_free_bufspace(stcb, asoc, chk, 1);
457 				sctp_m_freem(chk->data);
458 				chk->data = NULL;
459 				if (asoc->prsctp_supported && PR_SCTP_BUF_ENABLED(chk->flags)) {
460 					asoc->sent_queue_cnt_removeable--;
461 				}
462 			}
463 			asoc->sent_queue_cnt--;
464 			sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
465 		}
466 	}
467 	SCTP_PRINTF("after recover order is as follows\n");
468 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
469 		SCTP_PRINTF("chk:%p TSN:%x\n", (void *)chk, chk->rec.data.tsn);
470 	}
471 }
472 #endif
473 
474 static int
475 sctp_mark_all_for_resend(struct sctp_tcb *stcb,
476     struct sctp_nets *net,
477     struct sctp_nets *alt,
478     int window_probe,
479     int *num_marked,
480     int *num_abandoned)
481 {
482 
483 	/*
484 	 * Mark all chunks (well not all) that were sent to *net for
485 	 * retransmission. Move them to alt for there destination as well...
486 	 * We only mark chunks that have been outstanding long enough to
487 	 * have received feed-back.
488 	 */
489 	struct sctp_tmit_chunk *chk, *nchk;
490 	struct sctp_nets *lnets;
491 	struct timeval now, min_wait, tv;
492 	int cur_rto;
493 	int cnt_abandoned;
494 	int audit_tf, num_mk, fir;
495 	unsigned int cnt_mk;
496 	uint32_t orig_flight, orig_tf;
497 	uint32_t tsnlast, tsnfirst;
498 	int recovery_cnt = 0;
499 
500 
501 	/* none in flight now */
502 	audit_tf = 0;
503 	fir = 0;
504 	/*
505 	 * figure out how long a data chunk must be pending before we can
506 	 * mark it ..
507 	 */
508 	(void)SCTP_GETTIME_TIMEVAL(&now);
509 	/* get cur rto in micro-seconds */
510 	cur_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
511 	cur_rto *= 1000;
512 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
513 		sctp_log_fr(cur_rto,
514 		    stcb->asoc.peers_rwnd,
515 		    window_probe,
516 		    SCTP_FR_T3_MARK_TIME);
517 		sctp_log_fr(net->flight_size, 0, 0, SCTP_FR_CWND_REPORT);
518 		sctp_log_fr(net->flight_size, net->cwnd, stcb->asoc.total_flight, SCTP_FR_CWND_REPORT);
519 	}
520 	tv.tv_sec = cur_rto / 1000000;
521 	tv.tv_usec = cur_rto % 1000000;
522 	min_wait = now;
523 	timevalsub(&min_wait, &tv);
524 	if (min_wait.tv_sec < 0 || min_wait.tv_usec < 0) {
525 		/*
526 		 * if we hit here, we don't have enough seconds on the clock
527 		 * to account for the RTO. We just let the lower seconds be
528 		 * the bounds and don't worry about it. This may mean we
529 		 * will mark a lot more than we should.
530 		 */
531 		min_wait.tv_sec = min_wait.tv_usec = 0;
532 	}
533 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
534 		sctp_log_fr(cur_rto, now.tv_sec, now.tv_usec, SCTP_FR_T3_MARK_TIME);
535 		sctp_log_fr(0, min_wait.tv_sec, min_wait.tv_usec, SCTP_FR_T3_MARK_TIME);
536 	}
537 	/*
538 	 * Our rwnd will be incorrect here since we are not adding back the
539 	 * cnt * mbuf but we will fix that down below.
540 	 */
541 	orig_flight = net->flight_size;
542 	orig_tf = stcb->asoc.total_flight;
543 
544 	net->fast_retran_ip = 0;
545 	/* Now on to each chunk */
546 	cnt_abandoned = 0;
547 	num_mk = cnt_mk = 0;
548 	tsnfirst = tsnlast = 0;
549 #ifndef INVARIANTS
550 start_again:
551 #endif
552 	TAILQ_FOREACH_SAFE(chk, &stcb->asoc.sent_queue, sctp_next, nchk) {
553 		if (SCTP_TSN_GE(stcb->asoc.last_acked_seq, chk->rec.data.tsn)) {
554 			/* Strange case our list got out of order? */
555 			SCTP_PRINTF("Our list is out of order? last_acked:%x chk:%x\n",
556 			    (unsigned int)stcb->asoc.last_acked_seq, (unsigned int)chk->rec.data.tsn);
557 			recovery_cnt++;
558 #ifdef INVARIANTS
559 			panic("last acked >= chk on sent-Q");
560 #else
561 			SCTP_PRINTF("Recover attempts a restart cnt:%d\n", recovery_cnt);
562 			sctp_recover_sent_list(stcb);
563 			if (recovery_cnt < 10) {
564 				goto start_again;
565 			} else {
566 				SCTP_PRINTF("Recovery fails %d times??\n", recovery_cnt);
567 			}
568 #endif
569 		}
570 		if ((chk->whoTo == net) && (chk->sent < SCTP_DATAGRAM_ACKED)) {
571 			/*
572 			 * found one to mark: If it is less than
573 			 * DATAGRAM_ACKED it MUST not be a skipped or marked
574 			 * TSN but instead one that is either already set
575 			 * for retransmission OR one that needs
576 			 * retransmission.
577 			 */
578 
579 			/* validate its been outstanding long enough */
580 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
581 				sctp_log_fr(chk->rec.data.tsn,
582 				    chk->sent_rcv_time.tv_sec,
583 				    chk->sent_rcv_time.tv_usec,
584 				    SCTP_FR_T3_MARK_TIME);
585 			}
586 			if ((chk->sent_rcv_time.tv_sec > min_wait.tv_sec) && (window_probe == 0)) {
587 				/*
588 				 * we have reached a chunk that was sent
589 				 * some seconds past our min.. forget it we
590 				 * will find no more to send.
