xref: /titanic_44/usr/src/uts/common/inet/sctp/sctp_input.c (revision 94501b61e12c24a6ea3abf427022ca0d4a302f3b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/systm.h>
31 #include <sys/stream.h>
32 #include <sys/cmn_err.h>
33 #include <sys/kmem.h>
34 #define	_SUN_TPI_VERSION 2
35 #include <sys/tihdr.h>
36 #include <sys/socket.h>
37 #include <sys/strsun.h>
38 #include <sys/strsubr.h>
39 
40 #include <netinet/in.h>
41 #include <netinet/ip6.h>
42 #include <netinet/tcp_seq.h>
43 #include <netinet/sctp.h>
44 
45 #include <inet/common.h>
46 #include <inet/ip.h>
47 #include <inet/ip6.h>
48 #include <inet/mib2.h>
49 #include <inet/ipclassifier.h>
50 #include <inet/ipp_common.h>
51 #include <inet/ipsec_impl.h>
52 #include <inet/sctp_ip.h>
53 
54 #include "sctp_impl.h"
55 #include "sctp_asconf.h"
56 #include "sctp_addr.h"
57 
58 static struct kmem_cache *sctp_kmem_set_cache;
59 
60 /*
61  * PR-SCTP comments.
62  *
63  * When we get a valid Forward TSN chunk, we check the fragment list for this
64  * SSN and preceeding SSNs free all them. Further, if this Forward TSN causes
65  * the next expected SSN to be present in the stream queue, we deliver any
66  * such stranded messages upstream. We also update the SACK info. appropriately.
67  * When checking for advancing the cumulative ack (in sctp_cumack()) we must
68  * check for abandoned chunks and messages. While traversing the tramsmit
69  * list if we come across an abandoned chunk, we can skip the message (i.e.
70  * take it out of the (re)transmit list) since this message, and hence this
71  * chunk, has been marked abandoned by sctp_rexmit(). If we come across an
72  * unsent chunk for a message this now abandoned we need to check if a
73  * Forward TSN needs to be sent, this could be a case where we deferred sending
74  * a Forward TSN in sctp_get_msg_to_send(). Further, after processing a
75  * SACK we check if the Advanced peer ack point can be moved ahead, i.e.
76  * if we can send a Forward TSN via sctp_check_abandoned_data().
77  */
78 void
79 sctp_free_set(sctp_set_t *s)
80 {
81 	sctp_set_t *p;
82 
83 	while (s) {
84 		p = s->next;
85 		kmem_cache_free(sctp_kmem_set_cache, s);
86 		s = p;
87 	}
88 }
89 
90 static void
91 sctp_ack_add(sctp_set_t **head, uint32_t tsn, int *num)
92 {
93 	sctp_set_t *p, *t;
94 
95 	if (head == NULL || num == NULL)
96 		return;
97 
98 	ASSERT(*num >= 0);
99 	ASSERT((*num == 0 && *head == NULL) || (*num > 0 && *head != NULL));
100 
101 	if (*head == NULL) {
102 		*head = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
103 		if (*head == NULL)
104 			return;
105 		(*head)->prev = (*head)->next = NULL;
106 		(*head)->begin = tsn;
107 		(*head)->end = tsn;
108 		*num = 1;
109 		return;
110 	}
111 
112 	ASSERT((*head)->prev == NULL);
113 
114 	/*
115 	 * Handle this special case here so we don't have to check
116 	 * for it each time in the loop.
117 	 */
118 	if (SEQ_LT(tsn + 1, (*head)->begin)) {
119 		/* add a new set, and move the head pointer */
120 		t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
121 		if (t == NULL)
122 			return;
123 		t->next = *head;
124 		t->prev = NULL;
125 		(*head)->prev = t;
126 		t->begin = tsn;
127 		t->end = tsn;
128 		(*num)++;
129 		*head = t;
130 		return;
131 	}
132 
133 	/*
134 	 * We need to handle the following cases, where p points to
135 	 * the current set (as we walk through the loop):
136 	 *
137 	 * 1. tsn is entirely less than p; create a new set before p.
138 	 * 2. tsn borders p from less; coalesce p with tsn.
139 	 * 3. tsn is withing p; do nothing.
140 	 * 4. tsn borders p from greater; coalesce p with tsn.
141 	 * 4a. p may now border p->next from less; if so, coalesce those
142 	 *    two sets.
143 	 * 5. tsn is entirely greater then all sets; add a new set at
144 	 *    the end.
145 	 */
146 	for (p = *head; ; p = p->next) {
147 		if (SEQ_LT(tsn + 1, p->begin)) {
148 			/* 1: add a new set before p. */
149 			t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
150 			if (t == NULL)
151 				return;
152 			t->next = p;
153 			t->prev = NULL;
154 			t->begin = tsn;
155 			t->end = tsn;
156 			if (p->prev) {
157 				t->prev = p->prev;
158 				p->prev->next = t;
159 			}
160 			p->prev = t;
161 			(*num)++;
162 			return;
163 		}
164 
165 		if ((tsn + 1) == p->begin) {
166 			/* 2: adjust p->begin */
167 			p->begin = tsn;
168 			return;
169 		}
170 
171 		if (SEQ_GEQ(tsn, p->begin) && SEQ_LEQ(tsn, p->end)) {
172 			/* 3; do nothing */
173 			return;
174 		}
175 
176 		if ((p->end + 1) == tsn) {
177 			/* 4; adjust p->end */
178 			p->end = tsn;
179 
180 			if (p->next != NULL && (tsn + 1) == p->next->begin) {
181 				/* 4a: coalesce p and p->next */
182 				t = p->next;
183 				p->end = t->end;
184 				p->next = t->next;
185 				if (t->next != NULL)
186 					t->next->prev = p;
187 				kmem_cache_free(sctp_kmem_set_cache, t);
188 				(*num)--;
189 			}
190 			return;
191 		}
192 
193 		if (p->next == NULL) {
194 			/* 5: add new set at the end */
195 			t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
196 			if (t == NULL)
197 				return;
198 			t->next = NULL;
199 			t->prev = p;
200 			t->begin = tsn;
201 			t->end = tsn;
202 			p->next = t;
203 			(*num)++;
204 			return;
205 		}
206 
207 		if (SEQ_GT(tsn, p->end + 1))
208 			continue;
209 	}
210 }
211 
212 static void
213 sctp_ack_rem(sctp_set_t **head, uint32_t end, int *num)
214 {
215 	sctp_set_t *p, *t;
216 
217 	if (head == NULL || *head == NULL || num == NULL)
218 		return;
219 
220 	/* Nothing to remove */
221 	if (SEQ_LT(end, (*head)->begin))
222 		return;
223 
224 	/* Find out where to start removing sets */
225 	for (p = *head; p->next; p = p->next) {
226 		if (SEQ_LEQ(end, p->end))
227 			break;
228 	}
229 
230 	if (SEQ_LT(end, p->end) && SEQ_GEQ(end, p->begin)) {
231 		/* adjust p */
232 		p->begin = end + 1;
233 		/* all done */
234 		if (p == *head)
235 			return;
236 	} else if (SEQ_GEQ(end, p->end)) {
237 		/* remove this set too */
238 		p = p->next;
239 	}
240 
241 	/* unlink everything before this set */
242 	t = *head;
243 	*head = p;
244 	if (p != NULL && p->prev != NULL) {
245 		p->prev->next = NULL;
246 		p->prev = NULL;
247 	}
248 
249 	sctp_free_set(t);
250 
251 	/* recount the number of sets */
252 	*num = 0;
253 
254 	for (p = *head; p != NULL; p = p->next)
255 		(*num)++;
256 }
257 
258 void
259 sctp_sets_init()
260 {
261 	sctp_kmem_set_cache = kmem_cache_create("sctp_set_cache",
262 	    sizeof (sctp_set_t), 0, NULL, NULL, NULL, NULL,
263 	    NULL, 0);
264 }
265 
266 void
267 sctp_sets_fini()
268 {
269 	kmem_cache_destroy(sctp_kmem_set_cache);
270 }
271 
272 sctp_chunk_hdr_t *
273 sctp_first_chunk(uchar_t *rptr, ssize_t remaining)
274 {
275 	sctp_chunk_hdr_t *ch;
276 	uint16_t ch_len;
277 
278 	if (remaining < sizeof (*ch)) {
279 		return (NULL);
280 	}
281 
282 	ch = (sctp_chunk_hdr_t *)rptr;
283 	ch_len = ntohs(ch->sch_len);
284 
285 	if (ch_len < sizeof (*ch) || remaining < ch_len) {
286 		return (NULL);
287 	}
288 
289 	return (ch);
290 }
291 
292 sctp_chunk_hdr_t *
293 sctp_next_chunk(sctp_chunk_hdr_t *ch, ssize_t *remaining)
294 {
295 	int pad;
296 	uint16_t ch_len;
297 
298 	if (!ch) {
299 		return (NULL);
300 	}
301 
302 	ch_len = ntohs(ch->sch_len);
303 
304 	if ((pad = ch_len & (SCTP_ALIGN - 1)) != 0) {
305 		pad = SCTP_ALIGN - pad;
306 	}
307 
308 	*remaining -= (ch_len + pad);
309 	ch = (sctp_chunk_hdr_t *)((char *)ch + ch_len + pad);
310 
311 	return (sctp_first_chunk((uchar_t *)ch, *remaining));
312 }
313 
314 /*
315  * Attach ancillary data to a received SCTP segments.
316  * If the source address (fp) is not the primary, send up a
317  * unitdata_ind so recvfrom() can populate the msg_name field.
318  * If ancillary data is also requested, we append it to the
319  * unitdata_req. Otherwise, we just send up an optdata_ind.
320  */
321 static int
322 sctp_input_add_ancillary(sctp_t *sctp, mblk_t **mp, sctp_data_hdr_t *dcp,
323     sctp_faddr_t *fp, ip6_pkt_t *ipp)
324 {
325 	struct T_unitdata_ind	*tudi;
326 	int			optlen;
327 	int			hdrlen;
328 	uchar_t			*optptr;
329 	struct cmsghdr		*cmsg;
330 	mblk_t			*mp1;
331 	struct sockaddr_in6	sin_buf[1];
332 	struct sockaddr_in6	*sin6;
333 	struct sockaddr_in	*sin4;
334 	uint_t			addflag = 0;
335 
336 	sin4 = NULL;
337 	sin6 = NULL;
338 
339 	optlen = hdrlen = 0;
340 
341 	/* Figure out address size */
342 	if (sctp->sctp_ipversion == IPV4_VERSION) {
343 		sin4 = (struct sockaddr_in *)sin_buf;
344 		sin4->sin_family = AF_INET;
345 		sin4->sin_port = sctp->sctp_fport;
346 		IN6_V4MAPPED_TO_IPADDR(&fp->faddr, sin4->sin_addr.s_addr);
347 		hdrlen = sizeof (*tudi) + sizeof (*sin4);
348 	} else {
349 		sin6 = sin_buf;
350 		sin6->sin6_family = AF_INET6;
351 		sin6->sin6_port = sctp->sctp_fport;
352 		sin6->sin6_addr = fp->faddr;
353 		hdrlen = sizeof (*tudi) + sizeof (*sin6);
354 	}
355 
356 	/* If app asked to receive send / recv info */
357 	if (sctp->sctp_recvsndrcvinfo) {
358 		optlen += sizeof (*cmsg) + sizeof (struct sctp_sndrcvinfo);
359 		if (hdrlen == 0)
360 			hdrlen = sizeof (struct T_optdata_ind);
361 	}
362 
363 	if (sctp->sctp_ipv6_recvancillary == 0)
364 		goto noancillary;
365 
366 	if ((ipp->ipp_fields & IPPF_IFINDEX) &&
367 	    ipp->ipp_ifindex != sctp->sctp_recvifindex &&
368 	    (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVPKTINFO)) {
369 		optlen += sizeof (*cmsg) + sizeof (struct in6_pktinfo);
370 		if (hdrlen == 0)
371 			hdrlen = sizeof (struct T_unitdata_ind);
372 		addflag |= SCTP_IPV6_RECVPKTINFO;
373 	}
374 	/* If app asked for hoplimit and it has changed ... */
375 	if ((ipp->ipp_fields & IPPF_HOPLIMIT) &&
376 	    ipp->ipp_hoplimit != sctp->sctp_recvhops &&
377 	    (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVHOPLIMIT)) {
378 		optlen += sizeof (*cmsg) + sizeof (uint_t);
379 		if (hdrlen == 0)
380 			hdrlen = sizeof (struct T_unitdata_ind);
381 		addflag |= SCTP_IPV6_RECVHOPLIMIT;
382 	}
383 	/* If app asked for hopbyhop headers and it has changed ... */
384 	if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVHOPOPTS) &&
385 	    ip_cmpbuf(sctp->sctp_hopopts, sctp->sctp_hopoptslen,
386 		(ipp->ipp_fields & IPPF_HOPOPTS),
387 		ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
388 		optlen += sizeof (*cmsg) + ipp->ipp_hopoptslen -
389 		    sctp->sctp_v6label_len;
390 		if (hdrlen == 0)
391 			hdrlen = sizeof (struct T_unitdata_ind);
392 		addflag |= SCTP_IPV6_RECVHOPOPTS;
393 		if (!ip_allocbuf((void **)&sctp->sctp_hopopts,
394 		    &sctp->sctp_hopoptslen,
395 		    (ipp->ipp_fields & IPPF_HOPOPTS),
396 		    ipp->ipp_hopopts, ipp->ipp_hopoptslen))
397 			return (-1);
398 	}
399 	/* If app asked for dst headers before routing headers ... */
400 	if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVRTDSTOPTS) &&
401 	    ip_cmpbuf(sctp->sctp_rtdstopts, sctp->sctp_rtdstoptslen,
402 		(ipp->ipp_fields & IPPF_RTDSTOPTS),
403 		ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) {
404 		optlen += sizeof (*cmsg) + ipp->ipp_rtdstoptslen;
405 		if (hdrlen == 0)
406 			hdrlen = sizeof (struct T_unitdata_ind);
407 		addflag |= SCTP_IPV6_RECVRTDSTOPTS;
408 		if (!ip_allocbuf((void **)&sctp->sctp_rtdstopts,
409 		    &sctp->sctp_rtdstoptslen,
410 		    (ipp->ipp_fields & IPPF_RTDSTOPTS),
411 		    ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen))
412 			return (-1);
413 	}
414 	/* If app asked for routing headers and it has changed ... */
415 	if (sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVRTHDR) {
416 		if (ip_cmpbuf(sctp->sctp_rthdr, sctp->sctp_rthdrlen,
417 		    (ipp->ipp_fields & IPPF_RTHDR),
418 		    ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
419 			optlen += sizeof (*cmsg) + ipp->ipp_rthdrlen;
420 			if (hdrlen == 0)
421 				hdrlen = sizeof (struct T_unitdata_ind);
422 			addflag |= SCTP_IPV6_RECVRTHDR;
423 			if (!ip_allocbuf((void **)&sctp->sctp_rthdr,
424 			    &sctp->sctp_rthdrlen,
425 			    (ipp->ipp_fields & IPPF_RTHDR),
426 			    ipp->ipp_rthdr, ipp->ipp_rthdrlen))
427 				return (-1);
428 		}
429 	}
430 	/* If app asked for dest headers and it has changed ... */
431 	if ((sctp->sctp_ipv6_recvancillary & SCTP_IPV6_RECVDSTOPTS) &&
432 	    ip_cmpbuf(sctp->sctp_dstopts, sctp->sctp_dstoptslen,
433 		(ipp->ipp_fields & IPPF_DSTOPTS),
434 		ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
435 		optlen += sizeof (*cmsg) + ipp->ipp_dstoptslen;
436 		if (hdrlen == 0)
437 			hdrlen = sizeof (struct T_unitdata_ind);
438 		addflag |= SCTP_IPV6_RECVDSTOPTS;
439 		if (!ip_allocbuf((void **)&sctp->sctp_dstopts,
440 		    &sctp->sctp_dstoptslen,
441 		    (ipp->ipp_fields & IPPF_DSTOPTS),
442 		    ipp->ipp_dstopts, ipp->ipp_dstoptslen))
443 			return (-1);
444 	}
445 noancillary:
446 	/* Nothing to add */
447 	if (hdrlen == 0)
448 		return (-1);
449 
450 	mp1 = allocb(hdrlen + optlen + sizeof (void *), BPRI_MED);
451 	if (mp1 == NULL)
452 		return (-1);
453 	mp1->b_cont = *mp;
454 	*mp = mp1;
455 	mp1->b_rptr += sizeof (void *);  /* pointer worth of padding */
456 	mp1->b_wptr = mp1->b_rptr + hdrlen + optlen;
457 	DB_TYPE(mp1) = M_PROTO;
458 	tudi = (struct T_unitdata_ind *)mp1->b_rptr;
459 	tudi->PRIM_type = T_UNITDATA_IND;
460 	tudi->SRC_length = sin4 ? sizeof (*sin4) : sizeof (*sin6);
461 	tudi->SRC_offset = sizeof (*tudi);
462 	tudi->OPT_offset = sizeof (*tudi) + tudi->SRC_length;
463 	tudi->OPT_length = optlen;
464 	if (sin4) {
465 		bcopy(sin4, tudi + 1, sizeof (*sin4));
466 	} else {
467 		bcopy(sin6, tudi + 1, sizeof (*sin6));
468 	}
469 	optptr = (uchar_t *)tudi + tudi->OPT_offset;
470 
471 	if (sctp->sctp_recvsndrcvinfo) {
472 		/* XXX need backout method if memory allocation fails. */
473 		struct sctp_sndrcvinfo *sri;
474 
475 		cmsg = (struct cmsghdr *)optptr;
476 		cmsg->cmsg_level = IPPROTO_SCTP;
477 		cmsg->cmsg_type = SCTP_SNDRCV;
478 		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*sri);
479 		optptr += sizeof (*cmsg);
480 
481 		sri = (struct sctp_sndrcvinfo *)(cmsg + 1);
482 		ASSERT(OK_32PTR(sri));
483 		sri->sinfo_stream = ntohs(dcp->sdh_sid);
484 		sri->sinfo_ssn = ntohs(dcp->sdh_ssn);
485 		if (SCTP_DATA_GET_UBIT(dcp)) {
486 			sri->sinfo_flags = MSG_UNORDERED;
487 		} else {
488 			sri->sinfo_flags = 0;
489 		}
490 		sri->sinfo_ppid = dcp->sdh_payload_id;
491 		sri->sinfo_context = 0;
492 		sri->sinfo_timetolive = 0;
493 		sri->sinfo_tsn = ntohl(dcp->sdh_tsn);
494 		sri->sinfo_cumtsn = sctp->sctp_ftsn;
495 		sri->sinfo_assoc_id = 0;
496 
497 		optptr += sizeof (*sri);
498 	}
499 
500 	/*
501 	 * If app asked for pktinfo and the index has changed ...
502 	 * Note that the local address never changes for the connection.
