xref: /freebsd/sys/netinet/sctp_timer.c (revision 7cc1fde083b1fe9d55388045ba3df7d770d4f3bf)
1 /*-
2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  * a) Redistributions of source code must retain the above copyright notice,
8  *   this list of conditions and the following disclaimer.
9  *
10  * b) Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *   the documentation and/or other materials provided with the distribution.
13  *
14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15  *    contributors may be used to endorse or promote products derived
16  *    from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28  * THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 /* $KAME: sctp_timer.c,v 1.29 2005/03/06 16:04:18 itojun Exp $	 */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #define _IP_VHL
37 #include <netinet/sctp_os.h>
38 #include <netinet/sctp_pcb.h>
39 #ifdef INET6
40 #endif
41 #include <netinet/sctp_var.h>
42 #include <netinet/sctp_sysctl.h>
43 #include <netinet/sctp_timer.h>
44 #include <netinet/sctputil.h>
45 #include <netinet/sctp_output.h>
46 #include <netinet/sctp_header.h>
47 #include <netinet/sctp_indata.h>
48 #include <netinet/sctp_asconf.h>
49 #include <netinet/sctp_input.h>
50 #include <netinet/sctp.h>
51 #include <netinet/sctp_uio.h>
52 #include <netinet/udp.h>
53 
54 
55 void
56 sctp_early_fr_timer(struct sctp_inpcb *inp,
57     struct sctp_tcb *stcb,
58     struct sctp_nets *net)
59 {
60 	struct sctp_tmit_chunk *chk, *tp2;
61 	struct timeval now, min_wait, tv;
62 	unsigned int cur_rtt, cnt = 0, cnt_resend = 0;
63 
64 	/* an early FR is occuring. */
65 	(void)SCTP_GETTIME_TIMEVAL(&now);
66 	/* get cur rto in micro-seconds */
67 	if (net->lastsa == 0) {
68 		/* Hmm no rtt estimate yet? */
69 		cur_rtt = stcb->asoc.initial_rto >> 2;
70 	} else {
71 
72 		cur_rtt = ((net->lastsa >> 2) + net->lastsv) >> 1;
73 	}
74 	if (cur_rtt < SCTP_BASE_SYSCTL(sctp_early_fr_msec)) {
75 		cur_rtt = SCTP_BASE_SYSCTL(sctp_early_fr_msec);
76 	}
77 	cur_rtt *= 1000;
78 	tv.tv_sec = cur_rtt / 1000000;
79 	tv.tv_usec = cur_rtt % 1000000;
80 	min_wait = now;
81 	timevalsub(&min_wait, &tv);
82 	if (min_wait.tv_sec < 0 || min_wait.tv_usec < 0) {
83 		/*
84 		 * if we hit here, we don't have enough seconds on the clock
85 		 * to account for the RTO. We just let the lower seconds be
86 		 * the bounds and don't worry about it. This may mean we
87 		 * will mark a lot more than we should.
88 		 */
89 		min_wait.tv_sec = min_wait.tv_usec = 0;
90 	}
91 	chk = TAILQ_LAST(&stcb->asoc.sent_queue, sctpchunk_listhead);
92 	for (; chk != NULL; chk = tp2) {
93 		tp2 = TAILQ_PREV(chk, sctpchunk_listhead, sctp_next);
94 		if (chk->whoTo != net) {
95 			continue;
96 		}
97 		if (chk->sent == SCTP_DATAGRAM_RESEND)
98 			cnt_resend++;
99 		else if ((chk->sent > SCTP_DATAGRAM_UNSENT) &&
100 		    (chk->sent < SCTP_DATAGRAM_RESEND)) {
101 			/* pending, may need retran */
102 			if (chk->sent_rcv_time.tv_sec > min_wait.tv_sec) {
103 				/*
104 				 * we have reached a chunk that was sent
105 				 * some seconds past our min.. forget it we
106 				 * will find no more to send.
107 				 */
108 				continue;
109 			} else if (chk->sent_rcv_time.tv_sec == min_wait.tv_sec) {
110 				/*
111 				 * we must look at the micro seconds to
112 				 * know.
113 				 */
114 				if (chk->sent_rcv_time.tv_usec >= min_wait.tv_usec) {
115 					/*
116 					 * ok it was sent after our boundary
117 					 * time.
118 					 */
119 					continue;
120 				}
121 			}
122 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_EARLYFR_LOGGING_ENABLE) {
123 				sctp_log_fr(chk->rec.data.TSN_seq, chk->snd_count,
124 				    4, SCTP_FR_MARKED_EARLY);
125 			}
126 			SCTP_STAT_INCR(sctps_earlyfrmrkretrans);
127 			chk->sent = SCTP_DATAGRAM_RESEND;
128 			sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
129 			/* double book size since we are doing an early FR */
130 			chk->book_size_scale++;
131 			cnt += chk->send_size;
132 			if ((cnt + net->flight_size) > net->cwnd) {
133 				/* Mark all we could possibly resend */
134 				break;
135 			}
136 		}
137 	}
138 	if (cnt) {
139 		/*
140 		 * JRS - Use the congestion control given in the congestion
141 		 * control module
142 		 */
143 		stcb->asoc.cc_functions.sctp_cwnd_update_after_fr_timer(inp, stcb, net);
144 	} else if (cnt_resend) {
145 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_EARLY_FR_TMR, SCTP_SO_NOT_LOCKED);
146 	}
147 	/* Restart it? */
148 	if (net->flight_size < net->cwnd) {
149 		SCTP_STAT_INCR(sctps_earlyfrstrtmr);
150 		sctp_timer_start(SCTP_TIMER_TYPE_EARLYFR, stcb->sctp_ep, stcb, net);
151 	}
152 }
153 
154 void
155 sctp_audit_retranmission_queue(struct sctp_association *asoc)
156 {
157 	struct sctp_tmit_chunk *chk;
158 
159 	SCTPDBG(SCTP_DEBUG_TIMER4, "Audit invoked on send queue cnt:%d onqueue:%d\n",
160 	    asoc->sent_queue_retran_cnt,
161 	    asoc->sent_queue_cnt);
162 	asoc->sent_queue_retran_cnt = 0;
163 	asoc->sent_queue_cnt = 0;
164 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
165 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
166 			sctp_ucount_incr(asoc->sent_queue_retran_cnt);
167 		}
168 		asoc->sent_queue_cnt++;
169 	}
170 	TAILQ_FOREACH(chk, &asoc->control_send_queue, sctp_next) {
171 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
172 			sctp_ucount_incr(asoc->sent_queue_retran_cnt);
173 		}
174 	}
175 	TAILQ_FOREACH(chk, &asoc->asconf_send_queue, sctp_next) {
176 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
177 			sctp_ucount_incr(asoc->sent_queue_retran_cnt);
178 		}
179 	}
180 	SCTPDBG(SCTP_DEBUG_TIMER4, "Audit completes retran:%d onqueue:%d\n",
181 	    asoc->sent_queue_retran_cnt,
182 	    asoc->sent_queue_cnt);
183 }
184 
185 int
186 sctp_threshold_management(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
187     struct sctp_nets *net, uint16_t threshold)
188 {
189 	if (net) {
190 		net->error_count++;
191 		SCTPDBG(SCTP_DEBUG_TIMER4, "Error count for %p now %d thresh:%d\n",
192 		    net, net->error_count,
193 		    net->failure_threshold);
194 		if (net->error_count > net->failure_threshold) {
195 			/* We had a threshold failure */
196 			if (net->dest_state & SCTP_ADDR_REACHABLE) {
197 				net->dest_state &= ~SCTP_ADDR_REACHABLE;
198 				net->dest_state |= SCTP_ADDR_NOT_REACHABLE;
199 				net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
200 				if (net == stcb->asoc.primary_destination) {
201 					net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
202 				}
203 				/*
204 				 * JRS 5/14/07 - If a destination is
205 				 * unreachable, the PF bit is turned off.
206 				 * This allows an unambiguous use of the PF
207 				 * bit for destinations that are reachable
208 				 * but potentially failed. If the
209 				 * destination is set to the unreachable
210 				 * state, also set the destination to the PF
211 				 * state.
212 				 */
213 				/*
214 				 * Add debug message here if destination is
215 				 * not in PF state.
216 				 */
217 				/* Stop any running T3 timers here? */
218 				if ((stcb->asoc.sctp_cmt_on_off == 1) &&
219 				    (stcb->asoc.sctp_cmt_pf > 0)) {
220 					net->dest_state &= ~SCTP_ADDR_PF;
221 					SCTPDBG(SCTP_DEBUG_TIMER4, "Destination %p moved from PF to unreachable.\n",
222 					    net);
223 				}
224 				sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_DOWN,
225 				    stcb,
226 				    SCTP_FAILED_THRESHOLD,
227 				    (void *)net, SCTP_SO_NOT_LOCKED);
228 			}
229 		}
230 		/*********HOLD THIS COMMENT FOR PATCH OF ALTERNATE
231 		 *********ROUTING CODE
232 		 */
233 		/*********HOLD THIS COMMENT FOR END OF PATCH OF ALTERNATE
234 		 *********ROUTING CODE
235 		 */
236 	}
237 	if (stcb == NULL)
238 		return (0);
239 
240 	if (net) {
241 		if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0) {
242 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
243 				sctp_misc_ints(SCTP_THRESHOLD_INCR,
244 				    stcb->asoc.overall_error_count,
245 				    (stcb->asoc.overall_error_count + 1),
246 				    SCTP_FROM_SCTP_TIMER,
247 				    __LINE__);
248 			}
249 			stcb->asoc.overall_error_count++;
250 		}
251 	} else {
252 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
253 			sctp_misc_ints(SCTP_THRESHOLD_INCR,
254 			    stcb->asoc.overall_error_count,
255 			    (stcb->asoc.overall_error_count + 1),
256 			    SCTP_FROM_SCTP_TIMER,
257 			    __LINE__);
258 		}
259 		stcb->asoc.overall_error_count++;
260 	}
261 	SCTPDBG(SCTP_DEBUG_TIMER4, "Overall error count for %p now %d thresh:%u state:%x\n",
262 	    &stcb->asoc, stcb->asoc.overall_error_count,
263 	    (uint32_t) threshold,
264 	    ((net == NULL) ? (uint32_t) 0 : (uint32_t) net->dest_state));
265 	/*
266 	 * We specifically do not do >= to give the assoc one more change
267 	 * before we fail it.
