Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_indata.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $KAME: sctp_indata.c,v 1.35 2004/08/17 04:06:17 itojun Exp $ */ 2 3 /* 4 * Copyright (C) 2002, 2003, 2004 Cisco Systems Inc, 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #if !(defined(__OpenBSD__) || defined(__APPLE__)) 33 #include "opt_ipsec.h" 34 #endif 35 #if defined(__FreeBSD__) || defined(__DragonFly__) 36 #include "opt_inet6.h" 37 #include "opt_inet.h" 38 #endif 39 #if defined(__NetBSD__) 40 #include "opt_inet.h" 41 #endif 42 43 #ifdef __APPLE__ 44 #include <sctp.h> 45 #elif !defined(__OpenBSD__) 46 #include "opt_sctp.h" 47 #endif 48 49 #include <sys/param.h> 50 #include <sys/systm.h> 51 #include <sys/mbuf.h> 52 #include <sys/malloc.h> 53 #include <sys/socket.h> 54 #include <sys/socketvar.h> 55 #include <sys/sysctl.h> 56 57 #include <net/if.h> 58 #include <net/route.h> 59 60 61 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000 62 #include <sys/limits.h> 63 #else 64 #include <machine/limits.h> 65 #endif 66 #include <machine/cpu.h> 67 68 #include <netinet/in.h> 69 #include <netinet/in_systm.h> 70 #include <netinet/ip.h> 71 #ifdef INET6 72 #include <netinet/ip6.h> 73 #endif /* INET6 */ 74 #include <netinet/in_pcb.h> 75 #include <netinet/in_var.h> 76 #include <netinet/ip_var.h> 77 #ifdef INET6 78 #include <netinet6/ip6_var.h> 79 #endif /* INET6 */ 80 #include <netinet/ip_icmp.h> 81 #include <netinet/icmp_var.h> 82 #include <netinet/sctp_var.h> 83 #include <netinet/sctp_pcb.h> 84 #include <netinet/sctp_header.h> 85 #include <netinet/sctputil.h> 86 #include <netinet/sctp_output.h> 87 #include <netinet/sctp_input.h> 88 #include <netinet/sctp_hashdriver.h> 89 #include <netinet/sctp_indata.h> 90 #include <netinet/sctp_uio.h> 91 #include <netinet/sctp_timer.h> 92 #ifdef IPSEC 93 #ifndef __OpenBSD__ 94 #include <netinet6/ipsec.h> 95 #include <netproto/key/key.h> 96 #else 97 #undef IPSEC 98 #endif 99 #endif /*IPSEC*/ 100 101 #include <net/net_osdep.h> 102 103 #ifdef SCTP_DEBUG 104 extern u_int32_t sctp_debug_on; 105 #endif 106 107 /* 108 * NOTES: On the outbound side of things I need to check the sack timer to 109 * see if I should generate a sack into the chunk queue (if I have data to 110 * send that is and will be sending it .. for bundling. 111 * 112 * The callback in sctp_usrreq.c will get called when the socket is read 113 * from. This will cause sctp_service_queues() to get called on the top 114 * entry in the list. 115 */ 116 117 extern int sctp_strict_sacks; 118 119 void 120 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc) 121 { 122 u_int32_t calc, calc_w_oh; 123 124 #ifdef SCTP_DEBUG 125 if (sctp_debug_on & SCTP_DEBUG_INDATA4) { 126 kprintf("cc:%lu hiwat:%lu lowat:%lu mbcnt:%lu mbmax:%lu\n", 127 (u_long)stcb->sctp_socket->so_rcv.ssb_cc, 128 (u_long)stcb->sctp_socket->so_rcv.ssb_hiwat, 129 (u_long)stcb->sctp_socket->so_rcv.ssb_lowat, 130 (u_long)stcb->sctp_socket->so_rcv.ssb_mbcnt, 131 (u_long)stcb->sctp_socket->so_rcv.ssb_mbmax); 132 kprintf("Setting rwnd to: sb:%ld - (del:%d + reasm:%d str:%d)\n", 133 sctp_sbspace(&stcb->sctp_socket->so_rcv), 134 asoc->size_on_delivery_queue, 135 asoc->size_on_reasm_queue, 136 asoc->size_on_all_streams); 137 } 138 #endif 139 if (stcb->sctp_socket->so_rcv.ssb_cc == 0 && 140 asoc->size_on_delivery_queue == 0 && 141 asoc->size_on_reasm_queue == 0 && 142 asoc->size_on_all_streams == 0) { 143 /* Full rwnd granted */ 144 asoc->my_rwnd = max(stcb->sctp_socket->so_rcv.ssb_hiwat, 145 SCTP_MINIMAL_RWND); 146 return; 147 } 148 /* get actual space */ 149 calc = (u_int32_t)sctp_sbspace(&stcb->sctp_socket->so_rcv); 150 151 /* take out what has NOT been put on socket queue and 152 * we yet hold for putting up. 153 */ 154 calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_delivery_queue); 155 calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_reasm_queue); 156 calc = sctp_sbspace_sub(calc, (u_int32_t)asoc->size_on_all_streams); 157 158 /* what is the overhead of all these rwnd's */ 159 calc_w_oh = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len); 160 161 asoc->my_rwnd = calc; 162 if (calc_w_oh == 0) { 163 /* If our overhead is greater than the advertised 164 * rwnd, we clamp the rwnd to 1. This lets us 165 * still accept inbound segments, but hopefully will 166 * shut the sender down when he finally gets the message. 167 */ 168 asoc->my_rwnd = 1; 169 } else { 170 /* SWS threshold */ 171 if (asoc->my_rwnd && 172 (asoc->my_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_receiver)) { 173 /* SWS engaged, tell peer none left */ 174 asoc->my_rwnd = 1; 175 #ifdef SCTP_DEBUG 176 if (sctp_debug_on & SCTP_DEBUG_INDATA4) { 177 kprintf(" - SWS zeros\n"); 178 } 179 } else { 180 if (sctp_debug_on & SCTP_DEBUG_INDATA4) { 181 kprintf("\n"); 182 } 183 #endif 184 } 185 } 186 } 187 188 /* 189 * Take a chk structure and build it into an mbuf. Hmm should we change things 190 * so that instead we store the data side in a chunk? 191 */ 192 static struct mbuf * 193 sctp_build_ctl_nchunk(struct sctp_tcb *stcb, uint32_t tsn, uint32_t ppid, 194 uint32_t context, uint16_t stream_no, uint16_t stream_seq, uint8_t flags) 195 { 196 struct sctp_sndrcvinfo *outinfo; 197 struct cmsghdr *cmh; 198 struct mbuf *ret; 199 200 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) { 201 /* user does not want the sndrcv ctl */ 202 return (NULL); 203 } 204 205 MGETHDR(ret, MB_DONTWAIT, MT_CONTROL); 206 if (ret == NULL) { 207 /* No space */ 208 return (ret); 209 } 210 /* We need a CMSG header followed by the struct */ 211 cmh = mtod(ret, struct cmsghdr *); 212 outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh); 213 cmh->cmsg_level = IPPROTO_SCTP; 214 cmh->cmsg_type = SCTP_SNDRCV; 215 cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 216 outinfo->sinfo_stream = stream_no; 217 outinfo->sinfo_ssn = stream_seq; 218 if (flags & SCTP_DATA_UNORDERED) { 219 outinfo->sinfo_flags = MSG_UNORDERED; 220 } else { 221 outinfo->sinfo_flags = 0; 222 } 223 outinfo->sinfo_ppid = ppid; 224 outinfo->sinfo_context = context; 225 outinfo->sinfo_assoc_id = sctp_get_associd(stcb); 226 outinfo->sinfo_tsn = tsn; 227 outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn; 228 ret->m_len = cmh->cmsg_len; 229 ret->m_pkthdr.len = ret->m_len; 230 /* 231 * We track how many control len's have gone upon the sb 232 * and do not count these in the rwnd calculation. 233 */ 234 stcb->asoc.my_rwnd_control_len += 235 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 236 237 return (ret); 238 } 239 240 /* 241 * Take a chk structure and build it into an mbuf. Should we change things 242 * so that instead we store the data side in a chunk? 243 */ 244 static 245 struct mbuf * 246 sctp_build_ctl(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk) 247 { 248 struct sctp_sndrcvinfo *outinfo; 249 struct cmsghdr *cmh; 250 struct mbuf *ret; 251 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_RECVDATAIOEVNT) == 0) { 252 /* user does not want the sndrcv ctl */ 253 return (NULL); 254 } 255 MGET(ret, MB_DONTWAIT, MT_CONTROL); 256 if (ret == NULL) { 257 /* No space */ 258 return (ret); 259 } 260 261 /* We need a CMSG header followed by the struct */ 262 cmh = mtod(ret, struct cmsghdr *); 263 outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh); 264 cmh->cmsg_level = IPPROTO_SCTP; 265 cmh->cmsg_type = SCTP_SNDRCV; 266 cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 267 outinfo->sinfo_stream = chk->rec.data.stream_number; 268 outinfo->sinfo_ssn = chk->rec.data.stream_seq; 269 if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 270 outinfo->sinfo_flags = MSG_UNORDERED; 271 } else { 272 outinfo->sinfo_flags = 0; 273 } 274 outinfo->sinfo_ppid = chk->rec.data.payloadtype; 275 outinfo->sinfo_context = chk->rec.data.context; 276 outinfo->sinfo_assoc_id = sctp_get_associd(stcb); 277 outinfo->sinfo_tsn = chk->rec.data.TSN_seq; 278 outinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn; 279 ret->m_len = cmh->cmsg_len; 280 stcb->asoc.my_rwnd_control_len += 281 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 282 283 return (ret); 284 } 285 286 int 287 sctp_deliver_data(struct sctp_tcb *stcb, struct sctp_association *asoc, 288 struct sctp_tmit_chunk *chk, int hold_locks) 289 { 290 struct mbuf *control, *m; 291 int free_it; 292 struct sockaddr_in6 sin6; 293 struct sockaddr *to; 294 295 #ifdef SCTP_DEBUG 296 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 297 kprintf("I am now in Deliver data! (%p)\n", chk); 298 } 299 #endif 300 /* get a write lock on the inp if not already */ 301 if (hold_locks == 0) { 302 SCTP_TCB_UNLOCK(stcb); 303 SCTP_INP_WLOCK(stcb->sctp_ep); 304 SCTP_TCB_LOCK(stcb); 305 } 306 free_it = 0; 307 /* We always add it to the queue */ 308 if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 309 /* socket above is long gone */ 310 #ifdef SCTP_DEBUG 311 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 312 kprintf("gone is gone!\n"); 313 } 314 #endif 315 if (chk != NULL) { 316 if (chk->data) 317 sctp_m_freem(chk->data); 318 chk->data = NULL; 319 sctp_free_remote_addr(chk->whoTo); 320 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 321 sctppcbinfo.ipi_count_chunk--; 322 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 323 panic("Chunk count is negative"); 324 } 325 sctppcbinfo.ipi_gencnt_chunk++; 326 } 327 TAILQ_FOREACH(chk, &asoc->delivery_queue, sctp_next) { 328 asoc->size_on_delivery_queue -= chk->send_size; 329 asoc->cnt_on_delivery_queue--; 330 /* 331 * Lose the data pointer, since its in the socket buffer 332 */ 333 if (chk->data) 334 sctp_m_freem(chk->data); 335 chk->data = NULL; 336 /* Now free the address and data */ 337 sctp_free_remote_addr(chk->whoTo); 338 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 339 sctppcbinfo.ipi_count_chunk--; 340 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 341 panic("Chunk count is negative"); 342 } 343 sctppcbinfo.ipi_gencnt_chunk++; 344 } 345 if (hold_locks == 0) 346 SCTP_INP_WUNLOCK(stcb->sctp_ep); 347 return (0); 348 } 349 if (chk != NULL) { 350 TAILQ_INSERT_TAIL(&asoc->delivery_queue, chk, sctp_next); 351 asoc->size_on_delivery_queue += chk->send_size; 352 asoc->cnt_on_delivery_queue++; 353 } 354 if (asoc->fragmented_delivery_inprogress) { 355 /* 356 * oh oh, fragmented delivery in progress 357 * return out of here. 358 */ 359 #ifdef SCTP_DEBUG 360 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 361 kprintf("Fragmented delivery in progress?