503 	 */
504 	if (addflag & SCTP_IPV6_RECVPKTINFO) {
505 		struct in6_pktinfo *pkti;
506 
507 		cmsg = (struct cmsghdr *)optptr;
508 		cmsg->cmsg_level = IPPROTO_IPV6;
509 		cmsg->cmsg_type = IPV6_PKTINFO;
510 		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*pkti);
511 		optptr += sizeof (*cmsg);
512 
513 		pkti = (struct in6_pktinfo *)optptr;
514 		if (sctp->sctp_ipversion == IPV6_VERSION)
515 			pkti->ipi6_addr = sctp->sctp_ip6h->ip6_src;
516 		else
517 			IN6_IPADDR_TO_V4MAPPED(sctp->sctp_ipha->ipha_src,
518 			    &pkti->ipi6_addr);
519 		pkti->ipi6_ifindex = ipp->ipp_ifindex;
520 		optptr += sizeof (*pkti);
521 		ASSERT(OK_32PTR(optptr));
522 		/* Save as "last" value */
523 		sctp->sctp_recvifindex = ipp->ipp_ifindex;
524 	}
525 	/* If app asked for hoplimit and it has changed ... */
526 	if (addflag & SCTP_IPV6_RECVHOPLIMIT) {
527 		cmsg = (struct cmsghdr *)optptr;
528 		cmsg->cmsg_level = IPPROTO_IPV6;
529 		cmsg->cmsg_type = IPV6_HOPLIMIT;
530 		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (uint_t);
531 		optptr += sizeof (*cmsg);
532 
533 		*(uint_t *)optptr = ipp->ipp_hoplimit;
534 		optptr += sizeof (uint_t);
535 		ASSERT(OK_32PTR(optptr));
536 		/* Save as "last" value */
537 		sctp->sctp_recvhops = ipp->ipp_hoplimit;
538 	}
539 	if (addflag & SCTP_IPV6_RECVHOPOPTS) {
540 		cmsg = (struct cmsghdr *)optptr;
541 		cmsg->cmsg_level = IPPROTO_IPV6;
542 		cmsg->cmsg_type = IPV6_HOPOPTS;
543 		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_hopoptslen;
544 		optptr += sizeof (*cmsg);
545 
546 		bcopy(ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
547 		optptr += ipp->ipp_hopoptslen;
548 		ASSERT(OK_32PTR(optptr));
549 		/* Save as last value */
550 		ip_savebuf((void **)&sctp->sctp_hopopts,
551 		    &sctp->sctp_hopoptslen,
552 		    (ipp->ipp_fields & IPPF_HOPOPTS),
553 		    ipp->ipp_hopopts, ipp->ipp_hopoptslen);
554 	}
555 	if (addflag & SCTP_IPV6_RECVRTDSTOPTS) {
556 		cmsg = (struct cmsghdr *)optptr;
557 		cmsg->cmsg_level = IPPROTO_IPV6;
558 		cmsg->cmsg_type = IPV6_RTHDRDSTOPTS;
559 		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rtdstoptslen;
560 		optptr += sizeof (*cmsg);
561 
562 		bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen);
563 		optptr += ipp->ipp_rtdstoptslen;
564 		ASSERT(OK_32PTR(optptr));
565 		/* Save as last value */
566 		ip_savebuf((void **)&sctp->sctp_rtdstopts,
567 		    &sctp->sctp_rtdstoptslen,
568 		    (ipp->ipp_fields & IPPF_RTDSTOPTS),
569 		    ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen);
570 	}
571 	if (addflag & SCTP_IPV6_RECVRTHDR) {
572 		cmsg = (struct cmsghdr *)optptr;
573 		cmsg->cmsg_level = IPPROTO_IPV6;
574 		cmsg->cmsg_type = IPV6_RTHDR;
575 		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rthdrlen;
576 		optptr += sizeof (*cmsg);
577 
578 		bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
579 		optptr += ipp->ipp_rthdrlen;
580 		ASSERT(OK_32PTR(optptr));
581 		/* Save as last value */
582 		ip_savebuf((void **)&sctp->sctp_rthdr,
583 		    &sctp->sctp_rthdrlen,
584 		    (ipp->ipp_fields & IPPF_RTHDR),
585 		    ipp->ipp_rthdr, ipp->ipp_rthdrlen);
586 	}
587 	if (addflag & SCTP_IPV6_RECVDSTOPTS) {
588 		cmsg = (struct cmsghdr *)optptr;
589 		cmsg->cmsg_level = IPPROTO_IPV6;
590 		cmsg->cmsg_type = IPV6_DSTOPTS;
591 		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_dstoptslen;
592 		optptr += sizeof (*cmsg);
593 
594 		bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
595 		optptr += ipp->ipp_dstoptslen;
596 		ASSERT(OK_32PTR(optptr));
597 		/* Save as last value */
598 		ip_savebuf((void **)&sctp->sctp_dstopts,
599 		    &sctp->sctp_dstoptslen,
600 		    (ipp->ipp_fields & IPPF_DSTOPTS),
601 		    ipp->ipp_dstopts, ipp->ipp_dstoptslen);
602 	}
603 
604 	ASSERT(optptr == mp1->b_wptr);
605 
606 	return (0);
607 }
608 
609 void
610 sctp_free_reass(sctp_instr_t *sip)
611 {
612 	mblk_t *mp, *mpnext, *mctl;
613 
614 	for (mp = sip->istr_reass; mp != NULL; mp = mpnext) {
615 		mpnext = mp->b_next;
616 		mp->b_next = NULL;
617 		mp->b_prev = NULL;
618 		if (DB_TYPE(mp) == M_CTL) {
619 			mctl = mp;
620 			ASSERT(mp->b_cont != NULL);
621 			mp = mp->b_cont;
622 			mctl->b_cont = NULL;
623 			freeb(mctl);
624 		}
625 		freemsg(mp);
626 	}
627 }
628 
629 /*
630  * If the series of data fragments of which dmp is a part is successfully
631  * reassembled, the first mblk in the series is returned. dc is adjusted
632  * to point at the data chunk in the lead mblk, and b_rptr also points to
633  * the data chunk; the following mblk's b_rptr's point at the actual payload.
634  *
635  * If the series is not yet reassembled, NULL is returned. dc is not changed.
636  * XXX should probably move this up into the state machine.
637  */
638 
639 /* Fragment list for un-ordered messages. Partial delivery is not supported */
640 static mblk_t *
641 sctp_uodata_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc)
642 {
643 	mblk_t		*hmp;
644 	mblk_t		*begin = NULL;
645 	mblk_t		*end = NULL;
646 	sctp_data_hdr_t	*qdc;
647 	uint32_t	ntsn;
648 	uint32_t	tsn = ntohl((*dc)->sdh_tsn);
649 #ifdef	DEBUG
650 	mblk_t		*mp1;
651 #endif
652 
653 	/* First frag. */
654 	if (sctp->sctp_uo_frags == NULL) {
655 		sctp->sctp_uo_frags = dmp;
656 		return (NULL);
657 	}
658 	hmp = sctp->sctp_uo_frags;
659 	/*
660 	 * Insert the segment according to the TSN, fragmented unordered
661 	 * chunks are sequenced by TSN.
662 	 */
663 	while (hmp != NULL) {
664 		qdc = (sctp_data_hdr_t *)hmp->b_rptr;
665 		ntsn = ntohl(qdc->sdh_tsn);
666 		if (SEQ_GT(ntsn, tsn)) {
667 			if (hmp->b_prev == NULL) {
668 				dmp->b_next = hmp;
669 				hmp->b_prev = dmp;
670 				sctp->sctp_uo_frags = dmp;
671 			} else {
672 				dmp->b_next = hmp;
673 				dmp->b_prev = hmp->b_prev;
674 				hmp->b_prev->b_next = dmp;
675 				hmp->b_prev = dmp;
676 			}
677 			break;
678 		}
679 		if (hmp->b_next == NULL) {
680 			hmp->b_next = dmp;
681 			dmp->b_prev = hmp;
682 			break;
683 		}
684 		hmp = hmp->b_next;
685 	}
686 	/* check if we completed a msg */
687 	if (SCTP_DATA_GET_BBIT(*dc)) {
688 		begin = dmp;
689 	} else if (SCTP_DATA_GET_EBIT(*dc)) {
690 		end = dmp;
691 	}
692 	/*
693 	 * We walk consecutive TSNs backwards till we get a seg. with
694 	 * the B bit
695 	 */
696 	if (begin == NULL) {
697 		for (hmp = dmp->b_prev; hmp != NULL; hmp = hmp->b_prev) {
698 			qdc = (sctp_data_hdr_t *)hmp->b_rptr;
699 			ntsn = ntohl(qdc->sdh_tsn);
700 			if ((int32_t)(tsn - ntsn) > 1) {
701 				return (NULL);
702 			}
703 			if (SCTP_DATA_GET_BBIT(qdc)) {
704 				begin = hmp;
705 				break;
706 			}
707 			tsn = ntsn;
708 		}
709 	}
710 	tsn = ntohl((*dc)->sdh_tsn);
711 	/*
712 	 * We walk consecutive TSNs till we get a seg. with the E bit
713 	 */
714 	if (end == NULL) {
715 		for (hmp = dmp->b_next; hmp != NULL; hmp = hmp->b_next) {
716 			qdc = (sctp_data_hdr_t *)hmp->b_rptr;
717 			ntsn = ntohl(qdc->sdh_tsn);
718 			if ((int32_t)(ntsn - tsn) > 1) {
719 				return (NULL);
720 			}
721 			if (SCTP_DATA_GET_EBIT(qdc)) {
722 				end = hmp;
723 				break;
724 			}
725 			tsn = ntsn;
726 		}
727 	}
728 	if (begin == NULL || end == NULL) {
729 		return (NULL);
730 	}
731 	/* Got one!, Remove the msg from the list */
732 	if (sctp->sctp_uo_frags == begin) {
733 		ASSERT(begin->b_prev == NULL);
734 		sctp->sctp_uo_frags = end->b_next;
735 		if (end->b_next != NULL)
736 			end->b_next->b_prev = NULL;
737 	} else {
738 		begin->b_prev->b_next = end->b_next;
739 		if (end->b_next != NULL)
740 			end->b_next->b_prev = begin->b_prev;
741 	}
742 	begin->b_prev = NULL;
743 	end->b_next = NULL;
744 
745 	/*
746 	 * Null out b_next and b_prev and chain using b_cont.
747 	 */
748 	dmp = end = begin;
749 	hmp = begin->b_next;
750 	*dc = (sctp_data_hdr_t *)begin->b_rptr;
751 	begin->b_next = NULL;
752 	while (hmp != NULL) {
753 		qdc = (sctp_data_hdr_t *)hmp->b_rptr;
754 		hmp->b_rptr = (uchar_t *)(qdc + 1);
755 		end = hmp->b_next;
756 		dmp->b_cont = hmp;
757 		dmp = hmp;
758 
759 		if (end != NULL)
760 			hmp->b_next = NULL;
761 		hmp->b_prev = NULL;
762 		hmp = end;
763 	}
764 	BUMP_LOCAL(sctp->sctp_reassmsgs);
765 #ifdef	DEBUG
766 	mp1 = begin;
767 	while (mp1 != NULL) {
768 		ASSERT(mp1->b_next == NULL);
769 		ASSERT(mp1->b_prev == NULL);
770 		mp1 = mp1->b_cont;
771 	}
772 #endif
773 	return (begin);
774 }
775 /*
776  * Fragment list for ordered messages.
777  * If no error occures, error is set to 0. If we run out of memory, error
778  * is set to 1. If the peer commits a fatal error (like using different
779  * sequence numbers for the same data fragment series), the association is
780  * aborted and error is set to 2.
781  */
782 static mblk_t *
783 sctp_data_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc, int *error,
784     sctp_instr_t *sip, int trypartial, int *tpfinished)
785 {
786 	mblk_t		*hmp;
787 	mblk_t		*pmp;
788 	mblk_t		*qmp;
789 	mblk_t		*mp;
790 	mblk_t		*prev;
791 	mblk_t		*prevprev;
792 	mblk_t		*first_mp;
793 	sctp_reass_t	*srp;
794 	sctp_data_hdr_t	*qdc;
795 	sctp_data_hdr_t	*bdc;
796 	sctp_data_hdr_t	*edc;
797 	uint32_t	tsn;
798 
799 	/*
800 	 * We can overwrite the Link Layer + IP header here, I suppose.
801 	 * The M_CTL does not leave this function. We need to check
802 	 * DB_REF(dmp) before using DB_BASE(dmp), since there could be
803 	 * two fragments for different ssns in the same mblk.
804 	 */
805 #define	SCTP_NEW_REASS(nmp, dmp, srp, seterror)				\
806 	if ((DB_REF(dmp) == 2) && (MBLKHEAD(dmp) >= 			\
807 	    (sizeof (*(srp)) + sizeof (sctp_hdr_t))) &&			\
808 	    (IS_P2ALIGNED(DB_BASE(dmp), sizeof (uintptr_t)))) {		\
809 		(nmp) = (dmp);						\
810 	} else {							\
811 		(nmp) = allocb(sizeof (*(srp)), BPRI_MED); 		\
812 		if ((nmp) == NULL) {					\
813 			switch (seterror) {				\
814 			case B_TRUE:					\
815 				*error = 1;				\
816 				break;					\
817 			}						\
818 			return (NULL);					\
819 		}							\
820 		DB_TYPE(nmp) = M_CTL;					\
821 		(nmp)->b_cont = dmp;					\
822 	}								\
823 	(srp) = (sctp_reass_t *)DB_BASE(nmp);
824 
825 	*error = 0;
826 
827 	/* find the reassembly queue for this data chunk */
828 	hmp = qmp = sip->istr_reass;
829 	for (; hmp != NULL; hmp = hmp->b_next) {
830 		srp = (sctp_reass_t *)DB_BASE(hmp);
831 		if (ntohs((*dc)->sdh_ssn) == srp->ssn)
832 			goto foundit;
833 		else if (SSN_GT(srp->ssn, ntohs((*dc)->sdh_ssn)))
834 			break;
835 		qmp = hmp;
836 	}
837 
838 	SCTP_NEW_REASS(pmp, dmp, srp, B_TRUE);
839 	srp->ssn = ntohs((*dc)->sdh_ssn);
840 	srp->needed = 0;
841 	srp->got = 1;
842 	srp->tail = dmp;
843 	srp->partial_delivered = B_FALSE;
844 
845 	if (hmp != NULL) {
846 		if (sip->istr_reass == hmp) {
847 			sip->istr_reass = pmp;
848 			pmp->b_next = hmp;
849 			pmp->b_prev = NULL;
850 			hmp->b_prev = pmp;
851 		} else {
852 			qmp->b_next = pmp;
853 			pmp->b_prev = qmp;
854 			pmp->b_next = hmp;
855 			hmp->b_prev = pmp;
856 		}
857 	} else {
858 		/* make a new reass head and stick it on the end */
859 		if (sip->istr_reass == NULL) {
860 			sip->istr_reass = pmp;
861 			pmp->b_prev = NULL;
862 		} else {
863 			qmp->b_next = pmp;
864 			pmp->b_prev = qmp;
865 		}
866 		pmp->b_next = NULL;
867 	}
868 	return (NULL);
869 foundit:
870 	/*
871 	 * else already have a reassembly queue. Insert the new data chunk
872 	 * in the reassemble queue. Try the tail first, on the assumption
873 	 * that the fragments are coming in in order.
874 	 */
875 
876 	qmp = srp->tail;
877 	qdc = (sctp_data_hdr_t *)qmp->b_rptr;
878 	ASSERT(qmp->b_cont == NULL);
879 
880 	/* XXXIs it fine to do this just here? */
881 	if ((*dc)->sdh_sid != qdc->sdh_sid) {
882 		/* our peer is fatally confused; XXX abort the assc */
883 		*error = 2;
884 		return (NULL);
885 	}
886 	if (SEQ_GT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
887 		qmp->b_cont = dmp;
888 		srp->tail = dmp;
889 		dmp->b_cont = NULL;
890 		goto inserted;
891 	}
892 
893 	/* Next check for insertion at the beginning */
894 	qmp = (DB_TYPE(hmp) == M_DATA) ? hmp : hmp->b_cont;
895 	qdc = (sctp_data_hdr_t *)qmp->b_rptr;
896 	if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
897 		if (DB_TYPE(hmp) == M_DATA) {
898 			sctp_reass_t	*srp1 = srp;
899 
900 			SCTP_NEW_REASS(pmp, dmp, srp, B_TRUE);
901 			ASSERT(pmp->b_prev == NULL && pmp->b_next == NULL);
902 			if (sip->istr_reass == hmp) {
903 				sip->istr_reass = pmp;
904 				if (hmp->b_next != NULL) {
905 					hmp->b_next->b_prev = pmp;
906 					pmp->b_next = hmp->b_next;
907 				}
908 			} else {
909 				hmp->b_prev->b_next = pmp;
910 				pmp->b_prev = hmp->b_prev;
911 				if (hmp->b_next != NULL) {
912 					hmp->b_next->b_prev = pmp;
913 					pmp->b_next = hmp->b_next;
914 				}
915 			}
916 			srp->ssn = srp1->ssn;
917 			srp->needed = srp1->needed;
918 			srp->got = srp1->got;
919 			srp->tail = srp1->tail;
920 			srp->partial_delivered = srp1->partial_delivered;
921 			hmp->b_next = hmp->b_prev = NULL;
922 			dmp->b_cont = hmp;
923 			hmp = pmp;
924 		} else {
925 			ASSERT(DB_TYPE(hmp) == M_CTL);
926 			dmp->b_cont = qmp;
927 			hmp->b_cont = dmp;
928 		}
929 		goto inserted;
930 	}
931 
932 	/* Insert somewhere in the middle */
933 	for (;;) {
934 		/* Tail check above should have caught this */
935 		ASSERT(qmp->b_cont != NULL);
936 
937 		qdc = (sctp_data_hdr_t *)qmp->b_cont->b_rptr;
938 		if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
939 			/* insert here */
940 			dmp->b_cont = qmp->b_cont;
941 			qmp->b_cont = dmp;
942 			break;
943 		}
944 		qmp = qmp->b_cont;
945 	}
946 
947 inserted:
948 	(srp->got)++;
949 	first_mp = (DB_TYPE(hmp) == M_DATA) ? hmp : hmp->b_cont;
950 	if (srp->needed == 0) {
951 		/* check if we have the first and last fragments */
952 		bdc = (sctp_data_hdr_t *)first_mp->b_rptr;
953 		edc = (sctp_data_hdr_t *)srp->tail->b_rptr;
954 
955 		/* calculate how many fragments are needed, if possible  */
956 		if (SCTP_DATA_GET_BBIT(bdc) && SCTP_DATA_GET_EBIT(edc))
957 			srp->needed = ntohl(edc->sdh_tsn) -
958 			    ntohl(bdc->sdh_tsn) + 1;
959 	}
960 
961 	if (srp->needed != srp->got) {
962 		if (!trypartial)
963 			return (NULL);
964 		/*
965 		 * Try partial delivery. We need a consecutive run of
966 		 * at least two chunks, starting from the first chunk
967 		 * (which may have been the last + 1 chunk from a
968 		 * previous partial delivery).
969 		 */
970 		dprint(4, ("trypartial: got=%d, needed=%d\n",
971 		    (int)(srp->got), (int)(srp->needed)));
972 		mp = first_mp;
973 		if (mp->b_cont == NULL) {
974 			/* need at least two chunks */
975 			dprint(4, ("trypartial: only 1 chunk\n"));
976 			return (NULL);
977 		}
978 
979 		qdc = (sctp_data_hdr_t *)mp->b_rptr;
980 		if (!SCTP_DATA_GET_BBIT(qdc)) {
981 			/* don't have first chunk; can't do it. */
982 			dprint(4, ("trypartial: no beginning\n"));
983 			return (NULL);
984 		}
985 
986 		tsn = ntohl(qdc->sdh_tsn) + 1;
987 
988 		/*
989 		 * This loop has two exit conditions: the
990 		 * end of received chunks has been reached, or
991 		 * there is a break in the sequence. We want
992 		 * to chop the reassembly list as follows (the
993 		 * numbers are TSNs):
994 		 *   10 -> 11 -> | 12	(end of chunks)
995 		 *   10 -> 11 -> | 12 -> 14 (break in sequence)
996 		 */
997 		prevprev = prev = mp;
998 		mp = mp->b_cont;
999 		while (mp != NULL) {
1000 			qdc = (sctp_data_hdr_t *)mp->b_rptr;
1001 			if (ntohl(qdc->sdh_tsn) != tsn) {
1002 				/*
1003 				 * break in sequence.
1004 				 * 1st and 2nd chunks are not sequntial.
1005 				 */
1006 				if (mp == first_mp->b_cont)
1007 					return (NULL);
1008 				/* Back up mp and prev */
1009 				mp = prev;
1010 				prev = prevprev;
1011 				break;
1012 			}
1013 
1014 			/* end of sequence */
1015 			if (mp->b_cont == NULL)
1016 				break;
1017 
1018 			prevprev = prev;
1019 			prev = mp;
1020 			mp = mp->b_cont;
1021 			tsn++;
1022 		}
1023 		if (DB_TYPE(hmp) == M_DATA) {
1024 			sctp_reass_t	*srp1 = srp;
1025 
1026 			SCTP_NEW_REASS(pmp, mp, srp, B_FALSE);
1027 			ASSERT(pmp->b_prev == NULL && pmp->b_next == NULL);
1028 			if (sip->istr_reass == hmp) {
1029 				sip->istr_reass = pmp;
1030 				if (hmp->b_next != NULL) {
1031 					hmp->b_next->b_prev = pmp;
1032 					pmp->b_next = hmp->b_next;
1033 				}
1034 			} else {
1035 				hmp->b_prev->b_next = pmp;
1036 				pmp->b_prev = hmp->b_prev;
1037 				if (hmp->b_next != NULL) {
1038 					hmp->b_next->b_prev = pmp;
1039 					pmp->b_next = hmp->b_next;
1040 				}
1041 			}
1042 			srp->ssn = srp1->ssn;
1043 			srp->needed = srp1->needed;
1044 			srp->got = srp1->got;
1045 			srp->tail = srp1->tail;
1046 			hmp->b_next = hmp->b_prev = NULL;
1047 			dmp = hmp;
1048 			hmp = pmp;
1049 		} else {
1050 			ASSERT(DB_TYPE(hmp) == M_CTL);
1051 			dmp = hmp->b_cont;
1052 			hmp->b_cont = mp;
1053 		}
1054 		/*
1055 		 * mp now points at the last chunk in the sequence,
1056 		 * and prev points to mp's previous in the list.
1057 		 * We chop the list at prev, and convert mp into the
1058 		 * new list head by setting the B bit. Subsequence
1059 		 * fragment deliveries will follow the normal reassembly
1060 		 * path.
1061 		 */
1062 		prev->b_cont = NULL;
1063 		bdc = (sctp_data_hdr_t *)mp->b_rptr;
1064 		SCTP_DATA_SET_BBIT(bdc);
1065 		*tpfinished = 0;
1066 		srp->partial_delivered = B_TRUE;
1067 
1068 		dprint(4, ("trypartial: got some, got=%d, needed=%d\n",
1069 		    (int)(srp->got), (int)(srp->needed)));
1070 		goto fixup;
1071 	}
1072 
1073 	/*
1074 	 * else reassembly done; prepare the data for delivery.
1075 	 * First unlink hmp from the ssn list.
1076 	 */
1077 	if (sip->istr_reass == hmp) {
1078 		sip->istr_reass = hmp->b_next;
1079 		if (hmp->b_next) {
1080 			hmp->b_next->b_prev = NULL;
1081 		}
1082 	} else {
1083 		ASSERT(hmp->b_prev != NULL);
1084 		hmp->b_prev->b_next = hmp->b_next;
1085 		if (hmp->b_next) {
1086 			hmp->b_next->b_prev = hmp->b_prev;
1087 		}
1088 	}
1089 
1090 	/*
1091 	 * Using b_prev and b_next was a little sinful, but OK since
1092 	 * this mblk is never put*'d. However, freeb() will still
1093 	 * ASSERT that they are unused, so we need to NULL them out now.