591 				 */
592 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
593 					sctp_log_fr(0,
594 					    chk->sent_rcv_time.tv_sec,
595 					    chk->sent_rcv_time.tv_usec,
596 					    SCTP_FR_T3_STOPPED);
597 				}
598 				continue;
599 			} else if ((chk->sent_rcv_time.tv_sec == min_wait.tv_sec) &&
600 			    (window_probe == 0)) {
601 				/*
602 				 * we must look at the micro seconds to
603 				 * know.
604 				 */
605 				if (chk->sent_rcv_time.tv_usec >= min_wait.tv_usec) {
606 					/*
607 					 * ok it was sent after our boundary
608 					 * time.
609 					 */
610 					continue;
611 				}
612 			}
613 			if (stcb->asoc.prsctp_supported && PR_SCTP_TTL_ENABLED(chk->flags)) {
614 				/* Is it expired? */
615 				if (timevalcmp(&now, &chk->rec.data.timetodrop, >)) {
616 					/* Yes so drop it */
617 					if (chk->data) {
618 						(void)sctp_release_pr_sctp_chunk(stcb,
619 						    chk,
620 						    1,
621 						    SCTP_SO_NOT_LOCKED);
622 						cnt_abandoned++;
623 					}
624 					continue;
625 				}
626 			}
627 			if (stcb->asoc.prsctp_supported && PR_SCTP_RTX_ENABLED(chk->flags)) {
628 				/* Has it been retransmitted tv_sec times? */
629 				if (chk->snd_count > chk->rec.data.timetodrop.tv_sec) {
630 					if (chk->data) {
631 						(void)sctp_release_pr_sctp_chunk(stcb,
632 						    chk,
633 						    1,
634 						    SCTP_SO_NOT_LOCKED);
635 						cnt_abandoned++;
636 					}
637 					continue;
638 				}
639 			}
640 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
641 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
642 				num_mk++;
643 				if (fir == 0) {
644 					fir = 1;
645 					tsnfirst = chk->rec.data.tsn;
646 				}
647 				tsnlast = chk->rec.data.tsn;
648 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
649 					sctp_log_fr(chk->rec.data.tsn, chk->snd_count,
650 					    0, SCTP_FR_T3_MARKED);
651 				}
652 
653 				if (chk->rec.data.chunk_was_revoked) {
654 					/* deflate the cwnd */
655 					chk->whoTo->cwnd -= chk->book_size;
656 					chk->rec.data.chunk_was_revoked = 0;
657 				}
658 				net->marked_retrans++;
659 				stcb->asoc.marked_retrans++;
660 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
661 					sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND_TO,
662 					    chk->whoTo->flight_size,
663 					    chk->book_size,
664 					    (uint32_t)(uintptr_t)chk->whoTo,
665 					    chk->rec.data.tsn);
666 				}
667 				sctp_flight_size_decrease(chk);
668 				sctp_total_flight_decrease(stcb, chk);
669 				stcb->asoc.peers_rwnd += chk->send_size;
670 				stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
671 			}
672 			chk->sent = SCTP_DATAGRAM_RESEND;
673 			chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
674 			SCTP_STAT_INCR(sctps_markedretrans);
675 
676 			/* reset the TSN for striking and other FR stuff */
677 			chk->rec.data.doing_fast_retransmit = 0;
678 			/* Clear any time so NO RTT is being done */
679 
680 			if (chk->do_rtt) {
681 				if (chk->whoTo->rto_needed == 0) {
682 					chk->whoTo->rto_needed = 1;
683 				}
684 			}
685 			chk->do_rtt = 0;
686 			if (alt != net) {
687 				sctp_free_remote_addr(chk->whoTo);
688 				chk->no_fr_allowed = 1;
689 				chk->whoTo = alt;
690 				atomic_add_int(&alt->ref_count, 1);
691 			} else {
692 				chk->no_fr_allowed = 0;
693 				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
694 					chk->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
695 				} else {
696 					chk->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.tsn;
697 				}
698 			}
699 			/*
700 			 * CMT: Do not allow FRs on retransmitted TSNs.
701 			 */
702 			if (stcb->asoc.sctp_cmt_on_off > 0) {
703 				chk->no_fr_allowed = 1;
704 			}
705 #ifdef THIS_SHOULD_NOT_BE_DONE
706 		} else if (chk->sent == SCTP_DATAGRAM_ACKED) {
707 			/* remember highest acked one */
708 			could_be_sent = chk;
709 #endif
710 		}
711 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
712 			cnt_mk++;
713 		}
714 	}
715 	if ((orig_flight - net->flight_size) != (orig_tf - stcb->asoc.total_flight)) {
716 		/* we did not subtract the same things? */
717 		audit_tf = 1;
718 	}
719 
720 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
721 		sctp_log_fr(tsnfirst, tsnlast, num_mk, SCTP_FR_T3_TIMEOUT);
722 	}
723 #ifdef SCTP_DEBUG
724 	if (num_mk) {
725 		SCTPDBG(SCTP_DEBUG_TIMER1, "LAST TSN marked was %x\n",
726 		    tsnlast);
727 		SCTPDBG(SCTP_DEBUG_TIMER1, "Num marked for retransmission was %d peer-rwd:%u\n",
728 		    num_mk,
729 		    stcb->asoc.peers_rwnd);
730 	}
731 #endif
732 	*num_marked = num_mk;
733 	*num_abandoned = cnt_abandoned;
734 	/*
735 	 * Now check for a ECN Echo that may be stranded And include the
736 	 * cnt_mk'd to have all resends in the control queue.