\n"); 362 } 363 #endif 364 if (hold_locks == 0) 365 SCTP_INP_WUNLOCK(stcb->sctp_ep); 366 return (0); 367 } 368 /* Now grab the first one */ 369 chk = TAILQ_FIRST(&asoc->delivery_queue); 370 if (chk == NULL) { 371 /* Nothing in queue */ 372 #ifdef SCTP_DEBUG 373 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 374 kprintf("Nothing in queue?\n"); 375 } 376 #endif 377 asoc->size_on_delivery_queue = 0; 378 asoc->cnt_on_delivery_queue = 0; 379 if (hold_locks == 0) 380 SCTP_INP_WUNLOCK(stcb->sctp_ep); 381 return (0); 382 } 383 384 if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) { 385 /* Boy, there really is NO room */ 386 if (hold_locks == 0) 387 SCTP_INP_WUNLOCK(stcb->sctp_ep); 388 return (0); 389 } 390 #ifdef SCTP_DEBUG 391 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 392 kprintf("Now to the delivery with chk(%p)!\n", chk); 393 } 394 #endif 395 /* XXX need to append PKTHDR to the socket buffer first */ 396 if ((chk->data->m_flags & M_PKTHDR) == 0) { 397 MGETHDR(m, MB_DONTWAIT, MT_DATA); 398 if (m == NULL) { 399 /* no room! */ 400 if (hold_locks == 0) 401 SCTP_INP_WUNLOCK(stcb->sctp_ep); 402 return (0); 403 } 404 m->m_pkthdr.len = chk->send_size; 405 m->m_len = 0; 406 m->m_next = chk->data; 407 chk->data = m; 408 } 409 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 410 if (chk->data->m_next == NULL) { 411 /* hopefully we hit here most of the time */ 412 chk->data->m_flags |= M_EOR; 413 } else { 414 /* Add the flag to the LAST mbuf in the chain */ 415 m = chk->data; 416 while (m->m_next != NULL) { 417 m = m->m_next; 418 } 419 m->m_flags |= M_EOR; 420 } 421 } 422 423 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) { 424 struct sockaddr_in6 lsa6; 425 426 control = sctp_build_ctl(stcb, chk); 427 to = (struct sockaddr *)&chk->whoTo->ro._l_addr; 428 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) && 429 to->sa_family == AF_INET) { 430 struct sockaddr_in *sin; 431 432 sin = (struct sockaddr_in *)to; 433 bzero(&sin6, sizeof(sin6)); 434 sin6.sin6_family = AF_INET6; 435 sin6.sin6_len = sizeof(struct sockaddr_in6); 436 sin6.sin6_addr.s6_addr16[2] = 0xffff; 437 bcopy(&sin->sin_addr, &sin6.sin6_addr.s6_addr16[3], 438 sizeof(sin6.sin6_addr.s6_addr16[3])); 439 sin6.sin6_port = sin->sin_port; 440 to = (struct sockaddr *)&sin6; 441 } 442 /* check and strip embedded scope junk */ 443 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to, 444 &lsa6); 445 if (((struct sockaddr_in *)to)->sin_port == 0) { 446 kprintf("Huh a, port is %d not net:%p %d?\n", 447 ((struct sockaddr_in *)to)->sin_port, 448 chk->whoTo, 449 (int)(ntohs(stcb->rport))); 450 ((struct sockaddr_in *)to)->sin_port = stcb->rport; 451 } 452 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < (long)chk->send_size) { 453 /* Gak not enough room */ 454 if (control) { 455 sctp_m_freem(control); 456 stcb->asoc.my_rwnd_control_len -= 457 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 458 } 459 goto skip; 460 } 461 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token); 462 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, 463 to, chk->data, control, stcb->asoc.my_vtag, 464 stcb->sctp_ep)) { 465 /* Gak not enough room */ 466 if (control) { 467 sctp_m_freem(control); 468 stcb->asoc.my_rwnd_control_len -= 469 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 470 } 471 } else { 472 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) { 473 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) { 474 stcb->asoc.my_rwnd_control_len += 475 sizeof(struct mbuf); 476 } 477 } else { 478 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf); 479 } 480 free_it = 1; 481 } 482 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 483 } else { 484 /* append to a already started message. */ 485 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token); 486 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >= 487 (long)chk->send_size) { 488 ssb_append(&stcb->sctp_socket->so_rcv, chk->data); 489 free_it = 1; 490 } 491 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 492 } 493 skip: 494 if (hold_locks == 0) 495 SCTP_INP_WUNLOCK(stcb->sctp_ep); 496 /* free up the one we inserted */ 497 if (free_it) { 498 /* Pull it off the queue */ 499 #ifdef SCTP_DEBUG 500 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 501 kprintf("Free_it true, doing tickle wakeup\n"); 502 } 503 #endif 504 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 505 TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next); 506 asoc->size_on_delivery_queue -= chk->send_size; 507 asoc->cnt_on_delivery_queue--; 508 /* Lose the data pointer, since its in the socket buffer */ 509 chk->data = NULL; 510 /* Now free the address and data */ 511 sctp_free_remote_addr(chk->whoTo); 512 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 513 sctppcbinfo.ipi_count_chunk--; 514 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 515 panic("Chunk count is negative"); 516 } 517 sctppcbinfo.ipi_gencnt_chunk++; 518 } 519 return (free_it); 520 } 521 522 /* 523 * We are delivering currently from the reassembly queue. We must continue to 524 * deliver until we either: 525 * 1) run out of space. 526 * 2) run out of sequential TSN's 527 * 3) hit the SCTP_DATA_LAST_FRAG flag. 528 */ 529 static void 530 sctp_service_reassembly(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks) 531 { 532 struct sockaddr *to; 533 struct sockaddr_in6 sin6; 534 struct sctp_tmit_chunk *chk, *at; 535 struct mbuf *control, *m; 536 u_int16_t nxt_todel; 537 u_int16_t stream_no; 538 int cntDel; 539 cntDel = stream_no = 0; 540 if (hold_locks == 0) { 541 /* 542 * you always have the TCB lock, we need 543 * to have the inp write lock as well. 544 */ 545 SCTP_TCB_UNLOCK(stcb); 546 SCTP_INP_WLOCK(stcb->sctp_ep); 547 SCTP_TCB_LOCK(stcb); 548 } 549 if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 550 /* socket above is long gone */ 551 asoc->fragmented_delivery_inprogress = 0; 552 TAILQ_FOREACH(chk, &asoc->reasmqueue, sctp_next) { 553 asoc->size_on_delivery_queue -= chk->send_size; 554 asoc->cnt_on_delivery_queue--; 555 /* 556 * Lose the data pointer, since its in the socket buffer 557 */ 558 if (chk->data) 559 sctp_m_freem(chk->data); 560 chk->data = NULL; 561 /* Now free the address and data */ 562 sctp_free_remote_addr(chk->whoTo); 563 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 564 sctppcbinfo.ipi_count_chunk--; 565 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 566 panic("Chunk count is negative"); 567 } 568 sctppcbinfo.ipi_gencnt_chunk++; 569 } 570 if (hold_locks == 0) 571 SCTP_INP_WUNLOCK(stcb->sctp_ep); 572 return; 573 } 574 do { 575 if (stcb->sctp_socket->so_rcv.ssb_cc >= 576 stcb->sctp_socket->so_rcv.ssb_hiwat) { 577 if (cntDel) { 578 sctp_sorwakeup(stcb->sctp_ep, 579 stcb->sctp_socket); 580 } 581 if (hold_locks == 0) 582 SCTP_INP_WUNLOCK(stcb->sctp_ep); 583 return; 584 } 585 chk = TAILQ_FIRST(&asoc->reasmqueue); 586 if (chk == NULL) { 587 if (cntDel) { 588 sctp_sorwakeup(stcb->sctp_ep, 589 stcb->sctp_socket); 590 } 591 if (hold_locks == 0) 592 SCTP_INP_WUNLOCK(stcb->sctp_ep); 593 return; 594 } 595 if (chk->rec.data.TSN_seq != (asoc->tsn_last_delivered + 1)) { 596 /* Can't deliver more :< */ 597 if (cntDel) { 598 sctp_sorwakeup(stcb->sctp_ep, 599 stcb->sctp_socket); 600 } 601 if (hold_locks == 0) 602 SCTP_INP_WUNLOCK(stcb->sctp_ep); 603 return; 604 } 605 stream_no = chk->rec.data.stream_number; 606 nxt_todel = asoc->strmin[stream_no].last_sequence_delivered + 1; 607 if (nxt_todel != chk->rec.data.stream_seq && 608 (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 609 /* 610 * Not the next sequence to deliver in its stream OR 611 * unordered 612 */ 613 if (cntDel) { 614 sctp_sorwakeup(stcb->sctp_ep, 615 stcb->sctp_socket); 616 } 617 if (hold_locks == 0) 618 SCTP_INP_WUNLOCK(stcb->sctp_ep); 619 return; 620 } 621 622 if ((chk->data->m_flags & M_PKTHDR) == 0) { 623 MGETHDR(m, MB_DONTWAIT, MT_DATA); 624 if (m == NULL) { 625 /* no room! */ 626 if (hold_locks == 0) 627 SCTP_INP_WUNLOCK(stcb->sctp_ep); 628 return; 629 } 630 m->m_pkthdr.len = chk->send_size; 631 m->m_len = 0; 632 m->m_next = chk->data; 633 chk->data = m; 634 } 635 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 636 if (chk->data->m_next == NULL) { 637 /* hopefully we hit here most of the time */ 638 chk->data->m_flags |= M_EOR; 639 } else { 640 /* Add the flag to the LAST mbuf in the chain */ 641 m = chk->data; 642 while (m->m_next != NULL) { 643 m = m->m_next; 644 } 645 m->m_flags |= M_EOR; 646 } 647 } 648 if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) { 649 struct sockaddr_in6 lsa6; 650 651 control = sctp_build_ctl(stcb, chk); 652 to = (struct sockaddr *)&chk->whoTo->ro._l_addr; 653 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) && 654 to->sa_family == AF_INET) { 655 struct sockaddr_in *sin; 656 sin = (struct sockaddr_in *)to; 657 bzero(&sin6, sizeof(sin6)); 658 sin6.sin6_family = AF_INET6; 659 sin6.sin6_len = sizeof(struct sockaddr_in6); 660 sin6.sin6_addr.s6_addr16[2] = 0xffff; 661 bcopy(&sin->sin_addr, 662 &sin6.sin6_addr.s6_addr16[3], 663 sizeof(sin6.sin6_addr.s6_addr16[3])); 664 sin6.sin6_port = sin->sin_port; 665 to = (struct sockaddr *)&sin6; 666 } 667 /* check and strip embedded scope junk */ 668 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to, 669 &lsa6); 670 if (((struct sockaddr_in *)to)->sin_port == 0) { 671 kprintf("Huh b, port is %d not net:%p %d?