268 	 */
269 	if (stcb->asoc.overall_error_count > threshold) {
270 		/* Abort notification sends a ULP notify */
271 		struct mbuf *oper;
272 
273 		oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
274 		    0, M_DONTWAIT, 1, MT_DATA);
275 		if (oper) {
276 			struct sctp_paramhdr *ph;
277 			uint32_t *ippp;
278 
279 			SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
280 			    sizeof(uint32_t);
281 			ph = mtod(oper, struct sctp_paramhdr *);
282 			ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
283 			ph->param_length = htons(SCTP_BUF_LEN(oper));
284 			ippp = (uint32_t *) (ph + 1);
285 			*ippp = htonl(SCTP_FROM_SCTP_TIMER + SCTP_LOC_1);
286 		}
287 		inp->last_abort_code = SCTP_FROM_SCTP_TIMER + SCTP_LOC_1;
288 		sctp_abort_an_association(inp, stcb, SCTP_FAILED_THRESHOLD, oper, SCTP_SO_NOT_LOCKED);
289 		return (1);
290 	}
291 	return (0);
292 }
293 
294 struct sctp_nets *
295 sctp_find_alternate_net(struct sctp_tcb *stcb,
296     struct sctp_nets *net,
297     int mode)
298 {
299 	/* Find and return an alternate network if possible */
300 	struct sctp_nets *alt, *mnet, *min_errors_net = NULL, *max_cwnd_net = NULL;
301 	int once;
302 
303 	/* JRS 5/14/07 - Initialize min_errors to an impossible value. */
304 	int min_errors = -1;
305 	uint32_t max_cwnd = 0;
306 
307 	if (stcb->asoc.numnets == 1) {
308 		/* No others but net */
309 		return (TAILQ_FIRST(&stcb->asoc.nets));
310 	}
311 	/*
312 	 * JRS 5/14/07 - If mode is set to 2, use the CMT PF find alternate
313 	 * net algorithm. This algorithm chooses the active destination (not
314 	 * in PF state) with the largest cwnd value. If all destinations are
315 	 * in PF state, unreachable, or unconfirmed, choose the desination
316 	 * that is in PF state with the lowest error count. In case of a
317 	 * tie, choose the destination that was most recently active.
318 	 */
319 	if (mode == 2) {
320 		TAILQ_FOREACH(mnet, &stcb->asoc.nets, sctp_next) {
321 			/*
322 			 * JRS 5/14/07 - If the destination is unreachable
323 			 * or unconfirmed, skip it.
324 			 */
325 			if (((mnet->dest_state & SCTP_ADDR_REACHABLE) != SCTP_ADDR_REACHABLE) ||
326 			    (mnet->dest_state & SCTP_ADDR_UNCONFIRMED)) {
327 				continue;
328 			}
329 			/*
330 			 * JRS 5/14/07 -  If the destination is reachable
331 			 * but in PF state, compare the error count of the
332 			 * destination to the minimum error count seen thus
333 			 * far. Store the destination with the lower error
334 			 * count.  If the error counts are equal, store the
335 			 * destination that was most recently active.
336 			 */
337 			if (mnet->dest_state & SCTP_ADDR_PF) {
338 				/*
339 				 * JRS 5/14/07 - If the destination under
340 				 * consideration is the current destination,
341 				 * work as if the error count is one higher.
342 				 * The actual error count will not be
343 				 * incremented until later in the t3
344 				 * handler.
345 				 */
346 				if (mnet == net) {
347 					if (min_errors == -1) {
348 						min_errors = mnet->error_count + 1;
349 						min_errors_net = mnet;
350 					} else if (mnet->error_count + 1 < min_errors) {
351 						min_errors = mnet->error_count + 1;
352 						min_errors_net = mnet;
353 					} else if (mnet->error_count + 1 == min_errors
354 					    && mnet->last_active > min_errors_net->last_active) {
355 						min_errors_net = mnet;
356 						min_errors = mnet->error_count + 1;
357 					}
358 					continue;
359 				} else {
360 					if (min_errors == -1) {
361 						min_errors = mnet->error_count;
362 						min_errors_net = mnet;
363 					} else if (mnet->error_count < min_errors) {
364 						min_errors = mnet->error_count;
365 						min_errors_net = mnet;
366 					} else if (mnet->error_count == min_errors
367 					    && mnet->last_active > min_errors_net->last_active) {
368 						min_errors_net = mnet;
369 						min_errors = mnet->error_count;
370 					}
371 					continue;
372 				}
373 			}
374 			/*
375 			 * JRS 5/14/07 - If the destination is reachable and
376 			 * not in PF state, compare the cwnd of the
377 			 * destination to the highest cwnd seen thus far.
378 			 * Store the destination with the higher cwnd value.
379 			 * If the cwnd values are equal, randomly choose one
380 			 * of the two destinations.
381 			 */
382 			if (max_cwnd < mnet->cwnd) {
383 				max_cwnd_net = mnet;
384 				max_cwnd = mnet->cwnd;
385 			} else if (max_cwnd == mnet->cwnd) {
386 				uint32_t rndval;
387 				uint8_t this_random;
388 
389 				if (stcb->asoc.hb_random_idx > 3) {
390 					rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
391 					memcpy(stcb->asoc.hb_random_values, &rndval, sizeof(stcb->asoc.hb_random_values));
392 					this_random = stcb->asoc.hb_random_values[0];
393 					stcb->asoc.hb_random_idx++;
394 					stcb->asoc.hb_ect_randombit = 0;
395 				} else {
396 					this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
397 					stcb->asoc.hb_random_idx++;
398 					stcb->asoc.hb_ect_randombit = 0;
399 				}
400 				if (this_random % 2 == 1) {
401 					max_cwnd_net = mnet;
402 					max_cwnd = mnet->cwnd;	/* Useless? */
403 				}
404 			}
405 		}
406 		/*
407 		 * JRS 5/14/07 - After all destination have been considered
408 		 * as alternates, check to see if there was some active
409 		 * destination (not in PF state).  If not, check to see if
410 		 * there was some PF destination with the minimum number of
411 		 * errors.  If not, return the original destination.  If
412 		 * there is a min_errors_net, remove the PF flag from that
413 		 * destination, set the cwnd to one or two MTUs, and return
414 		 * the destination as an alt. If there was some active
415 		 * destination with a highest cwnd, return the destination
416 		 * as an alt.
417 		 */
418 		if (max_cwnd_net == NULL) {
419 			if (min_errors_net == NULL) {
420 				return (net);
421 			}
422 			min_errors_net->dest_state &= ~SCTP_ADDR_PF;
423 			min_errors_net->cwnd = min_errors_net->mtu * stcb->asoc.sctp_cmt_pf;
424 			if (SCTP_OS_TIMER_PENDING(&min_errors_net->rxt_timer.timer)) {
425 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
426 				    stcb, min_errors_net,
427 				    SCTP_FROM_SCTP_TIMER + SCTP_LOC_2);
428 			}
429 			SCTPDBG(SCTP_DEBUG_TIMER4, "Destination %p moved from PF to active with %d errors.\n",
430 			    min_errors_net, min_errors_net->error_count);
431 			return (min_errors_net);
432 		} else {
433 			return (max_cwnd_net);
434 		}
435 	}
436 	/*
437 	 * JRS 5/14/07 - If mode is set to 1, use the CMT policy for
438 	 * choosing an alternate net.