737 	 */
738 	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
739 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
740 			cnt_mk++;
741 		}
742 		if ((chk->whoTo == net) &&
743 		    (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
744 			sctp_free_remote_addr(chk->whoTo);
745 			chk->whoTo = alt;
746 			if (chk->sent != SCTP_DATAGRAM_RESEND) {
747 				chk->sent = SCTP_DATAGRAM_RESEND;
748 				chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
749 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
750 				cnt_mk++;
751 			}
752 			atomic_add_int(&alt->ref_count, 1);
753 		}
754 	}
755 #ifdef THIS_SHOULD_NOT_BE_DONE
756 	if ((stcb->asoc.sent_queue_retran_cnt == 0) && (could_be_sent)) {
757 		/* fix it so we retransmit the highest acked anyway */
758 		sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
759 		cnt_mk++;
760 		could_be_sent->sent = SCTP_DATAGRAM_RESEND;
761 	}
762 #endif
763 	if (stcb->asoc.sent_queue_retran_cnt != cnt_mk) {
764 #ifdef INVARIANTS
765 		SCTP_PRINTF("Local Audit says there are %d for retran asoc cnt:%d we marked:%d this time\n",
766 		    cnt_mk, stcb->asoc.sent_queue_retran_cnt, num_mk);
767 #endif
768 #ifndef SCTP_AUDITING_ENABLED
769 		stcb->asoc.sent_queue_retran_cnt = cnt_mk;
770 #endif
771 	}
772 	if (audit_tf) {
773 		SCTPDBG(SCTP_DEBUG_TIMER4,
774 		    "Audit total flight due to negative value net:%p\n",
775 		    (void *)net);
776 		stcb->asoc.total_flight = 0;
777 		stcb->asoc.total_flight_count = 0;
778 		/* Clear all networks flight size */
779 		TAILQ_FOREACH(lnets, &stcb->asoc.nets, sctp_next) {
780 			lnets->flight_size = 0;
781 			SCTPDBG(SCTP_DEBUG_TIMER4,
782 			    "Net:%p c-f cwnd:%d ssthresh:%d\n",
783 			    (void *)lnets, lnets->cwnd, lnets->ssthresh);
784 		}
785 		TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
786 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
787 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
788 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP,
789 					    chk->whoTo->flight_size,
790 					    chk->book_size,
791 					    (uint32_t)(uintptr_t)chk->whoTo,
792 					    chk->rec.data.tsn);
793 				}
794 
795 				sctp_flight_size_increase(chk);
796 				sctp_total_flight_increase(stcb, chk);
797 			}
798 		}
799 	}
800 	/* We return 1 if we only have a window probe outstanding */
801 	return (0);
802 }
803 
804 
805 int
806 sctp_t3rxt_timer(struct sctp_inpcb *inp,
807     struct sctp_tcb *stcb,
808     struct sctp_nets *net)
809 {
810 	struct sctp_nets *alt;
811 	int win_probe, num_mk, num_abandoned;
812 
813 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
814 		sctp_log_fr(0, 0, 0, SCTP_FR_T3_TIMEOUT);
815 	}
816 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
817 		struct sctp_nets *lnet;
818 
819 		TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
820 			if (net == lnet) {
821 				sctp_log_cwnd(stcb, lnet, 1, SCTP_CWND_LOG_FROM_T3);
822 			} else {
823 				sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_LOG_FROM_T3);
824 			}
825 		}
826 	}
827 	/* Find an alternate and mark those for retransmission */
828 	if ((stcb->asoc.peers_rwnd == 0) &&
829 	    (stcb->asoc.total_flight < net->mtu)) {
830 		SCTP_STAT_INCR(sctps_timowindowprobe);
831 		win_probe = 1;
832 	} else {
833 		win_probe = 0;
834 	}
835 
836 	if (win_probe == 0) {
837 		/* We don't do normal threshold management on window probes */
838 		if (sctp_threshold_management(inp, stcb, net,
839 		    stcb->asoc.max_send_times)) {
840 			/* Association was destroyed */
841 			return (1);
842 		} else {
843 			if (net != stcb->asoc.primary_destination) {
844 				/* send a immediate HB if our RTO is stale */
845 				struct timeval now;
846 				unsigned int ms_goneby;
847 
848 				(void)SCTP_GETTIME_TIMEVAL(&now);
849 				if (net->last_sent_time.tv_sec) {
850 					ms_goneby = (now.tv_sec - net->last_sent_time.tv_sec) * 1000;
851 				} else {
852 					ms_goneby = 0;
853 				}
854 				if ((net->dest_state & SCTP_ADDR_PF) == 0) {
855 					if ((ms_goneby > net->RTO) || (net->RTO == 0)) {
856 						/*
857 						 * no recent feed back in an
858 						 * RTO or more, request a
859 						 * RTT update
860 						 */
861 						sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
862 					}
863 				}
864 			}
865 		}
866 	} else {
867 		/*
868 		 * For a window probe we don't penalize the net's but only
869 		 * the association. This may fail it if SACKs are not coming
870 		 * back. If sack's are coming with rwnd locked at 0, we will
871 		 * continue to hold things waiting for rwnd to raise
872 		 */
873 		if (sctp_threshold_management(inp, stcb, NULL,
874 		    stcb->asoc.max_send_times)) {
875 			/* Association was destroyed */
876 			return (1);
877 		}
878 	}
879 	if (stcb->asoc.sctp_cmt_on_off > 0) {
880 		if (net->pf_threshold < net->failure_threshold) {
881 			alt = sctp_find_alternate_net(stcb, net, 2);
882 		} else {
883 			/*
884 			 * CMT: Using RTX_SSTHRESH policy for CMT. If CMT is
885 			 * being used, then pick dest with largest ssthresh
886 			 * for any retransmission.