\n", 672 ((struct sockaddr_in *)to)->sin_port, 673 chk->whoTo, 674 (int)(ntohs(stcb->rport))); 675 ((struct sockaddr_in *)to)->sin_port = stcb->rport; 676 } 677 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) < 678 (long)chk->send_size) { 679 if (control) { 680 sctp_m_freem(control); 681 stcb->asoc.my_rwnd_control_len -= 682 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 683 } 684 sctp_sorwakeup(stcb->sctp_ep, 685 stcb->sctp_socket); 686 if (hold_locks == 0) 687 SCTP_INP_WUNLOCK(stcb->sctp_ep); 688 return; 689 } 690 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token); 691 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, 692 to, chk->data, control, stcb->asoc.my_vtag, 693 stcb->sctp_ep)) { 694 /* Gak not enough room */ 695 if (control) { 696 sctp_m_freem(control); 697 stcb->asoc.my_rwnd_control_len -= 698 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 699 } 700 sctp_sorwakeup(stcb->sctp_ep, 701 stcb->sctp_socket); 702 if (hold_locks == 0) 703 SCTP_INP_WUNLOCK(stcb->sctp_ep); 704 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 705 return; 706 } 707 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 708 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) { 709 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) { 710 stcb->asoc.my_rwnd_control_len += 711 sizeof(struct mbuf); 712 } 713 } else { 714 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf); 715 } 716 cntDel++; 717 } else { 718 if (sctp_sbspace(&stcb->sctp_socket->so_rcv) >= 719 (long)chk->send_size) { 720 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token); 721 ssb_append(&stcb->sctp_socket->so_rcv, chk->data); 722 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 723 cntDel++; 724 } else { 725 /* out of space in the sb */ 726 sctp_sorwakeup(stcb->sctp_ep, 727 stcb->sctp_socket); 728 if (hold_locks == 0) 729 SCTP_INP_WUNLOCK(stcb->sctp_ep); 730 return; 731 } 732 } 733 /* pull it we did it */ 734 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 735 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 736 asoc->fragmented_delivery_inprogress = 0; 737 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0) { 738 asoc->strmin[stream_no].last_sequence_delivered++; 739 } 740 } 741 asoc->tsn_last_delivered = chk->rec.data.TSN_seq; 742 asoc->size_on_reasm_queue -= chk->send_size; 743 asoc->cnt_on_reasm_queue--; 744 /* free up the chk */ 745 sctp_free_remote_addr(chk->whoTo); 746 chk->data = NULL; 747 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 748 sctppcbinfo.ipi_count_chunk--; 749 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 750 panic("Chunk count is negative"); 751 } 752 sctppcbinfo.ipi_gencnt_chunk++; 753 if (asoc->fragmented_delivery_inprogress == 0) { 754 /* 755 * Now lets see if we can deliver the next one on the 756 * stream 757 */ 758 u_int16_t nxt_todel; 759 struct sctp_stream_in *strm; 760 761 strm = &asoc->strmin[stream_no]; 762 nxt_todel = strm->last_sequence_delivered + 1; 763 chk = TAILQ_FIRST(&strm->inqueue); 764 if (chk && (nxt_todel == chk->rec.data.stream_seq)) { 765 while (chk != NULL) { 766 /* all delivered */ 767 if (nxt_todel == 768 chk->rec.data.stream_seq) { 769 at = TAILQ_NEXT(chk, sctp_next); 770 TAILQ_REMOVE(&strm->inqueue, 771 chk, sctp_next); 772 asoc->size_on_all_streams -= 773 chk->send_size; 774 asoc->cnt_on_all_streams--; 775 strm->last_sequence_delivered++; 776 /* 777 * We ignore the return of 778 * deliver_data here since we 779 * always can hold the chunk on 780 * the d-queue. And we have a 781 * finite number that can be 782 * delivered from the strq. 783 */ 784 sctp_deliver_data(stcb, asoc, chk, 1); 785 chk = at; 786 } else { 787 break; 788 } 789 nxt_todel = 790 strm->last_sequence_delivered + 1; 791 } 792 } 793 if (!TAILQ_EMPTY(&asoc->delivery_queue)) { 794 /* Here if deliver_data fails, we must break */ 795 if (sctp_deliver_data(stcb, asoc, NULL, 1) == 0) 796 break; 797 } 798 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 799 if (hold_locks == 0) 800 SCTP_INP_WUNLOCK(stcb->sctp_ep); 801 return; 802 } 803 chk = TAILQ_FIRST(&asoc->reasmqueue); 804 } while (chk); 805 if (cntDel) { 806 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 807 } 808 if (hold_locks == 0) 809 SCTP_INP_WUNLOCK(stcb->sctp_ep); 810 } 811 812 /* 813 * Queue the chunk either right into the socket buffer if it is the next one 814 * to go OR put it in the correct place in the delivery queue. If we do 815 * append to the so_buf, keep doing so until we are out of order. 816 * One big question still remains, what to do when the socket buffer is FULL?? 817 */ 818 static void 819 sctp_queue_data_to_stream(struct sctp_tcb *stcb, struct sctp_association *asoc, 820 struct sctp_tmit_chunk *chk, int *abort_flag) 821 { 822 struct sctp_stream_in *strm; 823 struct sctp_tmit_chunk *at; 824 int queue_needed; 825 u_int16_t nxt_todel; 826 struct mbuf *oper; 827 828 /*** FIX FIX FIX ??? 829 * Need to add code to deal with 16 bit seq wrap 830 * without a TSN wrap for ordered delivery (maybe). 831 * FIX FIX FIX ??? 832 */ 833 queue_needed = 1; 834 asoc->size_on_all_streams += chk->send_size; 835 asoc->cnt_on_all_streams++; 836 strm = &asoc->strmin[chk->rec.data.stream_number]; 837 nxt_todel = strm->last_sequence_delivered + 1; 838 #ifdef SCTP_STR_LOGGING 839 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INTO_STRD); 840 #endif 841 #ifdef SCTP_DEBUG 842 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 843 kprintf("queue to stream called for ssn:%u lastdel:%u nxt:%u\n", 844 (u_int)chk->rec.data.stream_seq, 845 (u_int)strm->last_sequence_delivered, (u_int)nxt_todel); 846 } 847 #endif 848 if (compare_with_wrap(strm->last_sequence_delivered, 849 chk->rec.data.stream_seq, MAX_SEQ) || 850 (strm->last_sequence_delivered == chk->rec.data.stream_seq)) { 851 /* The incoming sseq is behind where we last delivered? */ 852 #ifdef SCTP_DEBUG 853 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 854 kprintf("Duplicate S-SEQ:%d delivered:%d from peer, Abort association\n", 855 chk->rec.data.stream_seq, 856 strm->last_sequence_delivered); 857 } 858 #endif 859 /* 860 * throw it in the stream so it gets cleaned up in 861 * association destruction 862 */ 863 TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next); 864 MGET(oper, MB_DONTWAIT, MT_DATA); 865 if (oper) { 866 struct sctp_paramhdr *ph; 867 u_int32_t *ippp; 868 869 oper->m_len = sizeof(struct sctp_paramhdr) + 870 sizeof(*ippp); 871 ph = mtod(oper, struct sctp_paramhdr *); 872 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 873 ph->param_length = htons(oper->m_len); 874 ippp = (u_int32_t *)(ph + 1); 875 *ippp = htonl(0x00000001); 876 } 877 sctp_abort_an_association(stcb->sctp_ep, stcb, 878 SCTP_PEER_FAULTY, oper); 879 880 *abort_flag = 1; 881 return; 882 883 } 884 if (nxt_todel == chk->rec.data.stream_seq) { 885 /* can be delivered right away */ 886 #ifdef SCTP_DEBUG 887 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 888 kprintf("It's NEXT!\n"); 889 } 890 #endif 891 #ifdef SCTP_STR_LOGGING 892 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_IMMED_DEL); 893 #endif 894 queue_needed = 0; 895 asoc->size_on_all_streams -= chk->send_size; 896 asoc->cnt_on_all_streams--; 897 strm->last_sequence_delivered++; 898 sctp_deliver_data(stcb, asoc, chk, 0); 899 chk = TAILQ_FIRST(&strm->inqueue); 900 while (chk != NULL) { 901 /* all delivered */ 902 nxt_todel = strm->last_sequence_delivered + 1; 903 if (nxt_todel == chk->rec.data.stream_seq) { 904 at = TAILQ_NEXT(chk, sctp_next); 905 TAILQ_REMOVE(&strm->inqueue, chk, sctp_next); 906 asoc->size_on_all_streams -= chk->send_size; 907 asoc->cnt_on_all_streams--; 908 strm->last_sequence_delivered++; 909 /* 910 * We ignore the return of deliver_data here 911 * since we always can hold the chunk on the 912 * d-queue. And we have a finite number that 913 * can be delivered from the strq. 914 */ 915 #ifdef SCTP_STR_LOGGING 916 sctp_log_strm_del(chk, NULL, 917 SCTP_STR_LOG_FROM_IMMED_DEL); 918 #endif 919 sctp_deliver_data(stcb, asoc, chk, 0); 920 chk = at; 921 continue; 922 } 923 break; 924 } 925 } 926 if (queue_needed) { 927 /* 928 * Ok, we did not deliver this guy, find 929 * the correct place to put it on the queue. 930 */ 931 #ifdef SCTP_DEBUG 932 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 933 kprintf("Queue Needed!\n"); 934 } 935 #endif 936 if (TAILQ_EMPTY(&strm->inqueue)) { 937 /* Empty queue */ 938 #ifdef SCTP_STR_LOGGING 939 sctp_log_strm_del(chk, NULL, SCTP_STR_LOG_FROM_INSERT_HD); 940 #endif 941 TAILQ_INSERT_HEAD(&strm->inqueue, chk, sctp_next); 942 } else { 943 TAILQ_FOREACH(at, &strm->inqueue, sctp_next) { 944 if (compare_with_wrap(at->rec.data.stream_seq, 945 chk->rec.data.stream_seq, MAX_SEQ)) { 946 /* 947 * one in queue is bigger than the new 948 * one, insert before this one 949 */ 950 #ifdef SCTP_STR_LOGGING 951 sctp_log_strm_del(chk, at, 952 SCTP_STR_LOG_FROM_INSERT_MD); 953 #endif 954 TAILQ_INSERT_BEFORE(at, chk, sctp_next); 955 break; 956 } else if (at->rec.data.stream_seq == 957 chk->rec.data.stream_seq) { 958 /* 959 * Gak, He sent me a duplicate str seq 960 * number 961 */ 962 /* 963 * foo bar, I guess I will just free 964 * this new guy, should we abort too? 965 * FIX ME MAYBE? Or it COULD be that 966 * the SSN's have wrapped. Maybe I 967 * should compare to TSN somehow... 968 * sigh for now just blow away the 969 * chunk! 970 */ 971 972 if (chk->data) 973 sctp_m_freem(chk->data); 974 chk->data = NULL; 975 asoc->size_on_all_streams -= chk->send_size; 976 asoc->cnt_on_all_streams--; 977 sctp_pegs[SCTP_DUP_SSN_RCVD]++; 978 sctp_free_remote_addr(chk->whoTo); 979 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 980 sctppcbinfo.ipi_count_chunk--; 981 if ((int)sctppcbinfo.ipi_count_chunk < 982 0) { 983 panic("Chunk count is negative"); 984 } 985 sctppcbinfo.ipi_gencnt_chunk++; 986 return; 987 } else { 988 if (TAILQ_NEXT(at, sctp_next) == NULL) { 989 /* 990 * We are at the end, insert it 991 * after this one 992 */ 993 #ifdef SCTP_STR_LOGGING 994 sctp_log_strm_del(chk, at, 995 SCTP_STR_LOG_FROM_INSERT_TL); 996 #endif 997 TAILQ_INSERT_AFTER(&strm->inqueue, 998 at, chk, sctp_next); 999 break; 1000 } 1001 } 1002 } 1003 } 1004 } else { 1005 /* We delivered some chunks, wake them up */ 1006 1007 #ifdef SCTP_DEBUG 1008 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1009 kprintf("Doing WAKEUP!