439 	 */
440 	else if (mode == 1) {
441 		TAILQ_FOREACH(mnet, &stcb->asoc.nets, sctp_next) {
442 			if (((mnet->dest_state & SCTP_ADDR_REACHABLE) != SCTP_ADDR_REACHABLE) ||
443 			    (mnet->dest_state & SCTP_ADDR_UNCONFIRMED)
444 			    ) {
445 				/*
446 				 * will skip ones that are not-reachable or
447 				 * unconfirmed
448 				 */
449 				continue;
450 			}
451 			if (max_cwnd < mnet->cwnd) {
452 				max_cwnd_net = mnet;
453 				max_cwnd = mnet->cwnd;
454 			} else if (max_cwnd == mnet->cwnd) {
455 				uint32_t rndval;
456 				uint8_t this_random;
457 
458 				if (stcb->asoc.hb_random_idx > 3) {
459 					rndval = sctp_select_initial_TSN(&stcb->sctp_ep->sctp_ep);
460 					memcpy(stcb->asoc.hb_random_values, &rndval,
461 					    sizeof(stcb->asoc.hb_random_values));
462 					this_random = stcb->asoc.hb_random_values[0];
463 					stcb->asoc.hb_random_idx = 0;
464 					stcb->asoc.hb_ect_randombit = 0;
465 				} else {
466 					this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
467 					stcb->asoc.hb_random_idx++;
468 					stcb->asoc.hb_ect_randombit = 0;
469 				}
470 				if (this_random % 2) {
471 					max_cwnd_net = mnet;
472 					max_cwnd = mnet->cwnd;
473 				}
474 			}
475 		}
476 		if (max_cwnd_net) {
477 			return (max_cwnd_net);
478 		}
479 	}
480 	mnet = net;
481 	once = 0;
482 
483 	if (mnet == NULL) {
484 		mnet = TAILQ_FIRST(&stcb->asoc.nets);
485 		if (mnet == NULL) {
486 			return (NULL);
487 		}
488 	}
489 	do {
490 		alt = TAILQ_NEXT(mnet, sctp_next);
491 		if (alt == NULL) {
492 			once++;
493 			if (once > 1) {
494 				break;
495 			}
496 			alt = TAILQ_FIRST(&stcb->asoc.nets);
497 			if (alt == NULL) {
498 				return (NULL);
499 			}
500 		}
501 		if (alt->ro.ro_rt == NULL) {
502 			if (alt->ro._s_addr) {
503 				sctp_free_ifa(alt->ro._s_addr);
504 				alt->ro._s_addr = NULL;
505 			}
506 			alt->src_addr_selected = 0;
507 		}
508 		if (
509 		    ((alt->dest_state & SCTP_ADDR_REACHABLE) == SCTP_ADDR_REACHABLE) &&
510 		    (alt->ro.ro_rt != NULL) &&
511 		/* sa_ignore NO_NULL_CHK */
512 		    (!(alt->dest_state & SCTP_ADDR_UNCONFIRMED))
513 		    ) {
514 			/* Found a reachable address */
515 			break;
516 		}
517 		mnet = alt;
518 	} while (alt != NULL);
519 
520 	if (alt == NULL) {
521 		/* Case where NO insv network exists (dormant state) */
522 		/* we rotate destinations */
523 		once = 0;
524 		mnet = net;
525 		do {
526 			if (mnet == NULL) {
527 				return (TAILQ_FIRST(&stcb->asoc.nets));
528 			}
529 			alt = TAILQ_NEXT(mnet, sctp_next);
530 			if (alt == NULL) {
531 				once++;
532 				if (once > 1) {
533 					break;
534 				}
535 				alt = TAILQ_FIRST(&stcb->asoc.nets);
536 			}
537 			/* sa_ignore NO_NULL_CHK */
538 			if ((!(alt->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
539 			    (alt != net)) {
540 				/* Found an alternate address */
541 				break;
542 			}
543 			mnet = alt;
544 		} while (alt != NULL);
545 	}
546 	if (alt == NULL) {
547 		return (net);
548 	}
549 	return (alt);
550 }
551 
552 
553 
554 static void
555 sctp_backoff_on_timeout(struct sctp_tcb *stcb,
556     struct sctp_nets *net,
557     int win_probe,
558     int num_marked, int num_abandoned)
559 {
560 	if (net->RTO == 0) {
561 		net->RTO = stcb->asoc.minrto;
562 	}
563 	net->RTO <<= 1;
564 	if (net->RTO > stcb->asoc.maxrto) {
565 		net->RTO = stcb->asoc.maxrto;
566 	}
567 	if ((win_probe == 0) && (num_marked || num_abandoned)) {
568 		/* We don't apply penalty to window probe scenarios */
569 		/* JRS - Use the congestion control given in the CC module */
570 		stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout(stcb, net);
571 	}
572 }
573 
574 #ifndef INVARIANTS
575 static void
576 sctp_recover_sent_list(struct sctp_tcb *stcb)
577 {
578 	struct sctp_tmit_chunk *chk, *tp2;
579 	struct sctp_association *asoc;
580 
581 	asoc = &stcb->asoc;
582 	chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
583 	for (; chk != NULL; chk = tp2) {
584 		tp2 = TAILQ_NEXT(chk, sctp_next);
585 		if ((compare_with_wrap(stcb->asoc.last_acked_seq,
586 		    chk->rec.data.TSN_seq,
587 		    MAX_TSN)) ||
588 		    (stcb->asoc.last_acked_seq == chk->rec.data.TSN_seq)) {
589 
590 			SCTP_PRINTF("Found chk:%p tsn:%x <= last_acked_seq:%x\n",
591 			    chk, chk->rec.data.TSN_seq, stcb->asoc.last_acked_seq);
592 			TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
593 			if (chk->pr_sctp_on) {
594 				if (asoc->pr_sctp_cnt != 0)
595 					asoc->pr_sctp_cnt--;
596 			}
597 			if (chk->data) {
598 				/* sa_ignore NO_NULL_CHK */
599 				sctp_free_bufspace(stcb, asoc, chk, 1);
600 				sctp_m_freem(chk->data);
601 				if (asoc->peer_supports_prsctp && PR_SCTP_BUF_ENABLED(chk->flags)) {
602 					asoc->sent_queue_cnt_removeable--;
603 				}
604 			}
605 			chk->data = NULL;
606 			asoc->sent_queue_cnt--;
607 			sctp_free_a_chunk(stcb, chk);
608 		}
609 	}
610 	SCTP_PRINTF("after recover order is as follows\n");
611 	chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
612 	for (; chk != NULL; chk = tp2) {
613 		tp2 = TAILQ_NEXT(chk, sctp_next);
614 		SCTP_PRINTF("chk:%p TSN:%x\n", chk, chk->rec.data.TSN_seq);
615 	}
616 }
617 
618 #endif
619 
620 static int
621 sctp_mark_all_for_resend(struct sctp_tcb *stcb,
622     struct sctp_nets *net,
623     struct sctp_nets *alt,
624     int window_probe,
625     int *num_marked,
626     int *num_abandoned)
627 {
628 
629 	/*
630 	 * Mark all chunks (well not all) that were sent to *net for
631 	 * retransmission. Move them to alt for there destination as well...
632 	 * We only mark chunks that have been outstanding long enough to
633 	 * have received feed-back.
634 	 */
635 	struct sctp_tmit_chunk *chk, *tp2;
636 	struct sctp_nets *lnets;
637 	struct timeval now, min_wait, tv;
638 	int cur_rtt;
639 	int cnt_abandoned;
640 	int audit_tf, num_mk, fir;
641 	unsigned int cnt_mk;
642 	uint32_t orig_flight, orig_tf;
643 	uint32_t tsnlast, tsnfirst;
644 	int recovery_cnt = 0;
645 
646 
647 	/* none in flight now */
648 	audit_tf = 0;
649 	fir = 0;
650 	/*
651 	 * figure out how long a data chunk must be pending before we can
652 	 * mark it ..
653 	 */
654 	(void)SCTP_GETTIME_TIMEVAL(&now);
655 	/* get cur rto in micro-seconds */
656 	cur_rtt = (((net->lastsa >> 2) + net->lastsv) >> 1);
657 	cur_rtt *= 1000;
658 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
659 		sctp_log_fr(cur_rtt,
660 		    stcb->asoc.peers_rwnd,
661 		    window_probe,
662 		    SCTP_FR_T3_MARK_TIME);
663 		sctp_log_fr(net->flight_size,
664 		    SCTP_OS_TIMER_PENDING(&net->fr_timer.timer),
665 		    SCTP_OS_TIMER_ACTIVE(&net->fr_timer.timer),
666 		    SCTP_FR_CWND_REPORT);
667 		sctp_log_fr(net->flight_size, net->cwnd, stcb->asoc.total_flight, SCTP_FR_CWND_REPORT);
668 	}
669 	tv.tv_sec = cur_rtt / 1000000;
670 	tv.tv_usec = cur_rtt % 1000000;
671 	min_wait = now;
672 	timevalsub(&min_wait, &tv);
673 	if (min_wait.tv_sec < 0 || min_wait.tv_usec < 0) {
674 		/*
675 		 * if we hit here, we don't have enough seconds on the clock
676 		 * to account for the RTO. We just let the lower seconds be
677 		 * the bounds and don't worry about it. This may mean we
678 		 * will mark a lot more than we should.
679 		 */
680 		min_wait.tv_sec = min_wait.tv_usec = 0;
681 	}
682 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
683 		sctp_log_fr(cur_rtt, now.tv_sec, now.tv_usec, SCTP_FR_T3_MARK_TIME);
684 		sctp_log_fr(0, min_wait.tv_sec, min_wait.tv_usec, SCTP_FR_T3_MARK_TIME);
685 	}
686 	/*
687 	 * Our rwnd will be incorrect here since we are not adding back the
688 	 * cnt * mbuf but we will fix that down below.