887 			 */
888 			alt = sctp_find_alternate_net(stcb, net, 1);
889 			/*
890 			 * CUCv2: If a different dest is picked for the
891 			 * retransmission, then new (rtx-)pseudo_cumack
892 			 * needs to be tracked for orig dest. Let CUCv2
893 			 * track new (rtx-) pseudo-cumack always.
894 			 */
895 			net->find_pseudo_cumack = 1;
896 			net->find_rtx_pseudo_cumack = 1;
897 		}
898 	} else {
899 		alt = sctp_find_alternate_net(stcb, net, 0);
900 	}
901 
902 	num_mk = 0;
903 	num_abandoned = 0;
904 	(void)sctp_mark_all_for_resend(stcb, net, alt, win_probe,
905 	    &num_mk, &num_abandoned);
906 	/* FR Loss recovery just ended with the T3. */
907 	stcb->asoc.fast_retran_loss_recovery = 0;
908 
909 	/* CMT FR loss recovery ended with the T3 */
910 	net->fast_retran_loss_recovery = 0;
911 	if ((stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) &&
912 	    (net->flight_size == 0)) {
913 		(*stcb->asoc.cc_functions.sctp_cwnd_new_transmission_begins) (stcb, net);
914 	}
915 
916 	/*
917 	 * setup the sat loss recovery that prevents satellite cwnd advance.
918 	 */
919 	stcb->asoc.sat_t3_loss_recovery = 1;
920 	stcb->asoc.sat_t3_recovery_tsn = stcb->asoc.sending_seq;
921 
922 	/* Backoff the timer and cwnd */
923 	sctp_backoff_on_timeout(stcb, net, win_probe, num_mk, num_abandoned);
924 	if ((!(net->dest_state & SCTP_ADDR_REACHABLE)) ||
925 	    (net->dest_state & SCTP_ADDR_PF)) {
926 		/* Move all pending over too */
927 		sctp_move_chunks_from_net(stcb, net);
928 
929 		/*
930 		 * Get the address that failed, to force a new src address
931 		 * selecton and a route allocation.
932 		 */
933 		if (net->ro._s_addr) {
934 			sctp_free_ifa(net->ro._s_addr);
935 			net->ro._s_addr = NULL;
936 		}
937 		net->src_addr_selected = 0;
938 
939 		/* Force a route allocation too */
940 		if (net->ro.ro_rt) {
941 			RTFREE(net->ro.ro_rt);
942 			net->ro.ro_rt = NULL;
943 		}
944 
945 		/* Was it our primary? */
946 		if ((stcb->asoc.primary_destination == net) && (alt != net)) {
947 			/*
948 			 * Yes, note it as such and find an alternate note:
949 			 * this means HB code must use this to resent the
950 			 * primary if it goes active AND if someone does a
951 			 * change-primary then this flag must be cleared
952 			 * from any net structures.
953 			 */
954 			if (stcb->asoc.alternate) {
955 				sctp_free_remote_addr(stcb->asoc.alternate);
956 			}
957 			stcb->asoc.alternate = alt;
958 			atomic_add_int(&stcb->asoc.alternate->ref_count, 1);
959 		}
960 	}
961 	/*
962 	 * Special case for cookie-echo'ed case, we don't do output but must
963 	 * await the COOKIE-ACK before retransmission
964 	 */
965 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) {
966 		/*
967 		 * Here we just reset the timer and start again since we
968 		 * have not established the asoc
969 		 */
970 		sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
971 		return (0);
972 	}
973 	if (stcb->asoc.prsctp_supported) {
974 		struct sctp_tmit_chunk *lchk;
975 
976 		lchk = sctp_try_advance_peer_ack_point(stcb, &stcb->asoc);
977 		/* C3. See if we need to send a Fwd-TSN */
978 		if (SCTP_TSN_GT(stcb->asoc.advanced_peer_ack_point, stcb->asoc.last_acked_seq)) {
979 			send_forward_tsn(stcb, &stcb->asoc);
980 			if (lchk) {
981 				/* Assure a timer is up */
982 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, lchk->whoTo);
983 			}
984 		}
985 	}
986 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_MONITOR_ENABLE) {
987 		sctp_log_cwnd(stcb, net, net->cwnd, SCTP_CWND_LOG_FROM_RTX);
988 	}
989 	return (0);
990 }
991 
992 int
993 sctp_t1init_timer(struct sctp_inpcb *inp,
994     struct sctp_tcb *stcb,
995     struct sctp_nets *net)
996 {
997 	/* bump the thresholds */
998 	if (stcb->asoc.delayed_connection) {
999 		/*
1000 		 * special hook for delayed connection. The library did NOT
1001 		 * complete the rest of its sends.
1002 		 */
1003 		stcb->asoc.delayed_connection = 0;
1004 		sctp_send_initiate(inp, stcb, SCTP_SO_NOT_LOCKED);
1005 		return (0);
1006 	}
1007 	if (SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT) {
1008 		return (0);
1009 	}
1010 	if (sctp_threshold_management(inp, stcb, net,
1011 	    stcb->asoc.max_init_times)) {
1012 		/* Association was destroyed */
1013 		return (1);
1014 	}
1015 	stcb->asoc.dropped_special_cnt = 0;
1016 	sctp_backoff_on_timeout(stcb, stcb->asoc.primary_destination, 1, 0, 0);
1017 	if (stcb->asoc.initial_init_rto_max < net->RTO) {
1018 		net->RTO = stcb->asoc.initial_init_rto_max;
1019 	}
1020 	if (stcb->asoc.numnets > 1) {
1021 		/* If we have more than one addr use it */
1022 		struct sctp_nets *alt;
1023 
1024 		alt = sctp_find_alternate_net(stcb, stcb->asoc.primary_destination, 0);
1025 		if (alt != stcb->asoc.primary_destination) {
1026 			sctp_move_chunks_from_net(stcb, stcb->asoc.primary_destination);
1027 			stcb->asoc.primary_destination = alt;
1028 		}
1029 	}
1030 	/* Send out a new init */
1031 	sctp_send_initiate(inp, stcb, SCTP_SO_NOT_LOCKED);
1032 	return (0);
1033 }
1034 
1035 /*
1036  * For cookie and asconf we actually need to find and mark for resend, then
1037  * increment the resend counter (after all the threshold management stuff of
1038  * course).