\n"); 1010 } 1011 #endif 1012 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 1013 } 1014 } 1015 1016 /* 1017 * Returns two things: You get the total size of the deliverable parts of the 1018 * first fragmented message on the reassembly queue. And you get a 1 back if 1019 * all of the message is ready or a 0 back if the message is still incomplete 1020 */ 1021 static int 1022 sctp_is_all_msg_on_reasm(struct sctp_association *asoc, int *t_size) 1023 { 1024 struct sctp_tmit_chunk *chk; 1025 u_int32_t tsn; 1026 1027 *t_size = 0; 1028 chk = TAILQ_FIRST(&asoc->reasmqueue); 1029 if (chk == NULL) { 1030 /* nothing on the queue */ 1031 return (0); 1032 } 1033 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) { 1034 /* Not a first on the queue */ 1035 return (0); 1036 } 1037 tsn = chk->rec.data.TSN_seq; 1038 while (chk) { 1039 if (tsn != chk->rec.data.TSN_seq) { 1040 return (0); 1041 } 1042 *t_size += chk->send_size; 1043 if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) { 1044 return (1); 1045 } 1046 tsn++; 1047 chk = TAILQ_NEXT(chk, sctp_next); 1048 } 1049 return (0); 1050 } 1051 1052 /* 1053 * Dump onto the re-assembly queue, in its proper place. After dumping on 1054 * the queue, see if anthing can be delivered. If so pull it off (or as much 1055 * as we can. If we run out of space then we must dump what we can and set 1056 * the appropriate flag to say we queued what we could. 1057 */ 1058 static void 1059 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc, 1060 struct sctp_tmit_chunk *chk, int *abort_flag) 1061 { 1062 struct mbuf *oper; 1063 u_int16_t nxt_todel; 1064 u_int32_t cum_ackp1, prev_tsn, post_tsn; 1065 int tsize; 1066 struct sctp_tmit_chunk *at, *prev, *next; 1067 1068 prev = next = NULL; 1069 cum_ackp1 = asoc->tsn_last_delivered + 1; 1070 1071 if (TAILQ_EMPTY(&asoc->reasmqueue)) { 1072 /* This is the first one on the queue */ 1073 TAILQ_INSERT_HEAD(&asoc->reasmqueue, chk, sctp_next); 1074 /* 1075 * we do not check for delivery of anything when 1076 * only one fragment is here 1077 */ 1078 asoc->size_on_reasm_queue = chk->send_size; 1079 asoc->cnt_on_reasm_queue++; 1080 if (chk->rec.data.TSN_seq == cum_ackp1) { 1081 if (asoc->fragmented_delivery_inprogress == 0 && 1082 (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) != 1083 SCTP_DATA_FIRST_FRAG) { 1084 /* 1085 * An empty queue, no delivery inprogress, we 1086 * hit the next one and it does NOT have a 1087 * FIRST fragment mark. 1088 */ 1089 #ifdef SCTP_DEBUG 1090 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1091 kprintf("Gak, Evil plot, its not first, no fragmented delivery in progress\n"); 1092 } 1093 #endif 1094 MGET(oper, MB_DONTWAIT, MT_DATA); 1095 if (oper) { 1096 struct sctp_paramhdr *ph; 1097 u_int32_t *ippp; 1098 1099 oper->m_len = 1100 sizeof(struct sctp_paramhdr) + 1101 sizeof(*ippp); 1102 ph = mtod(oper, struct sctp_paramhdr *); 1103 ph->param_type = 1104 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1105 ph->param_length = htons(oper->m_len); 1106 ippp = (u_int32_t *)(ph + 1); 1107 *ippp = htonl(0x10000001); 1108 } 1109 sctp_abort_an_association(stcb->sctp_ep, stcb, 1110 SCTP_PEER_FAULTY, oper); 1111 *abort_flag = 1; 1112 } else if (asoc->fragmented_delivery_inprogress && 1113 (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == SCTP_DATA_FIRST_FRAG) { 1114 /* 1115 * We are doing a partial delivery and the NEXT 1116 * chunk MUST be either the LAST or MIDDLE 1117 * fragment NOT a FIRST 1118 */ 1119 #ifdef SCTP_DEBUG 1120 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1121 kprintf("Gak, Evil plot, it IS a first and fragmented delivery in progress\n"); 1122 } 1123 #endif 1124 MGET(oper, MB_DONTWAIT, MT_DATA); 1125 if (oper) { 1126 struct sctp_paramhdr *ph; 1127 u_int32_t *ippp; 1128 1129 oper->m_len = 1130 sizeof(struct sctp_paramhdr) + 1131 sizeof(*ippp); 1132 ph = mtod(oper, struct sctp_paramhdr *); 1133 ph->param_type = 1134 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1135 ph->param_length = htons(oper->m_len); 1136 ippp = (u_int32_t *)(ph + 1); 1137 *ippp = htonl(0x10000002); 1138 } 1139 sctp_abort_an_association(stcb->sctp_ep, stcb, 1140 SCTP_PEER_FAULTY, oper); 1141 *abort_flag = 1; 1142 } else if (asoc->fragmented_delivery_inprogress) { 1143 /* Here we are ok with a MIDDLE or LAST piece */ 1144 if (chk->rec.data.stream_number != 1145 asoc->str_of_pdapi) { 1146 /* Got to be the right STR No */ 1147 #ifdef SCTP_DEBUG 1148 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1149 kprintf("Gak, Evil plot, it IS not same stream number %d vs %d\n", 1150 chk->rec.data.stream_number, 1151 asoc->str_of_pdapi); 1152 } 1153 #endif 1154 MGET(oper, MB_DONTWAIT, MT_DATA); 1155 if (oper) { 1156 struct sctp_paramhdr *ph; 1157 u_int32_t *ippp; 1158 oper->m_len = 1159 sizeof(struct sctp_paramhdr) + 1160 sizeof(*ippp); 1161 ph = mtod(oper, 1162 struct sctp_paramhdr *); 1163 ph->param_type = 1164 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1165 ph->param_length = 1166 htons(oper->m_len); 1167 ippp = (u_int32_t *)(ph + 1); 1168 *ippp = htonl(0x10000003); 1169 } 1170 sctp_abort_an_association(stcb->sctp_ep, 1171 stcb, SCTP_PEER_FAULTY, oper); 1172 *abort_flag = 1; 1173 } else if ((asoc->fragment_flags & SCTP_DATA_UNORDERED) != 1174 SCTP_DATA_UNORDERED && 1175 chk->rec.data.stream_seq != 1176 asoc->ssn_of_pdapi) { 1177 /* Got to be the right STR Seq */ 1178 #ifdef SCTP_DEBUG 1179 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1180 kprintf("Gak, Evil plot, it IS not same stream seq %d vs %d\n", 1181 chk->rec.data.stream_seq, 1182 asoc->ssn_of_pdapi); 1183 } 1184 #endif 1185 MGET(oper, MB_DONTWAIT, MT_DATA); 1186 if (oper) { 1187 struct sctp_paramhdr *ph; 1188 u_int32_t *ippp; 1189 oper->m_len = 1190 sizeof(struct sctp_paramhdr) + 1191 sizeof(*ippp); 1192 ph = mtod(oper, 1193 struct sctp_paramhdr *); 1194 ph->param_type = 1195 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1196 ph->param_length = 1197 htons(oper->m_len); 1198 ippp = (u_int32_t *)(ph + 1); 1199 *ippp = htonl(0x10000004); 1200 } 1201 sctp_abort_an_association(stcb->sctp_ep, 1202 stcb, SCTP_PEER_FAULTY, oper); 1203 *abort_flag = 1; 1204 } 1205 } 1206 } 1207 return; 1208 } 1209 /* Find its place */ 1210 at = TAILQ_FIRST(&asoc->reasmqueue); 1211 1212 /* Grab the top flags */ 1213 TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) { 1214 if (compare_with_wrap(at->rec.data.TSN_seq, 1215 chk->rec.data.TSN_seq, MAX_TSN)) { 1216 /* 1217 * one in queue is bigger than the new one, insert 1218 * before this one 1219 */ 1220 /* A check */ 1221 asoc->size_on_reasm_queue += chk->send_size; 1222 asoc->cnt_on_reasm_queue++; 1223 next = at; 1224 TAILQ_INSERT_BEFORE(at, chk, sctp_next); 1225 break; 1226 } else if (at->rec.data.TSN_seq == chk->rec.data.TSN_seq) { 1227 /* Gak, He sent me a duplicate str seq number */ 1228 /* 1229 * foo bar, I guess I will just free this new guy, 1230 * should we abort too? FIX ME MAYBE? Or it COULD be 1231 * that the SSN's have wrapped. Maybe I should compare 1232 * to TSN somehow... sigh for now just blow away the 1233 * chunk! 1234 */ 1235 if (chk->data) 1236 sctp_m_freem(chk->data); 1237 chk->data = NULL; 1238 sctp_free_remote_addr(chk->whoTo); 1239 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 1240 sctppcbinfo.ipi_count_chunk--; 1241 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 1242 panic("Chunk count is negative"); 1243 } 1244 sctppcbinfo.ipi_gencnt_chunk++; 1245 return; 1246 } else { 1247 prev = at; 1248 if (TAILQ_NEXT(at, sctp_next) == NULL) { 1249 /* 1250 * We are at the end, insert it after this one 1251 */ 1252 /* check it first */ 1253 asoc->size_on_reasm_queue += chk->send_size; 1254 asoc->cnt_on_reasm_queue++; 1255 TAILQ_INSERT_AFTER(&asoc->reasmqueue, at, chk, sctp_next); 1256 break; 1257 } 1258 } 1259 } 1260 /* Now the audits */ 1261 if (prev) { 1262 prev_tsn = chk->rec.data.TSN_seq - 1; 1263 if (prev_tsn == prev->rec.data.TSN_seq) { 1264 /* 1265 * Ok the one I am dropping onto the end 1266 * is the NEXT. A bit of valdiation here. 1267 */ 1268 if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) == 1269 SCTP_DATA_FIRST_FRAG || 1270 (prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) == 1271 SCTP_DATA_MIDDLE_FRAG) { 1272 /* 1273 * Insert chk MUST be a MIDDLE or LAST fragment 1274 */ 1275 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) == 1276 SCTP_DATA_FIRST_FRAG) { 1277 #ifdef SCTP_DEBUG 1278 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1279 kprintf("Prev check - It can be a midlle or last but not a first\n"); 1280 kprintf("Gak, Evil plot, it's a FIRST!