1094 	 */
1095 	hmp->b_next = NULL;
1096 	hmp->b_prev = NULL;
1097 	dmp = hmp;
1098 	if (DB_TYPE(hmp) == M_CTL) {
1099 		dmp = dmp->b_cont;
1100 		hmp->b_cont = NULL;
1101 		freeb(hmp);
1102 	}
1103 	*tpfinished = 1;
1104 
1105 fixup:
1106 	/*
1107 	 * Adjust all mblk's except the lead so their rptr's point to the
1108 	 * payload. sctp_data_chunk() will need to process the lead's
1109 	 * data chunk section, so leave it's rptr pointing at the data chunk.
1110 	 */
1111 	*dc = (sctp_data_hdr_t *)dmp->b_rptr;
1112 	if (trypartial && !(*tpfinished)) {
1113 		(srp->got)--;
1114 		ASSERT(srp->got != 0);
1115 		if (srp->needed != 0) {
1116 			(srp->needed)--;
1117 			ASSERT(srp->needed != 0);
1118 		}
1119 	}
1120 	for (qmp = dmp->b_cont; qmp; qmp = qmp->b_cont) {
1121 		qdc = (sctp_data_hdr_t *)qmp->b_rptr;
1122 		qmp->b_rptr = (uchar_t *)(qdc + 1);
1123 
1124 		/*
1125 		 * If in partial delivery, deduct the balance from got
1126 		 * and needed here, now that we know we are actually
1127 		 * delivering these data.
1128 		 */
1129 		if (trypartial && !(*tpfinished)) {
1130 			(srp->got)--;
1131 			ASSERT(srp->got != 0);
1132 			if (srp->needed != 0) {
1133 				(srp->needed)--;
1134 				ASSERT(srp->needed != 0);
1135 			}
1136 		}
1137 	}
1138 	BUMP_LOCAL(sctp->sctp_reassmsgs);
1139 
1140 	return (dmp);
1141 }
1142 
1143 static void
1144 sctp_add_dup(uint32_t tsn, mblk_t **dups)
1145 {
1146 	mblk_t *mp;
1147 	size_t bsize = SCTP_DUP_MBLK_SZ * sizeof (tsn);
1148 
1149 	if (dups == NULL) {
1150 		return;
1151 	}
1152 
1153 	/* first time? */
1154 	if (*dups == NULL) {
1155 		*dups = allocb(bsize, BPRI_MED);
1156 		if (*dups == NULL) {
1157 			return;
1158 		}
1159 	}
1160 
1161 	mp = *dups;
1162 	if ((mp->b_wptr - mp->b_rptr) >= bsize) {
1163 		/* maximum reached */
1164 		return;
1165 	}
1166 
1167 	/* add the duplicate tsn */
1168 	bcopy(&tsn, mp->b_wptr, sizeof (tsn));
1169 	mp->b_wptr += sizeof (tsn);
1170 	ASSERT((mp->b_wptr - mp->b_rptr) <= bsize);
1171 }
1172 
1173 static void
1174 sctp_data_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *mp, mblk_t **dups,
1175     sctp_faddr_t *fp, ip6_pkt_t *ipp)
1176 {
1177 	sctp_data_hdr_t *dc;
1178 	mblk_t *dmp, *pmp;
1179 	mblk_t *errmp;
1180 	sctp_instr_t *instr;
1181 	int ubit;
1182 	int isfrag;
1183 	uint16_t ssn;
1184 	uint32_t oftsn;
1185 	boolean_t can_deliver = B_TRUE;
1186 	uint32_t tsn;
1187 	int dlen;
1188 	int trypartial = 0;
1189 	int tpfinished = 1;
1190 	int32_t new_rwnd;
1191 
1192 	/* The following are used multiple times, so we inline them */
1193 #define	SCTP_ACK_IT(sctp, tsn)						\
1194 	if (tsn == sctp->sctp_ftsn) {					\
1195 		dprint(2, ("data_chunk: acking next %x\n", tsn));	\
1196 		(sctp)->sctp_ftsn++;					\
1197 		if ((sctp)->sctp_sack_gaps > 0)				\
1198 			(sctp)->sctp_force_sack = 1;			\
1199 	} else if (SEQ_GT(tsn, sctp->sctp_ftsn)) {			\
1200 		/* Got a gap; record it */				\
1201 		dprint(2, ("data_chunk: acking gap %x\n", tsn));	\
1202 		sctp_ack_add(&sctp->sctp_sack_info, tsn,		\
1203 		    &sctp->sctp_sack_gaps);				\
1204 		sctp->sctp_force_sack = 1;				\
1205 	}
1206 
1207 	errmp = NULL;
1208 	dmp = NULL;
1209 
1210 	dc = (sctp_data_hdr_t *)ch;
1211 	tsn = ntohl(dc->sdh_tsn);
1212 
1213 	dprint(3, ("sctp_data_chunk: mp=%p tsn=%x\n", (void *)mp, tsn));
1214 
1215 	/* Check for duplicates */
1216 	if (SEQ_LT(tsn, sctp->sctp_ftsn)) {
1217 		dprint(4, ("sctp_data_chunk: dropping duplicate\n"));
1218 		sctp->sctp_force_sack = 1;
1219 		sctp_add_dup(dc->sdh_tsn, dups);
1220 		return;
1221 	}
1222 
1223 	if (sctp->sctp_sack_info != NULL) {
1224 		sctp_set_t *sp;
1225 
1226 		for (sp = sctp->sctp_sack_info; sp; sp = sp->next) {
1227 			if (SEQ_GEQ(tsn, sp->begin) && SEQ_LEQ(tsn, sp->end)) {
1228 				dprint(4,
1229 				("sctp_data_chunk: dropping dup > cumtsn\n"));
1230 				sctp->sctp_force_sack = 1;
1231 				sctp_add_dup(dc->sdh_tsn, dups);
1232 				return;
1233 			}
1234 		}
1235 	}
1236 
1237 	/* We cannot deliver anything up now but we still need to handle it. */
1238 	if (SCTP_IS_DETACHED(sctp)) {
1239 		BUMP_MIB(&sctp_mib, sctpInClosed);
1240 		can_deliver = B_FALSE;
1241 	}
1242 
1243 	dlen = ntohs(dc->sdh_len) - sizeof (*dc);
1244 
1245 	/* Check for buffer space */
1246 	if (sctp->sctp_rwnd - sctp->sctp_rxqueued < dlen) {
1247 		/* Drop and SACK, but don't advance the cumulative TSN. */
1248 		sctp->sctp_force_sack = 1;
1249 		dprint(0, ("sctp_data_chunk: exceed rwnd %d rxqueued %d "
1250 			"ssn %d tsn %x\n", sctp->sctp_rwnd,
1251 			sctp->sctp_rxqueued, dc->sdh_ssn, ntohl(dc->sdh_tsn)));
1252 		return;
1253 	}
1254 
1255 	if (ntohs(dc->sdh_sid) >= sctp->sctp_num_istr) {
1256 		uint16_t	inval_parm[2];
1257 
1258 		inval_parm[0] = dc->sdh_sid;
1259 		/* RESERVED to be ignored at the receiving end */
1260 		inval_parm[1] = 0;
1261 		/* ack and drop it */
1262 		errmp = sctp_make_err(sctp, SCTP_ERR_BAD_SID,
1263 		    (char *)inval_parm, sizeof (inval_parm));
1264 		SCTP_ACK_IT(sctp, tsn);
1265 		if (errmp != NULL)
1266 			sctp_send_err(sctp, errmp, NULL);
1267 		return;
1268 	}
1269 
1270 	ubit = SCTP_DATA_GET_UBIT(dc);
1271 	ASSERT(sctp->sctp_instr != NULL);
1272 	instr = &sctp->sctp_instr[ntohs(dc->sdh_sid)];
1273 	/* Initialize the stream, if not yet used */
1274 	if (instr->sctp == NULL)
1275 		instr->sctp = sctp;
1276 	/*
1277 	 * If we are getting low on buffers set trypartial to try
1278 	 * a partial delivery if we are reassembling a fragmented
1279 	 * message. Only do this if we can immediately deliver the
1280 	 * partially assembled message, and only partially deliver
1281 	 * one message at a time (i.e. messages cannot be intermixed
1282 	 * arriving at the upper layer). A simple way to enforce
1283 	 * this is to only try partial delivery if this TSN is
1284 	 * the next expected TSN. Partial Delivery not supported
1285 	 * for un-ordered message.
1286 	 */
1287 	isfrag = !(SCTP_DATA_GET_BBIT(dc) && SCTP_DATA_GET_EBIT(dc));
1288 	ssn = ntohs(dc->sdh_ssn);
1289 	if ((sctp->sctp_rwnd - sctp->sctp_rxqueued < SCTP_RECV_LOWATER) &&
1290 	    !ubit && isfrag && (tsn == sctp->sctp_ftsn)) {
1291 		trypartial = 1;
1292 	}
1293 
1294 	dmp = dupb(mp);
1295 	if (dmp == NULL) {
1296 		/* drop it and don't ack it, causing the peer to retransmit */
1297 		return;
1298 	}
1299 	dmp->b_wptr = (uchar_t *)ch + ntohs(ch->sch_len);
1300 
1301 	sctp->sctp_rxqueued += dlen;
1302 
1303 	oftsn = sctp->sctp_ftsn;
1304 
1305 	if (isfrag) {
1306 		int error = 0;
1307 
1308 		/* fragmented data chunk */
1309 		dmp->b_rptr = (uchar_t *)dc;
1310 		if (ubit) {
1311 			dmp = sctp_uodata_frag(sctp, dmp, &dc);
1312 #if	DEBUG
1313 			if (dmp != NULL) {
1314 				ASSERT(instr ==
1315 				    &sctp->sctp_instr[ntohs(dc->sdh_sid)]);
1316 			}
1317 #endif
1318 		} else {
1319 			dmp = sctp_data_frag(sctp, dmp, &dc, &error, instr,
1320 			    trypartial, &tpfinished);
1321 		}
1322 		if (error != 0) {
1323 			sctp->sctp_rxqueued -= dlen;
1324 			if (error == 1) {
1325 				/*
1326 				 * out of memory; don't ack it so
1327 				 * the peer retransmits
1328 				 */
1329 				return;
1330 			} else if (error == 2) {
1331 				/*
1332 				 * fatal error (i.e. peer used different
1333 				 * ssn's for same fragmented data) --
1334 				 * the association has been aborted.
1335 				 * XXX need to return errval so state
1336 				 * machine can also abort processing.
1337 				 */
1338 				dprint(0, ("error 2: must not happen!\n"));
1339 				return;
1340 			}
1341 		}
1342 
1343 		if (dmp == NULL) {
1344 			/*
1345 			 * Can't process this data now, but the cumulative
1346 			 * TSN may be advanced, so do the checks at done.
1347 			 */
1348 			SCTP_ACK_IT(sctp, tsn);
1349 			goto done;
1350 		}
1351 	}
1352 
1353 	if (!ubit && !trypartial && ssn != instr->nextseq) {
1354 		/* Adjust rptr to point at the data chunk for compares */
1355 		dmp->b_rptr = (uchar_t *)dc;
1356 
1357 		dprint(2,
1358 		    ("data_chunk: inserted %x in pq (ssn %d expected %d)\n",
1359 		    ntohl(dc->sdh_tsn), (int)(ssn), (int)(instr->nextseq)));
1360 
1361 		if (instr->istr_msgs == NULL) {
1362 			instr->istr_msgs = dmp;
1363 			ASSERT(dmp->b_prev == NULL && dmp->b_next == NULL);
1364 		} else {
1365 			mblk_t			*imblk = instr->istr_msgs;
1366 			sctp_data_hdr_t		*idc;
1367 
1368 			/*
1369 			 * XXXNeed to take sequence wraps into account,
1370 			 * ... and a more efficient insertion algo.
1371 			 */
1372 			for (;;) {
1373 				idc = (sctp_data_hdr_t *)imblk->b_rptr;
1374 				if (SSN_GT(ntohs(idc->sdh_ssn),
1375 					ntohs(dc->sdh_ssn))) {
1376 					if (instr->istr_msgs == imblk) {
1377 						instr->istr_msgs = dmp;
1378 						dmp->b_next = imblk;
1379 						imblk->b_prev = dmp;
1380 					} else {
1381 						ASSERT(imblk->b_prev != NULL);
1382 						imblk->b_prev->b_next = dmp;
1383 						dmp->b_prev = imblk->b_prev;
1384 						imblk->b_prev = dmp;
1385 						dmp->b_next = imblk;
1386 					}
1387 					break;
1388 				}
1389 				if (imblk->b_next == NULL) {
1390 					imblk->b_next = dmp;
1391 					dmp->b_prev = imblk;
1392 					break;
1393 				}
1394 				imblk = imblk->b_next;
1395 			}
1396 		}
1397 		(instr->istr_nmsgs)++;
1398 		(sctp->sctp_istr_nmsgs)++;
1399 		SCTP_ACK_IT(sctp, tsn);
1400 		return;
1401 	}
1402 
1403 	/*
1404 	 * Else we can deliver the data directly. Recalculate
1405 	 * dlen now since we may have reassembled data.
1406 	 */
1407 	dlen = dmp->b_wptr - (uchar_t *)dc - sizeof (*dc);
1408 	for (pmp = dmp->b_cont; pmp != NULL; pmp = pmp->b_cont)
1409 		dlen += pmp->b_wptr - pmp->b_rptr;
1410 	ASSERT(sctp->sctp_rxqueued >= dlen);
1411 	ASSERT(sctp->sctp_rwnd >= dlen);
1412 
1413 	/* Deliver the message. */
1414 	sctp->sctp_rxqueued -= dlen;
1415 
1416 	if (can_deliver) {
1417 		dmp->b_rptr = (uchar_t *)(dc + 1);
1418 		if (sctp_input_add_ancillary(sctp, &dmp, dc, fp, ipp) == 0) {
1419 			dprint(1, ("sctp_data_chunk: delivering %lu bytes\n",
1420 			    msgdsize(dmp)));
1421 			sctp->sctp_rwnd -= dlen;
1422 			new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd, dmp,
1423 			    tpfinished ? 0 : SCTP_PARTIAL_DATA);
1424 			if (new_rwnd > sctp->sctp_rwnd) {
1425 				sctp->sctp_rwnd = new_rwnd;
1426 			}
1427 			SCTP_ACK_IT(sctp, tsn);
1428 		} else {
1429 			/* Just free the message if we don't have memory. */
1430 			freemsg(dmp);
1431 			return;
1432 		}
1433 	} else {
1434 		/* About to free the data */
1435 		freemsg(dmp);
1436 		SCTP_ACK_IT(sctp, tsn);
1437 	}
1438 
1439 	/*
1440 	 * data, now enqueued, may already have been processed and free'd
1441 	 * by the ULP (or we may have just freed it above, if we could not
1442 	 * deliver it), so we must not reference it (this is why we kept
1443 	 * the ssn and ubit above).
1444 	 */
1445 	if (ubit != 0) {
1446 		BUMP_LOCAL(sctp->sctp_iudchunks);
1447 		goto done;
1448 	}
1449 	BUMP_LOCAL(sctp->sctp_idchunks);
1450 
1451 	/*
1452 	 * If there was a partial delivery and it has not finished,
1453 	 * don't pull anything from the pqueues.
1454 	 */
1455 	if (!tpfinished) {
1456 		goto done;
1457 	}
1458 
1459 	instr->nextseq = ssn + 1;
1460 	/* Deliver any successive data chunks in the instr queue */
1461 	while (instr->istr_nmsgs > 0) {
1462 		dmp = (mblk_t *)instr->istr_msgs;
1463 		dc = (sctp_data_hdr_t *)dmp->b_rptr;
1464 		ssn = ntohs(dc->sdh_ssn);
1465 		/* Gap in the sequence */
1466 		if (ssn != instr->nextseq)
1467 			break;
1468 
1469 		/* Else deliver the data */
1470 		(instr->istr_nmsgs)--;
1471 		(instr->nextseq)++;
1472 		(sctp->sctp_istr_nmsgs)--;
1473 
1474 		instr->istr_msgs = instr->istr_msgs->b_next;
1475 		if (instr->istr_msgs != NULL)
1476 			instr->istr_msgs->b_prev = NULL;
1477 		dmp->b_next = dmp->b_prev = NULL;
1478 
1479 		dprint(2, ("data_chunk: pulling %x from pq (ssn %d)\n",
1480 		    ntohl(dc->sdh_tsn), (int)ssn));
1481 
1482 		/*
1483 		 * If this chunk was reassembled, each b_cont represents
1484 		 * another TSN; advance ftsn now.
1485 		 */
1486 		dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc);
1487 		for (pmp = dmp->b_cont; pmp; pmp = pmp->b_cont)
1488 			dlen += pmp->b_wptr - pmp->b_rptr;
1489 
1490 		ASSERT(sctp->sctp_rxqueued >= dlen);
1491 		ASSERT(sctp->sctp_rwnd >= dlen);
1492 
1493 		sctp->sctp_rxqueued -= dlen;
1494 		if (can_deliver) {
1495 			dmp->b_rptr = (uchar_t *)(dc + 1);
1496 			if (sctp_input_add_ancillary(sctp, &dmp, dc, fp,
1497 			    ipp) == 0) {
1498 				dprint(1, ("sctp_data_chunk: delivering %lu "
1499 				    "bytes\n", msgdsize(dmp)));
1500 				sctp->sctp_rwnd -= dlen;
1501 				new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd,
1502 				    dmp, tpfinished ? 0 : SCTP_PARTIAL_DATA);
1503 				if (new_rwnd > sctp->sctp_rwnd) {
1504 					sctp->sctp_rwnd = new_rwnd;
1505 				}
1506 				SCTP_ACK_IT(sctp, tsn);
1507 			} else {
1508 				freemsg(dmp);
1509 				return;
1510 			}
1511 		} else {
1512 			/* About to free the data */
1513 			freemsg(dmp);
1514 			SCTP_ACK_IT(sctp, tsn);
1515 		}
1516 	}
1517 
1518 done:
1519 
1520 	/*
1521 	 * If there are gap reports pending, check if advancing
1522 	 * the ftsn here closes a gap. If so, we can advance
1523 	 * ftsn to the end of the set.
1524 	 */
1525 	if (sctp->sctp_sack_info != NULL &&
1526 	    sctp->sctp_ftsn == sctp->sctp_sack_info->begin) {
1527 		sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1;
1528 	}
1529 	/*
1530 	 * If ftsn has moved forward, maybe we can remove gap reports.
1531 	 * NB: dmp may now be NULL, so don't dereference it here.