1039  */
1040 int
1041 sctp_cookie_timer(struct sctp_inpcb *inp,
1042     struct sctp_tcb *stcb,
1043     struct sctp_nets *net SCTP_UNUSED)
1044 {
1045 	struct sctp_nets *alt;
1046 	struct sctp_tmit_chunk *cookie;
1047 
1048 	/* first before all else we must find the cookie */
1049 	TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, sctp_next) {
1050 		if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
1051 			break;
1052 		}
1053 	}
1054 	if (cookie == NULL) {
1055 		if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED) {
1056 			/* FOOBAR! */
1057 			struct mbuf *op_err;
1058 
1059 			op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1060 			    "Cookie timer expired, but no cookie");
1061 			inp->last_abort_code = SCTP_FROM_SCTP_TIMER + SCTP_LOC_3;
1062 			sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1063 		} else {
1064 #ifdef INVARIANTS
1065 			panic("Cookie timer expires in wrong state?");
1066 #else
1067 			SCTP_PRINTF("Strange in state %d not cookie-echoed yet c-e timer expires?\n", SCTP_GET_STATE(stcb));
1068 			return (0);
1069 #endif
1070 		}
1071 		return (0);
1072 	}
1073 	/* Ok we found the cookie, threshold management next */
1074 	if (sctp_threshold_management(inp, stcb, cookie->whoTo,
1075 	    stcb->asoc.max_init_times)) {
1076 		/* Assoc is over */
1077 		return (1);
1078 	}
1079 	/*
1080 	 * Cleared threshold management, now lets backoff the address and
1081 	 * select an alternate
1082 	 */
1083 	stcb->asoc.dropped_special_cnt = 0;
1084 	sctp_backoff_on_timeout(stcb, cookie->whoTo, 1, 0, 0);
1085 	alt = sctp_find_alternate_net(stcb, cookie->whoTo, 0);
1086 	if (alt != cookie->whoTo) {
1087 		sctp_free_remote_addr(cookie->whoTo);
1088 		cookie->whoTo = alt;
1089 		atomic_add_int(&alt->ref_count, 1);
1090 	}
1091 	/* Now mark the retran info */
1092 	if (cookie->sent != SCTP_DATAGRAM_RESEND) {
1093 		sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1094 	}
1095 	cookie->sent = SCTP_DATAGRAM_RESEND;
1096 	cookie->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1097 	/*
1098 	 * Now call the output routine to kick out the cookie again, Note we
1099 	 * don't mark any chunks for retran so that FR will need to kick in
1100 	 * to move these (or a send timer).
1101 	 */
1102 	return (0);
1103 }
1104 
1105 int
1106 sctp_strreset_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1107     struct sctp_nets *net)
1108 {
1109 	struct sctp_nets *alt;
1110 	struct sctp_tmit_chunk *strrst = NULL, *chk = NULL;
1111 
1112 	if (stcb->asoc.stream_reset_outstanding == 0) {
1113 		return (0);
1114 	}
1115 	/* find the existing STRRESET, we use the seq number we sent out on */
1116 	(void)sctp_find_stream_reset(stcb, stcb->asoc.str_reset_seq_out, &strrst);
1117 	if (strrst == NULL) {
1118 		return (0);
1119 	}
1120 	/* do threshold management */
1121 	if (sctp_threshold_management(inp, stcb, strrst->whoTo,
1122 	    stcb->asoc.max_send_times)) {
1123 		/* Assoc is over */
1124 		return (1);
1125 	}
1126 	/*
1127 	 * Cleared threshold management, now lets backoff the address and
1128 	 * select an alternate
1129 	 */
1130 	sctp_backoff_on_timeout(stcb, strrst->whoTo, 1, 0, 0);
1131 	alt = sctp_find_alternate_net(stcb, strrst->whoTo, 0);
1132 	sctp_free_remote_addr(strrst->whoTo);
1133 	strrst->whoTo = alt;
1134 	atomic_add_int(&alt->ref_count, 1);
1135 
1136 	/* See if a ECN Echo is also stranded */
1137 	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
1138 		if ((chk->whoTo == net) &&
1139 		    (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
1140 			sctp_free_remote_addr(chk->whoTo);
1141 			if (chk->sent != SCTP_DATAGRAM_RESEND) {
1142 				chk->sent = SCTP_DATAGRAM_RESEND;
1143 				chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1144 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1145 			}
1146 			chk->whoTo = alt;
1147 			atomic_add_int(&alt->ref_count, 1);
1148 		}
1149 	}
1150 	if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
1151 		/*
1152 		 * If the address went un-reachable, we need to move to
1153 		 * alternates for ALL chk's in queue
1154 		 */
1155 		sctp_move_chunks_from_net(stcb, net);
1156 	}
1157 	/* mark the retran info */
1158 	if (strrst->sent != SCTP_DATAGRAM_RESEND)
1159 		sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1160 	strrst->sent = SCTP_DATAGRAM_RESEND;
1161 	strrst->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1162 
1163 	/* restart the timer */
1164 	sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, inp, stcb, strrst->whoTo);
1165 	return (0);
1166 }
1167 
1168 int
1169 sctp_asconf_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1170     struct sctp_nets *net)
1171 {
1172 	struct sctp_nets *alt;
1173 	struct sctp_tmit_chunk *asconf, *chk;
1174 
1175 	/* is this a first send, or a retransmission? */
1176 	if (TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) {
1177 		/* compose a new ASCONF chunk and send it */
1178 		sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1179 	} else {
1180 		/*
1181 		 * Retransmission of the existing ASCONF is needed
1182 		 */
1183 
1184 		/* find the existing ASCONF */
1185 		asconf = TAILQ_FIRST(&stcb->asoc.asconf_send_queue);
1186 		if (asconf == NULL) {
1187 			return (0);
1188 		}
1189 		/* do threshold management */
1190 		if (sctp_threshold_management(inp, stcb, asconf->whoTo,
1191 		    stcb->asoc.max_send_times)) {
1192 			/* Assoc is over */
1193 			return (1);
1194 		}
1195 		if (asconf->snd_count > stcb->asoc.max_send_times) {
1196 			/*
1197 			 * Something is rotten: our peer is not responding
1198 			 * to ASCONFs but apparently is to other chunks.