689 	 */
690 	orig_flight = net->flight_size;
691 	orig_tf = stcb->asoc.total_flight;
692 
693 	net->fast_retran_ip = 0;
694 	/* Now on to each chunk */
695 	cnt_abandoned = 0;
696 	num_mk = cnt_mk = 0;
697 	tsnfirst = tsnlast = 0;
698 #ifndef INVARIANTS
699 start_again:
700 #endif
701 	chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
702 	for (; chk != NULL; chk = tp2) {
703 		tp2 = TAILQ_NEXT(chk, sctp_next);
704 		if ((compare_with_wrap(stcb->asoc.last_acked_seq,
705 		    chk->rec.data.TSN_seq,
706 		    MAX_TSN)) ||
707 		    (stcb->asoc.last_acked_seq == chk->rec.data.TSN_seq)) {
708 			/* Strange case our list got out of order? */
709 			SCTP_PRINTF("Our list is out of order? last_acked:%x chk:%x",
710 			    (unsigned int)stcb->asoc.last_acked_seq, (unsigned int)chk->rec.data.TSN_seq);
711 			recovery_cnt++;
712 #ifdef INVARIANTS
713 			panic("last acked >= chk on sent-Q");
714 #else
715 			SCTP_PRINTF("Recover attempts a restart cnt:%d\n", recovery_cnt);
716 			sctp_recover_sent_list(stcb);
717 			if (recovery_cnt < 10) {
718 				goto start_again;
719 			} else {
720 				SCTP_PRINTF("Recovery fails %d times??\n", recovery_cnt);
721 			}
722 #endif
723 		}
724 		if ((chk->whoTo == net) && (chk->sent < SCTP_DATAGRAM_ACKED)) {
725 			/*
726 			 * found one to mark: If it is less than
727 			 * DATAGRAM_ACKED it MUST not be a skipped or marked
728 			 * TSN but instead one that is either already set
729 			 * for retransmission OR one that needs
730 			 * retransmission.
731 			 */
732 
733 			/* validate its been outstanding long enough */
734 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
735 				sctp_log_fr(chk->rec.data.TSN_seq,
736 				    chk->sent_rcv_time.tv_sec,
737 				    chk->sent_rcv_time.tv_usec,
738 				    SCTP_FR_T3_MARK_TIME);
739 			}
740 			if ((chk->sent_rcv_time.tv_sec > min_wait.tv_sec) && (window_probe == 0)) {
741 				/*
742 				 * we have reached a chunk that was sent
743 				 * some seconds past our min.. forget it we
744 				 * will find no more to send.
745 				 */
746 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
747 					sctp_log_fr(0,
748 					    chk->sent_rcv_time.tv_sec,
749 					    chk->sent_rcv_time.tv_usec,
750 					    SCTP_FR_T3_STOPPED);
751 				}
752 				continue;
753 			} else if ((chk->sent_rcv_time.tv_sec == min_wait.tv_sec) &&
754 			    (window_probe == 0)) {
755 				/*
756 				 * we must look at the micro seconds to
757 				 * know.
758 				 */
759 				if (chk->sent_rcv_time.tv_usec >= min_wait.tv_usec) {
760 					/*
761 					 * ok it was sent after our boundary
762 					 * time.
763 					 */
764 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
765 						sctp_log_fr(0,
766 						    chk->sent_rcv_time.tv_sec,
767 						    chk->sent_rcv_time.tv_usec,
768 						    SCTP_FR_T3_STOPPED);
769 					}
770 					continue;
771 				}
772 			}
773 			if (stcb->asoc.peer_supports_prsctp && PR_SCTP_TTL_ENABLED(chk->flags)) {
774 				/* Is it expired? */
775 				if (timevalcmp(&now, &chk->rec.data.timetodrop, >)) {
776 					/* Yes so drop it */
777 					if (chk->data) {
778 						(void)sctp_release_pr_sctp_chunk(stcb,
779 						    chk,
780 						    (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
781 						    SCTP_SO_NOT_LOCKED);
782 						cnt_abandoned++;
783 					}
784 					continue;
785 				}
786 			}
787 			if (stcb->asoc.peer_supports_prsctp && PR_SCTP_RTX_ENABLED(chk->flags)) {
788 				/* Has it been retransmitted tv_sec times? */
789 				if (chk->snd_count > chk->rec.data.timetodrop.tv_sec) {
790 					if (chk->data) {
791 						(void)sctp_release_pr_sctp_chunk(stcb,
792 						    chk,
793 						    (SCTP_RESPONSE_TO_USER_REQ | SCTP_NOTIFY_DATAGRAM_SENT),
794 						    SCTP_SO_NOT_LOCKED);
795 						cnt_abandoned++;
796 					}
797 					continue;
798 				}
799 			}
800 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
801 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
802 				num_mk++;
803 				if (fir == 0) {
804 					fir = 1;
805 					tsnfirst = chk->rec.data.TSN_seq;
806 				}
807 				tsnlast = chk->rec.data.TSN_seq;
808 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
809 					sctp_log_fr(chk->rec.data.TSN_seq, chk->snd_count,
810 					    0, SCTP_FR_T3_MARKED);
811 				}
812 				if (chk->rec.data.chunk_was_revoked) {
813 					/* deflate the cwnd */
814 					chk->whoTo->cwnd -= chk->book_size;
815 					chk->rec.data.chunk_was_revoked = 0;
816 				}
817 				net->marked_retrans++;
818 				stcb->asoc.marked_retrans++;
819 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
820 					sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND_TO,
821 					    chk->whoTo->flight_size,
822 					    chk->book_size,
823 					    (uintptr_t) chk->whoTo,
824 					    chk->rec.data.TSN_seq);
825 				}
826 				sctp_flight_size_decrease(chk);
827 				sctp_total_flight_decrease(stcb, chk);
828 				stcb->asoc.peers_rwnd += chk->send_size;
829 				stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
830 			}
831 			chk->sent = SCTP_DATAGRAM_RESEND;
832 			SCTP_STAT_INCR(sctps_markedretrans);
833 
834 			/* reset the TSN for striking and other FR stuff */
835 			chk->rec.data.doing_fast_retransmit = 0;
836 			/* Clear any time so NO RTT is being done */
837 			chk->do_rtt = 0;
838 			if (alt != net) {
839 				sctp_free_remote_addr(chk->whoTo);
840 				chk->no_fr_allowed = 1;
841 				chk->whoTo = alt;
842 				atomic_add_int(&alt->ref_count, 1);
843 			} else {
844 				chk->no_fr_allowed = 0;
845 				if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
846 					chk->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
847 				} else {
848 					chk->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
849 				}
850 			}
851 			/*
852 			 * CMT: Do not allow FRs on retransmitted TSNs.
853 			 */
854 			if (stcb->asoc.sctp_cmt_on_off == 1) {
855 				chk->no_fr_allowed = 1;
856 			}
857 #ifdef THIS_SHOULD_NOT_BE_DONE
858 		} else if (chk->sent == SCTP_DATAGRAM_ACKED) {
859 			/* remember highest acked one */
860 			could_be_sent = chk;
861 #endif
862 		}
863 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
864 			cnt_mk++;
865 		}
866 	}
867 	if ((orig_flight - net->flight_size) != (orig_tf - stcb->asoc.total_flight)) {
868 		/* we did not subtract the same things? */
869 		audit_tf = 1;
870 	}
871 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_EARLYFR_LOGGING_ENABLE | SCTP_FR_LOGGING_ENABLE)) {
872 		sctp_log_fr(tsnfirst, tsnlast, num_mk, SCTP_FR_T3_TIMEOUT);
873 	}
874 #ifdef SCTP_DEBUG
875 	if (num_mk) {
876 		SCTPDBG(SCTP_DEBUG_TIMER1, "LAST TSN marked was %x\n",
877 		    tsnlast);
878 		SCTPDBG(SCTP_DEBUG_TIMER1, "Num marked for retransmission was %d peer-rwd:%ld\n",
879 		    num_mk, (u_long)stcb->asoc.peers_rwnd);
880 		SCTPDBG(SCTP_DEBUG_TIMER1, "LAST TSN marked was %x\n",
881 		    tsnlast);
882 		SCTPDBG(SCTP_DEBUG_TIMER1, "Num marked for retransmission was %d peer-rwd:%d\n",
883 		    num_mk,
884 		    (int)stcb->asoc.peers_rwnd);
885 	}
886 #endif
887 	*num_marked = num_mk;
888 	*num_abandoned = cnt_abandoned;
889 	/*
890 	 * Now check for a ECN Echo that may be stranded And include the
891 	 * cnt_mk'd to have all resends in the control queue.
892 	 */
893 	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
894 		if (chk->sent == SCTP_DATAGRAM_RESEND) {
895 			cnt_mk++;
896 		}
897 		if ((chk->whoTo == net) &&
898 		    (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
899 			sctp_free_remote_addr(chk->whoTo);
900 			chk->whoTo = alt;
901 			if (chk->sent != SCTP_DATAGRAM_RESEND) {
902 				chk->sent = SCTP_DATAGRAM_RESEND;
903 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
904 				cnt_mk++;
905 			}
906 			atomic_add_int(&alt->ref_count, 1);
907 		}
908 	}
909 #ifdef THIS_SHOULD_NOT_BE_DONE
910 	if ((stcb->asoc.sent_queue_retran_cnt == 0) && (could_be_sent)) {
911 		/* fix it so we retransmit the highest acked anyway */
912 		sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
913 		cnt_mk++;
914 		could_be_sent->sent = SCTP_DATAGRAM_RESEND;
915 	}
916 #endif
917 	if (stcb->asoc.sent_queue_retran_cnt != cnt_mk) {
918 #ifdef INVARIANTS
919 		SCTP_PRINTF("Local Audit says there are %d for retran asoc cnt:%d we marked:%d this time\n",
920 		    cnt_mk, stcb->asoc.sent_queue_retran_cnt, num_mk);
921 #endif
922 #ifndef SCTP_AUDITING_ENABLED
923 		stcb->asoc.sent_queue_retran_cnt = cnt_mk;
924 #endif
925 	}
926 	if (audit_tf) {
927 		SCTPDBG(SCTP_DEBUG_TIMER4,
928 		    "Audit total flight due to negative value net:%p\n",
929 		    net);
930 		stcb->asoc.total_flight = 0;
931 		stcb->asoc.total_flight_count = 0;
932 		/* Clear all networks flight size */
933 		TAILQ_FOREACH(lnets, &stcb->asoc.nets, sctp_next) {
934 			lnets->flight_size = 0;
935 			SCTPDBG(SCTP_DEBUG_TIMER4,
936 			    "Net:%p c-f cwnd:%d ssthresh:%d\n",
937 			    lnets, lnets->cwnd, lnets->ssthresh);
938 		}
939 		TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
940 			if (chk->sent < SCTP_DATAGRAM_RESEND) {
941 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
942 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP,
943 					    chk->whoTo->flight_size,
944 					    chk->book_size,
945 					    (uintptr_t) chk->whoTo,
946 					    chk->rec.data.TSN_seq);
947 				}
948 				sctp_flight_size_increase(chk);
949 				sctp_total_flight_increase(stcb, chk);
950 			}
951 		}
952 	}
953 	/*
954 	 * Setup the ecn nonce re-sync point. We do this since
955 	 * retranmissions are NOT setup for ECN. This means that do to
956 	 * Karn's rule, we don't know the total of the peers ecn bits.