1532 	 */
1533 	if (oftsn != sctp->sctp_ftsn && sctp->sctp_sack_info != NULL) {
1534 		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
1535 		    &sctp->sctp_sack_gaps);
1536 		dprint(2, ("data_chunk: removed acks before %x (num=%d)\n",
1537 		    sctp->sctp_ftsn - 1, sctp->sctp_sack_gaps));
1538 	}
1539 
1540 #ifdef	DEBUG
1541 	if (sctp->sctp_sack_info != NULL) {
1542 		ASSERT(sctp->sctp_ftsn != sctp->sctp_sack_info->begin);
1543 	}
1544 #endif
1545 
1546 #undef	SCTP_ACK_IT
1547 }
1548 
1549 void
1550 sctp_fill_sack(sctp_t *sctp, unsigned char *dst, int sacklen)
1551 {
1552 	sctp_chunk_hdr_t *sch;
1553 	sctp_sack_chunk_t *sc;
1554 	sctp_sack_frag_t *sf;
1555 	uint16_t num_gaps = sctp->sctp_sack_gaps;
1556 	sctp_set_t *sp;
1557 
1558 	/* Chunk hdr */
1559 	sch = (sctp_chunk_hdr_t *)dst;
1560 	sch->sch_id = CHUNK_SACK;
1561 	sch->sch_flags = 0;
1562 	sch->sch_len = htons(sacklen);
1563 
1564 	/* SACK chunk */
1565 	sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
1566 
1567 	sc = (sctp_sack_chunk_t *)(sch + 1);
1568 	sc->ssc_cumtsn = htonl(sctp->sctp_lastacked);
1569 	if (sctp->sctp_rxqueued < sctp->sctp_rwnd) {
1570 		sc->ssc_a_rwnd = htonl(sctp->sctp_rwnd - sctp->sctp_rxqueued);
1571 	} else {
1572 		sc->ssc_a_rwnd = 0;
1573 	}
1574 	sc->ssc_numfrags = htons(num_gaps);
1575 	sc->ssc_numdups = 0;
1576 
1577 	/* lay in gap reports */
1578 	sf = (sctp_sack_frag_t *)(sc + 1);
1579 	for (sp = sctp->sctp_sack_info; sp; sp = sp->next) {
1580 		uint16_t offset;
1581 
1582 		/* start */
1583 		if (sp->begin > sctp->sctp_lastacked) {
1584 			offset = (uint16_t)(sp->begin - sctp->sctp_lastacked);
1585 		} else {
1586 			/* sequence number wrap */
1587 			offset = (uint16_t)(UINT32_MAX - sctp->sctp_lastacked +
1588 			    sp->begin);
1589 		}
1590 		sf->ssf_start = htons(offset);
1591 
1592 		/* end */
1593 		if (sp->end >= sp->begin) {
1594 			offset += (uint16_t)(sp->end - sp->begin);
1595 		} else {
1596 			/* sequence number wrap */
1597 			offset += (uint16_t)(UINT32_MAX - sp->begin + sp->end);
1598 		}
1599 		sf->ssf_end = htons(offset);
1600 
1601 		sf++;
1602 		/* This is just for debugging (a la the following assertion) */
1603 		num_gaps--;
1604 	}
1605 
1606 	ASSERT(num_gaps == 0);
1607 
1608 	/* If the SACK timer is running, stop it */
1609 	if (sctp->sctp_ack_timer_running) {
1610 		sctp_timer_stop(sctp->sctp_ack_mp);
1611 		sctp->sctp_ack_timer_running = B_FALSE;
1612 	}
1613 
1614 	BUMP_LOCAL(sctp->sctp_obchunks);
1615 }
1616 
1617 mblk_t *
1618 sctp_make_sack(sctp_t *sctp, sctp_faddr_t *sendto, mblk_t *dups)
1619 {
1620 	mblk_t *smp;
1621 	size_t slen;
1622 	sctp_chunk_hdr_t *sch;
1623 	sctp_sack_chunk_t *sc;
1624 
1625 	if (sctp->sctp_force_sack) {
1626 		sctp->sctp_force_sack = 0;
1627 		goto checks_done;
1628 	}
1629 
1630 	if (sctp->sctp_state == SCTPS_ESTABLISHED) {
1631 		if (sctp->sctp_sack_toggle < 2) {
1632 			/* no need to SACK right now */
1633 			dprint(2, ("sctp_make_sack: %p no sack (toggle)\n",
1634 			    (void *)sctp));
1635 			return (NULL);
1636 		} else if (sctp->sctp_sack_toggle >= 2) {
1637 			sctp->sctp_sack_toggle = 0;
1638 		}
1639 	}
1640 
1641 	if (sctp->sctp_ftsn == sctp->sctp_lastacked + 1) {
1642 		dprint(2, ("sctp_make_sack: %p no sack (already)\n",
1643 		    (void *)sctp));
1644 		return (NULL);
1645 	}
1646 
1647 checks_done:
1648 	dprint(2, ("sctp_make_sack: acking %x\n", sctp->sctp_ftsn - 1));
1649 
1650 	slen = sizeof (*sch) + sizeof (*sc) +
1651 	    (sizeof (sctp_sack_frag_t) * sctp->sctp_sack_gaps);
1652 	smp = sctp_make_mp(sctp, sendto, slen);
1653 	if (smp == NULL) {
1654 		SCTP_KSTAT(sctp_send_sack_failed);
1655 		return (NULL);
1656 	}
1657 	sch = (sctp_chunk_hdr_t *)smp->b_wptr;
1658 
1659 	sctp_fill_sack(sctp, smp->b_wptr, slen);
1660 	smp->b_wptr += slen;
1661 	if (dups) {
1662 		sc = (sctp_sack_chunk_t *)(sch + 1);
1663 		sc->ssc_numdups = htons((dups->b_wptr - dups->b_rptr)
1664 		    / sizeof (uint32_t));
1665 		sch->sch_len = htons(slen + (dups->b_wptr - dups->b_rptr));
1666 		smp->b_cont = dups;
1667 	}
1668 
1669 	return (smp);
1670 }
1671 
1672 void
1673 sctp_sack(sctp_t *sctp, mblk_t *dups)
1674 {
1675 	mblk_t *smp;
1676 
1677 	/* If we are shutting down, let send_shutdown() bundle the SACK */
1678 	if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
1679 		sctp_send_shutdown(sctp, 0);
1680 	}
1681 
1682 	ASSERT(sctp->sctp_lastdata != NULL);
1683 
1684 	if ((smp = sctp_make_sack(sctp, sctp->sctp_lastdata, dups)) == NULL) {
1685 		/* The caller of sctp_sack() will not free the dups mblk. */
1686 		if (dups != NULL)
1687 			freeb(dups);
1688 		return;
1689 	}
1690 
1691 	sctp_set_iplen(sctp, smp);
1692 
1693 	dprint(2, ("sctp_sack: sending to %p %x:%x:%x:%x\n",
1694 	    (void *)sctp->sctp_lastdata,
1695 	    SCTP_PRINTADDR(sctp->sctp_lastdata->faddr)));
1696 
1697 	sctp->sctp_active = lbolt64;
1698 
1699 	BUMP_MIB(&sctp_mib, sctpOutAck);
1700 	sctp_add_sendq(sctp, smp);
1701 }
1702 
1703 /*
1704  * This is called if we have a message that was partially sent and is
1705  * abandoned. The cum TSN will be the last chunk sent for this message,
1706  * subsequent chunks will be marked ABANDONED. We send a Forward TSN
1707  * chunk in this case with the TSN of the last sent chunk so that the
1708  * peer can clean up its fragment list for this message. This message
1709  * will be removed from the transmit list when the peer sends a SACK
1710  * back.
1711  */
1712 int
1713 sctp_check_abandoned_msg(sctp_t *sctp, mblk_t *meta)
1714 {
1715 	sctp_data_hdr_t	*dh;
1716 	mblk_t		*nmp;
1717 	mblk_t		*head;
1718 	int32_t		unsent = 0;
1719 	mblk_t		*mp1 = meta->b_cont;
1720 	uint32_t	adv_pap = sctp->sctp_adv_pap;
1721 	sctp_faddr_t	*fp = sctp->sctp_current;
1722 
1723 	dh = (sctp_data_hdr_t *)mp1->b_rptr;
1724 	if (SEQ_GEQ(sctp->sctp_lastack_rxd, ntohl(dh->sdh_tsn))) {
1725 		sctp_ftsn_set_t	*sets = NULL;
1726 		uint_t		nsets = 0;
1727 		uint32_t	seglen = sizeof (uint32_t);
1728 		boolean_t	ubit = SCTP_DATA_GET_UBIT(dh);
1729 
1730 		while (mp1->b_next != NULL && SCTP_CHUNK_ISSENT(mp1->b_next))
1731 			mp1 = mp1->b_next;
1732 		dh = (sctp_data_hdr_t *)mp1->b_rptr;
1733 		sctp->sctp_adv_pap = ntohl(dh->sdh_tsn);
1734 		if (!ubit &&
1735 		    !sctp_add_ftsn_set(&sets, fp, meta, &nsets, &seglen)) {
1736 			sctp->sctp_adv_pap = adv_pap;
1737 			return (ENOMEM);
1738 		}
1739 		nmp = sctp_make_ftsn_chunk(sctp, fp, sets, nsets, seglen);
1740 		sctp_free_ftsn_set(sets);
1741 		if (nmp == NULL) {
1742 			sctp->sctp_adv_pap = adv_pap;
1743 			return (ENOMEM);
1744 		}
1745 		head = sctp_add_proto_hdr(sctp, fp, nmp, 0, NULL);
1746 		if (head == NULL) {
1747 			sctp->sctp_adv_pap = adv_pap;
1748 			freemsg(nmp);
1749 			SCTP_KSTAT(sctp_send_ftsn_failed);
1750 			return (ENOMEM);
1751 		}
1752 		SCTP_MSG_SET_ABANDONED(meta);
1753 		sctp_set_iplen(sctp, head);
1754 		sctp_add_sendq(sctp, head);
1755 		if (!fp->timer_running)
1756 			SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
1757 		mp1 = mp1->b_next;
1758 		while (mp1 != NULL) {
1759 			ASSERT(!SCTP_CHUNK_ISSENT(mp1));
1760 			ASSERT(!SCTP_CHUNK_ABANDONED(mp1));
1761 			SCTP_ABANDON_CHUNK(mp1);
1762 			dh = (sctp_data_hdr_t *)mp1->b_rptr;
1763 			unsent += ntohs(dh->sdh_len) - sizeof (*dh);
1764 			mp1 = mp1->b_next;
1765 		}
1766 		ASSERT(sctp->sctp_unsent >= unsent);
1767 		sctp->sctp_unsent -= unsent;
1768 		/*
1769 		 * Update ULP the amount of queued data, which is
1770 		 * sent-unack'ed + unsent.
1771 		 */
1772 		if (!SCTP_IS_DETACHED(sctp)) {
1773 			sctp->sctp_ulp_xmitted(sctp->sctp_ulpd,
1774 			    sctp->sctp_unacked + sctp->sctp_unsent);
1775 		}
1776 		return (0);
1777 	}
1778 	return (-1);
1779 }
1780 
1781 uint32_t
1782 sctp_cumack(sctp_t *sctp, uint32_t tsn, mblk_t **first_unacked)
1783 {
1784 	mblk_t *ump, *nump, *mp = NULL;
1785 	uint16_t chunklen;
1786 	uint32_t xtsn;
1787 	sctp_faddr_t *fp;
1788 	sctp_data_hdr_t *sdc;
1789 	uint32_t cumack_forward = 0;
1790 	sctp_msg_hdr_t	*mhdr;
1791 
1792 	ump = sctp->sctp_xmit_head;
1793 
1794 	/*
1795 	 * Free messages only when they're completely acked.
1796 	 */
1797 	while (ump != NULL) {
1798 		mhdr = (sctp_msg_hdr_t *)ump->b_rptr;
1799 		for (mp = ump->b_cont; mp != NULL; mp = mp->b_next) {
1800 			if (SCTP_CHUNK_ABANDONED(mp)) {
1801 				ASSERT(SCTP_IS_MSG_ABANDONED(ump));
1802 				mp = NULL;
1803 				break;
1804 			}
1805 			/*
1806 			 * We check for abandoned message if we are PR-SCTP
1807 			 * aware, if this is not the first chunk in the
1808 			 * message (b_cont) and if the message is marked
1809 			 * abandoned.
1810 			 */
1811 			if (!SCTP_CHUNK_ISSENT(mp)) {
1812 				if (sctp->sctp_prsctp_aware &&
1813 				    mp != ump->b_cont &&
1814 				    (SCTP_IS_MSG_ABANDONED(ump) ||
1815 				    SCTP_MSG_TO_BE_ABANDONED(ump, mhdr,
1816 				    sctp))) {
1817 					(void) sctp_check_abandoned_msg(sctp,
1818 					    ump);
1819 				}
1820 				goto cum_ack_done;
1821 			}
1822 			sdc = (sctp_data_hdr_t *)mp->b_rptr;
1823 			xtsn = ntohl(sdc->sdh_tsn);
1824 			if (SEQ_GEQ(sctp->sctp_lastack_rxd, xtsn))
1825 				continue;
1826 			if (SEQ_GEQ(tsn, xtsn)) {
1827 				fp = SCTP_CHUNK_DEST(mp);
1828 				chunklen = ntohs(sdc->sdh_len);
1829 
1830 				if (sctp->sctp_out_time != 0 &&
1831 				    xtsn == sctp->sctp_rtt_tsn) {
1832 					/* Got a new RTT measurement */
1833 					sctp_update_rtt(sctp, fp,
1834 					    lbolt64 - sctp->sctp_out_time);
1835 					sctp->sctp_out_time = 0;
1836 				}
1837 				if (SCTP_CHUNK_ISACKED(mp))
1838 					continue;
1839 				SCTP_CHUNK_SET_SACKCNT(mp, 0);
1840 				SCTP_CHUNK_ACKED(mp);
1841 				ASSERT(fp->suna >= chunklen);
1842 				fp->suna -= chunklen;
1843 				fp->acked += chunklen;
1844 				cumack_forward += chunklen;
1845 				ASSERT(sctp->sctp_unacked >=
1846 				    (chunklen - sizeof (*sdc)));
1847 				sctp->sctp_unacked -=
1848 				    (chunklen - sizeof (*sdc));
1849 				if (fp->suna == 0) {
1850 					/* all outstanding data acked */
1851 					fp->pba = 0;
1852 					SCTP_FADDR_TIMER_STOP(fp);
1853 				} else {
1854 					SCTP_FADDR_TIMER_RESTART(sctp, fp,
1855 					    fp->rto);
1856 				}
1857 			} else {
1858 				goto cum_ack_done;
1859 			}
1860 		}
1861 		nump = ump->b_next;
1862 		if (nump != NULL)
1863 			nump->b_prev = NULL;
1864 		if (ump == sctp->sctp_xmit_tail)
1865 			sctp->sctp_xmit_tail = nump;
1866 		if (SCTP_IS_MSG_ABANDONED(ump)) {
1867 			BUMP_LOCAL(sctp->sctp_prsctpdrop);
1868 			ump->b_next = NULL;
1869 			sctp_sendfail_event(sctp, ump, 0, B_TRUE);
1870 		} else {
1871 			sctp_free_msg(ump);
1872 		}
1873 		sctp->sctp_xmit_head = ump = nump;
1874 	}
1875 cum_ack_done:
1876 	*first_unacked = mp;
1877 	if (cumack_forward > 0) {
1878 		BUMP_MIB(&sctp_mib, sctpInAck);
1879 		if (SEQ_GT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn)) {
1880 			sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd;
1881 		}
1882 
1883 		/*
1884 		 * Update ULP the amount of queued data, which is
1885 		 * sent-unack'ed + unsent.
1886 		 */
1887 		if (!SCTP_IS_DETACHED(sctp)) {
1888 			sctp->sctp_ulp_xmitted(sctp->sctp_ulpd,
1889 			    sctp->sctp_unacked + sctp->sctp_unsent);
1890 		}
1891 
1892 		/* Time to send a shutdown? */
1893 		if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
1894 			sctp_send_shutdown(sctp, 0);
1895 		}
1896 		sctp->sctp_xmit_unacked = mp;
1897 	} else {
1898 		/* dup ack */
1899 		BUMP_MIB(&sctp_mib, sctpInDupAck);
1900 	}
1901 	sctp->sctp_lastack_rxd = tsn;
1902 	if (SEQ_LT(sctp->sctp_adv_pap, sctp->sctp_lastack_rxd))
1903 		sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
1904 	ASSERT(sctp->sctp_xmit_head || sctp->sctp_unacked == 0);
1905 
1906 	return (cumack_forward);
1907 }
1908 
1909 static int
1910 sctp_set_frwnd(sctp_t *sctp, uint32_t frwnd)
1911 {
1912 	uint32_t orwnd;
1913 
1914 	if (sctp->sctp_unacked > frwnd) {
1915 		sctp->sctp_frwnd = 0;
1916 		return (0);
1917 	}
1918 	orwnd = sctp->sctp_frwnd;
1919 	sctp->sctp_frwnd = frwnd - sctp->sctp_unacked;
1920 	if (orwnd < sctp->sctp_frwnd) {
1921 		return (1);
1922 	} else {
1923 		return (0);
1924 	}
1925 }
1926 
1927 /*
1928  * For un-ordered messages.
1929  * Walk the sctp->sctp_uo_frag list and remove any fragments with TSN
1930  * less than/equal to ftsn. Fragments for un-ordered messages are
1931  * strictly in sequence (w.r.t TSN).
1932  */
1933 static int
1934 sctp_ftsn_check_uo_frag(sctp_t *sctp, uint32_t ftsn)
1935 {
1936 	mblk_t		*hmp;
1937 	mblk_t		*hmp_next;
1938 	sctp_data_hdr_t	*dc;
1939 	int		dlen = 0;
1940 
1941 	hmp = sctp->sctp_uo_frags;
1942 	while (hmp != NULL) {
1943 		hmp_next = hmp->b_next;
1944 		dc = (sctp_data_hdr_t *)hmp->b_rptr;
1945 		if (SEQ_GT(ntohl(dc->sdh_tsn), ftsn))
1946 			return (dlen);
1947 		sctp->sctp_uo_frags = hmp_next;
1948 		if (hmp_next != NULL)
1949 			hmp_next->b_prev = NULL;
1950 		hmp->b_next = NULL;
1951 		dlen += ntohs(dc->sdh_len) - sizeof (*dc);
1952 		freeb(hmp);
1953 		hmp = hmp_next;
1954 	}
1955 	return (dlen);
1956 }
1957 
1958 /*
1959  * For ordered messages.
1960  * Check for existing fragments for an sid-ssn pair reported as abandoned,
1961  * hence will not receive, in the Forward TSN. If there are fragments, then
1962  * we just nuke them. If and when Partial Delivery API is supported, we
1963  * would need to send a notification to the upper layer about this.
1964  */
1965 static int
1966 sctp_ftsn_check_frag(sctp_t *sctp, uint16_t ssn, sctp_instr_t *sip)
1967 {
1968 	sctp_reass_t	*srp;
1969 	mblk_t		*hmp;
1970 	mblk_t		*dmp;
1971 	mblk_t		*hmp_next;
1972 	sctp_data_hdr_t	*dc;
1973 	int		dlen = 0;
1974 
1975 	hmp = sip->istr_reass;
1976 	while (hmp != NULL) {
1977 		hmp_next = hmp->b_next;
1978 		srp = (sctp_reass_t *)DB_BASE(hmp);
1979 		if (SSN_GT(srp->ssn, ssn))
1980 			return (dlen);
1981 		/*
1982 		 * If we had sent part of this message up, send a partial
1983 		 * delivery event. Since this is ordered delivery, we should
1984 		 * have sent partial message only for the next in sequence,
1985 		 * hence the ASSERT. See comments in sctp_data_chunk() for
1986 		 * trypartial.
1987 		 */
1988 		if (srp->partial_delivered) {
1989 			ASSERT(sip->nextseq == srp->ssn);
1990 			sctp_partial_delivery_event(sctp);
1991 		}
1992 		/* Take it out of the reass queue */
1993 		sip->istr_reass = hmp_next;
1994 		if (hmp_next != NULL)
1995 			hmp_next->b_prev = NULL;
1996 		hmp->b_next = NULL;
1997 		ASSERT(hmp->b_prev == NULL);
1998 		dmp = hmp;
1999 		if (DB_TYPE(hmp) == M_CTL) {
2000 			dmp = hmp->b_cont;
2001 			hmp->b_cont = NULL;
2002 			freeb(hmp);
2003 			hmp = dmp;
2004 		}
2005 		while (dmp != NULL) {
2006 			dc = (sctp_data_hdr_t *)dmp->b_rptr;
2007 			dlen += ntohs(dc->sdh_len) - sizeof (*dc);
2008 			dmp = dmp->b_cont;
2009 		}
2010 		freemsg(hmp);
2011 		hmp = hmp_next;
2012 	}
2013 	return (dlen);
2014 }
2015 
2016 /*
2017  * Update sctp_ftsn to the cumulative TSN from the Forward TSN chunk. Remove
2018  * any SACK gaps less than the newly updated sctp_ftsn. Walk through the
2019  * sid-ssn pair in the Forward TSN and for each, clean the fragment list
2020  * for this pair, if needed, and check if we can deliver subsequent
2021  * messages, if any, from the instream queue (that were waiting for this
2022  * sid-ssn message to show up). Once we are done try to update the SACK
2023  * info. We could get a duplicate Forward TSN, in which case just send
2024  * a SACK. If any of the sid values in the the Forward TSN is invalid,
2025  * send back an "Invalid Stream Identifier" error and continue processing
2026  * the rest.
2027  */
2028 static void
2029 sctp_process_forward_tsn(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp,
2030     ip6_pkt_t *ipp)
2031 {
2032 	uint32_t	*ftsn = (uint32_t *)(ch + 1);
2033 	ftsn_entry_t	*ftsn_entry;
2034 	sctp_instr_t	*instr;
2035 	boolean_t	can_deliver = B_TRUE;
2036 	size_t		dlen;
2037 	int		flen;
2038 	mblk_t		*dmp;
2039 	mblk_t		*pmp;
2040 	sctp_data_hdr_t	*dc;
2041 	ssize_t		remaining;
2042 
2043 	*ftsn = ntohl(*ftsn);
2044 	remaining =  ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*ftsn);
2045 
2046 	if (SCTP_IS_DETACHED(sctp)) {
2047 		BUMP_MIB(&sctp_mib, sctpInClosed);
2048 		can_deliver = B_FALSE;
2049 	}
2050 	/*
2051 	 * un-ordered messages don't have SID-SSN pair entries, we check
2052 	 * for any fragments (for un-ordered message) to be discarded using
2053 	 * the cumulative FTSN.
2054 	 */
2055 	flen = sctp_ftsn_check_uo_frag(sctp, *ftsn);
2056 	if (flen > 0) {
2057 		ASSERT(sctp->sctp_rxqueued >= flen);
2058 		sctp->sctp_rxqueued -= flen;
2059 	}
2060 	ftsn_entry = (ftsn_entry_t *)(ftsn + 1);
2061 	while (remaining >= sizeof (*ftsn_entry)) {
2062 		ftsn_entry->ftsn_sid = ntohs(ftsn_entry->ftsn_sid);
2063 		ftsn_entry->ftsn_ssn = ntohs(ftsn_entry->ftsn_ssn);
2064 		if (ftsn_entry->ftsn_sid >= sctp->sctp_num_istr) {
2065 			uint16_t	inval_parm[2];
2066 			mblk_t		*errmp;
2067 
2068 			inval_parm[0] = htons(ftsn_entry->ftsn_sid);
2069 			/* RESERVED to be ignored at the receiving end */
2070 			inval_parm[1] = 0;
2071 			errmp = sctp_make_err(sctp, SCTP_ERR_BAD_SID,
2072 			    (char *)inval_parm, sizeof (inval_parm));
2073 			if (errmp != NULL)
2074 				sctp_send_err(sctp, errmp, NULL);
2075 			ftsn_entry++;
2076 			remaining -= sizeof (*ftsn_entry);
2077 			continue;
2078 		}
2079 		instr = &sctp->sctp_instr[ftsn_entry->ftsn_sid];
2080 		flen = sctp_ftsn_check_frag(sctp, ftsn_entry->ftsn_ssn, instr);
2081 		/* Indicates frags were nuked, update rxqueued */
2082 		if (flen > 0) {
2083 			ASSERT(sctp->sctp_rxqueued >= flen);
2084 			sctp->sctp_rxqueued -= flen;
2085 		}
2086 		/*
2087 		 * It is possible to receive an FTSN chunk with SSN smaller
2088 		 * than then nextseq if this chunk is a retransmission because
2089 		 * of incomplete processing when it was first processed.