\n"); 1281 } 1282 #endif 1283 MGET(oper, MB_DONTWAIT, MT_DATA); 1284 if (oper) { 1285 struct sctp_paramhdr *ph; 1286 u_int32_t *ippp; 1287 1288 oper->m_len = 1289 sizeof(struct sctp_paramhdr) + 1290 sizeof(*ippp); 1291 ph = mtod(oper, 1292 struct sctp_paramhdr *); 1293 ph->param_type = 1294 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1295 ph->param_length = 1296 htons(oper->m_len); 1297 1298 ippp = (u_int32_t *)(ph + 1); 1299 *ippp = htonl(0x10000005); 1300 } 1301 sctp_abort_an_association(stcb->sctp_ep, 1302 stcb, SCTP_PEER_FAULTY, oper); 1303 *abort_flag = 1; 1304 return; 1305 } 1306 if (chk->rec.data.stream_number != 1307 prev->rec.data.stream_number) { 1308 /* 1309 * Huh, need the correct STR here, they 1310 * must be the same. 1311 */ 1312 #ifdef SCTP_DEBUG 1313 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1314 kprintf("Prev check - Gak, Evil plot, ssn:%d not the same as at:%d\n", 1315 chk->rec.data.stream_number, 1316 prev->rec.data.stream_number); 1317 } 1318 #endif 1319 MGET(oper, MB_DONTWAIT, MT_DATA); 1320 if (oper) { 1321 struct sctp_paramhdr *ph; 1322 u_int32_t *ippp; 1323 1324 oper->m_len = 1325 sizeof(struct sctp_paramhdr) + 1326 sizeof(*ippp); 1327 ph = mtod(oper, 1328 struct sctp_paramhdr *); 1329 ph->param_type = 1330 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1331 ph->param_length = 1332 htons(oper->m_len); 1333 ippp = (u_int32_t *)(ph + 1); 1334 *ippp = htonl(0x10000006); 1335 } 1336 1337 sctp_abort_an_association(stcb->sctp_ep, 1338 stcb, SCTP_PEER_FAULTY, oper); 1339 1340 *abort_flag = 1; 1341 return; 1342 } 1343 if ((prev->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 && 1344 chk->rec.data.stream_seq != 1345 prev->rec.data.stream_seq) { 1346 /* 1347 * Huh, need the correct STR here, they 1348 * must be the same. 1349 */ 1350 #ifdef SCTP_DEBUG 1351 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1352 kprintf("Prev check - Gak, Evil plot, sseq:%d not the same as at:%d\n", 1353 chk->rec.data.stream_seq, 1354 prev->rec.data.stream_seq); 1355 } 1356 #endif 1357 MGET(oper, MB_DONTWAIT, MT_DATA); 1358 if (oper) { 1359 struct sctp_paramhdr *ph; 1360 u_int32_t *ippp; 1361 1362 oper->m_len = 1363 sizeof(struct sctp_paramhdr) + 1364 sizeof(*ippp); 1365 ph = mtod(oper, 1366 struct sctp_paramhdr *); 1367 ph->param_type = 1368 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1369 ph->param_length = 1370 htons(oper->m_len); 1371 ippp = (u_int32_t *)(ph + 1); 1372 *ippp = htonl(0x10000007); 1373 } 1374 1375 sctp_abort_an_association(stcb->sctp_ep, 1376 stcb, SCTP_PEER_FAULTY, oper); 1377 1378 *abort_flag = 1; 1379 return; 1380 } 1381 } else if ((prev->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) == 1382 SCTP_DATA_LAST_FRAG) { 1383 /* Insert chk MUST be a FIRST */ 1384 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) != 1385 SCTP_DATA_FIRST_FRAG) { 1386 #ifdef SCTP_DEBUG 1387 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1388 kprintf("Prev check - Gak, evil plot, its not FIRST and it must be!\n"); 1389 } 1390 #endif 1391 MGET(oper, MB_DONTWAIT, MT_DATA); 1392 if (oper) { 1393 struct sctp_paramhdr *ph; 1394 u_int32_t *ippp; 1395 1396 oper->m_len = 1397 sizeof(struct sctp_paramhdr) + 1398 sizeof(*ippp); 1399 ph = mtod(oper, 1400 struct sctp_paramhdr *); 1401 ph->param_type = 1402 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1403 ph->param_length = 1404 htons(oper->m_len); 1405 ippp = (u_int32_t *)(ph + 1); 1406 *ippp = htonl(0x10000008); 1407 } 1408 1409 sctp_abort_an_association(stcb->sctp_ep, 1410 stcb, SCTP_PEER_FAULTY, oper); 1411 1412 *abort_flag = 1; 1413 return; 1414 } 1415 } 1416 } 1417 } 1418 1419 if (next) { 1420 post_tsn = chk->rec.data.TSN_seq + 1; 1421 if (post_tsn == next->rec.data.TSN_seq) { 1422 /* 1423 * Ok the one I am inserting ahead of 1424 * is my NEXT one. A bit of valdiation here. 1425 */ 1426 if (next->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) { 1427 /* Insert chk MUST be a last fragment */ 1428 if ((chk->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK) 1429 != SCTP_DATA_LAST_FRAG) { 1430 #ifdef SCTP_DEBUG 1431 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1432 kprintf("Next chk - Next is FIRST, we must be LAST\n"); 1433 kprintf("Gak, Evil plot, its not a last!\n"); 1434 } 1435 #endif 1436 MGET(oper, MB_DONTWAIT, MT_DATA); 1437 if (oper) { 1438 struct sctp_paramhdr *ph; 1439 u_int32_t *ippp; 1440 1441 oper->m_len = 1442 sizeof(struct sctp_paramhdr) + 1443 sizeof(*ippp); 1444 ph = mtod(oper, 1445 struct sctp_paramhdr *); 1446 ph->param_type = 1447 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1448 ph->param_length = 1449 htons(oper->m_len); 1450 ippp = (u_int32_t *)(ph + 1); 1451 *ippp = htonl(0x10000009); 1452 } 1453 1454 sctp_abort_an_association(stcb->sctp_ep, 1455 stcb, SCTP_PEER_FAULTY, oper); 1456 1457 *abort_flag = 1; 1458 return; 1459 } 1460 } else if ((next->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) == 1461 SCTP_DATA_MIDDLE_FRAG || 1462 (next->rec.data.rcv_flags&SCTP_DATA_FRAG_MASK) == 1463 SCTP_DATA_LAST_FRAG) { 1464 /* Insert chk CAN be MIDDLE or FIRST NOT LAST */ 1465 if ((chk->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) == 1466 SCTP_DATA_LAST_FRAG) { 1467 #ifdef SCTP_DEBUG 1468 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1469 kprintf("Next chk - Next is a MIDDLE/LAST\n"); 1470 kprintf("Gak, Evil plot, new prev chunk is a LAST\n"); 1471 } 1472 #endif 1473 MGET(oper, MB_DONTWAIT, MT_DATA); 1474 if (oper) { 1475 struct sctp_paramhdr *ph; 1476 u_int32_t *ippp; 1477 1478 oper->m_len = 1479 sizeof(struct sctp_paramhdr) + 1480 sizeof(*ippp); 1481 ph = mtod(oper, 1482 struct sctp_paramhdr *); 1483 ph->param_type = 1484 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1485 ph->param_length = 1486 htons(oper->m_len); 1487 ippp = (u_int32_t *)(ph + 1); 1488 *ippp = htonl(0x1000000a); 1489 } 1490 sctp_abort_an_association(stcb->sctp_ep, 1491 stcb, SCTP_PEER_FAULTY, oper); 1492 1493 *abort_flag = 1; 1494 return; 1495 } 1496 if (chk->rec.data.stream_number != 1497 next->rec.data.stream_number) { 1498 /* 1499 * Huh, need the correct STR here, they 1500 * must be the same. 1501 */ 1502 #ifdef SCTP_DEBUG 1503 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1504 kprintf("Next chk - Gak, Evil plot, ssn:%d not the same as at:%d\n", 1505 chk->rec.data.stream_number, 1506 next->rec.data.stream_number); 1507 } 1508 #endif 1509 MGET(oper, MB_DONTWAIT, MT_DATA); 1510 if (oper) { 1511 struct sctp_paramhdr *ph; 1512 u_int32_t *ippp; 1513 1514 oper->m_len = 1515 sizeof(struct sctp_paramhdr) + 1516 sizeof(*ippp); 1517 ph = mtod(oper, 1518 struct sctp_paramhdr *); 1519 ph->param_type = 1520 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1521 ph->param_length = 1522 htons(oper->m_len); 1523 ippp = (u_int32_t *)(ph + 1); 1524 *ippp = htonl(0x1000000b); 1525 } 1526 1527 sctp_abort_an_association(stcb->sctp_ep, 1528 stcb, SCTP_PEER_FAULTY, oper); 1529 1530 *abort_flag = 1; 1531 return; 1532 } 1533 if ((next->rec.data.rcv_flags & SCTP_DATA_UNORDERED) == 0 && 1534 chk->rec.data.stream_seq != 1535 next->rec.data.stream_seq) { 1536 /* 1537 * Huh, need the correct STR here, they 1538 * must be the same. 1539 */ 1540 #ifdef SCTP_DEBUG 1541 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1542 kprintf("Next chk - Gak, Evil plot, sseq:%d not the same as at:%d\n", 1543 chk->rec.data.stream_seq, 1544 next->rec.data.stream_seq); 1545 } 1546 #endif 1547 MGET(oper, MB_DONTWAIT, MT_DATA); 1548 if (oper) { 1549 struct sctp_paramhdr *ph; 1550 u_int32_t *ippp; 1551 1552 oper->m_len = 1553 sizeof(struct sctp_paramhdr) + 1554 sizeof(*ippp); 1555 ph = mtod(oper, 1556 struct sctp_paramhdr *); 1557 ph->param_type = 1558 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1559 ph->param_length = 1560 htons(oper->m_len); 1561 ippp = (u_int32_t *)(ph + 1); 1562 *ippp = htonl(0x1000000c); 1563 } 1564 1565 sctp_abort_an_association(stcb->sctp_ep, 1566 stcb, SCTP_PEER_FAULTY, oper); 1567 1568 *abort_flag = 1; 1569 return; 1570 1571 } 1572 } 1573 } 1574 } 1575 /* 1576 * now that we have all in there place we must check a number of 1577 * things to see if we can send data to the ULP. 1578 */ 1579 /* we need to do some delivery, if we can */ 1580 chk = TAILQ_FIRST(&asoc->reasmqueue); 1581 if (chk == NULL) { 1582 /* Huh? */ 1583 asoc->size_on_reasm_queue = 0; 1584 asoc->cnt_on_reasm_queue = 0; 1585 return; 1586 } 1587 if (asoc->fragmented_delivery_inprogress == 0) { 1588 nxt_todel = 1589 asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1; 1590 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) && 1591 (nxt_todel == chk->rec.data.stream_seq || 1592 (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) { 1593 /* 1594 * Yep the first one is here and its 1595 * ok to deliver but should we? 1596 */ 1597 if (TAILQ_EMPTY(&asoc->delivery_queue) && 1598 (sctp_is_all_msg_on_reasm(asoc, &tsize) || 1599 (asoc->size_on_reasm_queue >= 1600 (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) && 1601 tsize))) { 1602 /* 1603 * Yes, we setup to 1604 * start reception, by backing down the TSN 1605 * just in case we can't deliver. If we 1606 */ 1607 asoc->fragmented_delivery_inprogress = 1; 1608 asoc->tsn_last_delivered = 1609 chk->rec.data.TSN_seq - 1; 1610 asoc->str_of_pdapi = 1611 chk->rec.data.stream_number; 1612 asoc->ssn_of_pdapi = chk->rec.data.stream_seq; 1613 asoc->fragment_flags = chk->rec.data.rcv_flags; 1614 sctp_service_reassembly(stcb, asoc, 0); 1615 } 1616 } 1617 } else { 1618 sctp_service_reassembly(stcb, asoc, 0); 1619 } 1620 } 1621 1622 /* 1623 * This is an unfortunate routine. It checks to make sure a evil guy is not 1624 * stuffing us full of bad packet fragments. A broken peer could also do this 1625 * but this is doubtful. It is to bad I must worry about evil crackers sigh 1626 * :< more cycles. 1627 */ 1628 static int 1629 sctp_does_chk_belong_to_reasm(struct sctp_association *asoc, 1630 struct sctp_tmit_chunk *chk) 1631 { 1632 struct sctp_tmit_chunk *at; 1633 u_int32_t tsn_est; 1634 1635 TAILQ_FOREACH(at, &asoc->reasmqueue, sctp_next) { 1636 if (compare_with_wrap(chk->rec.data.TSN_seq, 1637 at->rec.data.TSN_seq, MAX_TSN)) { 1638 /* is it one bigger? */ 1639 tsn_est = at->rec.data.TSN_seq + 1; 1640 if (tsn_est == chk->rec.data.TSN_seq) { 1641 /* yep. It better be a last then*/ 1642 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) != 1643 SCTP_DATA_LAST_FRAG) { 1644 /* 1645 * Ok this guy belongs next to a guy 1646 * that is NOT last, it should be a 1647 * middle/last, not a complete chunk. 