1199 			 * i.e. it is not properly handling the chunk type
1200 			 * upper bits. Mark this peer as ASCONF incapable
1201 			 * and cleanup.
1202 			 */
1203 			SCTPDBG(SCTP_DEBUG_TIMER1, "asconf_timer: Peer has not responded to our repeated ASCONFs\n");
1204 			sctp_asconf_cleanup(stcb, net);
1205 			return (0);
1206 		}
1207 		/*
1208 		 * cleared threshold management, so now backoff the net and
1209 		 * select an alternate
1210 		 */
1211 		sctp_backoff_on_timeout(stcb, asconf->whoTo, 1, 0, 0);
1212 		alt = sctp_find_alternate_net(stcb, asconf->whoTo, 0);
1213 		if (asconf->whoTo != alt) {
1214 			sctp_free_remote_addr(asconf->whoTo);
1215 			asconf->whoTo = alt;
1216 			atomic_add_int(&alt->ref_count, 1);
1217 		}
1218 
1219 		/* See if an ECN Echo is also stranded */
1220 		TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
1221 			if ((chk->whoTo == net) &&
1222 			    (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
1223 				sctp_free_remote_addr(chk->whoTo);
1224 				chk->whoTo = alt;
1225 				if (chk->sent != SCTP_DATAGRAM_RESEND) {
1226 					chk->sent = SCTP_DATAGRAM_RESEND;
1227 					chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1228 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1229 				}
1230 				atomic_add_int(&alt->ref_count, 1);
1231 			}
1232 		}
1233 		TAILQ_FOREACH(chk, &stcb->asoc.asconf_send_queue, sctp_next) {
1234 			if (chk->whoTo != alt) {
1235 				sctp_free_remote_addr(chk->whoTo);
1236 				chk->whoTo = alt;
1237 				atomic_add_int(&alt->ref_count, 1);
1238 			}
1239 			if (asconf->sent != SCTP_DATAGRAM_RESEND && chk->sent != SCTP_DATAGRAM_UNSENT)
1240 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1241 			chk->sent = SCTP_DATAGRAM_RESEND;
1242 			chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1243 		}
1244 		if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
1245 			/*
1246 			 * If the address went un-reachable, we need to move
1247 			 * to the alternate for ALL chunks in queue
1248 			 */
1249 			sctp_move_chunks_from_net(stcb, net);
1250 		}
1251 		/* mark the retran info */
1252 		if (asconf->sent != SCTP_DATAGRAM_RESEND)
1253 			sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1254 		asconf->sent = SCTP_DATAGRAM_RESEND;
1255 		asconf->flags |= CHUNK_FLAGS_FRAGMENT_OK;
1256 
1257 		/* send another ASCONF if any and we can do */
1258 		sctp_send_asconf(stcb, alt, SCTP_ADDR_NOT_LOCKED);
1259 	}
1260 	return (0);
1261 }
1262 
1263 /* Mobility adaptation */
1264 void
1265 sctp_delete_prim_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1266     struct sctp_nets *net SCTP_UNUSED)
1267 {
1268 	if (stcb->asoc.deleted_primary == NULL) {
1269 		SCTPDBG(SCTP_DEBUG_ASCONF1, "delete_prim_timer: deleted_primary is not stored...\n");
1270 		sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
1271 		return;
1272 	}
1273 	SCTPDBG(SCTP_DEBUG_ASCONF1, "delete_prim_timer: finished to keep deleted primary ");
1274 	SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1275 	sctp_free_remote_addr(stcb->asoc.deleted_primary);
1276 	stcb->asoc.deleted_primary = NULL;
1277 	sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
1278 	return;
1279 }
1280 
1281 /*
1282  * For the shutdown and shutdown-ack, we do not keep one around on the
1283  * control queue. This means we must generate a new one and call the general
1284  * chunk output routine, AFTER having done threshold management.
1285  * It is assumed that net is non-NULL.