2090 		 */
2091 		if (SSN_GE(ftsn_entry->ftsn_ssn, instr->nextseq))
2092 			instr->nextseq = ftsn_entry->ftsn_ssn + 1;
2093 		while (instr->istr_nmsgs > 0) {
2094 			mblk_t	*next;
2095 
2096 			dmp = (mblk_t *)instr->istr_msgs;
2097 			dc = (sctp_data_hdr_t *)dmp->b_rptr;
2098 			if (ntohs(dc->sdh_ssn) != instr->nextseq)
2099 				break;
2100 
2101 			next = dmp->b_next;
2102 			dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc);
2103 			for (pmp = dmp->b_cont; pmp != NULL;
2104 			    pmp = pmp->b_cont) {
2105 				dlen += pmp->b_wptr - pmp->b_rptr;
2106 			}
2107 			if (can_deliver) {
2108 				int32_t	nrwnd;
2109 
2110 				dmp->b_rptr = (uchar_t *)(dc + 1);
2111 				dmp->b_next = NULL;
2112 				ASSERT(dmp->b_prev == NULL);
2113 				if (sctp_input_add_ancillary(sctp,
2114 				    &dmp, dc, fp, ipp) == 0) {
2115 					sctp->sctp_rxqueued -= dlen;
2116 					sctp->sctp_rwnd -= dlen;
2117 					nrwnd = sctp->sctp_ulp_recv(
2118 					    sctp->sctp_ulpd, dmp, 0);
2119 					if (nrwnd > sctp->sctp_rwnd)
2120 						sctp->sctp_rwnd = nrwnd;
2121 				} else {
2122 					/*
2123 					 * We will resume processing when
2124 					 * the FTSN chunk is re-xmitted.
2125 					 */
2126 					dmp->b_rptr = (uchar_t *)dc;
2127 					dmp->b_next = next;
2128 					dprint(0,
2129 					    ("FTSN dequeuing %u failed\n",
2130 					    ntohs(dc->sdh_ssn)));
2131 					return;
2132 				}
2133 			} else {
2134 				sctp->sctp_rxqueued -= dlen;
2135 				ASSERT(dmp->b_prev == NULL);
2136 				dmp->b_next = NULL;
2137 				freemsg(dmp);
2138 			}
2139 			instr->istr_nmsgs--;
2140 			instr->nextseq++;
2141 			sctp->sctp_istr_nmsgs--;
2142 			if (next != NULL)
2143 				next->b_prev = NULL;
2144 			instr->istr_msgs = next;
2145 		}
2146 		ftsn_entry++;
2147 		remaining -= sizeof (*ftsn_entry);
2148 	}
2149 	/* Duplicate FTSN */
2150 	if (*ftsn <= (sctp->sctp_ftsn - 1)) {
2151 		sctp->sctp_force_sack = 1;
2152 		return;
2153 	}
2154 	/* Advance cum TSN to that reported in the Forward TSN chunk */
2155 	sctp->sctp_ftsn = *ftsn + 1;
2156 
2157 	/* Remove all the SACK gaps before the new cum TSN */
2158 	if (sctp->sctp_sack_info != NULL) {
2159 		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
2160 		    &sctp->sctp_sack_gaps);
2161 	}
2162 	/*
2163 	 * If there are gap reports pending, check if advancing
2164 	 * the ftsn here closes a gap. If so, we can advance
2165 	 * ftsn to the end of the set.
2166 	 * If ftsn has moved forward, maybe we can remove gap reports.
2167 	 */
2168 	if (sctp->sctp_sack_info != NULL &&
2169 	    sctp->sctp_ftsn == sctp->sctp_sack_info->begin) {
2170 		sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1;
2171 		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
2172 		    &sctp->sctp_sack_gaps);
2173 	}
2174 }
2175 
2176 /*
2177  * When we have processed a SACK we check to see if we can advance the
2178  * cumulative TSN if there are abandoned chunks immediately following
2179  * the updated cumulative TSN. If there are, we attempt to send a
2180  * Forward TSN chunk.
2181  */
2182 static void
2183 sctp_check_abandoned_data(sctp_t *sctp, sctp_faddr_t *fp)
2184 {
2185 	mblk_t		*meta = sctp->sctp_xmit_head;
2186 	mblk_t		*mp;
2187 	mblk_t		*nmp;
2188 	uint32_t	seglen;
2189 	uint32_t	adv_pap = sctp->sctp_adv_pap;
2190 
2191 	/*
2192 	 * We only check in the first meta since otherwise we can't
2193 	 * advance the cumulative ack point. We just look for chunks
2194 	 * marked for retransmission, else we might prematurely
2195 	 * send an FTSN for a sent, but unacked, chunk.
2196 	 */
2197 	for (mp = meta->b_cont; mp != NULL; mp = mp->b_next) {
2198 		if (!SCTP_CHUNK_ISSENT(mp))
2199 			return;
2200 		if (SCTP_CHUNK_WANT_REXMIT(mp))
2201 			break;
2202 	}
2203 	if (mp == NULL)
2204 		return;
2205 	sctp_check_adv_ack_pt(sctp, meta, mp);
2206 	if (SEQ_GT(sctp->sctp_adv_pap, adv_pap)) {
2207 		sctp_make_ftsns(sctp, meta, mp, &nmp, fp, &seglen);
2208 		if (nmp == NULL) {
2209 			sctp->sctp_adv_pap = adv_pap;
2210 			if (!fp->timer_running)
2211 				SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
2212 			return;
2213 		}
2214 		sctp_set_iplen(sctp, nmp);
2215 		sctp_add_sendq(sctp, nmp);
2216 		if (!fp->timer_running)
2217 			SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
2218 	}
2219 }
2220 
2221 /*
2222  * The processing here follows the same logic in sctp_got_sack(), the reason
2223  * we do this separately is because, usually, gap blocks are ordered and
2224  * we can process it in sctp_got_sack(). However if they aren't we would
2225  * need to do some additional non-optimal stuff when we start processing the
2226  * unordered gaps. To that effect sctp_got_sack() does the processing in the
2227  * simple case and this does the same in the more involved case.
2228  */
2229 static uint32_t
2230 sctp_process_uo_gaps(sctp_t *sctp, uint32_t ctsn, sctp_sack_frag_t *ssf,
2231     int num_gaps, mblk_t *umphead, mblk_t *mphead, int *trysend,
2232     boolean_t *fast_recovery, uint32_t fr_xtsn)
2233 {
2234 	uint32_t		xtsn;
2235 	uint32_t		gapstart = 0;
2236 	uint32_t		gapend = 0;
2237 	int			gapcnt;
2238 	uint16_t		chunklen;
2239 	sctp_data_hdr_t		*sdc;
2240 	int			gstart;
2241 	mblk_t			*ump = umphead;
2242 	mblk_t			*mp = mphead;
2243 	sctp_faddr_t		*fp;
2244 	uint32_t		acked = 0;
2245 
2246 	/*
2247 	 * gstart tracks the last (in the order of TSN) gapstart that
2248 	 * we process in this SACK gaps walk.
2249 	 */
2250 	gstart = ctsn;
2251 
2252 	sdc = (sctp_data_hdr_t *)mp->b_rptr;
2253 	xtsn = ntohl(sdc->sdh_tsn);
2254 	for (gapcnt = 0; gapcnt < num_gaps; gapcnt++, ssf++) {
2255 		if (gapstart != 0) {
2256 			/*
2257 			 * If we have reached the end of the transmit list or
2258 			 * hit an unsent chunk or encountered an unordered gap
2259 			 * block start from the ctsn again.
2260 			 */
2261 			if (ump == NULL || !SCTP_CHUNK_ISSENT(mp) ||
2262 			    SEQ_LT(ctsn + ntohs(ssf->ssf_start), xtsn)) {
2263 				ump = umphead;
2264 				mp = mphead;
2265 				sdc = (sctp_data_hdr_t *)mp->b_rptr;
2266 				xtsn = ntohl(sdc->sdh_tsn);
2267 			}
2268 		}
2269 
2270 		gapstart = ctsn + ntohs(ssf->ssf_start);
2271 		gapend = ctsn + ntohs(ssf->ssf_end);
2272 
2273 		/* SACK for TSN we have not sent - ABORT */
2274 		if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) ||
2275 		    SEQ_GT(gapend, sctp->sctp_ltsn - 1)) {
2276 			BUMP_MIB(&sctp_mib, sctpInAckUnsent);
2277 			*trysend = -1;
2278 			return (acked);
2279 		} else if (SEQ_LT(gapend, gapstart)) {
2280 			break;
2281 		}
2282 		/*
2283 		 * The xtsn can be the TSN processed for the last gap
2284 		 * (gapend) or it could be the cumulative TSN. We continue
2285 		 * with the last xtsn as long as the gaps are ordered, when
2286 		 * we hit an unordered gap, we re-start from the cumulative
2287 		 * TSN. For the first gap it is always the cumulative TSN.
2288 		 */
2289 		while (xtsn != gapstart) {
2290 			/*
2291 			 * We can't reliably check for reneged chunks
2292 			 * when walking the unordered list, so we don't.
2293 			 * In case the peer reneges then we will end up
2294 			 * sending the reneged chunk via timeout.
2295 			 */
2296 			mp = mp->b_next;
2297 			if (mp == NULL) {
2298 				ump = ump->b_next;
2299 				/*
2300 				 * ump can't be NULL because of the sanity
2301 				 * check above.
2302 				 */
2303 				ASSERT(ump != NULL);
2304 				mp = ump->b_cont;
2305 			}
2306 			/*
2307 			 * mp can't be unsent because of the sanity check
2308 			 * above.
2309 			 */
2310 			ASSERT(SCTP_CHUNK_ISSENT(mp));
2311 			sdc = (sctp_data_hdr_t *)mp->b_rptr;
2312 			xtsn = ntohl(sdc->sdh_tsn);
2313 		}
2314 		/*
2315 		 * Now that we have found the chunk with TSN == 'gapstart',
2316 		 * let's walk till we hit the chunk with TSN == 'gapend'.
2317 		 * All intermediate chunks will be marked ACKED, if they
2318 		 * haven't already been.
2319 		 */
2320 		while (SEQ_LEQ(xtsn, gapend)) {
2321 			/*
2322 			 * SACKed
2323 			 */
2324 			SCTP_CHUNK_SET_SACKCNT(mp, 0);
2325 			if (!SCTP_CHUNK_ISACKED(mp)) {
2326 				SCTP_CHUNK_ACKED(mp);
2327 
2328 				fp = SCTP_CHUNK_DEST(mp);
2329 				chunklen = ntohs(sdc->sdh_len);
2330 				ASSERT(fp->suna >= chunklen);
2331 				fp->suna -= chunklen;
2332 				if (fp->suna == 0) {
2333 					/* All outstanding data acked. */
2334 					fp->pba = 0;
2335 					SCTP_FADDR_TIMER_STOP(fp);
2336 				}
2337 				fp->acked += chunklen;
2338 				acked += chunklen;
2339 				sctp->sctp_unacked -= chunklen - sizeof (*sdc);
2340 				ASSERT(sctp->sctp_unacked >= 0);
2341 			}
2342 			/*
2343 			 * Move to the next message in the transmit list
2344 			 * if we are done with all the chunks from the current
2345 			 * message. Note, it is possible to hit the end of the
2346 			 * transmit list here, i.e. if we have already completed
2347 			 * processing the gap block.
2348 			 */
2349 			mp = mp->b_next;
2350 			if (mp == NULL) {
2351 				ump = ump->b_next;
2352 				if (ump == NULL) {
2353 					ASSERT(xtsn == gapend);
2354 					break;
2355 				}
2356 				mp = ump->b_cont;
2357 			}
2358 			/*
2359 			 * Likewise, we can hit an unsent chunk once we have
2360 			 * completed processing the gap block.
2361 			 */
2362 			if (!SCTP_CHUNK_ISSENT(mp)) {
2363 				ASSERT(xtsn == gapend);
2364 				break;
2365 			}
2366 			sdc = (sctp_data_hdr_t *)mp->b_rptr;
2367 			xtsn = ntohl(sdc->sdh_tsn);
2368 		}
2369 		/*
2370 		 * We keep track of the last gap we successfully processed
2371 		 * so that we can terminate the walk below for incrementing
2372 		 * the SACK count.
2373 		 */
2374 		if (SEQ_LT(gstart, gapstart))
2375 			gstart = gapstart;
2376 	}
2377 	/*
2378 	 * Check if have incremented the SACK count for all unacked TSNs in
2379 	 * sctp_got_sack(), if so we are done.
2380 	 */
2381 	if (SEQ_LEQ(gstart, fr_xtsn))
2382 		return (acked);
2383 
2384 	ump = umphead;
2385 	mp = mphead;
2386 	sdc = (sctp_data_hdr_t *)mp->b_rptr;
2387 	xtsn = ntohl(sdc->sdh_tsn);
2388 	while (SEQ_LT(xtsn, gstart)) {
2389 		/*
2390 		 * We have incremented SACK count for TSNs less than fr_tsn
2391 		 * in sctp_got_sack(), so don't increment them again here.
2392 		 */
2393 		if (SEQ_GT(xtsn, fr_xtsn) && !SCTP_CHUNK_ISACKED(mp)) {
2394 			SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1);
2395 			if (SCTP_CHUNK_SACKCNT(mp) == sctp_fast_rxt_thresh) {
2396 				SCTP_CHUNK_REXMIT(mp);
2397 				sctp->sctp_chk_fast_rexmit = B_TRUE;
2398 				*trysend = 1;
2399 				if (!*fast_recovery) {
2400 					/*
2401 					 * Entering fast recovery.
2402 					 */
2403 					fp = SCTP_CHUNK_DEST(mp);
2404 					fp->ssthresh = fp->cwnd / 2;
2405 					if (fp->ssthresh < 2 * fp->sfa_pmss) {
2406 						fp->ssthresh =
2407 						    2 * fp->sfa_pmss;
2408 					}
2409 					fp->cwnd = fp->ssthresh;
2410 					fp->pba = 0;
2411 					sctp->sctp_recovery_tsn =
2412 					    sctp->sctp_ltsn - 1;
2413 					*fast_recovery = B_TRUE;
2414 				}
2415 			}
2416 		}
2417 		mp = mp->b_next;
2418 		if (mp == NULL) {
2419 			ump = ump->b_next;
2420 			/* We can't get to the end of the transmit list here */
2421 			ASSERT(ump != NULL);
2422 			mp = ump->b_cont;
2423 		}
2424 		/* We can't hit an unsent chunk here */
2425 		ASSERT(SCTP_CHUNK_ISSENT(mp));
2426 		sdc = (sctp_data_hdr_t *)mp->b_rptr;
2427 		xtsn = ntohl(sdc->sdh_tsn);
2428 	}
2429 	return (acked);
2430 }
2431 
2432 static int
2433 sctp_got_sack(sctp_t *sctp, sctp_chunk_hdr_t *sch)
2434 {
2435 	sctp_sack_chunk_t	*sc;
2436 	sctp_data_hdr_t		*sdc;
2437 	sctp_sack_frag_t	*ssf;
2438 	mblk_t			*ump;
2439 	mblk_t			*mp;
2440 	mblk_t			*mp1;
2441 	uint32_t		cumtsn;
2442 	uint32_t		xtsn;
2443 	uint32_t		gapstart = 0;
2444 	uint32_t		gapend = 0;
2445 	uint32_t		acked = 0;
2446 	uint16_t		chunklen;
2447 	sctp_faddr_t		*fp;
2448 	int			num_gaps;
2449 	int			trysend = 0;
2450 	int			i;
2451 	boolean_t		fast_recovery = B_FALSE;
2452 	boolean_t		cumack_forward = B_FALSE;
2453 	boolean_t		fwd_tsn = B_FALSE;
2454 
2455 	BUMP_LOCAL(sctp->sctp_ibchunks);
2456 	chunklen = ntohs(sch->sch_len);
2457 	if (chunklen < (sizeof (*sch) + sizeof (*sc)))
2458 		return (0);
2459 
2460 	sc = (sctp_sack_chunk_t *)(sch + 1);
2461 	cumtsn = ntohl(sc->ssc_cumtsn);
2462 
2463 	dprint(2, ("got sack cumtsn %x -> %x\n", sctp->sctp_lastack_rxd,
2464 	    cumtsn));
2465 
2466 	/* out of order */
2467 	if (SEQ_LT(cumtsn, sctp->sctp_lastack_rxd))
2468 		return (0);
2469 
2470 	if (SEQ_GT(cumtsn, sctp->sctp_ltsn - 1)) {
2471 		BUMP_MIB(&sctp_mib, sctpInAckUnsent);
2472 		/* Send an ABORT */
2473 		return (-1);
2474 	}
2475 
2476 	/*
2477 	 * Cwnd only done when not in fast recovery mode.
2478 	 */
2479 	if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn))
2480 		fast_recovery = B_TRUE;
2481 
2482 	/*
2483 	 * .. and if the cum TSN is not moving ahead on account Forward TSN
2484 	 */
2485 	if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_adv_pap))
2486 		fwd_tsn = B_TRUE;
2487 
2488 	if (cumtsn == sctp->sctp_lastack_rxd &&
2489 	    (sctp->sctp_xmit_unacked == NULL ||
2490 	    !SCTP_CHUNK_ABANDONED(sctp->sctp_xmit_unacked))) {
2491 		if (sctp->sctp_xmit_unacked != NULL)
2492 			mp = sctp->sctp_xmit_unacked;
2493 		else if (sctp->sctp_xmit_head != NULL)
2494 			mp = sctp->sctp_xmit_head->b_cont;
2495 		else
2496 			mp = NULL;
2497 		BUMP_MIB(&sctp_mib, sctpInDupAck);
2498 		/*
2499 		 * If we were doing a zero win probe and the win
2500 		 * has now opened to at least MSS, re-transmit the
2501 		 * zero win probe via sctp_rexmit_packet().
2502 		 */
2503 		if (mp != NULL && sctp->sctp_zero_win_probe &&
2504 		    ntohl(sc->ssc_a_rwnd) >= sctp->sctp_current->sfa_pmss) {
2505 			mblk_t	*pkt;
2506 			uint_t	pkt_len;
2507 			mblk_t	*mp1 = mp;
2508 			mblk_t	*meta = sctp->sctp_xmit_head;
2509 
2510 			/*
2511 			 * Reset the RTO since we have been backing-off
2512 			 * to send the ZWP.
2513 			 */
2514 			fp = sctp->sctp_current;
2515 			fp->rto = fp->srtt + 4 * fp->rttvar;
2516 			/* Resend the ZWP */
2517 			pkt = sctp_rexmit_packet(sctp, &meta, &mp1, fp,
2518 			    &pkt_len);
2519 			if (pkt == NULL) {
2520 				SCTP_KSTAT(sctp_ss_rexmit_failed);
2521 				return (0);
2522 			}
2523 			ASSERT(pkt_len <= fp->sfa_pmss);
2524 			sctp->sctp_zero_win_probe = B_FALSE;
2525 			sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
2526 			sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
2527 			sctp_set_iplen(sctp, pkt);
2528 			sctp_add_sendq(sctp, pkt);
2529 		}
2530 	} else {
2531 		if (sctp->sctp_zero_win_probe) {
2532 			/*
2533 			 * Reset the RTO since we have been backing-off
2534 			 * to send the ZWP.
2535 			 */
2536 			fp = sctp->sctp_current;
2537 			fp->rto = fp->srtt + 4 * fp->rttvar;
2538 			sctp->sctp_zero_win_probe = B_FALSE;
2539 			/* This is probably not required */
2540 			if (!sctp->sctp_rexmitting) {
2541 				sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
2542 				sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
2543 			}
2544 		}
2545 		acked = sctp_cumack(sctp, cumtsn, &mp);
2546 		sctp->sctp_xmit_unacked = mp;
2547 		if (acked > 0) {
2548 			trysend = 1;
2549 			cumack_forward = B_TRUE;
2550 			if (fwd_tsn && SEQ_GEQ(sctp->sctp_lastack_rxd,
2551 			    sctp->sctp_adv_pap)) {
2552 				cumack_forward = B_FALSE;
2553 			}
2554 		}
2555 	}
2556 	num_gaps = ntohs(sc->ssc_numfrags);
2557 	if (num_gaps == 0 || mp == NULL || !SCTP_CHUNK_ISSENT(mp) ||
2558 	    chunklen < (sizeof (*sch) + sizeof (*sc) +
2559 	    num_gaps * sizeof (*ssf))) {
2560 		goto ret;
2561 	}
2562 #ifdef	DEBUG
2563 	/*
2564 	 * Since we delete any message that has been acked completely,
2565 	 * the unacked chunk must belong to sctp_xmit_head (as
2566 	 * we don't have a back pointer from the mp to the meta data
2567 	 * we do this).
2568 	 */
2569 	{
2570 		mblk_t	*mp2 = sctp->sctp_xmit_head->b_cont;
2571 
2572 		while (mp2 != NULL) {
2573 			if (mp2 == mp)
2574 				break;
2575 			mp2 = mp2->b_next;
2576 		}
2577 		ASSERT(mp2 != NULL);
2578 	}
2579 #endif
2580 	ump = sctp->sctp_xmit_head;
2581 
2582 	/*
2583 	 * Just remember where we started from, in case we need to call
2584 	 * sctp_process_uo_gaps() if the gap blocks are unordered.