1648 */ 1649 return (1); 1650 } else { 1651 /* 1652 * This guy is ok since its a LAST and 1653 * the new chunk is a fully self- 1654 * contained one. 1655 */ 1656 return (0); 1657 } 1658 } 1659 } else if (chk->rec.data.TSN_seq == at->rec.data.TSN_seq) { 1660 /* Software error since I have a dup? */ 1661 return (1); 1662 } else { 1663 /* 1664 * Ok, 'at' is larger than new chunk but does it 1665 * need to be right before it. 1666 */ 1667 tsn_est = chk->rec.data.TSN_seq + 1; 1668 if (tsn_est == at->rec.data.TSN_seq) { 1669 /* Yep, It better be a first */ 1670 if ((at->rec.data.rcv_flags & SCTP_DATA_FRAG_MASK) != 1671 SCTP_DATA_FIRST_FRAG) { 1672 return (1); 1673 } else { 1674 return (0); 1675 } 1676 } 1677 } 1678 } 1679 return (0); 1680 } 1681 1682 extern unsigned int sctp_max_chunks_on_queue; 1683 static int 1684 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc, 1685 struct mbuf **m, int offset, struct sctp_data_chunk *ch, int chk_length, 1686 struct sctp_nets *net, u_int32_t *high_tsn, int *abort_flag, 1687 int *break_flag, int last_chunk) 1688 { 1689 /* Process a data chunk */ 1690 /* struct sctp_tmit_chunk *chk;*/ 1691 struct sctp_tmit_chunk *chk; 1692 u_int32_t tsn, gap; 1693 struct mbuf *dmbuf; 1694 int the_len; 1695 u_int16_t strmno, strmseq; 1696 struct mbuf *oper; 1697 1698 chk = NULL; 1699 tsn = ntohl(ch->dp.tsn); 1700 #ifdef SCTP_MAP_LOGGING 1701 sctp_log_map(0, tsn, asoc->cumulative_tsn, SCTP_MAP_PREPARE_SLIDE); 1702 #endif 1703 if (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN) || 1704 asoc->cumulative_tsn == tsn) { 1705 /* It is a duplicate */ 1706 sctp_pegs[SCTP_DUPTSN_RECVD]++; 1707 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) { 1708 /* Record a dup for the next outbound sack */ 1709 asoc->dup_tsns[asoc->numduptsns] = tsn; 1710 asoc->numduptsns++; 1711 } 1712 return (0); 1713 } 1714 /* Calculate the number of TSN's between the base and this TSN */ 1715 if (tsn >= asoc->mapping_array_base_tsn) { 1716 gap = tsn - asoc->mapping_array_base_tsn; 1717 } else { 1718 gap = (MAX_TSN - asoc->mapping_array_base_tsn) + tsn + 1; 1719 } 1720 if (gap >= (SCTP_MAPPING_ARRAY << 3)) { 1721 /* Can't hold the bit in the mapping at max array, toss it */ 1722 return (0); 1723 } 1724 if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) { 1725 if (sctp_expand_mapping_array(asoc)) { 1726 /* Can't expand, drop it */ 1727 return (0); 1728 } 1729 } 1730 if (compare_with_wrap(tsn, *high_tsn, MAX_TSN)) { 1731 *high_tsn = tsn; 1732 } 1733 /* See if we have received this one already */ 1734 if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) { 1735 sctp_pegs[SCTP_DUPTSN_RECVD]++; 1736 if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) { 1737 /* Record a dup for the next outbound sack */ 1738 asoc->dup_tsns[asoc->numduptsns] = tsn; 1739 asoc->numduptsns++; 1740 } 1741 if (!callout_pending(&asoc->dack_timer.timer)) { 1742 /* 1743 * By starting the timer we assure that we 1744 * WILL sack at the end of the packet 1745 * when sctp_sack_check gets called. 1746 */ 1747 sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, 1748 stcb, NULL); 1749 } 1750 return (0); 1751 } 1752 /* 1753 * Check to see about the GONE flag, duplicates would cause 1754 * a sack to be sent up above 1755 */ 1756 if (stcb && (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) { 1757 /* 1758 * wait a minute, this guy is gone, there is no 1759 * longer a receiver. Send peer an ABORT! 1760 */ 1761 struct mbuf *op_err; 1762 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC); 1763 sctp_abort_an_association(stcb->sctp_ep, stcb, 0, op_err); 1764 *abort_flag = 1; 1765 return (0); 1766 } 1767 /* 1768 * Now before going further we see if there is room. If NOT then 1769 * we MAY let one through only IF this TSN is the one we are 1770 * waiting for on a partial delivery API. 1771 */ 1772 1773 /* now do the tests */ 1774 if (((asoc->cnt_on_all_streams + 1775 asoc->cnt_on_delivery_queue + 1776 asoc->cnt_on_reasm_queue + 1777 asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) || 1778 (((int)asoc->my_rwnd) <= 0)) { 1779 /* 1780 * When we have NO room in the rwnd we check 1781 * to make sure the reader is doing its job... 1782 */ 1783 if (stcb->sctp_socket->so_rcv.ssb_cc) { 1784 /* some to read, wake-up */ 1785 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 1786 } 1787 /* now is it in the mapping array of what we have accepted? */ 1788 if (compare_with_wrap(tsn, 1789 asoc->highest_tsn_inside_map, MAX_TSN)) { 1790 1791 /* Nope not in the valid range dump it */ 1792 #ifdef SCTP_DEBUG 1793 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1794 kprintf("My rwnd overrun1:tsn:%lx rwnd %lu sbspace:%ld delq:%d!\n", 1795 (u_long)tsn, (u_long)asoc->my_rwnd, 1796 sctp_sbspace(&stcb->sctp_socket->so_rcv), 1797 stcb->asoc.cnt_on_delivery_queue); 1798 } 1799 #endif 1800 sctp_set_rwnd(stcb, asoc); 1801 if ((asoc->cnt_on_all_streams + 1802 asoc->cnt_on_delivery_queue + 1803 asoc->cnt_on_reasm_queue + 1804 asoc->cnt_msg_on_sb) > sctp_max_chunks_on_queue) { 1805 sctp_pegs[SCTP_MSGC_DROP]++; 1806 } else { 1807 sctp_pegs[SCTP_RWND_DROPS]++; 1808 } 1809 *break_flag = 1; 1810 return (0); 1811 } 1812 } 1813 strmno = ntohs(ch->dp.stream_id); 1814 if (strmno >= asoc->streamincnt) { 1815 struct sctp_paramhdr *phdr; 1816 struct mbuf *mb; 1817 1818 MGETHDR(mb, MB_DONTWAIT, MT_DATA); 1819 if (mb != NULL) { 1820 /* add some space up front so prepend will work well */ 1821 mb->m_data += sizeof(struct sctp_chunkhdr); 1822 phdr = mtod(mb, struct sctp_paramhdr *); 1823 /* 1824 * Error causes are just param's and this one has 1825 * two back to back phdr, one with the error type 1826 * and size, the other with the streamid and a rsvd 1827 */ 1828 mb->m_pkthdr.len = mb->m_len = 1829 (sizeof(struct sctp_paramhdr) * 2); 1830 phdr->param_type = htons(SCTP_CAUSE_INV_STRM); 1831 phdr->param_length = 1832 htons(sizeof(struct sctp_paramhdr) * 2); 1833 phdr++; 1834 /* We insert the stream in the type field */ 1835 phdr->param_type = ch->dp.stream_id; 1836 /* And set the length to 0 for the rsvd field */ 1837 phdr->param_length = 0; 1838 sctp_queue_op_err(stcb, mb); 1839 } 1840 sctp_pegs[SCTP_BAD_STRMNO]++; 1841 return (0); 1842 } 1843 /* 1844 * Before we continue lets validate that we are not 1845 * being fooled by an evil attacker. We can only 1846 * have 4k chunks based on our TSN spread allowed 1847 * by the mapping array 512 * 8 bits, so there is 1848 * no way our stream sequence numbers could have wrapped. 1849 * We of course only validate the FIRST fragment so the 1850 * bit must be set. 1851 */ 1852 strmseq = ntohs(ch->dp.stream_sequence); 1853 if ((ch->ch.chunk_flags & SCTP_DATA_FIRST_FRAG) && 1854 (ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0 && 1855 (compare_with_wrap(asoc->strmin[strmno].last_sequence_delivered, 1856 strmseq, MAX_SEQ) || 1857 asoc->strmin[strmno].last_sequence_delivered == strmseq)) { 1858 /* The incoming sseq is behind where we last delivered? */ 1859 #ifdef SCTP_DEBUG 1860 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 1861 kprintf("EVIL/Broken-Dup S-SEQ:%d delivered:%d from peer, Abort!\n", 1862 strmseq, 1863 asoc->strmin[strmno].last_sequence_delivered); 1864 } 1865 #endif 1866 /* 1867 * throw it in the stream so it gets cleaned up in 1868 * association destruction 1869 */ 1870 MGET(oper, MB_DONTWAIT, MT_DATA); 1871 if (oper) { 1872 struct sctp_paramhdr *ph; 1873 u_int32_t *ippp; 1874 1875 oper->m_len = sizeof(struct sctp_paramhdr) + 1876 sizeof(*ippp); 1877 ph = mtod(oper, struct sctp_paramhdr *); 1878 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 1879 ph->param_length = htons(oper->m_len); 1880 ippp = (u_int32_t *)(ph + 1); 1881 *ippp = htonl(0x20000001); 1882 } 1883 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, 1884 oper); 1885 sctp_pegs[SCTP_BAD_SSN_WRAP]++; 1886 *abort_flag = 1; 1887 return (0); 1888 } 1889 1890 the_len = (chk_length-sizeof(struct sctp_data_chunk)); 1891 if (last_chunk == 0) { 1892 dmbuf = sctp_m_copym(*m, 1893 (offset + sizeof(struct sctp_data_chunk)), 1894 the_len, MB_DONTWAIT); 1895 } else { 1896 /* We can steal the last chunk */ 1897 dmbuf = *m; 1898 /* lop off the top part */ 1899 m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk))); 1900 if (dmbuf->m_pkthdr.len > the_len) { 1901 /* Trim the end round bytes off too */ 1902 m_adj(dmbuf, -(dmbuf->m_pkthdr.len-the_len)); 1903 } 1904 sctp_pegs[SCTP_NO_COPY_IN]++; 1905 } 1906 if (dmbuf == NULL) { 1907 sctp_pegs[SCTP_DROP_NOMEMORY]++; 1908 return (0); 1909 } 1910 if ((ch->ch.chunk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG && 1911 asoc->fragmented_delivery_inprogress == 0 && 1912 TAILQ_EMPTY(&asoc->delivery_queue) && 1913 ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) || 1914 ((asoc->strmin[strmno].last_sequence_delivered + 1) == strmseq && 1915 TAILQ_EMPTY(&asoc->strmin[strmno].inqueue))) && 1916 ((long)(stcb->sctp_socket->so_rcv.ssb_hiwat - 1917 stcb->sctp_socket->so_rcv.ssb_cc) >= (long)the_len)) { 1918 /* Candidate for express delivery */ 1919 /* 1920 * Its not fragmented, 1921 * No PD-API is up, 1922 * Nothing in the delivery queue, 1923 * Its un-ordered OR ordered and the next to deliver AND 1924 * nothing else is stuck on the stream queue, 1925 * And there is room for it in the socket buffer. 1926 * Lets just stuff it up the buffer.... 1927 */ 1928 1929 struct mbuf *control, *mmm; 1930 struct sockaddr_in6 sin6; 1931 struct sockaddr_in6 lsa6; 1932 struct sockaddr *to; 1933 1934 /* It would be nice to avoid this copy if we could :< */ 1935 control = sctp_build_ctl_nchunk(stcb, tsn, 1936 ch->dp.protocol_id, 0, strmno, strmseq, 1937 ch->ch.chunk_flags); 1938 /* XXX need to append PKTHDR to the socket buffer first */ 1939 1940 if ((dmbuf->m_flags & M_PKTHDR) == 0) { 1941 struct mbuf *tmp; 1942 MGETHDR(tmp, MB_DONTWAIT, MT_DATA); 1943 if (tmp == NULL) { 1944 1945 /* no room! */ 1946 if (control) { 1947 sctp_m_freem(control); 1948 stcb->asoc.my_rwnd_control_len -= 1949 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 1950 } 1951 1952 goto failed_express_del; 1953 } 1954 tmp->m_pkthdr.len = the_len; 1955 tmp->m_len = 0; 1956 tmp->m_next = dmbuf; 1957 dmbuf = tmp; 1958 } 1959 to = (struct sockaddr *)&net->ro._l_addr; 1960 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) && 1961 to->sa_family == AF_INET) { 1962 struct sockaddr_in *sin; 1963 1964 sin = (struct sockaddr_in *)to; 1965 bzero(&sin6, sizeof(sin6)); 1966 sin6.sin6_family = AF_INET6; 1967 sin6.sin6_len = sizeof(struct sockaddr_in6); 1968 sin6.sin6_addr.s6_addr16[2] = 0xffff; 1969 bcopy(&sin->sin_addr, 1970 &sin6.sin6_addr.s6_addr16[3], 1971 sizeof(sin6.sin6_addr.s6_addr16[3])); 1972 sin6.sin6_port = sin->sin_port; 1973 to = (struct sockaddr *)&sin6; 1974 } 1975 1976 /* check and strip embedded scope junk */ 1977 to = (struct sockaddr *)sctp_recover_scope((struct sockaddr_in6 *)to, 1978 &lsa6); 1979 if (((struct sockaddr_in *)to)->sin_port == 0) { 1980 kprintf("Huh c, port is %d not net:%p %d?