957 	 */
958 	chk = TAILQ_FIRST(&stcb->asoc.send_queue);
959 	if (chk == NULL) {
960 		stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq;
961 	} else {
962 		stcb->asoc.nonce_resync_tsn = chk->rec.data.TSN_seq;
963 	}
964 	stcb->asoc.nonce_wait_for_ecne = 0;
965 	stcb->asoc.nonce_sum_check = 0;
966 	/* We return 1 if we only have a window probe outstanding */
967 	return (0);
968 }
969 
970 
971 int
972 sctp_t3rxt_timer(struct sctp_inpcb *inp,
973     struct sctp_tcb *stcb,
974     struct sctp_nets *net)
975 {
976 	struct sctp_nets *alt;
977 	int win_probe, num_mk, num_abandoned;
978 
979 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
980 		sctp_log_fr(0, 0, 0, SCTP_FR_T3_TIMEOUT);
981 	}
982 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
983 		struct sctp_nets *lnet;
984 
985 		TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
986 			if (net == lnet) {
987 				sctp_log_cwnd(stcb, lnet, 1, SCTP_CWND_LOG_FROM_T3);
988 			} else {
989 				sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_LOG_FROM_T3);
990 			}
991 		}
992 	}
993 	/* Find an alternate and mark those for retransmission */
994 	if ((stcb->asoc.peers_rwnd == 0) &&
995 	    (stcb->asoc.total_flight < net->mtu)) {
996 		SCTP_STAT_INCR(sctps_timowindowprobe);
997 		win_probe = 1;
998 	} else {
999 		win_probe = 0;
1000 	}
1001 
1002 	/*
1003 	 * JRS 5/14/07 - If CMT PF is on and the destination if not already
1004 	 * in PF state, set the destination to PF state and store the
1005 	 * current time as the time that the destination was last active. In
1006 	 * addition, find an alternate destination with PF-based
1007 	 * find_alt_net().
1008 	 */
1009 	if ((stcb->asoc.sctp_cmt_on_off == 1) &&
1010 	    (stcb->asoc.sctp_cmt_pf > 0)) {
1011 		if ((net->dest_state & SCTP_ADDR_PF) != SCTP_ADDR_PF) {
1012 			net->dest_state |= SCTP_ADDR_PF;
1013 			net->last_active = sctp_get_tick_count();
1014 			SCTPDBG(SCTP_DEBUG_TIMER4, "Destination %p moved from active to PF.\n",
1015 			    net);
1016 		}
1017 		alt = sctp_find_alternate_net(stcb, net, 2);
1018 	} else if (stcb->asoc.sctp_cmt_on_off == 1) {
1019 		/*
1020 		 * CMT: Using RTX_SSTHRESH policy for CMT. If CMT is being
1021 		 * used, then pick dest with largest ssthresh for any
1022 		 * retransmission.
1023 		 */
1024 		alt = net;
1025 		alt = sctp_find_alternate_net(stcb, alt, 1);
1026 		/*
1027 		 * CUCv2: If a different dest is picked for the
1028 		 * retransmission, then new (rtx-)pseudo_cumack needs to be
1029 		 * tracked for orig dest. Let CUCv2 track new (rtx-)
1030 		 * pseudo-cumack always.
1031 		 */
1032 		net->find_pseudo_cumack = 1;
1033 		net->find_rtx_pseudo_cumack = 1;
1034 	} else {		/* CMT is OFF */
1035 		alt = sctp_find_alternate_net(stcb, net, 0);
1036 	}
1037 	num_mk = 0;
1038 	num_abandoned = 0;
1039 	(void)sctp_mark_all_for_resend(stcb, net, alt, win_probe,
1040 	    &num_mk, &num_abandoned);
1041 	/* FR Loss recovery just ended with the T3. */
1042 	stcb->asoc.fast_retran_loss_recovery = 0;
1043 
1044 	/* CMT FR loss recovery ended with the T3 */
1045 	net->fast_retran_loss_recovery = 0;
1046 
1047 	/*
1048 	 * setup the sat loss recovery that prevents satellite cwnd advance.
1049 	 */
1050 	stcb->asoc.sat_t3_loss_recovery = 1;
1051 	stcb->asoc.sat_t3_recovery_tsn = stcb->asoc.sending_seq;
1052 
1053 	/* Backoff the timer and cwnd */
1054 	sctp_backoff_on_timeout(stcb, net, win_probe, num_mk, num_abandoned);
1055 	if (win_probe == 0) {
1056 		/* We don't do normal threshold management on window probes */
1057 		if (sctp_threshold_management(inp, stcb, net,
1058 		    stcb->asoc.max_send_times)) {
1059 			/* Association was destroyed */
1060 			return (1);
1061 		} else {
1062 			if (net != stcb->asoc.primary_destination) {
1063 				/* send a immediate HB if our RTO is stale */
1064 				struct timeval now;
1065 				unsigned int ms_goneby;
1066 
1067 				(void)SCTP_GETTIME_TIMEVAL(&now);
1068 				if (net->last_sent_time.tv_sec) {
1069 					ms_goneby = (now.tv_sec - net->last_sent_time.tv_sec) * 1000;
1070 				} else {
1071 					ms_goneby = 0;
1072 				}
1073 				if ((ms_goneby > net->RTO) || (net->RTO == 0)) {
1074 					/*
1075 					 * no recent feed back in an RTO or
1076 					 * more, request a RTT update
1077 					 */
1078 					if (sctp_send_hb(stcb, 1, net) < 0)
1079 						/*
1080 						 * Less than 0 means we lost
1081 						 * the assoc
1082 						 */
1083 						return (1);
1084 				}
1085 			}
1086 		}
1087 	} else {
1088 		/*
1089 		 * For a window probe we don't penalize the net's but only
1090 		 * the association. This may fail it if SACKs are not coming
1091 		 * back. If sack's are coming with rwnd locked at 0, we will
1092 		 * continue to hold things waiting for rwnd to raise
1093 		 */
1094 		if (sctp_threshold_management(inp, stcb, NULL,
1095 		    stcb->asoc.max_send_times)) {
1096 			/* Association was destroyed */
1097 			return (1);
1098 		}
1099 	}
1100 	if (net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
1101 		/* Move all pending over too */
1102 		sctp_move_chunks_from_net(stcb, net);
1103 
1104 		/*
1105 		 * Get the address that failed, to force a new src address
1106 		 * selecton and a route allocation.
1107 		 */
1108 		if (net->ro._s_addr) {
1109 			sctp_free_ifa(net->ro._s_addr);
1110 			net->ro._s_addr = NULL;
1111 		}
1112 		net->src_addr_selected = 0;
1113 
1114 		/* Force a route allocation too */
1115 		if (net->ro.ro_rt) {
1116 			RTFREE(net->ro.ro_rt);
1117 			net->ro.ro_rt = NULL;
1118 		}
1119 		/* Was it our primary? */
1120 		if ((stcb->asoc.primary_destination == net) && (alt != net)) {
1121 			/*
1122 			 * Yes, note it as such and find an alternate note:
1123 			 * this means HB code must use this to resent the
1124 			 * primary if it goes active AND if someone does a
1125 			 * change-primary then this flag must be cleared
1126 			 * from any net structures.
1127 			 */
1128 			if (sctp_set_primary_addr(stcb,
1129 			    (struct sockaddr *)NULL,
1130 			    alt) == 0) {
1131 				net->dest_state |= SCTP_ADDR_WAS_PRIMARY;
1132 			}
1133 		}
1134 	} else if ((stcb->asoc.sctp_cmt_on_off == 1) &&
1135 		    (stcb->asoc.sctp_cmt_pf > 0) &&
1136 	    ((net->dest_state & SCTP_ADDR_PF) == SCTP_ADDR_PF)) {
1137 		/*
1138 		 * JRS 5/14/07 - If the destination hasn't failed completely
1139 		 * but is in PF state, a PF-heartbeat needs to be sent
1140 		 * manually.