2585 	 */
2586 	mp1 = mp;
2587 
2588 	sdc = (sctp_data_hdr_t *)mp->b_rptr;
2589 	xtsn = ntohl(sdc->sdh_tsn);
2590 	ASSERT(xtsn == cumtsn + 1);
2591 
2592 	/*
2593 	 * Go through SACK gaps. They are ordered based on start TSN.
2594 	 */
2595 	ssf = (sctp_sack_frag_t *)(sc + 1);
2596 	for (i = 0; i < num_gaps; i++, ssf++) {
2597 		if (gapstart != 0) {
2598 			/* check for unordered gap */
2599 			if (SEQ_LEQ(cumtsn + ntohs(ssf->ssf_start), gapstart)) {
2600 				acked += sctp_process_uo_gaps(sctp,
2601 				    cumtsn, ssf, num_gaps - i,
2602 				    sctp->sctp_xmit_head, mp1,
2603 				    &trysend, &fast_recovery, gapstart);
2604 				if (trysend < 0) {
2605 					BUMP_MIB(&sctp_mib, sctpInAckUnsent);
2606 					return (-1);
2607 				}
2608 				break;
2609 			}
2610 		}
2611 		gapstart = cumtsn + ntohs(ssf->ssf_start);
2612 		gapend = cumtsn + ntohs(ssf->ssf_end);
2613 
2614 		/* SACK for TSN we have not sent - ABORT */
2615 		if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) ||
2616 		    SEQ_GT(gapend, sctp->sctp_ltsn - 1)) {
2617 			BUMP_MIB(&sctp_mib, sctpInAckUnsent);
2618 			return (-1);
2619 		} else if (SEQ_LT(gapend, gapstart)) {
2620 			break;
2621 		}
2622 		/*
2623 		 * Let's start at the current TSN (for the 1st gap we start
2624 		 * from the cumulative TSN, for subsequent ones we start from
2625 		 * where the previous gapend was found - second while loop
2626 		 * below) and walk the transmit list till we find the TSN
2627 		 * corresponding to gapstart. All the unacked chunks till we
2628 		 * get to the chunk with TSN == gapstart will have their
2629 		 * SACKCNT incremented by 1. Note since the gap blocks are
2630 		 * ordered, we won't be incrementing the SACKCNT for an
2631 		 * unacked chunk by more than one while processing the gap
2632 		 * blocks. If the SACKCNT for any unacked chunk exceeds
2633 		 * the fast retransmit threshold, we will fast retransmit
2634 		 * after processing all the gap blocks.
2635 		 */
2636 		ASSERT(SEQ_LT(xtsn, gapstart));
2637 		while (xtsn != gapstart) {
2638 			SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1);
2639 			if (SCTP_CHUNK_SACKCNT(mp) == sctp_fast_rxt_thresh) {
2640 				SCTP_CHUNK_REXMIT(mp);
2641 				sctp->sctp_chk_fast_rexmit = B_TRUE;
2642 				trysend = 1;
2643 				if (!fast_recovery) {
2644 					/*
2645 					 * Entering fast recovery.
2646 					 */
2647 					fp = SCTP_CHUNK_DEST(mp);
2648 					fp->ssthresh = fp->cwnd / 2;
2649 					if (fp->ssthresh < 2 * fp->sfa_pmss) {
2650 						fp->ssthresh =
2651 						    2 * fp->sfa_pmss;
2652 					}
2653 					fp->cwnd = fp->ssthresh;
2654 					fp->pba = 0;
2655 					sctp->sctp_recovery_tsn =
2656 					    sctp->sctp_ltsn - 1;
2657 					fast_recovery = B_TRUE;
2658 				}
2659 			}
2660 
2661 			/*
2662 			 * Peer may have reneged on this chunk, so un-sack
2663 			 * it now. If the peer did renege, we need to
2664 			 * readjust unacked.
2665 			 */
2666 			if (SCTP_CHUNK_ISACKED(mp)) {
2667 				chunklen = ntohs(sdc->sdh_len);
2668 				fp = SCTP_CHUNK_DEST(mp);
2669 				fp->suna += chunklen;
2670 				sctp->sctp_unacked += chunklen - sizeof (*sdc);
2671 				SCTP_CHUNK_CLEAR_ACKED(mp);
2672 				if (!fp->timer_running) {
2673 					SCTP_FADDR_TIMER_RESTART(sctp, fp,
2674 					    fp->rto);
2675 				}
2676 			}
2677 
2678 			mp = mp->b_next;
2679 			if (mp == NULL) {
2680 				ump = ump->b_next;
2681 				/*
2682 				 * ump can't be NULL given the sanity check
2683 				 * above.
2684 				 */
2685 				ASSERT(ump != NULL);
2686 				mp = ump->b_cont;
2687 			}
2688 			/*
2689 			 * mp can't be unsent given the sanity check above.
2690 			 */
2691 			ASSERT(SCTP_CHUNK_ISSENT(mp));
2692 			sdc = (sctp_data_hdr_t *)mp->b_rptr;
2693 			xtsn = ntohl(sdc->sdh_tsn);
2694 		}
2695 		/*
2696 		 * Now that we have found the chunk with TSN == 'gapstart',
2697 		 * let's walk till we hit the chunk with TSN == 'gapend'.
2698 		 * All intermediate chunks will be marked ACKED, if they
2699 		 * haven't already been.
2700 		 */
2701 		while (SEQ_LEQ(xtsn, gapend)) {
2702 			/*
2703 			 * SACKed
2704 			 */
2705 			SCTP_CHUNK_SET_SACKCNT(mp, 0);
2706 			if (!SCTP_CHUNK_ISACKED(mp)) {
2707 				SCTP_CHUNK_ACKED(mp);
2708 
2709 				fp = SCTP_CHUNK_DEST(mp);
2710 				chunklen = ntohs(sdc->sdh_len);
2711 				ASSERT(fp->suna >= chunklen);
2712 				fp->suna -= chunklen;
2713 				if (fp->suna == 0) {
2714 					/* All outstanding data acked. */
2715 					fp->pba = 0;
2716 					SCTP_FADDR_TIMER_STOP(fp);
2717 				}
2718 				fp->acked += chunklen;
2719 				acked += chunklen;
2720 				sctp->sctp_unacked -= chunklen - sizeof (*sdc);
2721 				ASSERT(sctp->sctp_unacked >= 0);
2722 			}
2723 			/* Go to the next chunk of the current message */
2724 			mp = mp->b_next;
2725 			/*
2726 			 * Move to the next message in the transmit list
2727 			 * if we are done with all the chunks from the current
2728 			 * message. Note, it is possible to hit the end of the
2729 			 * transmit list here, i.e. if we have already completed
2730 			 * processing the gap block.
2731 			 * Also, note that we break here, which means we
2732 			 * continue processing gap blocks, if any. In case of
2733 			 * ordered gap blocks there can't be any following
2734 			 * this (if there is it will fail the sanity check
2735 			 * above). In case of un-ordered gap blocks we will
2736 			 * switch to sctp_process_uo_gaps().  In either case
2737 			 * it should be fine to continue with NULL ump/mp,
2738 			 * but we just reset it to xmit_head.
2739 			 */
2740 			if (mp == NULL) {
2741 				ump = ump->b_next;
2742 				if (ump == NULL) {
2743 					ASSERT(xtsn == gapend);
2744 					ump = sctp->sctp_xmit_head;
2745 					mp = mp1;
2746 					sdc = (sctp_data_hdr_t *)mp->b_rptr;
2747 					xtsn = ntohl(sdc->sdh_tsn);
2748 					break;
2749 				}
2750 				mp = ump->b_cont;
2751 			}
2752 			/*
2753 			 * Likewise, we could hit an unsent chunk once we have
2754 			 * completed processing the gap block. Again, it is
2755 			 * fine to continue processing gap blocks with mp
2756 			 * pointing to the unsent chunk, because if there
2757 			 * are more ordered gap blocks, they will fail the
2758 			 * sanity check, and if there are un-ordered gap blocks,
2759 			 * we will continue processing in sctp_process_uo_gaps()
2760 			 * We just reset the mp to the one we started with.
2761 			 */
2762 			if (!SCTP_CHUNK_ISSENT(mp)) {
2763 				ASSERT(xtsn == gapend);
2764 				ump = sctp->sctp_xmit_head;
2765 				mp = mp1;
2766 				sdc = (sctp_data_hdr_t *)mp->b_rptr;
2767 				xtsn = ntohl(sdc->sdh_tsn);
2768 				break;
2769 			}
2770 			sdc = (sctp_data_hdr_t *)mp->b_rptr;
2771 			xtsn = ntohl(sdc->sdh_tsn);
2772 		}
2773 	}
2774 	if (sctp->sctp_prsctp_aware)
2775 		sctp_check_abandoned_data(sctp, sctp->sctp_current);
2776 	if (sctp->sctp_chk_fast_rexmit)
2777 		sctp_fast_rexmit(sctp);
2778 ret:
2779 	trysend += sctp_set_frwnd(sctp, ntohl(sc->ssc_a_rwnd));
2780 
2781 	/*
2782 	 * If receive window is closed while there is unsent data,
2783 	 * set a timer for doing zero window probes.
2784 	 */
2785 	if (sctp->sctp_frwnd == 0 && sctp->sctp_unacked == 0 &&
2786 	    sctp->sctp_unsent != 0) {
2787 		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
2788 		    sctp->sctp_current->rto);
2789 	}
2790 
2791 	/*
2792 	 * Set cwnd for all destinations.
2793 	 * Congestion window gets increased only when cumulative
2794 	 * TSN moves forward, we're not in fast recovery, and
2795 	 * cwnd has been fully utilized (almost fully, need to allow
2796 	 * some leeway due to non-MSS sized messages).
2797 	 */
2798 	if (sctp->sctp_current->acked == acked) {
2799 		/*
2800 		 * Fast-path, only data sent to sctp_current got acked.
2801 		 */
2802 		fp = sctp->sctp_current;
2803 		if (cumack_forward && !fast_recovery &&
2804 		    (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) {
2805 			if (fp->cwnd < fp->ssthresh) {
2806 				/*
2807 				 * Slow start
2808 				 */
2809 				if (fp->acked > fp->sfa_pmss) {
2810 					fp->cwnd += fp->sfa_pmss;
2811 				} else {
2812 					fp->cwnd += fp->acked;
2813 				}
2814 				fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max);
2815 			} else {
2816 				/*
2817 				 * Congestion avoidance
2818 				 */
2819 				fp->pba += fp->acked;
2820 				if (fp->pba >= fp->cwnd) {
2821 					fp->pba -= fp->cwnd;
2822 					fp->cwnd += fp->sfa_pmss;
2823 					fp->cwnd = MIN(fp->cwnd,
2824 					    sctp->sctp_cwnd_max);
2825 				}
2826 			}
2827 		}
2828 		/*
2829 		 * Limit the burst of transmitted data segments.
2830 		 */
2831 		if (fp->suna + sctp_maxburst * fp->sfa_pmss < fp->cwnd) {
2832 			fp->cwnd = fp->suna + sctp_maxburst * fp->sfa_pmss;
2833 		}
2834 		fp->acked = 0;
2835 		goto check_ss_rxmit;
2836 	}
2837 	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
2838 		if (cumack_forward && fp->acked && !fast_recovery &&
2839 		    (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) {
2840 			if (fp->cwnd < fp->ssthresh) {
2841 				if (fp->acked > fp->sfa_pmss) {
2842 					fp->cwnd += fp->sfa_pmss;
2843 				} else {
2844 					fp->cwnd += fp->acked;
2845 				}
2846 				fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max);
2847 			} else {
2848 				fp->pba += fp->acked;
2849 				if (fp->pba >= fp->cwnd) {
2850 					fp->pba -= fp->cwnd;
2851 					fp->cwnd += fp->sfa_pmss;
2852 					fp->cwnd = MIN(fp->cwnd,
2853 					    sctp->sctp_cwnd_max);
2854 				}
2855 			}
2856 		}
2857 		if (fp->suna + sctp_maxburst * fp->sfa_pmss < fp->cwnd) {
2858 			fp->cwnd = fp->suna + sctp_maxburst * fp->sfa_pmss;
2859 		}
2860 		fp->acked = 0;
2861 	}
2862 check_ss_rxmit:
2863 	/*
2864 	 * If this is a SACK following a timeout, check if there are
2865 	 * still unacked chunks (sent before the timeout) that we can
2866 	 * send.
2867 	 */
2868 	if (sctp->sctp_rexmitting) {
2869 		if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_rxt_maxtsn)) {
2870 			/*
2871 			 * As we are in retransmission phase, we may get a
2872 			 * SACK which indicates some new chunks are received
2873 			 * but cum_tsn does not advance.  During this
2874 			 * phase, the other side advances cum_tsn only because
2875 			 * it receives our retransmitted chunks.  Only
2876 			 * this signals that some chunks are still
2877 			 * missing.
2878 			 */
2879 			if (cumack_forward)
2880 				sctp_ss_rexmit(sctp);
2881 		} else {
2882 			sctp->sctp_rexmitting = B_FALSE;
2883 			sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
2884 			sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
2885 		}
2886 	}
2887 	return (trysend);
2888 }
2889 
2890 /*
2891  * Returns 0 if the caller should stop processing any more chunks,
2892  * 1 if the caller should skip this chunk and continue processing.
2893  */
2894 static int
2895 sctp_strange_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp)
2896 {
2897 	mblk_t *errmp;
2898 	size_t len;
2899 
2900 	BUMP_LOCAL(sctp->sctp_ibchunks);
2901 	/* check top two bits for action required */
2902 	if (ch->sch_id & 0x40) {	/* also matches 0xc0 */
2903 		len = ntohs(ch->sch_len);
2904 		errmp = sctp_make_err(sctp, SCTP_ERR_UNREC_CHUNK, ch, len);
2905 		if (errmp != NULL)
2906 			sctp_send_err(sctp, errmp, fp);
2907 		if ((ch->sch_id & 0xc0) == 0xc0) {
2908 			/* skip and continue */
2909 			return (1);
2910 		} else {
2911 			/* stop processing */
2912 			return (0);
2913 		}
2914 	}
2915 	if (ch->sch_id & 0x80) {
2916 		/* skip and continue, no error */
2917 		return (1);
2918 	}
2919 	/* top two bits are clear; stop processing and no error */
2920 	return (0);
2921 }
2922 
2923 /*
2924  * Basic sanity checks on all input chunks and parameters: they must
2925  * be of legitimate size for their purported type, and must follow
2926  * ordering conventions as defined in rfc2960.
2927  *
2928  * Returns 1 if the chunk and all encloded params are legitimate,
2929  * 0 otherwise.
2930  */
2931 /*ARGSUSED*/
2932 static int
2933 sctp_check_input(sctp_t *sctp, sctp_chunk_hdr_t *ch, ssize_t len, int first)
2934 {
2935 	sctp_parm_hdr_t	*ph;
2936 	void		*p = NULL;
2937 	ssize_t		clen;
2938 	uint16_t	ch_len;
2939 
2940 	ch_len = ntohs(ch->sch_len);
2941 	if (ch_len > len) {
2942 		return (0);
2943 	}
2944 
2945 	switch (ch->sch_id) {
2946 	case CHUNK_DATA:
2947 		if (ch_len < sizeof (sctp_data_hdr_t)) {
2948 			return (0);
2949 		}
2950 		return (1);
2951 	case CHUNK_INIT:
2952 	case CHUNK_INIT_ACK:
2953 		{
2954 			ssize_t	remlen = len;
2955 
2956 			/*
2957 			 * INIT and INIT-ACK chunks must not be bundled with
2958 			 * any other.
2959 			 */
2960 			if (!first || sctp_next_chunk(ch, &remlen) != NULL ||
2961 			    (ch_len < (sizeof (*ch) +
2962 			    sizeof (sctp_init_chunk_t)))) {
2963 				return (0);
2964 			}
2965 			/* may have params that need checking */
2966 			p = (char *)(ch + 1) + sizeof (sctp_init_chunk_t);
2967 			clen = ch_len - (sizeof (*ch) +
2968 			    sizeof (sctp_init_chunk_t));
2969 		}
2970 		break;
2971 	case CHUNK_SACK:
2972 		if (ch_len < (sizeof (*ch) + sizeof (sctp_sack_chunk_t))) {
2973 			return (0);
2974 		}
2975 		/* dup and gap reports checked by got_sack() */
2976 		return (1);
2977 	case CHUNK_SHUTDOWN:
2978 		if (ch_len < (sizeof (*ch) + sizeof (uint32_t))) {
2979 			return (0);
2980 		}
2981 		return (1);
2982 	case CHUNK_ABORT:
2983 	case CHUNK_ERROR:
2984 		if (ch_len < sizeof (*ch)) {
2985 			return (0);
2986 		}
2987 		/* may have params that need checking */
2988 		p = ch + 1;
2989 		clen = ch_len - sizeof (*ch);
2990 		break;
2991 	case CHUNK_ECNE:
2992 	case CHUNK_CWR:
2993 	case CHUNK_HEARTBEAT:
2994 	case CHUNK_HEARTBEAT_ACK:
2995 	/* Full ASCONF chunk and parameter checks are in asconf.c */
2996 	case CHUNK_ASCONF:
2997 	case CHUNK_ASCONF_ACK:
2998 		if (ch_len < sizeof (*ch)) {
2999 			return (0);
3000 		}
3001 		/* heartbeat data checked by process_heartbeat() */
3002 		return (1);
3003 	case CHUNK_SHUTDOWN_COMPLETE:
3004 		{
3005 			ssize_t remlen = len;
3006 
3007 			/*
3008 			 * SHUTDOWN-COMPLETE chunk must not be bundled with any
3009 			 * other
3010 			 */
3011 			if (!first || sctp_next_chunk(ch, &remlen) != NULL ||
3012 			    ch_len < sizeof (*ch)) {
3013 				return (0);
3014 			}
3015 		}
3016 		return (1);
3017 	case CHUNK_COOKIE:
3018 	case CHUNK_COOKIE_ACK:
3019 	case CHUNK_SHUTDOWN_ACK:
3020 		if (ch_len < sizeof (*ch) || !first) {
3021 			return (0);
3022 		}
3023 		return (1);
3024 	case CHUNK_FORWARD_TSN:
3025 		if (ch_len < (sizeof (*ch) + sizeof (uint32_t)))
3026 			return (0);
3027 		return (1);
3028 	default:
3029 		return (1);	/* handled by strange_chunk() */
3030 	}
3031 
3032 	/* check and byteorder parameters */
3033 	if (clen <= 0) {
3034 		return (1);
3035 	}
3036 	ASSERT(p != NULL);
3037 
3038 	ph = p;
3039 	while (ph != NULL && clen > 0) {
3040 		ch_len = ntohs(ph->sph_len);
3041 		if (ch_len > len || ch_len < sizeof (*ph)) {
3042 			return (0);
3043 		}
3044 		ph = sctp_next_parm(ph, &clen);
3045 	}
3046 
3047 	/* All OK */
3048 	return (1);
3049 }
3050 
3051 /* ARGSUSED */
3052 static sctp_hdr_t *
3053 find_sctp_hdrs(mblk_t *mp, in6_addr_t *src, in6_addr_t *dst,
3054     uint_t *ifindex, uint_t *ip_hdr_len, ip6_pkt_t *ipp, in_pktinfo_t *pinfo)
3055 {
3056 	uchar_t	*rptr;
3057 	ipha_t	*ip4h;
3058 	ip6_t	*ip6h;
3059 	mblk_t	*mp1;
3060 
3061 	rptr = mp->b_rptr;
3062 	if (IPH_HDR_VERSION(rptr) == IPV4_VERSION) {
3063 		*ip_hdr_len = IPH_HDR_LENGTH(rptr);
3064 		ip4h = (ipha_t *)rptr;
3065 		IN6_IPADDR_TO_V4MAPPED(ip4h->ipha_src, src);
3066 		IN6_IPADDR_TO_V4MAPPED(ip4h->ipha_dst, dst);
3067 
3068 		ipp->ipp_fields |= IPPF_HOPLIMIT;
3069 		ipp->ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl;
3070 		if (pinfo != NULL && (pinfo->in_pkt_flags & IPF_RECVIF)) {
3071 			ipp->ipp_fields |= IPPF_IFINDEX;
3072 			ipp->ipp_ifindex = pinfo->in_pkt_ifindex;
3073 		}
3074 	} else {
3075 		ASSERT(IPH_HDR_VERSION(rptr) == IPV6_VERSION);
3076 		ip6h = (ip6_t *)rptr;
3077 		ipp->ipp_fields = IPPF_HOPLIMIT;
3078 		ipp->ipp_hoplimit = ip6h->ip6_hops;
3079 
3080 		if (ip6h->ip6_nxt != IPPROTO_SCTP) {
3081 			/* Look for ifindex information */
3082 			if (ip6h->ip6_nxt == IPPROTO_RAW) {
3083 				ip6i_t *ip6i = (ip6i_t *)ip6h;
3084 
3085 				if (ip6i->ip6i_flags & IP6I_IFINDEX) {
3086 					ASSERT(ip6i->ip6i_ifindex != 0);
3087 					ipp->ipp_fields |= IPPF_IFINDEX;
3088 					ipp->ipp_ifindex = ip6i->ip6i_ifindex;
3089 				}
3090 				rptr = (uchar_t *)&ip6i[1];
3091 				mp->b_rptr = rptr;
3092 				if (rptr == mp->b_wptr) {
3093 					mp1 = mp->b_cont;
3094 					freeb(mp);
3095 					mp = mp1;
3096 					rptr = mp->b_rptr;
3097 				}
3098 				ASSERT(mp->b_wptr - rptr >=
3099 				    IPV6_HDR_LEN + sizeof (sctp_hdr_t));
3100 				ip6h = (ip6_t *)rptr;
3101 			}
3102 			/*
3103 			 * Find any potentially interesting extension headers
3104 			 * as well as the length of the IPv6 + extension
3105 			 * headers.