\n", 1981 ((struct sockaddr_in *)to)->sin_port, 1982 net, 1983 (int)(ntohs(stcb->rport))); 1984 ((struct sockaddr_in *)to)->sin_port = stcb->rport; 1985 } 1986 1987 mmm = dmbuf; 1988 /* Mark the EOR */ 1989 while (mmm->m_next != NULL) { 1990 mmm = mmm->m_next; 1991 } 1992 mmm->m_flags |= M_EOR; 1993 if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) { 1994 /* we have a new high score */ 1995 asoc->highest_tsn_inside_map = tsn; 1996 #ifdef SCTP_MAP_LOGGING 1997 sctp_log_map(0, 1, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 1998 #endif 1999 } 2000 SCTP_TCB_UNLOCK(stcb); 2001 SCTP_INP_WLOCK(stcb->sctp_ep); 2002 SCTP_TCB_LOCK(stcb); 2003 lwkt_gettoken(&stcb->sctp_socket->so_rcv.ssb_token); 2004 if (!sctp_sbappendaddr_nocheck(&stcb->sctp_socket->so_rcv, to, dmbuf, 2005 control, stcb->asoc.my_vtag, stcb->sctp_ep)) { 2006 if (control) { 2007 sctp_m_freem(control); 2008 stcb->asoc.my_rwnd_control_len -= 2009 CMSG_LEN(sizeof(struct sctp_sndrcvinfo)); 2010 } 2011 sctp_m_freem(dmbuf); 2012 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 2013 goto failed_express_del; 2014 } 2015 lwkt_reltoken(&stcb->sctp_socket->so_rcv.ssb_token); 2016 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) { 2017 if (sctp_add_to_socket_q(stcb->sctp_ep, stcb)) { 2018 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf); 2019 } 2020 } else { 2021 stcb->asoc.my_rwnd_control_len += sizeof(struct mbuf); 2022 } 2023 SCTP_INP_WUNLOCK(stcb->sctp_ep); 2024 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 2025 if ((ch->ch.chunk_flags & SCTP_DATA_UNORDERED) == 0) { 2026 2027 /* for ordered, bump what we delivered */ 2028 asoc->strmin[strmno].last_sequence_delivered++; 2029 } 2030 sctp_pegs[SCTP_EXPRESS_ROUTE]++; 2031 #ifdef SCTP_STR_LOGGING 2032 sctp_log_strm_del_alt(tsn, strmseq, 2033 SCTP_STR_LOG_FROM_EXPRS_DEL); 2034 #endif 2035 #ifdef SCTP_DEBUG 2036 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 2037 kprintf("Express Delivery succeeds\n"); 2038 } 2039 #endif 2040 goto finish_express_del; 2041 } 2042 2043 failed_express_del: 2044 /* If we reach here this is a new chunk */ 2045 chk = (struct sctp_tmit_chunk *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_chunk); 2046 if (chk == NULL) { 2047 /* No memory so we drop the chunk */ 2048 sctp_pegs[SCTP_DROP_NOMEMORY]++; 2049 if (last_chunk == 0) { 2050 /* we copied it, free the copy */ 2051 sctp_m_freem(dmbuf); 2052 } 2053 return (0); 2054 } 2055 sctppcbinfo.ipi_count_chunk++; 2056 sctppcbinfo.ipi_gencnt_chunk++; 2057 chk->rec.data.TSN_seq = tsn; 2058 chk->rec.data.stream_seq = strmseq; 2059 chk->rec.data.stream_number = strmno; 2060 chk->rec.data.payloadtype = ch->dp.protocol_id; 2061 chk->rec.data.context = 0; 2062 chk->rec.data.doing_fast_retransmit = 0; 2063 chk->rec.data.rcv_flags = ch->ch.chunk_flags; 2064 chk->asoc = asoc; 2065 chk->send_size = the_len; 2066 chk->whoTo = net; 2067 net->ref_count++; 2068 chk->data = dmbuf; 2069 2070 2071 /* Mark it as received */ 2072 /* Now queue it where it belongs */ 2073 if ((chk->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) == 2074 SCTP_DATA_NOT_FRAG) { 2075 /* First a sanity check */ 2076 if (asoc->fragmented_delivery_inprogress) { 2077 /* 2078 * Ok, we have a fragmented delivery in progress 2079 * if this chunk is next to deliver OR belongs in 2080 * our view to the reassembly, the peer is evil 2081 * or broken. 2082 */ 2083 u_int32_t estimate_tsn; 2084 estimate_tsn = asoc->tsn_last_delivered + 1; 2085 if (TAILQ_EMPTY(&asoc->reasmqueue) && 2086 (estimate_tsn == chk->rec.data.TSN_seq)) { 2087 /* Evil/Broke peer */ 2088 MGET(oper, MB_DONTWAIT, MT_DATA); 2089 if (oper) { 2090 struct sctp_paramhdr *ph; 2091 u_int32_t *ippp; 2092 2093 oper->m_len = 2094 sizeof(struct sctp_paramhdr) + 2095 sizeof(*ippp); 2096 ph = mtod(oper, struct sctp_paramhdr *); 2097 ph->param_type = 2098 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 2099 ph->param_length = htons(oper->m_len); 2100 ippp = (u_int32_t *)(ph + 1); 2101 *ippp = htonl(0x20000002); 2102 } 2103 sctp_abort_an_association(stcb->sctp_ep, stcb, 2104 SCTP_PEER_FAULTY, oper); 2105 2106 *abort_flag = 1; 2107 sctp_pegs[SCTP_DROP_FRAG]++; 2108 return (0); 2109 } else { 2110 if (sctp_does_chk_belong_to_reasm(asoc, chk)) { 2111 MGET(oper, MB_DONTWAIT, MT_DATA); 2112 if (oper) { 2113 struct sctp_paramhdr *ph; 2114 u_int32_t *ippp; 2115 2116 oper->m_len = 2117 sizeof(struct sctp_paramhdr) + 2118 sizeof(*ippp); 2119 ph = mtod(oper, 2120 struct sctp_paramhdr *); 2121 ph->param_type = 2122 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 2123 ph->param_length = 2124 htons(oper->m_len); 2125 ippp = (u_int32_t *)(ph + 1); 2126 *ippp = htonl(0x20000003); 2127 } 2128 sctp_abort_an_association(stcb->sctp_ep, 2129 stcb, SCTP_PEER_FAULTY, oper); 2130 2131 *abort_flag = 1; 2132 sctp_pegs[SCTP_DROP_FRAG]++; 2133 return (0); 2134 } 2135 } 2136 } else { 2137 if (!TAILQ_EMPTY(&asoc->reasmqueue)) { 2138 /* 2139 * Reassembly queue is NOT empty 2140 * validate that this chk does not need to 2141 * be in reasembly queue. If it does then 2142 * our peer is broken or evil. 2143 */ 2144 if (sctp_does_chk_belong_to_reasm(asoc, chk)) { 2145 MGET(oper, MB_DONTWAIT, MT_DATA); 2146 if (oper) { 2147 struct sctp_paramhdr *ph; 2148 u_int32_t *ippp; 2149 2150 oper->m_len = 2151 sizeof(struct sctp_paramhdr) + 2152 sizeof(*ippp); 2153 ph = mtod(oper, 2154 struct sctp_paramhdr *); 2155 ph->param_type = 2156 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 2157 ph->param_length = 2158 htons(oper->m_len); 2159 ippp = (u_int32_t *)(ph + 1); 2160 *ippp = htonl(0x20000004); 2161 } 2162 sctp_abort_an_association(stcb->sctp_ep, 2163 stcb, SCTP_PEER_FAULTY, oper); 2164 2165 *abort_flag = 1; 2166 sctp_pegs[SCTP_DROP_FRAG]++; 2167 return (0); 2168 } 2169 } 2170 } 2171 if (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) { 2172 /* queue directly into socket buffer */ 2173 sctp_deliver_data(stcb, asoc, chk, 0); 2174 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 2175 } else { 2176 /* Special check for when streams are resetting. 2177 * We could be more smart about this and check the 2178 * actual stream to see if it is not being reset.. that 2179 * way we would not create a HOLB when amongst streams 2180 * being reset and those not being reset. 2181 * 2182 * We take complete messages that have a stream reset 2183 * intervening (aka the TSN is after where our cum-ack needs 2184 * to be) off and put them on a pending_reply_queue. The 2185 * reassembly ones we do not have to worry about since 2186 * they are all sorted and proceessed by TSN order. It 2187 * is only the singletons I must worry about. 2188 */ 2189 if ((asoc->pending_reply) && 2190 ((compare_with_wrap(tsn, ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) || 2191 (tsn == ntohl(asoc->pending_reply->reset_at_tsn))) 2192 ) { 2193 /* yep its past where we need to reset... go ahead and 2194 * queue it. 2195 */ 2196 TAILQ_INSERT_TAIL(&asoc->pending_reply_queue , chk, sctp_next); 2197 } else { 2198 sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag); 2199 } 2200 } 2201 } else { 2202 /* Into the re-assembly queue */ 2203 sctp_queue_data_for_reasm(stcb, asoc, chk, abort_flag); 2204 if (*abort_flag) { 2205 sctp_pegs[SCTP_DROP_FRAG]++; 2206 return (0); 2207 } 2208 } 2209 if (compare_with_wrap(tsn, asoc->highest_tsn_inside_map, MAX_TSN)) { 2210 /* we have a new high score */ 2211 asoc->highest_tsn_inside_map = tsn; 2212 #ifdef SCTP_MAP_LOGGING 2213 sctp_log_map(0, 2, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 2214 #endif 2215 } 2216 finish_express_del: 2217 if (last_chunk) { 2218 *m = NULL; 2219 } 2220 sctp_pegs[SCTP_PEG_TSNS_RCVD]++; 2221 /* Set it present please */ 2222 #ifdef SCTP_STR_LOGGING 2223 sctp_log_strm_del_alt(tsn, strmseq, SCTP_STR_LOG_FROM_MARK_TSN); 2224 #endif 2225 #ifdef SCTP_MAP_LOGGING 2226 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn, 2227 asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE); 2228 #endif 2229 SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap); 2230 return (1); 2231 } 2232 2233 void 2234 sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort_flag) 2235 { 2236 /* 2237 * Now we also need to check the mapping array in a couple of ways. 2238 * 1) Did we move the cum-ack point? 2239 */ 2240 struct sctp_association *asoc; 2241 int i, at; 2242 int m_size, all_ones; 2243 int slide_from, slide_end, lgap, distance; 2244 #ifdef SCTP_MAP_LOGGING 2245 uint32_t old_cumack, old_base, old_highest; 2246 unsigned char aux_array[64]; 2247 #endif 2248 2249 asoc = &stcb->asoc; 2250 at = 0; 2251 2252 #ifdef SCTP_MAP_LOGGING 2253 old_cumack = asoc->cumulative_tsn; 2254 old_base = asoc->mapping_array_base_tsn; 2255 old_highest = asoc->highest_tsn_inside_map; 2256 if (asoc->mapping_array_size < 64) 2257 memcpy(aux_array, asoc->mapping_array, 2258 asoc->mapping_array_size); 2259 else 2260 memcpy(aux_array, asoc->mapping_array, 64); 2261 #endif 2262 2263 /* 2264 * We could probably improve this a small bit by calculating the 2265 * offset of the current cum-ack as the starting point. 