1286  */
1287 int
1288 sctp_shutdown_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1289     struct sctp_nets *net)
1290 {
1291 	struct sctp_nets *alt;
1292 
1293 	/* first threshold management */
1294 	if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1295 		/* Assoc is over */
1296 		return (1);
1297 	}
1298 	sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1299 	/* second select an alternative */
1300 	alt = sctp_find_alternate_net(stcb, net, 0);
1301 
1302 	/* third generate a shutdown into the queue for out net */
1303 	sctp_send_shutdown(stcb, alt);
1304 
1305 	/* fourth restart timer */
1306 	sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, alt);
1307 	return (0);
1308 }
1309 
1310 int
1311 sctp_shutdownack_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1312     struct sctp_nets *net)
1313 {
1314 	struct sctp_nets *alt;
1315 
1316 	/* first threshold management */
1317 	if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1318 		/* Assoc is over */
1319 		return (1);
1320 	}
1321 	sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1322 	/* second select an alternative */
1323 	alt = sctp_find_alternate_net(stcb, net, 0);
1324 
1325 	/* third generate a shutdown into the queue for out net */
1326 	sctp_send_shutdown_ack(stcb, alt);
1327 
1328 	/* fourth restart timer */
1329 	sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, alt);
1330 	return (0);
1331 }
1332 
1333 static void
1334 sctp_audit_stream_queues_for_size(struct sctp_inpcb *inp,
1335     struct sctp_tcb *stcb)
1336 {
1337 	struct sctp_stream_queue_pending *sp;
1338 	unsigned int i, chks_in_queue = 0;
1339 	int being_filled = 0;
1340 
1341 	/*
1342 	 * This function is ONLY called when the send/sent queues are empty.
1343 	 */
1344 	if ((stcb == NULL) || (inp == NULL))
1345 		return;
1346 
1347 	if (stcb->asoc.sent_queue_retran_cnt) {
1348 		SCTP_PRINTF("Hmm, sent_queue_retran_cnt is non-zero %d\n",
1349 		    stcb->asoc.sent_queue_retran_cnt);
1350 		stcb->asoc.sent_queue_retran_cnt = 0;
1351 	}
1352 	if (stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, &stcb->asoc)) {
1353 		/* No stream scheduler information, initialize scheduler */
1354 		stcb->asoc.ss_functions.sctp_ss_init(stcb, &stcb->asoc, 0);
1355 		if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, &stcb->asoc)) {
1356 			/* yep, we lost a stream or two */
1357 			SCTP_PRINTF("Found additional streams NOT managed by scheduler, corrected\n");
1358 		} else {
1359 			/* no streams lost */
1360 			stcb->asoc.total_output_queue_size = 0;
1361 		}
1362 	}
1363 	/* Check to see if some data queued, if so report it */
1364 	for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1365 		if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
1366 			TAILQ_FOREACH(sp, &stcb->asoc.strmout[i].outqueue, next) {
1367 				if (sp->msg_is_complete)
1368 					being_filled++;
1369 				chks_in_queue++;
1370 			}
1371 		}
1372 	}
1373 	if (chks_in_queue != stcb->asoc.stream_queue_cnt) {
1374 		SCTP_PRINTF("Hmm, stream queue cnt at %d I counted %d in stream out wheel\n",
1375 		    stcb->asoc.stream_queue_cnt, chks_in_queue);
1376 	}
1377 	if (chks_in_queue) {
1378 		/* call the output queue function */
1379 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1380 		if ((TAILQ_EMPTY(&stcb->asoc.send_queue)) &&
1381 		    (TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
1382 			/*
1383 			 * Probably should go in and make it go back through
1384 			 * and add fragments allowed
1385 			 */
1386 			if (being_filled == 0) {
1387 				SCTP_PRINTF("Still nothing moved %d chunks are stuck\n",
1388 				    chks_in_queue);
1389 			}
1390 		}
1391 	} else {
1392 		SCTP_PRINTF("Found no chunks on any queue tot:%lu\n",
1393 		    (u_long)stcb->asoc.total_output_queue_size);
1394 		stcb->asoc.total_output_queue_size = 0;
1395 	}
1396 }
1397 
1398 int
1399 sctp_heartbeat_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1400     struct sctp_nets *net)
1401 {
1402 	uint8_t net_was_pf;
1403 
1404 	if (net->dest_state & SCTP_ADDR_PF) {
1405 		net_was_pf = 1;
1406 	} else {
1407 		net_was_pf = 0;
1408 	}
1409 	if (net->hb_responded == 0) {
1410 		if (net->ro._s_addr) {
1411 			/*
1412 			 * Invalidate the src address if we did not get a
1413 			 * response last time.