1141 		 */
1142 		if (sctp_send_hb(stcb, 1, net) < 0)
1143 			/* Return less than 0 means we lost the association */
1144 			return (1);
1145 	}
1146 	/*
1147 	 * Special case for cookie-echo'ed case, we don't do output but must
1148 	 * await the COOKIE-ACK before retransmission
1149 	 */
1150 	if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
1151 		/*
1152 		 * Here we just reset the timer and start again since we
1153 		 * have not established the asoc
1154 		 */
1155 		sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb, net);
1156 		return (0);
1157 	}
1158 	if (stcb->asoc.peer_supports_prsctp) {
1159 		struct sctp_tmit_chunk *lchk;
1160 
1161 		lchk = sctp_try_advance_peer_ack_point(stcb, &stcb->asoc);
1162 		/* C3. See if we need to send a Fwd-TSN */
1163 		if (compare_with_wrap(stcb->asoc.advanced_peer_ack_point,
1164 		    stcb->asoc.last_acked_seq, MAX_TSN)) {
1165 			/*
1166 			 * ISSUE with ECN, see FWD-TSN processing for notes
1167 			 * on issues that will occur when the ECN NONCE
1168 			 * stuff is put into SCTP for cross checking.
1169 			 */
1170 			send_forward_tsn(stcb, &stcb->asoc);
1171 			if (lchk) {
1172 				/* Assure a timer is up */
1173 				sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, lchk->whoTo);
1174 			}
1175 		}
1176 	}
1177 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_MONITOR_ENABLE) {
1178 		sctp_log_cwnd(stcb, net, net->cwnd, SCTP_CWND_LOG_FROM_RTX);
1179 	}
1180 	return (0);
1181 }
1182 
1183 int
1184 sctp_t1init_timer(struct sctp_inpcb *inp,
1185     struct sctp_tcb *stcb,
1186     struct sctp_nets *net)
1187 {
1188 	/* bump the thresholds */
1189 	if (stcb->asoc.delayed_connection) {
1190 		/*
1191 		 * special hook for delayed connection. The library did NOT
1192 		 * complete the rest of its sends.
1193 		 */
1194 		stcb->asoc.delayed_connection = 0;
1195 		sctp_send_initiate(inp, stcb, SCTP_SO_NOT_LOCKED);
1196 		return (0);
1197 	}
1198 	if (SCTP_GET_STATE((&stcb->asoc)) != SCTP_STATE_COOKIE_WAIT) {
1199 		return (0);
1200 	}
1201 	if (sctp_threshold_management(inp, stcb, net,
1202 	    stcb->asoc.max_init_times)) {
1203 		/* Association was destroyed */
1204 		return (1);
1205 	}
1206 	stcb->asoc.dropped_special_cnt = 0;
1207 	sctp_backoff_on_timeout(stcb, stcb->asoc.primary_destination, 1, 0, 0);
1208 	if (stcb->asoc.initial_init_rto_max < net->RTO) {
1209 		net->RTO = stcb->asoc.initial_init_rto_max;
1210 	}
1211 	if (stcb->asoc.numnets > 1) {
1212 		/* If we have more than one addr use it */
1213 		struct sctp_nets *alt;
1214 
1215 		alt = sctp_find_alternate_net(stcb, stcb->asoc.primary_destination, 0);
1216 		if ((alt != NULL) && (alt != stcb->asoc.primary_destination)) {
1217 			sctp_move_chunks_from_net(stcb, stcb->asoc.primary_destination);
1218 			stcb->asoc.primary_destination = alt;
1219 		}
1220 	}
1221 	/* Send out a new init */
1222 	sctp_send_initiate(inp, stcb, SCTP_SO_NOT_LOCKED);
1223 	return (0);
1224 }
1225 
1226 /*
1227  * For cookie and asconf we actually need to find and mark for resend, then
1228  * increment the resend counter (after all the threshold management stuff of
1229  * course).
1230  */
1231 int
1232 sctp_cookie_timer(struct sctp_inpcb *inp,
1233     struct sctp_tcb *stcb,
1234     struct sctp_nets *net)
1235 {
1236 	struct sctp_nets *alt;
1237 	struct sctp_tmit_chunk *cookie;
1238 
1239 	/* first before all else we must find the cookie */
1240 	TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue, sctp_next) {
1241 		if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
1242 			break;
1243 		}
1244 	}
1245 	if (cookie == NULL) {
1246 		if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
1247 			/* FOOBAR! */
1248 			struct mbuf *oper;
1249 
1250 			oper = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
1251 			    0, M_DONTWAIT, 1, MT_DATA);
1252 			if (oper) {
1253 				struct sctp_paramhdr *ph;
1254 				uint32_t *ippp;
1255 
1256 				SCTP_BUF_LEN(oper) = sizeof(struct sctp_paramhdr) +
1257 				    sizeof(uint32_t);
1258 				ph = mtod(oper, struct sctp_paramhdr *);
1259 				ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION);
1260 				ph->param_length = htons(SCTP_BUF_LEN(oper));
1261 				ippp = (uint32_t *) (ph + 1);
1262 				*ippp = htonl(SCTP_FROM_SCTP_TIMER + SCTP_LOC_3);
1263 			}
1264 			inp->last_abort_code = SCTP_FROM_SCTP_TIMER + SCTP_LOC_4;
1265 			sctp_abort_an_association(inp, stcb, SCTP_INTERNAL_ERROR,
1266 			    oper, SCTP_SO_NOT_LOCKED);
1267 		} else {
1268 #ifdef INVARIANTS
1269 			panic("Cookie timer expires in wrong state?");
1270 #else
1271 			SCTP_PRINTF("Strange in state %d not cookie-echoed yet c-e timer expires?\n", SCTP_GET_STATE(&stcb->asoc));
1272 			return (0);
1273 #endif
1274 		}
1275 		return (0);
1276 	}
1277 	/* Ok we found the cookie, threshold management next */
1278 	if (sctp_threshold_management(inp, stcb, cookie->whoTo,
1279 	    stcb->asoc.max_init_times)) {
1280 		/* Assoc is over */
1281 		return (1);
1282 	}
1283 	/*
1284 	 * cleared theshold management now lets backoff the address & select
1285 	 * an alternate
1286 	 */
1287 	stcb->asoc.dropped_special_cnt = 0;
1288 	sctp_backoff_on_timeout(stcb, cookie->whoTo, 1, 0, 0);
1289 	alt = sctp_find_alternate_net(stcb, cookie->whoTo, 0);
1290 	if (alt != cookie->whoTo) {
1291 		sctp_free_remote_addr(cookie->whoTo);
1292 		cookie->whoTo = alt;
1293 		atomic_add_int(&alt->ref_count, 1);
1294 	}
1295 	/* Now mark the retran info */
1296 	if (cookie->sent != SCTP_DATAGRAM_RESEND) {
1297 		sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1298 	}
1299 	cookie->sent = SCTP_DATAGRAM_RESEND;
1300 	/*
1301 	 * Now call the output routine to kick out the cookie again, Note we
1302 	 * don't mark any chunks for retran so that FR will need to kick in
1303 	 * to move these (or a send timer).
1304 	 */
1305 	return (0);
1306 }
1307 
1308 int
1309 sctp_strreset_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1310     struct sctp_nets *net)
1311 {
1312 	struct sctp_nets *alt;
1313 	struct sctp_tmit_chunk *strrst = NULL, *chk = NULL;
1314 
1315 	if (stcb->asoc.stream_reset_outstanding == 0) {
1316 		return (0);
1317 	}
1318 	/* find the existing STRRESET, we use the seq number we sent out on */
1319 	(void)sctp_find_stream_reset(stcb, stcb->asoc.str_reset_seq_out, &strrst);
1320 	if (strrst == NULL) {
1321 		return (0);
1322 	}
1323 	/* do threshold management */
1324 	if (sctp_threshold_management(inp, stcb, strrst->whoTo,
1325 	    stcb->asoc.max_send_times)) {
1326 		/* Assoc is over */
1327 		return (1);
1328 	}
1329 	/*
1330 	 * cleared theshold management now lets backoff the address & select
1331 	 * an alternate
1332 	 */
1333 	sctp_backoff_on_timeout(stcb, strrst->whoTo, 1, 0, 0);
1334 	alt = sctp_find_alternate_net(stcb, strrst->whoTo, 0);
1335 	sctp_free_remote_addr(strrst->whoTo);
1336 	strrst->whoTo = alt;
1337 	atomic_add_int(&alt->ref_count, 1);
1338 
1339 	/* See if a ECN Echo is also stranded */
1340 	TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
1341 		if ((chk->whoTo == net) &&
1342 		    (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
1343 			sctp_free_remote_addr(chk->whoTo);
1344 			if (chk->sent != SCTP_DATAGRAM_RESEND) {
1345 				chk->sent = SCTP_DATAGRAM_RESEND;
1346 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1347 			}
1348 			chk->whoTo = alt;
1349 			atomic_add_int(&alt->ref_count, 1);
1350 		}
1351 	}
1352 	if (net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
1353 		/*
1354 		 * If the address went un-reachable, we need to move to
1355 		 * alternates for ALL chk's in queue
1356 		 */
1357 		sctp_move_chunks_from_net(stcb, net);
1358 	}
1359 	/* mark the retran info */
1360 	if (strrst->sent != SCTP_DATAGRAM_RESEND)
1361 		sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1362 	strrst->sent = SCTP_DATAGRAM_RESEND;
1363 
1364 	/* restart the timer */
1365 	sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, inp, stcb, strrst->whoTo);
1366 	return (0);
1367 }
1368 
1369 int
1370 sctp_asconf_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1371     struct sctp_nets *net)
1372 {
1373 	struct sctp_nets *alt;
1374 	struct sctp_tmit_chunk *asconf, *chk, *nchk;
1375 
1376 	/* is this a first send, or a retransmission? */
1377 	if (TAILQ_EMPTY(&stcb->asoc.asconf_send_queue)) {
1378 		/* compose a new ASCONF chunk and send it */
1379 		sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1380 	} else {
1381 		/*
1382 		 * Retransmission of the existing ASCONF is needed
1383 		 */
1384 
1385 		/* find the existing ASCONF */
1386 		asconf = TAILQ_FIRST(&stcb->asoc.asconf_send_queue);
1387 		if (asconf == NULL) {
1388 			return (0);
1389 		}
1390 		/* do threshold management */
1391 		if (sctp_threshold_management(inp, stcb, asconf->whoTo,
1392 		    stcb->asoc.max_send_times)) {
1393 			/* Assoc is over */
1394 			return (1);
1395 		}
1396 		if (asconf->snd_count > stcb->asoc.max_send_times) {
1397 			/*
1398 			 * Something is rotten: our peer is not responding
1399 			 * to ASCONFs but apparently is to other chunks.