3106 			 */
3107 			*ip_hdr_len = ip_find_hdr_v6(mp, ip6h, ipp, NULL);
3108 		} else {
3109 			*ip_hdr_len = IPV6_HDR_LEN;
3110 		}
3111 		*src = ip6h->ip6_src;
3112 		*dst = ip6h->ip6_dst;
3113 	}
3114 	ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
3115 	return ((sctp_hdr_t *)&rptr[*ip_hdr_len]);
3116 #undef IPVER
3117 }
3118 
3119 static mblk_t *
3120 sctp_check_in_policy(mblk_t *mp, mblk_t *ipsec_mp)
3121 {
3122 	ipsec_in_t *ii;
3123 	boolean_t check = B_TRUE;
3124 	boolean_t policy_present;
3125 	ipha_t *ipha;
3126 	ip6_t *ip6h;
3127 
3128 	ii = (ipsec_in_t *)ipsec_mp->b_rptr;
3129 	ASSERT(ii->ipsec_in_type == IPSEC_IN);
3130 	if (ii->ipsec_in_dont_check) {
3131 		check = B_FALSE;
3132 		if (!ii->ipsec_in_secure) {
3133 			freeb(ipsec_mp);
3134 			ipsec_mp = NULL;
3135 		}
3136 	}
3137 	if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
3138 		policy_present = ipsec_inbound_v4_policy_present;
3139 		ipha = (ipha_t *)mp->b_rptr;
3140 		ip6h = NULL;
3141 	} else {
3142 		policy_present = ipsec_inbound_v6_policy_present;
3143 		ipha = NULL;
3144 		ip6h = (ip6_t *)mp->b_rptr;
3145 	}
3146 
3147 	if (check && policy_present) {
3148 		/*
3149 		 * The conn_t parameter is NULL because we already know
3150 		 * nobody's home.
3151 		 */
3152 		ipsec_mp = ipsec_check_global_policy(ipsec_mp, (conn_t *)NULL,
3153 		    ipha, ip6h, B_TRUE);
3154 		if (ipsec_mp == NULL)
3155 			return (NULL);
3156 	}
3157 	if (ipsec_mp != NULL)
3158 		freeb(ipsec_mp);
3159 	return (mp);
3160 }
3161 
3162 /* Handle out-of-the-blue packets */
3163 void
3164 sctp_ootb_input(mblk_t *mp, ill_t *recv_ill, uint_t ipif_seqid,
3165     zoneid_t zoneid, boolean_t mctl_present)
3166 {
3167 	sctp_t			*sctp;
3168 	sctp_chunk_hdr_t	*ch;
3169 	sctp_hdr_t		*sctph;
3170 	in6_addr_t		src, dst;
3171 	uint_t			ip_hdr_len;
3172 	uint_t			ifindex;
3173 	ip6_pkt_t		ipp;
3174 	ssize_t			mlen;
3175 	in_pktinfo_t		*pinfo = NULL;
3176 	mblk_t			*first_mp;
3177 
3178 	BUMP_MIB(&sctp_mib, sctpOutOfBlue);
3179 	BUMP_MIB(&sctp_mib, sctpInSCTPPkts);
3180 
3181 	first_mp = mp;
3182 	if (mctl_present)
3183 		mp = mp->b_cont;
3184 
3185 	/* Initiate IPPf processing, if needed. */
3186 	if (IPP_ENABLED(IPP_LOCAL_IN)) {
3187 		ip_process(IPP_LOCAL_IN, &mp,
3188 		    recv_ill->ill_phyint->phyint_ifindex);
3189 		if (mp == NULL) {
3190 			if (mctl_present)
3191 				freeb(first_mp);
3192 			return;
3193 		}
3194 	}
3195 
3196 	if (mp->b_cont != NULL) {
3197 		/*
3198 		 * All subsequent code is vastly simplified if it can
3199 		 * assume a single contiguous chunk of data.
3200 		 */
3201 		if (pullupmsg(mp, -1) == 0) {
3202 			BUMP_MIB(&ip_mib, ipInDiscards);
3203 			freemsg(first_mp);
3204 			return;
3205 		}
3206 	}
3207 
3208 	/*
3209 	 * We don't really need to call this function...  Need to
3210 	 * optimize later.
3211 	 */
3212 	sctph = find_sctp_hdrs(mp, &src, &dst, &ifindex, &ip_hdr_len,
3213 	    &ipp, pinfo);
3214 	mlen = mp->b_wptr - (uchar_t *)(sctph + 1);
3215 	if ((ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen)) == NULL) {
3216 		dprint(3, ("sctp_ootb_input: invalid packet\n"));
3217 		BUMP_MIB(&ip_mib, ipInDiscards);
3218 		freemsg(first_mp);
3219 		return;
3220 	}
3221 
3222 	switch (ch->sch_id) {
3223 	case CHUNK_INIT:
3224 		/* no listener; send abort  */
3225 		if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL)
3226 			return;
3227 		sctp_send_abort(gsctp, sctp_init2vtag(ch), 0,
3228 		    NULL, 0, mp, 0, B_TRUE);
3229 		break;
3230 	case CHUNK_INIT_ACK:
3231 		/* check for changed src addr */
3232 		sctp = sctp_addrlist2sctp(mp, sctph, ch, ipif_seqid, zoneid);
3233 		if (sctp != NULL) {
3234 			/* success; proceed to normal path */
3235 			mutex_enter(&sctp->sctp_lock);
3236 			if (sctp->sctp_running) {
3237 				if (!sctp_add_recvq(sctp, mp, B_FALSE)) {
3238 					BUMP_MIB(&ip_mib, ipInDiscards);
3239 					freemsg(mp);
3240 				}
3241 				mutex_exit(&sctp->sctp_lock);
3242 			} else {
3243 				/*
3244 				 * If the source address is changed, we
3245 				 * don't need to worry too much about
3246 				 * out of order processing.  So we don't
3247 				 * check if the recvq is empty or not here.
3248 				 */
3249 				sctp->sctp_running = B_TRUE;
3250 				mutex_exit(&sctp->sctp_lock);
3251 				sctp_input_data(sctp, mp, NULL);
3252 				WAKE_SCTP(sctp);
3253 				sctp_process_sendq(sctp);
3254 			}
3255 			SCTP_REFRELE(sctp);
3256 			return;
3257 		}
3258 		if (mctl_present)
3259 			freeb(first_mp);
3260 		/* else bogus init ack; drop it */
3261 		break;
3262 	case CHUNK_SHUTDOWN_ACK:
3263 		if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL)
3264 			return;
3265 		sctp_ootb_shutdown_ack(gsctp, mp, ip_hdr_len);
3266 		sctp_process_sendq(gsctp);
3267 		return;
3268 	case CHUNK_ERROR:
3269 	case CHUNK_ABORT:
3270 	case CHUNK_COOKIE_ACK:
3271 	case CHUNK_SHUTDOWN_COMPLETE:
3272 		if (mctl_present)
3273 			freeb(first_mp);
3274 		break;
3275 	default:
3276 		if (mctl_present && sctp_check_in_policy(mp, first_mp) == NULL)
3277 			return;
3278 		sctp_send_abort(gsctp, sctph->sh_verf, 0, NULL, 0, mp, 0,
3279 		    B_TRUE);
3280 		break;
3281 	}
3282 	sctp_process_sendq(gsctp);
3283 	freemsg(mp);
3284 }
3285 
3286 void
3287 sctp_input(conn_t *connp, ipha_t *ipha, mblk_t *mp, mblk_t *first_mp,
3288     ill_t *recv_ill, boolean_t isv4, boolean_t mctl_present)
3289 {
3290 	sctp_t *sctp = CONN2SCTP(connp);
3291 
3292 	/*
3293 	 * We check some fields in conn_t without holding a lock.
3294 	 * This should be fine.
3295 	 */
3296 	if (CONN_INBOUND_POLICY_PRESENT(connp) || mctl_present) {
3297 		first_mp = ipsec_check_inbound_policy(first_mp, connp,
3298 		    ipha, NULL, mctl_present);
3299 		if (first_mp == NULL) {
3300 			SCTP_REFRELE(sctp);
3301 			return;
3302 		}
3303 	}
3304 
3305 	/* Initiate IPPF processing for fastpath */
3306 	if (IPP_ENABLED(IPP_LOCAL_IN)) {
3307 		ip_process(IPP_LOCAL_IN, &mp,
3308 		    recv_ill->ill_phyint->phyint_ifindex);
3309 		if (mp == NULL) {
3310 			SCTP_REFRELE(sctp);
3311 			if (mctl_present)
3312 				freeb(first_mp);
3313 			return;
3314 		} else if (mctl_present) {
3315 			/*
3316 			 * ip_process might return a new mp.
3317 			 */
3318 			ASSERT(first_mp != mp);
3319 			first_mp->b_cont = mp;
3320 		} else {
3321 			first_mp = mp;
3322 		}
3323 	}
3324 
3325 	if (connp->conn_recvif || connp->conn_recvslla ||
3326 	    connp->conn_ipv6_recvpktinfo) {
3327 		int in_flags = 0;
3328 
3329 		if (connp->conn_recvif || connp->conn_ipv6_recvpktinfo) {
3330 			in_flags = IPF_RECVIF;
3331 		}
3332 		if (connp->conn_recvslla) {
3333 			in_flags |= IPF_RECVSLLA;
3334 		}
3335 		if (isv4) {
3336 			mp = ip_add_info(mp, recv_ill, in_flags);
3337 		} else {
3338 			mp = ip_add_info_v6(mp, recv_ill,
3339 			    &(((ip6_t *)ipha)->ip6_dst));
3340 		}
3341 		if (mp == NULL) {
3342 			SCTP_REFRELE(sctp);
3343 			if (mctl_present)
3344 				freeb(first_mp);
3345 			return;
3346 		} else if (mctl_present) {
3347 			/*
3348 			 * ip_add_info might return a new mp.
3349 			 */
3350 			ASSERT(first_mp != mp);
3351 			first_mp->b_cont = mp;
3352 		} else {
3353 			first_mp = mp;
3354 		}
3355 	}
3356 
3357 	mutex_enter(&sctp->sctp_lock);
3358 	if (sctp->sctp_running) {
3359 		if (mctl_present)
3360 			mp->b_prev = first_mp;
3361 		if (!sctp_add_recvq(sctp, mp, B_FALSE)) {
3362 			BUMP_MIB(&ip_mib, ipInDiscards);
3363 			freemsg(first_mp);
3364 		}
3365 		mutex_exit(&sctp->sctp_lock);
3366 		SCTP_REFRELE(sctp);
3367 		return;
3368 	} else {
3369 		sctp->sctp_running = B_TRUE;
3370 		mutex_exit(&sctp->sctp_lock);
3371 
3372 		mutex_enter(&sctp->sctp_recvq_lock);
3373 		if (sctp->sctp_recvq != NULL) {
3374 			if (mctl_present)
3375 				mp->b_prev = first_mp;
3376 			if (!sctp_add_recvq(sctp, mp, B_TRUE)) {
3377 				BUMP_MIB(&ip_mib, ipInDiscards);
3378 				freemsg(first_mp);
3379 			}
3380 			mutex_exit(&sctp->sctp_recvq_lock);
3381 			WAKE_SCTP(sctp);
3382 			SCTP_REFRELE(sctp);
3383 			return;
3384 		}
3385 	}
3386 	mutex_exit(&sctp->sctp_recvq_lock);
3387 	sctp_input_data(sctp, mp, (mctl_present ? first_mp : NULL));
3388 	WAKE_SCTP(sctp);
3389 	sctp_process_sendq(sctp);
3390 	SCTP_REFRELE(sctp);
3391 }
3392 
3393 static void
3394 sctp_process_abort(sctp_t *sctp, sctp_chunk_hdr_t *ch, int err)
3395 {
3396 	BUMP_MIB(&sctp_mib, sctpAborted);
3397 	BUMP_LOCAL(sctp->sctp_ibchunks);
3398 
3399 	sctp_assoc_event(sctp, SCTP_COMM_LOST,
3400 	    ntohs(((sctp_parm_hdr_t *)(ch + 1))->sph_type), ch);
3401 	sctp_clean_death(sctp, err);
3402 }
3403 
3404 void
3405 sctp_input_data(sctp_t *sctp, mblk_t *mp, mblk_t *ipsec_mp)
3406 {
3407 	sctp_chunk_hdr_t	*ch;
3408 	ssize_t			mlen;
3409 	int			gotdata;
3410 	int			trysend;
3411 	sctp_faddr_t		*fp;
3412 	sctp_init_chunk_t	*iack;
3413 	uint32_t		tsn;
3414 	sctp_data_hdr_t		*sdc;
3415 	ip6_pkt_t		ipp;
3416 	in6_addr_t		src;
3417 	in6_addr_t		dst;
3418 	uint_t			ifindex;
3419 	sctp_hdr_t		*sctph;
3420 	uint_t			ip_hdr_len;
3421 	mblk_t			*dups = NULL;
3422 	int			recv_adaption;
3423 	boolean_t		wake_eager = B_FALSE;
3424 	mblk_t			*pinfo_mp;
3425 	in_pktinfo_t		*pinfo = NULL;
3426 	in6_addr_t		peer_src;
3427 	int64_t			now;
3428 
3429 	if (DB_TYPE(mp) != M_DATA) {
3430 		ASSERT(DB_TYPE(mp) == M_CTL);
3431 		if (MBLKL(mp) == sizeof (in_pktinfo_t) &&
3432 		    ((in_pktinfo_t *)mp->b_rptr)->in_pkt_ulp_type ==
3433 		    IN_PKTINFO) {
3434 			pinfo = (in_pktinfo_t *)mp->b_rptr;
3435 			pinfo_mp = mp;
3436 			mp = mp->b_cont;
3437 		} else {
3438 			if (ipsec_mp != NULL)
3439 				freeb(ipsec_mp);
3440 			sctp_icmp_error(sctp, mp);
3441 			return;
3442 		}
3443 	}
3444 	ASSERT(DB_TYPE(mp) == M_DATA);
3445 
3446 	if (mp->b_cont != NULL) {
3447 		/*
3448 		 * All subsequent code is vastly simplified if it can
3449 		 * assume a single contiguous chunk of data.
3450 		 */
3451 		if (pullupmsg(mp, -1) == 0) {
3452 			BUMP_MIB(&ip_mib, ipInDiscards);
3453 			if (ipsec_mp != NULL)
3454 				freeb(ipsec_mp);
3455 			if (pinfo != NULL)
3456 				freeb(pinfo_mp);
3457 			freemsg(mp);
3458 			return;
3459 		}
3460 	}
3461 
3462 	BUMP_LOCAL(sctp->sctp_ipkts);
3463 	sctph = find_sctp_hdrs(mp, &src, &dst, &ifindex, &ip_hdr_len,
3464 	    &ipp, pinfo);
3465 	if (pinfo != NULL)
3466 		freeb(pinfo_mp);
3467 	mlen = mp->b_wptr - (uchar_t *)(sctph + 1);
3468 	ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen);
3469 	if (ch == NULL) {
3470 		BUMP_MIB(&ip_mib, ipInDiscards);
3471 		if (ipsec_mp != NULL)
3472 			freeb(ipsec_mp);
3473 		freemsg(mp);
3474 		return;
3475 	}
3476 
3477 	if (!sctp_check_input(sctp, ch, mlen, 1)) {
3478 		BUMP_MIB(&ip_mib, ipInDiscards);
3479 		goto done;
3480 	}
3481 	/*
3482 	 * Check verfication tag (special handling for INIT,
3483 	 * COOKIE, SHUTDOWN_COMPLETE and SHUTDOWN_ACK chunks).
3484 	 * ABORTs are handled in the chunk processing loop, since
3485 	 * may not appear first. All other checked chunks must
3486 	 * appear first, or will have been dropped by check_input().
3487 	 */
3488 	switch (ch->sch_id) {
3489 	case CHUNK_INIT:
3490 		if (sctph->sh_verf != 0) {
3491 			/* drop it */
3492 			goto done;
3493 		}
3494 		break;
3495 	case CHUNK_SHUTDOWN_COMPLETE:
3496 		if (sctph->sh_verf == sctp->sctp_lvtag)
3497 			break;
3498 		if (sctph->sh_verf == sctp->sctp_fvtag &&
3499 		    SCTP_GET_TBIT(ch)) {
3500 			break;
3501 		}
3502 		/* else drop it */
3503 		goto done;
3504 	case CHUNK_ABORT:
3505 	case CHUNK_COOKIE:
3506 		/* handled below */
3507 		break;
3508 	case CHUNK_SHUTDOWN_ACK:
3509 		if (sctp->sctp_state > SCTPS_BOUND &&
3510 		    sctp->sctp_state < SCTPS_ESTABLISHED) {
3511 			/* treat as OOTB */
3512 			sctp_ootb_shutdown_ack(sctp, mp, ip_hdr_len);
3513 			if (ipsec_mp != NULL)
3514 				freeb(ipsec_mp);
3515 			return;
3516 		}
3517 		/* else fallthru */
3518 	default:
3519 		/*
3520 		 * All other packets must have a valid
3521 		 * verification tag, however if this is a
3522 		 * listener, we use a refined version of
3523 		 * out-of-the-blue logic.
3524 		 */
3525 		if (sctph->sh_verf != sctp->sctp_lvtag &&
3526 		    sctp->sctp_state != SCTPS_LISTEN) {
3527 			/* drop it */
3528 			goto done;
3529 		}
3530 		break;
3531 	}
3532 
3533 	/* Have a valid sctp for this packet */
3534 	fp = sctp_lookup_faddr(sctp, &src);
3535 	dprint(2, ("sctp_dispatch_rput: mp=%p fp=%p sctp=%p\n", (void *)mp,
3536 	    (void *)fp, (void *)sctp));
3537 
3538 	gotdata = 0;
3539 	trysend = 0;
3540 
3541 	now = lbolt64;
3542 	/* Process the chunks */
3543 	do {
3544 		dprint(3, ("sctp_dispatch_rput: state=%d, chunk id=%d\n",
3545 		    sctp->sctp_state, (int)(ch->sch_id)));
3546 
3547 		if (ch->sch_id == CHUNK_ABORT) {
3548 			if (sctph->sh_verf != sctp->sctp_lvtag &&
3549 			    sctph->sh_verf != sctp->sctp_fvtag) {
3550 				/* drop it */
3551 				goto done;
3552 			}
3553 		}
3554 
3555 		switch (sctp->sctp_state) {
3556 
3557 		case SCTPS_ESTABLISHED:
3558 		case SCTPS_SHUTDOWN_PENDING:
3559 		case SCTPS_SHUTDOWN_SENT:
3560 			switch (ch->sch_id) {
3561 			case CHUNK_DATA:
3562 				/* 0-length data chunks are not allowed */
3563 				if (ntohs(ch->sch_len) == sizeof (*sdc)) {
3564 					sdc = (sctp_data_hdr_t *)ch;
3565 					tsn = sdc->sdh_tsn;
3566 					sctp_send_abort(sctp, sctp->sctp_fvtag,
3567 					    SCTP_ERR_NO_USR_DATA, (char *)&tsn,
3568 					    sizeof (tsn), mp, 0, B_FALSE);
3569 					sctp_assoc_event(sctp, SCTP_COMM_LOST,
3570 					    0, NULL);
3571 					sctp_clean_death(sctp, ECONNABORTED);
3572 					goto done;
3573 				}
3574 
3575 				ASSERT(fp != NULL);
3576 				sctp->sctp_lastdata = fp;
3577 				sctp_data_chunk(sctp, ch, mp, &dups, fp, &ipp);
3578 				gotdata = 1;
3579 				/* Restart shutdown timer if shutting down */
3580 				if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
3581 					/*
3582 					 * If we have exceeded our max
3583 					 * wait bound for waiting for a
3584 					 * shutdown ack from the peer,
3585 					 * abort the association.
3586 					 */
3587 					if (sctp_shutack_wait_bound != 0 &&
3588 					    TICK_TO_MSEC(now -
3589 					    sctp->sctp_out_time) >
3590 					    sctp_shutack_wait_bound) {
3591 						sctp_send_abort(sctp,
3592 						    sctp->sctp_fvtag, 0, NULL,
3593 						    0, mp, 0, B_FALSE);
3594 						sctp_assoc_event(sctp,
3595 						    SCTP_COMM_LOST, 0, NULL);
3596 						sctp_clean_death(sctp,
3597 						    ECONNABORTED);
3598 						goto done;
3599 					}
3600 					SCTP_FADDR_TIMER_RESTART(sctp, fp,
3601 					    fp->rto);
3602 				}
3603 				break;
3604 			case CHUNK_SACK:
3605 				ASSERT(fp != NULL);
3606 				/*
3607 				 * Peer is real and alive if it can ack our
3608 				 * data.