1414 			 */
1415 			sctp_free_ifa(net->ro._s_addr);
1416 			net->ro._s_addr = NULL;
1417 			net->src_addr_selected = 0;
1418 		}
1419 		sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1420 		if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1421 			/* Assoc is over */
1422 			return (1);
1423 		}
1424 	}
1425 	/* Zero PBA, if it needs it */
1426 	if (net->partial_bytes_acked) {
1427 		net->partial_bytes_acked = 0;
1428 	}
1429 	if ((stcb->asoc.total_output_queue_size > 0) &&
1430 	    (TAILQ_EMPTY(&stcb->asoc.send_queue)) &&
1431 	    (TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
1432 		sctp_audit_stream_queues_for_size(inp, stcb);
1433 	}
1434 	if (!(net->dest_state & SCTP_ADDR_NOHB) &&
1435 	    !((net_was_pf == 0) && (net->dest_state & SCTP_ADDR_PF))) {
1436 		/*
1437 		 * when move to PF during threshold mangement, a HB has been
1438 		 * queued in that routine
1439 		 */
1440 		uint32_t ms_gone_by;
1441 
1442 		if ((net->last_sent_time.tv_sec > 0) ||
1443 		    (net->last_sent_time.tv_usec > 0)) {
1444 			struct timeval diff;
1445 
1446 			SCTP_GETTIME_TIMEVAL(&diff);
1447 			timevalsub(&diff, &net->last_sent_time);
1448 			ms_gone_by = (uint32_t)(diff.tv_sec * 1000) +
1449 			    (uint32_t)(diff.tv_usec / 1000);
1450 		} else {
1451 			ms_gone_by = 0xffffffff;
1452 		}
1453 		if ((ms_gone_by >= net->heart_beat_delay) ||
1454 		    (net->dest_state & SCTP_ADDR_PF)) {
1455 			sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
1456 		}
1457 	}
1458 	return (0);
1459 }
1460 
1461 void
1462 sctp_pathmtu_timer(struct sctp_inpcb *inp,
1463     struct sctp_tcb *stcb,
1464     struct sctp_nets *net)
1465 {
1466 	uint32_t next_mtu, mtu;
1467 
1468 	next_mtu = sctp_get_next_mtu(net->mtu);
1469 
1470 	if ((next_mtu > net->mtu) && (net->port == 0)) {
1471 		if ((net->src_addr_selected == 0) ||
1472 		    (net->ro._s_addr == NULL) ||
1473 		    (net->ro._s_addr->localifa_flags & SCTP_BEING_DELETED)) {
1474 			if ((net->ro._s_addr != NULL) && (net->ro._s_addr->localifa_flags & SCTP_BEING_DELETED)) {
1475 				sctp_free_ifa(net->ro._s_addr);
1476 				net->ro._s_addr = NULL;
1477 				net->src_addr_selected = 0;
1478 			} else if (net->ro._s_addr == NULL) {
1479 #if defined(INET6) && defined(SCTP_EMBEDDED_V6_SCOPE)
1480 				if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1481 					struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1482 
1483 					/* KAME hack: embed scopeid */
1484 					(void)sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone));
1485 				}
1486 #endif
1487 
1488 				net->ro._s_addr = sctp_source_address_selection(inp,
1489 				    stcb,
1490 				    (sctp_route_t *)&net->ro,
1491 				    net, 0, stcb->asoc.vrf_id);
1492 #if defined(INET6) && defined(SCTP_EMBEDDED_V6_SCOPE)
1493 				if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1494 					struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1495 
1496 					(void)sa6_recoverscope(sin6);
1497 				}
1498 #endif				/* INET6 */
1499 			}
1500 			if (net->ro._s_addr)
1501 				net->src_addr_selected = 1;
1502 		}
1503 		if (net->ro._s_addr) {
1504 			mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._s_addr.sa, net->ro.ro_rt);
1505 #if defined(INET) || defined(INET6)
1506 			if (net->port) {
1507 				mtu -= sizeof(struct udphdr);
1508 			}
1509 #endif
1510 			if (mtu > next_mtu) {
1511 				net->mtu = next_mtu;
1512 			} else {
1513 				net->mtu = mtu;
1514 			}
1515 		}
1516 	}
1517 	/* restart the timer */
1518 	sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net);
1519 }
1520 
1521 void
1522 sctp_autoclose_timer(struct sctp_inpcb *inp,
1523     struct sctp_tcb *stcb,
1524     struct sctp_nets *net)
1525 {
1526 	struct timeval tn, *tim_touse;
1527 	struct sctp_association *asoc;
1528 	int ticks_gone_by;
1529 
1530 	(void)SCTP_GETTIME_TIMEVAL(&tn);
1531 	if (stcb->asoc.sctp_autoclose_ticks &&
1532 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1533 		/* Auto close is on */
1534 		asoc = &stcb->asoc;
1535 		/* pick the time to use */
1536 		if (asoc->time_last_rcvd.tv_sec >
1537 		    asoc->time_last_sent.tv_sec) {
1538 			tim_touse = &asoc->time_last_rcvd;
1539 		} else {
1540 			tim_touse = &asoc->time_last_sent;
1541 		}
1542 		/* Now has long enough transpired to autoclose? */
1543 		ticks_gone_by = SEC_TO_TICKS(tn.tv_sec - tim_touse->tv_sec);
1544 		if ((ticks_gone_by > 0) &&
1545 		    (ticks_gone_by >= (int)asoc->sctp_autoclose_ticks)) {
1546 			/*
1547 			 * autoclose time has hit, call the output routine,
1548 			 * which should do nothing just to be SURE we don't
1549 			 * have hanging data. We can then safely check the
1550 			 * queues and know that we are clear to send
1551 			 * shutdown
1552 			 */
1553 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1554 			/* Are we clean? */
1555 			if (TAILQ_EMPTY(&asoc->send_queue) &&
1556 			    TAILQ_EMPTY(&asoc->sent_queue)) {
1557 				/*
1558 				 * there is nothing queued to send, so I'm
1559 				 * done...
1560 				 */
1561 				if (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) {
1562 					/* only send SHUTDOWN 1st time thru */
1563 					struct sctp_nets *netp;
1564 
1565 					if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
1566 					    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
1567 						SCTP_STAT_DECR_GAUGE32(sctps_currestab);
1568 					}
1569 					SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT);
1570 					sctp_stop_timers_for_shutdown(stcb);
1571 					if (stcb->asoc.alternate) {
1572 						netp = stcb->asoc.alternate;
1573 					} else {
1574 						netp = stcb->asoc.primary_destination;
1575 					}
1576 					sctp_send_shutdown(stcb, netp);
1577 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
1578 					    stcb->sctp_ep, stcb,
1579 					    netp);
1580 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1581 					    stcb->sctp_ep, stcb,
1582 					    netp);
1583 				}
1584 			}
1585 		} else {
1586 			/*
1587 			 * No auto close at this time, reset t-o to check
1588 			 * later
1589 			 */
1590 			int tmp;
1591 
1592 			/* fool the timer startup to use the time left */
1593 			tmp = asoc->sctp_autoclose_ticks;
1594 			asoc->sctp_autoclose_ticks -= ticks_gone_by;
1595 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1596 			    net);
1597 			/* restore the real tick value */
1598 			asoc->sctp_autoclose_ticks = tmp;
1599 		}
1600 	}
1601 }
1602