1400 			 * i.e. it is not properly handling the chunk type
1401 			 * upper bits. Mark this peer as ASCONF incapable
1402 			 * and cleanup.
1403 			 */
1404 			SCTPDBG(SCTP_DEBUG_TIMER1, "asconf_timer: Peer has not responded to our repeated ASCONFs\n");
1405 			sctp_asconf_cleanup(stcb, net);
1406 			return (0);
1407 		}
1408 		/*
1409 		 * cleared threshold management, so now backoff the net and
1410 		 * select an alternate
1411 		 */
1412 		sctp_backoff_on_timeout(stcb, asconf->whoTo, 1, 0, 0);
1413 		alt = sctp_find_alternate_net(stcb, asconf->whoTo, 0);
1414 		if (asconf->whoTo != alt) {
1415 			sctp_free_remote_addr(asconf->whoTo);
1416 			asconf->whoTo = alt;
1417 			atomic_add_int(&alt->ref_count, 1);
1418 		}
1419 		/* See if an ECN Echo is also stranded */
1420 		TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
1421 			if ((chk->whoTo == net) &&
1422 			    (chk->rec.chunk_id.id == SCTP_ECN_ECHO)) {
1423 				sctp_free_remote_addr(chk->whoTo);
1424 				chk->whoTo = alt;
1425 				if (chk->sent != SCTP_DATAGRAM_RESEND) {
1426 					chk->sent = SCTP_DATAGRAM_RESEND;
1427 					sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1428 				}
1429 				atomic_add_int(&alt->ref_count, 1);
1430 			}
1431 		}
1432 		for (chk = asconf; chk; chk = nchk) {
1433 			nchk = TAILQ_NEXT(chk, sctp_next);
1434 			if (chk->whoTo != alt) {
1435 				sctp_free_remote_addr(chk->whoTo);
1436 				chk->whoTo = alt;
1437 				atomic_add_int(&alt->ref_count, 1);
1438 			}
1439 			if (asconf->sent != SCTP_DATAGRAM_RESEND && chk->sent != SCTP_DATAGRAM_UNSENT)
1440 				sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1441 			chk->sent = SCTP_DATAGRAM_RESEND;
1442 		}
1443 		if (net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
1444 			/*
1445 			 * If the address went un-reachable, we need to move
1446 			 * to the alternate for ALL chunks in queue
1447 			 */
1448 			sctp_move_chunks_from_net(stcb, net);
1449 		}
1450 		/* mark the retran info */
1451 		if (asconf->sent != SCTP_DATAGRAM_RESEND)
1452 			sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1453 		asconf->sent = SCTP_DATAGRAM_RESEND;
1454 
1455 		/* send another ASCONF if any and we can do */
1456 		sctp_send_asconf(stcb, alt, SCTP_ADDR_NOT_LOCKED);
1457 	}
1458 	return (0);
1459 }
1460 
1461 /* Mobility adaptation */
1462 void
1463 sctp_delete_prim_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1464     struct sctp_nets *net)
1465 {
1466 	if (stcb->asoc.deleted_primary == NULL) {
1467 		SCTPDBG(SCTP_DEBUG_ASCONF1, "delete_prim_timer: deleted_primary is not stored...\n");
1468 		sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
1469 		return;
1470 	}
1471 	SCTPDBG(SCTP_DEBUG_ASCONF1, "delete_prim_timer: finished to keep deleted primary ");
1472 	SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1473 	sctp_free_remote_addr(stcb->asoc.deleted_primary);
1474 	stcb->asoc.deleted_primary = NULL;
1475 	sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
1476 	return;
1477 }
1478 
1479 /*
1480  * For the shutdown and shutdown-ack, we do not keep one around on the
1481  * control queue. This means we must generate a new one and call the general
1482  * chunk output routine, AFTER having done threshold management.
1483  */
1484 int
1485 sctp_shutdown_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1486     struct sctp_nets *net)
1487 {
1488 	struct sctp_nets *alt;
1489 
1490 	/* first threshold managment */
1491 	if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1492 		/* Assoc is over */
1493 		return (1);
1494 	}
1495 	/* second select an alternative */
1496 	alt = sctp_find_alternate_net(stcb, net, 0);
1497 
1498 	/* third generate a shutdown into the queue for out net */
1499 	if (alt) {
1500 		sctp_send_shutdown(stcb, alt);
1501 	} else {
1502 		/*
1503 		 * if alt is NULL, there is no dest to send to??
1504 		 */
1505 		return (0);
1506 	}
1507 	/* fourth restart timer */
1508 	sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, alt);
1509 	return (0);
1510 }
1511 
1512 int
1513 sctp_shutdownack_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1514     struct sctp_nets *net)
1515 {
1516 	struct sctp_nets *alt;
1517 
1518 	/* first threshold managment */
1519 	if (sctp_threshold_management(inp, stcb, net, stcb->asoc.max_send_times)) {
1520 		/* Assoc is over */
1521 		return (1);
1522 	}
1523 	/* second select an alternative */
1524 	alt = sctp_find_alternate_net(stcb, net, 0);
1525 
1526 	/* third generate a shutdown into the queue for out net */
1527 	sctp_send_shutdown_ack(stcb, alt);
1528 
1529 	/* fourth restart timer */
1530 	sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, alt);
1531 	return (0);
1532 }
1533 
1534 static void
1535 sctp_audit_stream_queues_for_size(struct sctp_inpcb *inp,
1536     struct sctp_tcb *stcb)
1537 {
1538 	struct sctp_stream_out *outs;
1539 	struct sctp_stream_queue_pending *sp;
1540 	unsigned int chks_in_queue = 0;
1541 	int being_filled = 0;
1542 
1543 	/*
1544 	 * This function is ONLY called when the send/sent queues are empty.
1545 	 */
1546 	if ((stcb == NULL) || (inp == NULL))
1547 		return;
1548 
1549 	if (stcb->asoc.sent_queue_retran_cnt) {
1550 		SCTP_PRINTF("Hmm, sent_queue_retran_cnt is non-zero %d\n",
1551 		    stcb->asoc.sent_queue_retran_cnt);
1552 		stcb->asoc.sent_queue_retran_cnt = 0;
1553 	}
1554 	SCTP_TCB_SEND_LOCK(stcb);
1555 	if (TAILQ_EMPTY(&stcb->asoc.out_wheel)) {
1556 		int i, cnt = 0;
1557 
1558 		/* Check to see if a spoke fell off the wheel */
1559 		for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1560 			if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
1561 				sctp_insert_on_wheel(stcb, &stcb->asoc, &stcb->asoc.strmout[i], 1);
1562 				cnt++;
1563 			}
1564 		}
1565 		if (cnt) {
1566 			/* yep, we lost a spoke or two */
1567 			SCTP_PRINTF("Found an additional %d streams NOT on outwheel, corrected\n", cnt);
1568 		} else {
1569 			/* no spokes lost, */
1570 			stcb->asoc.total_output_queue_size = 0;
1571 		}
1572 		SCTP_TCB_SEND_UNLOCK(stcb);
1573 		return;
1574 	}
1575 	SCTP_TCB_SEND_UNLOCK(stcb);
1576 	/* Check to see if some data queued, if so report it */
1577 	TAILQ_FOREACH(outs, &stcb->asoc.out_wheel, next_spoke) {
1578 		if (!TAILQ_EMPTY(&outs->outqueue)) {
1579 			TAILQ_FOREACH(sp, &outs->outqueue, next) {
1580 				if (sp->msg_is_complete)
1581 					being_filled++;
1582 				chks_in_queue++;
1583 			}
1584 		}
1585 	}
1586 	if (chks_in_queue != stcb->asoc.stream_queue_cnt) {
1587 		SCTP_PRINTF("Hmm, stream queue cnt at %d I counted %d in stream out wheel\n",
1588 		    stcb->asoc.stream_queue_cnt, chks_in_queue);
1589 	}
1590 	if (chks_in_queue) {
1591 		/* call the output queue function */
1592 		sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1593 		if ((TAILQ_EMPTY(&stcb->asoc.send_queue)) &&
1594 		    (TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
1595 			/*
1596 			 * Probably should go in and make it go back through
1597 			 * and add fragments allowed
1598 			 */
1599 			if (being_filled == 0) {
1600 				SCTP_PRINTF("Still nothing moved %d chunks are stuck\n",
1601 				    chks_in_queue);
1602 			}
1603 		}
1604 	} else {
1605 		SCTP_PRINTF("Found no chunks on any queue tot:%lu\n",
1606 		    (u_long)stcb->asoc.total_output_queue_size);
1607 		stcb->asoc.total_output_queue_size = 0;
1608 	}
1609 }
1610 
1611 int
1612 sctp_heartbeat_timer(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1613     struct sctp_nets *net, int cnt_of_unconf)
1614 {
1615 	int ret;
1616 
1617 	if (net) {
1618 		if (net->hb_responded == 0) {
1619 			if (net->ro._s_addr) {
1620 				/*
1621 				 * Invalidate the src address if we did not
1622 				 * get a response last time.