3609 				 */
3610 				sctp_faddr_alive(sctp, fp);
3611 				trysend = sctp_got_sack(sctp, ch);
3612 				if (trysend < 0) {
3613 					sctp_send_abort(sctp, sctph->sh_verf,
3614 					    0, NULL, 0, mp, 0, B_FALSE);
3615 					sctp_assoc_event(sctp,
3616 					    SCTP_COMM_LOST, 0, NULL);
3617 					sctp_clean_death(sctp,
3618 					    ECONNABORTED);
3619 					goto done;
3620 				}
3621 				break;
3622 			case CHUNK_HEARTBEAT:
3623 				sctp_return_heartbeat(sctp, ch, mp);
3624 				break;
3625 			case CHUNK_HEARTBEAT_ACK:
3626 				sctp_process_heartbeat(sctp, ch);
3627 				break;
3628 			case CHUNK_SHUTDOWN:
3629 				sctp_shutdown_event(sctp);
3630 				trysend = sctp_shutdown_received(sctp, ch,
3631 				    B_FALSE, B_FALSE, fp);
3632 				BUMP_LOCAL(sctp->sctp_ibchunks);
3633 				break;
3634 			case CHUNK_SHUTDOWN_ACK:
3635 				BUMP_LOCAL(sctp->sctp_ibchunks);
3636 				if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
3637 					sctp_shutdown_complete(sctp);
3638 					BUMP_MIB(&sctp_mib, sctpShutdowns);
3639 					sctp_assoc_event(sctp,
3640 					    SCTP_SHUTDOWN_COMP, 0, NULL);
3641 					sctp_clean_death(sctp, 0);
3642 					goto done;
3643 				}
3644 				break;
3645 			case CHUNK_ABORT: {
3646 				sctp_saddr_ipif_t *sp;
3647 
3648 				/* Ignore if delete pending */
3649 				sp = sctp_saddr_lookup(sctp, &dst, 0);
3650 				ASSERT(sp != NULL);
3651 				if (sp->saddr_ipif_delete_pending) {
3652 					BUMP_LOCAL(sctp->sctp_ibchunks);
3653 					break;
3654 				}
3655 
3656 				sctp_process_abort(sctp, ch, ECONNRESET);
3657 				goto done;
3658 			}
3659 			case CHUNK_INIT:
3660 				sctp_send_initack(sctp, sctph, ch, mp);
3661 				break;
3662 			case CHUNK_COOKIE:
3663 				if (sctp_process_cookie(sctp, ch, mp, &iack,
3664 				    sctph, &recv_adaption, NULL) != -1) {
3665 					sctp_send_cookie_ack(sctp);
3666 					sctp_assoc_event(sctp, SCTP_RESTART,
3667 					    0, NULL);
3668 					if (recv_adaption) {
3669 						sctp->sctp_recv_adaption = 1;
3670 						sctp_adaption_event(sctp);
3671 					}
3672 				} else {
3673 					BUMP_MIB(&sctp_mib,
3674 					    sctpInInvalidCookie);
3675 				}
3676 				break;
3677 			case CHUNK_ERROR: {
3678 				int error;
3679 
3680 				BUMP_LOCAL(sctp->sctp_ibchunks);
3681 				error = sctp_handle_error(sctp, sctph, ch, mp);
3682 				if (error != 0) {
3683 					sctp_clean_death(sctp, error);
3684 					goto done;
3685 				}
3686 				break;
3687 			}
3688 			case CHUNK_ASCONF:
3689 				ASSERT(fp != NULL);
3690 				sctp_input_asconf(sctp, ch, fp);
3691 				BUMP_LOCAL(sctp->sctp_ibchunks);
3692 				break;
3693 			case CHUNK_ASCONF_ACK:
3694 				ASSERT(fp != NULL);
3695 				sctp_faddr_alive(sctp, fp);
3696 				sctp_input_asconf_ack(sctp, ch, fp);
3697 				BUMP_LOCAL(sctp->sctp_ibchunks);
3698 				break;
3699 			case CHUNK_FORWARD_TSN:
3700 				ASSERT(fp != NULL);
3701 				sctp->sctp_lastdata = fp;
3702 				sctp_process_forward_tsn(sctp, ch, fp, &ipp);
3703 				gotdata = 1;
3704 				BUMP_LOCAL(sctp->sctp_ibchunks);
3705 				break;
3706 			default:
3707 				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
3708 					goto nomorechunks;
3709 				} /* else skip and continue processing */
3710 				break;
3711 			}
3712 			break;
3713 
3714 		case SCTPS_LISTEN:
3715 			switch (ch->sch_id) {
3716 			case CHUNK_INIT:
3717 				sctp_send_initack(sctp, sctph, ch, mp);
3718 				break;
3719 			case CHUNK_COOKIE: {
3720 				sctp_t *eager;
3721 
3722 				if (sctp_process_cookie(sctp, ch, mp, &iack,
3723 				    sctph, &recv_adaption, &peer_src) == -1) {
3724 					BUMP_MIB(&sctp_mib,
3725 					    sctpInInvalidCookie);
3726 					goto done;
3727 				}
3728 
3729 				/*
3730 				 * The cookie is good; ensure that
3731 				 * the peer used the verification
3732 				 * tag from the init ack in the header.
3733 				 */
3734 				if (iack->sic_inittag != sctph->sh_verf)
3735 					goto done;
3736 
3737 				eager = sctp_conn_request(sctp, mp, ifindex,
3738 				    ip_hdr_len, iack, ipsec_mp);
3739 				if (eager == NULL) {
3740 					sctp_send_abort(sctp, sctph->sh_verf,
3741 					    SCTP_ERR_NO_RESOURCES, NULL, 0, mp,
3742 					    0, B_FALSE);
3743 					goto done;
3744 				}
3745 
3746 				/*
3747 				 * If there were extra chunks
3748 				 * bundled with the cookie,
3749 				 * they must be processed
3750 				 * on the eager's queue. We
3751 				 * accomplish this by refeeding
3752 				 * the whole packet into the
3753 				 * state machine on the right
3754 				 * q. The packet (mp) gets
3755 				 * there via the eager's
3756 				 * cookie_mp field (overloaded
3757 				 * with the active open role).
3758 				 * This is picked up when
3759 				 * processing the null bind
3760 				 * request put on the eager's
3761 				 * q by sctp_accept(). We must
3762 				 * first revert the cookie
3763 				 * chunk's length field to network
3764 				 * byteorder so it can be
3765 				 * properly reprocessed on the
3766 				 * eager's queue.
3767 				 */
3768 				BUMP_MIB(&sctp_mib, sctpPassiveEstab);
3769 				if (mlen > ntohs(ch->sch_len)) {
3770 					eager->sctp_cookie_mp = dupb(mp);
3771 					mblk_setcred(eager->sctp_cookie_mp,
3772 					    CONN_CRED(eager->sctp_connp));
3773 					/*
3774 					 * If no mem, just let
3775 					 * the peer retransmit.
3776 					 */
3777 				}
3778 				sctp_assoc_event(eager, SCTP_COMM_UP, 0, NULL);
3779 				if (recv_adaption) {
3780 					eager->sctp_recv_adaption = 1;
3781 					eager->sctp_rx_adaption_code =
3782 					    sctp->sctp_rx_adaption_code;
3783 					sctp_adaption_event(eager);
3784 				}
3785 
3786 				eager->sctp_active = now;
3787 				sctp_send_cookie_ack(eager);
3788 
3789 				wake_eager = B_TRUE;
3790 
3791 				/*
3792 				 * Process rest of the chunks with eager.
3793 				 */
3794 				sctp = eager;
3795 				fp = sctp_lookup_faddr(sctp, &peer_src);
3796 				/*
3797 				 * Confirm peer's original source.  fp can
3798 				 * only be NULL if peer does not use the
3799 				 * original source as one of its addresses...
3800 				 */
3801 				if (fp == NULL)
3802 					fp = sctp_lookup_faddr(sctp, &src);
3803 				else
3804 					sctp_faddr_alive(sctp, fp);
3805 
3806 				/*
3807 				 * Validate the peer addresses.  It also starts
3808 				 * the heartbeat timer.
3809 				 */
3810 				sctp_validate_peer(sctp);
3811 				break;
3812 			}
3813 			/* Anything else is considered out-of-the-blue */
3814 			case CHUNK_ERROR:
3815 			case CHUNK_ABORT:
3816 			case CHUNK_COOKIE_ACK:
3817 			case CHUNK_SHUTDOWN_COMPLETE:
3818 				BUMP_LOCAL(sctp->sctp_ibchunks);
3819 				goto done;
3820 			default:
3821 				BUMP_LOCAL(sctp->sctp_ibchunks);
3822 				sctp_send_abort(sctp, sctph->sh_verf, 0, NULL,
3823 				    0, mp, 0, B_TRUE);
3824 				goto done;
3825 			}
3826 			break;
3827 
3828 		case SCTPS_COOKIE_WAIT:
3829 			switch (ch->sch_id) {
3830 			case CHUNK_INIT_ACK:
3831 				sctp_stop_faddr_timers(sctp);
3832 				sctp_faddr_alive(sctp, sctp->sctp_current);
3833 				sctp_send_cookie_echo(sctp, ch, mp);
3834 				BUMP_LOCAL(sctp->sctp_ibchunks);
3835 				break;
3836 			case CHUNK_ABORT:
3837 				sctp_process_abort(sctp, ch, ECONNREFUSED);
3838 				goto done;
3839 			case CHUNK_INIT:
3840 				sctp_send_initack(sctp, sctph, ch, mp);
3841 				break;
3842 			case CHUNK_COOKIE:
3843 				if (sctp_process_cookie(sctp, ch, mp, &iack,
3844 				    sctph, &recv_adaption, NULL) == -1) {
3845 					BUMP_MIB(&sctp_mib,
3846 					    sctpInInvalidCookie);
3847 					break;
3848 				}
3849 				sctp_send_cookie_ack(sctp);
3850 				sctp_stop_faddr_timers(sctp);
3851 				if (!SCTP_IS_DETACHED(sctp)) {
3852 				    sctp->sctp_ulp_connected(sctp->sctp_ulpd);
3853 				    sctp_set_ulp_prop(sctp);
3854 				}
3855 				sctp->sctp_state = SCTPS_ESTABLISHED;
3856 				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
3857 				BUMP_MIB(&sctp_mib, sctpActiveEstab);
3858 				if (sctp->sctp_cookie_mp) {
3859 					freemsg(sctp->sctp_cookie_mp);
3860 					sctp->sctp_cookie_mp = NULL;
3861 				}
3862 
3863 				/* Validate the peer addresses. */
3864 				sctp->sctp_active = now;
3865 				sctp_validate_peer(sctp);
3866 
3867 				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
3868 				if (recv_adaption) {
3869 					sctp->sctp_recv_adaption = 1;
3870 					sctp_adaption_event(sctp);
3871 				}
3872 				/* Try sending queued data, or ASCONFs */
3873 				trysend = 1;
3874 				break;
3875 			default:
3876 				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
3877 					goto nomorechunks;
3878 				} /* else skip and continue processing */
3879 				break;
3880 			}
3881 			break;
3882 
3883 		case SCTPS_COOKIE_ECHOED:
3884 			switch (ch->sch_id) {
3885 			case CHUNK_COOKIE_ACK:
3886 				if (!SCTP_IS_DETACHED(sctp)) {
3887 				    sctp->sctp_ulp_connected(sctp->sctp_ulpd);
3888 				    sctp_set_ulp_prop(sctp);
3889 				}
3890 				if (sctp->sctp_unacked == 0)
3891 					sctp_stop_faddr_timers(sctp);
3892 				sctp->sctp_state = SCTPS_ESTABLISHED;
3893 				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
3894 				BUMP_MIB(&sctp_mib, sctpActiveEstab);
3895 				BUMP_LOCAL(sctp->sctp_ibchunks);
3896 				if (sctp->sctp_cookie_mp) {
3897 					freemsg(sctp->sctp_cookie_mp);
3898 					sctp->sctp_cookie_mp = NULL;
3899 				}
3900 				sctp_faddr_alive(sctp, fp);
3901 				/* Validate the peer addresses. */
3902 				sctp->sctp_active = now;
3903 				sctp_validate_peer(sctp);
3904 
3905 				/* Try sending queued data, or ASCONFs */
3906 				trysend = 1;
3907 				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
3908 				sctp_adaption_event(sctp);
3909 				break;
3910 			case CHUNK_ABORT:
3911 				sctp_process_abort(sctp, ch, ECONNREFUSED);
3912 				goto done;
3913 			case CHUNK_COOKIE:
3914 				if (sctp_process_cookie(sctp, ch, mp, &iack,
3915 				    sctph, &recv_adaption, NULL) == -1) {
3916 					BUMP_MIB(&sctp_mib,
3917 					    sctpInInvalidCookie);
3918 					break;
3919 				}
3920 				sctp_send_cookie_ack(sctp);
3921 
3922 				if (!SCTP_IS_DETACHED(sctp)) {
3923 				    sctp->sctp_ulp_connected(sctp->sctp_ulpd);
3924 				    sctp_set_ulp_prop(sctp);
3925 				}
3926 				if (sctp->sctp_unacked == 0)
3927 					sctp_stop_faddr_timers(sctp);
3928 				sctp->sctp_state = SCTPS_ESTABLISHED;
3929 				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
3930 				BUMP_MIB(&sctp_mib, sctpActiveEstab);
3931 				if (sctp->sctp_cookie_mp) {
3932 					freemsg(sctp->sctp_cookie_mp);
3933 					sctp->sctp_cookie_mp = NULL;
3934 				}
3935 				/* Validate the peer addresses. */
3936 				sctp->sctp_active = now;
3937 				sctp_validate_peer(sctp);
3938 
3939 				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
3940 				if (recv_adaption) {
3941 					sctp->sctp_recv_adaption = 1;
3942 					sctp_adaption_event(sctp);
3943 				}
3944 				/* Try sending queued data, or ASCONFs */
3945 				trysend = 1;
3946 				break;
3947 			case CHUNK_INIT:
3948 				sctp_send_initack(sctp, sctph, ch, mp);
3949 				break;
3950 			case CHUNK_ERROR: {
3951 				sctp_parm_hdr_t *p;
3952 
3953 				BUMP_LOCAL(sctp->sctp_ibchunks);
3954 				/* check for a stale cookie */
3955 				if (ntohs(ch->sch_len) >=
3956 				    (sizeof (*p) + sizeof (*ch)) +
3957 				    sizeof (uint32_t)) {
3958 
3959 					p = (sctp_parm_hdr_t *)(ch + 1);
3960 					if (p->sph_type ==
3961 					    htons(SCTP_ERR_STALE_COOKIE)) {
3962 						BUMP_MIB(&sctp_mib,
3963 						    sctpAborted);
3964 						sctp_error_event(sctp, ch);
3965 						sctp_clean_death(sctp,
3966 						    ECONNREFUSED);
3967 						goto done;
3968 					}
3969 				}
3970 				break;
3971 			}
3972 			case CHUNK_HEARTBEAT:
3973 				sctp_return_heartbeat(sctp, ch, mp);
3974 				break;
3975 			default:
3976 				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
3977 					goto nomorechunks;
3978 				} /* else skip and continue processing */
3979 			} /* switch (ch->sch_id) */
3980 			break;
3981 
3982 		case SCTPS_SHUTDOWN_ACK_SENT:
3983 			switch (ch->sch_id) {
3984 			case CHUNK_ABORT:
3985 				/* Pass gathered wisdom to IP for keeping */
3986 				sctp_update_ire(sctp);
3987 				sctp_process_abort(sctp, ch, 0);
3988 				goto done;
3989 			case CHUNK_SHUTDOWN_COMPLETE:
3990 				BUMP_LOCAL(sctp->sctp_ibchunks);
3991 				BUMP_MIB(&sctp_mib, sctpShutdowns);
3992 				sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0,
3993 				    NULL);
3994 
3995 				/* Pass gathered wisdom to IP for keeping */
3996 				sctp_update_ire(sctp);
3997 				sctp_clean_death(sctp, 0);
3998 				goto done;
3999 			case CHUNK_SHUTDOWN_ACK:
4000 				sctp_shutdown_complete(sctp);
4001 				BUMP_LOCAL(sctp->sctp_ibchunks);
4002 				BUMP_MIB(&sctp_mib, sctpShutdowns);
4003 				sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0,
4004 				    NULL);
4005 				sctp_clean_death(sctp, 0);
4006 				goto done;
4007 			case CHUNK_COOKIE:
4008 				(void) sctp_shutdown_received(sctp, NULL,
4009 				    B_TRUE, B_FALSE, fp);
4010 				BUMP_LOCAL(sctp->sctp_ibchunks);
4011 				break;
4012 			case CHUNK_HEARTBEAT:
4013 				sctp_return_heartbeat(sctp, ch, mp);
4014 				break;
4015 			default:
4016 				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
4017 					goto nomorechunks;
4018 				} /* else skip and continue processing */
4019 				break;
4020 			}
4021 			break;
4022 
4023 		case SCTPS_SHUTDOWN_RECEIVED:
4024 			switch (ch->sch_id) {
4025 			case CHUNK_SHUTDOWN:
4026 				trysend = sctp_shutdown_received(sctp, ch,
4027 				    B_FALSE, B_FALSE, fp);
4028 				break;
4029 			case CHUNK_SACK:
4030 				trysend = sctp_got_sack(sctp, ch);
4031 				if (trysend < 0) {
4032 					sctp_send_abort(sctp, sctph->sh_verf,
4033 					    0, NULL, 0, mp, 0, B_FALSE);
4034 					sctp_assoc_event(sctp,
4035 					    SCTP_COMM_LOST, 0, NULL);
4036 					sctp_clean_death(sctp,
4037 					    ECONNABORTED);
4038 					goto done;
4039 				}
4040 				break;
4041 			case CHUNK_ABORT:
4042 				sctp_process_abort(sctp, ch, ECONNRESET);
4043 				goto done;
4044 			case CHUNK_HEARTBEAT:
4045 				sctp_return_heartbeat(sctp, ch, mp);
4046 				break;
4047 			default:
4048 				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
4049 					goto nomorechunks;
4050 				} /* else skip and continue processing */
4051 				break;
4052 			}
4053 			break;
4054 
4055 		default:
4056 			/*
4057 			 * The only remaining states are SCTPS_IDLE and
4058 			 * SCTPS_BOUND, and we should not be getting here
4059 			 * for these.
4060 			 */
4061 			ASSERT(0);
4062 		} /* switch (sctp->sctp_state) */
4063 
4064 		ch = sctp_next_chunk(ch, &mlen);
4065 		if (ch != NULL && !sctp_check_input(sctp, ch, mlen, 0))
4066 			goto done;
4067 	} while (ch != NULL);
4068 
4069 	/* Finished processing all chunks in packet */
4070 
4071 nomorechunks:
4072 	/* SACK if necessary */
4073 	if (gotdata) {
4074 		(sctp->sctp_sack_toggle)++;
4075 		sctp_sack(sctp, dups);
4076 		dups = NULL;
4077 
4078 		if (!sctp->sctp_ack_timer_running) {
4079 			sctp->sctp_ack_timer_running = B_TRUE;
4080 			sctp_timer(sctp, sctp->sctp_ack_mp,
4081 			    MSEC_TO_TICK(sctp_deferred_ack_interval));
4082 		}
4083 	}
4084 
4085 	if (trysend) {
4086 		sctp_output(sctp);
4087 		if (sctp->sctp_cxmit_list != NULL)
4088 			sctp_wput_asconf(sctp, NULL);
4089 	}
4090 	/* If there is unsent data, make sure a timer is running */
4091 	if (sctp->sctp_unsent > 0 && !sctp->sctp_current->timer_running) {
4092 		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
4093 		    sctp->sctp_current->rto);
4094 	}
4095 
4096 done:
4097 	if (dups != NULL)
4098 		freeb(dups);
4099 	if (ipsec_mp != NULL)
4100 		freeb(ipsec_mp);
4101 	freemsg(mp);
4102 
4103 	if (wake_eager) {
4104 		/*
4105 		 * sctp points to newly created control block, need to
4106 		 * release it before exiting.  Before releasing it and
4107 		 * processing the sendq, need to grab a hold on it.
4108 		 * Otherwise, another thread can close it while processing
4109 		 * the sendq.
4110 		 */
4111 		SCTP_REFHOLD(sctp);
4112 		WAKE_SCTP(sctp);
4113 		sctp_process_sendq(sctp);
4114 		SCTP_REFRELE(sctp);
4115 	}
4116 }
4117 
4118 /*
4119  * Some amount of data got removed from rx q.
4120  * Check if we should send a window update.
4121  *
4122  * Due to way sctp_rwnd updates are made, ULP can give reports out-of-order.
4123  * To keep from dropping incoming data due to this, we only update
4124  * sctp_rwnd when if it's larger than what we've reported to peer earlier.
4125  */
4126 void
4127 sctp_recvd(sctp_t *sctp, int len)
4128 {
4129 	int32_t old, new;
4130 
4131 	ASSERT(sctp != NULL);
4132 	RUN_SCTP(sctp);
4133 
4134 	if (len < sctp->sctp_rwnd) {
4135 		WAKE_SCTP(sctp);
4136 		return;
4137 	}
4138 	ASSERT(sctp->sctp_rwnd >= sctp->sctp_rxqueued);
4139 	old = sctp->sctp_rwnd - sctp->sctp_rxqueued;
4140 	new = len - sctp->sctp_rxqueued;
4141 	sctp->sctp_rwnd = len;
4142 
4143 	if (sctp->sctp_state >= SCTPS_ESTABLISHED &&
4144 	    ((old <= new >> 1) || (old < sctp->sctp_mss))) {
4145 		sctp->sctp_force_sack = 1;
4146 		BUMP_MIB(&sctp_mib, sctpOutWinUpdate);
4147 		sctp_sack(sctp, NULL);
4148 		old = 1;
4149 	} else {
4150 		old = 0;
4151 	}
4152 	WAKE_SCTP(sctp);
4153 	if (old > 0) {
4154 		sctp_process_sendq(sctp);
4155 	}
4156 }
4157