1623 				 */
1624 				sctp_free_ifa(net->ro._s_addr);
1625 				net->ro._s_addr = NULL;
1626 				net->src_addr_selected = 0;
1627 			}
1628 			sctp_backoff_on_timeout(stcb, net, 1, 0, 0);
1629 		}
1630 		/* Zero PBA, if it needs it */
1631 		if (net->partial_bytes_acked) {
1632 			net->partial_bytes_acked = 0;
1633 		}
1634 	}
1635 	if ((stcb->asoc.total_output_queue_size > 0) &&
1636 	    (TAILQ_EMPTY(&stcb->asoc.send_queue)) &&
1637 	    (TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
1638 		sctp_audit_stream_queues_for_size(inp, stcb);
1639 	}
1640 	/* Send a new HB, this will do threshold managment, pick a new dest */
1641 	if (cnt_of_unconf == 0) {
1642 		if (sctp_send_hb(stcb, 0, NULL) < 0) {
1643 			return (1);
1644 		}
1645 	} else {
1646 		/*
1647 		 * this will send out extra hb's up to maxburst if there are
1648 		 * any unconfirmed addresses.
1649 		 */
1650 		uint32_t cnt_sent = 0;
1651 
1652 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1653 			if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1654 			    (net->dest_state & SCTP_ADDR_REACHABLE)) {
1655 				cnt_sent++;
1656 				if (net->hb_responded == 0) {
1657 					/* Did we respond last time? */
1658 					if (net->ro._s_addr) {
1659 						sctp_free_ifa(net->ro._s_addr);
1660 						net->ro._s_addr = NULL;
1661 						net->src_addr_selected = 0;
1662 					}
1663 				}
1664 				ret = sctp_send_hb(stcb, 1, net);
1665 				if (ret < 0)
1666 					return 1;
1667 				else if (ret == 0) {
1668 					break;
1669 				}
1670 				if (cnt_sent >= SCTP_BASE_SYSCTL(sctp_hb_maxburst))
1671 					break;
1672 			}
1673 		}
1674 	}
1675 	return (0);
1676 }
1677 
1678 int
1679 sctp_is_hb_timer_running(struct sctp_tcb *stcb)
1680 {
1681 	if (SCTP_OS_TIMER_PENDING(&stcb->asoc.hb_timer.timer)) {
1682 		/* its running */
1683 		return (1);
1684 	} else {
1685 		/* nope */
1686 		return (0);
1687 	}
1688 }
1689 
1690 int
1691 sctp_is_sack_timer_running(struct sctp_tcb *stcb)
1692 {
1693 	if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
1694 		/* its running */
1695 		return (1);
1696 	} else {
1697 		/* nope */
1698 		return (0);
1699 	}
1700 }
1701 
1702 #define SCTP_NUMBER_OF_MTU_SIZES 18
1703 static uint32_t mtu_sizes[] = {
1704 	68,
1705 	296,
1706 	508,
1707 	512,
1708 	544,
1709 	576,
1710 	1006,
1711 	1492,
1712 	1500,
1713 	1536,
1714 	2002,
1715 	2048,
1716 	4352,
1717 	4464,
1718 	8166,
1719 	17914,
1720 	32000,
1721 	65535
1722 };
1723 
1724 
1725 static uint32_t
1726 sctp_getnext_mtu(struct sctp_inpcb *inp, uint32_t cur_mtu)
1727 {
1728 	/* select another MTU that is just bigger than this one */
1729 	int i;
1730 
1731 	for (i = 0; i < SCTP_NUMBER_OF_MTU_SIZES; i++) {
1732 		if (cur_mtu < mtu_sizes[i]) {
1733 			/* no max_mtu is bigger than this one */
1734 			return (mtu_sizes[i]);
1735 		}
1736 	}
1737 	/* here return the highest allowable */
1738 	return (cur_mtu);
1739 }
1740 
1741 
1742 void
1743 sctp_pathmtu_timer(struct sctp_inpcb *inp,
1744     struct sctp_tcb *stcb,
1745     struct sctp_nets *net)
1746 {
1747 	uint32_t next_mtu, mtu;
1748 
1749 	next_mtu = sctp_getnext_mtu(inp, net->mtu);
1750 
1751 	if ((next_mtu > net->mtu) && (net->port == 0)) {
1752 		if ((net->src_addr_selected == 0) ||
1753 		    (net->ro._s_addr == NULL) ||
1754 		    (net->ro._s_addr->localifa_flags & SCTP_BEING_DELETED)) {
1755 			if ((net->ro._s_addr != NULL) && (net->ro._s_addr->localifa_flags & SCTP_BEING_DELETED)) {
1756 				sctp_free_ifa(net->ro._s_addr);
1757 				net->ro._s_addr = NULL;
1758 				net->src_addr_selected = 0;
1759 			} else if (net->ro._s_addr == NULL) {
1760 #if defined(INET6) && defined(SCTP_EMBEDDED_V6_SCOPE)
1761 				if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1762 					struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1763 
1764 					/* KAME hack: embed scopeid */
1765 					(void)sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone));
1766 				}
1767 #endif
1768 
1769 				net->ro._s_addr = sctp_source_address_selection(inp,
1770 				    stcb,
1771 				    (sctp_route_t *) & net->ro,
1772 				    net, 0, stcb->asoc.vrf_id);
1773 #if defined(INET6) && defined(SCTP_EMBEDDED_V6_SCOPE)
1774 				if (net->ro._l_addr.sa.sa_family == AF_INET6) {
1775 					struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1776 
1777 					(void)sa6_recoverscope(sin6);
1778 				}
1779 #endif				/* INET6 */
1780 			}
1781 			if (net->ro._s_addr)
1782 				net->src_addr_selected = 1;
1783 		}
1784 		if (net->ro._s_addr) {
1785 			mtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._s_addr.sa, net->ro.ro_rt);
1786 			if (net->port) {
1787 				mtu -= sizeof(struct udphdr);
1788 			}
1789 			if (mtu > next_mtu) {
1790 				net->mtu = next_mtu;
1791 			}
1792 		}
1793 	}
1794 	/* restart the timer */
1795 	sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net);
1796 }
1797 
1798 void
1799 sctp_autoclose_timer(struct sctp_inpcb *inp,
1800     struct sctp_tcb *stcb,
1801     struct sctp_nets *net)
1802 {
1803 	struct timeval tn, *tim_touse;
1804 	struct sctp_association *asoc;
1805 	int ticks_gone_by;
1806 
1807 	(void)SCTP_GETTIME_TIMEVAL(&tn);
1808 	if (stcb->asoc.sctp_autoclose_ticks &&
1809 	    sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1810 		/* Auto close is on */
1811 		asoc = &stcb->asoc;
1812 		/* pick the time to use */
1813 		if (asoc->time_last_rcvd.tv_sec >
1814 		    asoc->time_last_sent.tv_sec) {
1815 			tim_touse = &asoc->time_last_rcvd;
1816 		} else {
1817 			tim_touse = &asoc->time_last_sent;
1818 		}
1819 		/* Now has long enough transpired to autoclose? */
1820 		ticks_gone_by = SEC_TO_TICKS(tn.tv_sec - tim_touse->tv_sec);
1821 		if ((ticks_gone_by > 0) &&
1822 		    (ticks_gone_by >= (int)asoc->sctp_autoclose_ticks)) {
1823 			/*
1824 			 * autoclose time has hit, call the output routine,
1825 			 * which should do nothing just to be SURE we don't
1826 			 * have hanging data. We can then safely check the
1827 			 * queues and know that we are clear to send
1828 			 * shutdown
1829 			 */
1830 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1831 			/* Are we clean? */
1832 			if (TAILQ_EMPTY(&asoc->send_queue) &&
1833 			    TAILQ_EMPTY(&asoc->sent_queue)) {
1834 				/*
1835 				 * there is nothing queued to send, so I'm
1836 				 * done...
1837 				 */
1838 				if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1839 					/* only send SHUTDOWN 1st time thru */
1840 					sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
1841 					if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
1842 					    (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
1843 						SCTP_STAT_DECR_GAUGE32(sctps_currestab);
1844 					}
1845 					SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_SENT);
1846 					SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
1847 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
1848 					    stcb->sctp_ep, stcb,
1849 					    asoc->primary_destination);
1850 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1851 					    stcb->sctp_ep, stcb,
1852 					    asoc->primary_destination);
1853 				}
1854 			}
1855 		} else {
1856 			/*
1857 			 * No auto close at this time, reset t-o to check
1858 			 * later
1859 			 */
1860 			int tmp;
1861 
1862 			/* fool the timer startup to use the time left */
1863 			tmp = asoc->sctp_autoclose_ticks;
1864 			asoc->sctp_autoclose_ticks -= ticks_gone_by;
1865 			sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1866 			    net);
1867 			/* restore the real tick value */
1868 			asoc->sctp_autoclose_ticks = tmp;
1869 		}
1870 	}
1871 }
1872