2266 */ 2267 all_ones = 1; 2268 m_size = stcb->asoc.mapping_array_size << 3; 2269 for (i = 0; i < m_size; i++) { 2270 if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i)) { 2271 /* 2272 * Ok we found the first place that we are 2273 * missing a TSN. 2274 */ 2275 at = i; 2276 all_ones = 0; 2277 asoc->cumulative_tsn = asoc->mapping_array_base_tsn + 2278 (i - 1); 2279 break; 2280 } 2281 } 2282 if (compare_with_wrap(asoc->cumulative_tsn, 2283 asoc->highest_tsn_inside_map, 2284 MAX_TSN)) { 2285 panic("huh, cumack greater than high-tsn in map"); 2286 } 2287 if (all_ones || 2288 (asoc->cumulative_tsn == asoc->highest_tsn_inside_map && at >= 8)) { 2289 /* The complete array was completed by a single FR */ 2290 /* higest becomes the cum-ack */ 2291 int clr; 2292 asoc->cumulative_tsn = asoc->highest_tsn_inside_map; 2293 /* clear the array */ 2294 if (all_ones) 2295 clr = asoc->mapping_array_size; 2296 else { 2297 clr = (at >> 3) + 1; 2298 /* 2299 * this should be the allones case 2300 * but just in case :> 2301 */ 2302 if (clr > asoc->mapping_array_size) 2303 clr = asoc->mapping_array_size; 2304 } 2305 memset(asoc->mapping_array, 0, clr); 2306 /* base becomes one ahead of the cum-ack */ 2307 asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1; 2308 #ifdef SCTP_MAP_LOGGING 2309 sctp_log_map(old_base, old_cumack, old_highest, 2310 SCTP_MAP_PREPARE_SLIDE); 2311 sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn, 2312 asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_CLEARED); 2313 #endif 2314 } else if (at >= 8) { 2315 /* we can slide the mapping array down */ 2316 /* Calculate the new byte postion we can move down */ 2317 slide_from = at >> 3; 2318 /* now calculate the ceiling of the move using our highest TSN value */ 2319 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) { 2320 lgap = asoc->highest_tsn_inside_map - 2321 asoc->mapping_array_base_tsn; 2322 } else { 2323 lgap = (MAX_TSN - asoc->mapping_array_base_tsn) + 2324 asoc->highest_tsn_inside_map + 1; 2325 } 2326 slide_end = lgap >> 3; 2327 if (slide_end < slide_from) { 2328 panic("impossible slide"); 2329 } 2330 distance = (slide_end-slide_from) + 1; 2331 #ifdef SCTP_MAP_LOGGING 2332 sctp_log_map(old_base, old_cumack, old_highest, 2333 SCTP_MAP_PREPARE_SLIDE); 2334 sctp_log_map((uint32_t)slide_from, (uint32_t)slide_end, 2335 (uint32_t)lgap, SCTP_MAP_SLIDE_FROM); 2336 #endif 2337 if (distance + slide_from > asoc->mapping_array_size || 2338 distance < 0) { 2339 #ifdef SCTP_DEBUG 2340 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 2341 kprintf("Ugh bad addition.. you can't hrumpp!\n"); 2342 } 2343 #endif 2344 /* 2345 * Here we do NOT slide forward the array so that 2346 * hopefully when more data comes in to fill it up 2347 * we will be able to slide it forward. Really 2348 * I don't think this should happen :-0 2349 */ 2350 2351 #ifdef SCTP_MAP_LOGGING 2352 sctp_log_map((uint32_t)distance, (uint32_t)slide_from, 2353 (uint32_t)asoc->mapping_array_size, 2354 SCTP_MAP_SLIDE_NONE); 2355 #endif 2356 } else { 2357 int ii; 2358 for (ii = 0; ii < distance; ii++) { 2359 asoc->mapping_array[ii] = 2360 asoc->mapping_array[slide_from + ii]; 2361 } 2362 for (ii = distance;ii <= slide_end; ii++) { 2363 asoc->mapping_array[ii] = 0; 2364 } 2365 asoc->mapping_array_base_tsn += (slide_from << 3); 2366 #ifdef SCTP_MAP_LOGGING 2367 sctp_log_map(asoc->mapping_array_base_tsn, 2368 asoc->cumulative_tsn, asoc->highest_tsn_inside_map, 2369 SCTP_MAP_SLIDE_RESULT); 2370 #endif 2371 } 2372 } 2373 2374 /* check the special flag for stream resets */ 2375 if ((asoc->pending_reply) && 2376 ((compare_with_wrap((asoc->cumulative_tsn+1), ntohl(asoc->pending_reply->reset_at_tsn), MAX_TSN)) || 2377 ((asoc->cumulative_tsn+1) == ntohl(asoc->pending_reply->reset_at_tsn))) 2378 ) { 2379 /* we have finished working through the backlogged TSN's now 2380 * time to reset streams. 2381 * 1: call reset function. 2382 * 2: free pending_reply space 2383 * 3: distribute any chunks in pending_reply_queue. 2384 */ 2385 struct sctp_tmit_chunk *chk; 2386 sctp_handle_stream_reset_response(stcb, asoc->pending_reply); 2387 kfree(asoc->pending_reply, M_PCB); 2388 asoc->pending_reply = NULL; 2389 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 2390 while (chk) { 2391 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next); 2392 sctp_queue_data_to_stream(stcb, asoc, chk, abort_flag); 2393 if (*abort_flag) { 2394 return; 2395 } 2396 chk = TAILQ_FIRST(&asoc->pending_reply_queue); 2397 } 2398 } 2399 /* 2400 * Now we need to see if we need to queue a sack or just start 2401 * the timer (if allowed). 2402 */ 2403 if (ok_to_sack) { 2404 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 2405 /* 2406 * Ok special case, in SHUTDOWN-SENT case. 2407 * here we maker sure SACK timer is off and 2408 * instead send a SHUTDOWN and a SACK 2409 */ 2410 if (callout_pending(&stcb->asoc.dack_timer.timer)) { 2411 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, 2412 stcb->sctp_ep, stcb, NULL); 2413 } 2414 #ifdef SCTP_DEBUG 2415 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 2416 kprintf("%s:%d sends a shutdown\n", 2417 __FILE__, 2418 __LINE__ 2419 ); 2420 } 2421 #endif 2422 sctp_send_shutdown(stcb, stcb->asoc.primary_destination); 2423 sctp_send_sack(stcb); 2424 } else { 2425 int is_a_gap; 2426 /* is there a gap now ? */ 2427 is_a_gap = compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 2428 stcb->asoc.cumulative_tsn, MAX_TSN); 2429 if ((stcb->asoc.first_ack_sent == 0) || /* First time we send a sack */ 2430 ((was_a_gap) && (is_a_gap == 0)) || /* was a gap, but no longer is one */ 2431 (stcb->asoc.numduptsns) || /* we have dup's */ 2432 (is_a_gap) || /* is still a gap */ 2433 (callout_pending(&stcb->asoc.dack_timer.timer)) /* timer was up . second packet */ 2434 ) { 2435 /* 2436 * Ok we must build a SACK since the timer 2437 * is pending, we got our first packet OR 2438 * there are gaps or duplicates. 2439 */ 2440 stcb->asoc.first_ack_sent = 1; 2441 sctp_send_sack(stcb); 2442 /* The sending will stop the timer */ 2443 } else { 2444 sctp_timer_start(SCTP_TIMER_TYPE_RECV, 2445 stcb->sctp_ep, stcb, NULL); 2446 } 2447 } 2448 } 2449 } 2450 2451 void 2452 sctp_service_queues(struct sctp_tcb *stcb, struct sctp_association *asoc, int hold_locks) 2453 { 2454 struct sctp_tmit_chunk *chk; 2455 int tsize, cntDel; 2456 u_int16_t nxt_todel; 2457 2458 cntDel = 0; 2459 if (asoc->fragmented_delivery_inprogress) { 2460 sctp_service_reassembly(stcb, asoc, hold_locks); 2461 } 2462 /* Can we proceed further, i.e. the PD-API is complete */ 2463 if (asoc->fragmented_delivery_inprogress) { 2464 /* no */ 2465 return; 2466 } 2467 2468 /* 2469 * Yes, reassembly delivery no longer in progress see if we 2470 * have some on the sb hold queue. 2471 */ 2472 do { 2473 if (stcb->sctp_socket->so_rcv.ssb_cc >= stcb->sctp_socket->so_rcv.ssb_hiwat) { 2474 if (cntDel == 0) 2475 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 2476 break; 2477 } 2478 /* If deliver_data says no we must stop */ 2479 if (sctp_deliver_data(stcb, asoc, NULL, hold_locks) == 0) 2480 break; 2481 cntDel++; 2482 chk = TAILQ_FIRST(&asoc->delivery_queue); 2483 } while (chk); 2484 if (cntDel) { 2485 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket); 2486 } 2487 /* 2488 * Now is there some other chunk I can deliver 2489 * from the reassembly queue. 2490 */ 2491 chk = TAILQ_FIRST(&asoc->reasmqueue); 2492 if (chk == NULL) { 2493 asoc->size_on_reasm_queue = 0; 2494 asoc->cnt_on_reasm_queue = 0; 2495 return; 2496 } 2497 nxt_todel = asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered + 1; 2498 if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) && 2499 ((nxt_todel == chk->rec.data.stream_seq) || 2500 (chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED))) { 2501 /* 2502 * Yep the first one is here. We setup to 2503 * start reception, by backing down the TSN 2504 * just in case we can't deliver. 2505 */ 2506 2507 /* 2508 * Before we start though either all of the 2509 * message should be here or 1/4 the socket buffer 2510 * max or nothing on the delivery queue and something 2511 * can be delivered. 2512 */ 2513 if (TAILQ_EMPTY(&asoc->delivery_queue) && 2514 (sctp_is_all_msg_on_reasm(asoc, &tsize) || 2515 (asoc->size_on_reasm_queue >= 2516 (stcb->sctp_socket->so_rcv.ssb_hiwat >> 2) && tsize))) { 2517 asoc->fragmented_delivery_inprogress = 1; 2518 asoc->tsn_last_delivered = chk->rec.data.TSN_seq-1; 2519 asoc->str_of_pdapi = chk->rec.data.stream_number; 2520 asoc->ssn_of_pdapi = chk->rec.data.stream_seq; 2521 asoc->fragment_flags = chk->rec.data.rcv_flags; 2522 sctp_service_reassembly(stcb, asoc, hold_locks); 2523 } 2524 } 2525 } 2526 2527 int 2528 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length, 2529 struct sctphdr *sh, struct sctp_inpcb *inp, struct sctp_tcb *stcb, 2530 struct sctp_nets *net, u_int32_t *high_tsn) 2531 { 2532 struct sctp_data_chunk *ch, chunk_buf; 2533 struct sctp_association *asoc; 2534 int num_chunks = 0; /* number of control chunks processed */ 2535 int chk_length, break_flag, last_chunk; 2536 int abort_flag = 0, was_a_gap = 0; 2537 struct mbuf *m; 2538 2539 /* set the rwnd */ 2540 sctp_set_rwnd(stcb, &stcb->asoc); 2541 2542 m = *mm; 2543 asoc = &stcb->asoc; 2544 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map, 2545 stcb->asoc.cumulative_tsn, MAX_TSN)) { 2546 /* there was a gap before this data was processed */ 2547 was_a_gap = 1; 2548 } 2549 /* 2550 * setup where we got the last DATA packet from for 2551 * any SACK that may need to go out. Don't bump 2552 * the net. This is done ONLY when a chunk 2553 * is assigned. 2554 */ 2555 asoc->last_data_chunk_from = net; 2556 2557 /* 2558 * Now before we proceed we must figure out if this 2559 * is a wasted cluster... i.e. it is a small packet 2560 * sent in and yet the driver underneath allocated a 2561 * full cluster for it. If so we must copy it to a 2562 * smaller mbuf and free up the cluster mbuf. This 2563 * will help with cluster starvation. 2564 */ 2565 if (m->m_len < (long)MHLEN && m->m_next == NULL) { 2566 /* we only handle mbufs that are singletons.. not chains */ 2567 #ifdef __DragonFly__ 2568 if ((*mm)->m_flags & M_PKTHDR) 2569 MGETHDR(m, MB_DONTWAIT, MT_HEADER); 2570 else 2571 #endif 2572 MGET(m, MB_DONTWAIT, MT_DATA); 2573 if (m) { 2574 /* ok lets see if we can copy the data up */ 2575 caddr_t *from, *to; 2576 2577 if ((*mm)->m_flags & M_PKTHDR) { 2578 /* got to copy the header first */ 2579 #ifdef __APPLE__ 2580 M_COPY_PKTHDR(m, (*mm)); 2581 #else 2582 M_MOVE_PKTHDR(m, (*mm)); 2583 #endif 2584 } 2585 /* get the pointers and copy */ 2586 to = mtod(m, caddr_t *); 2587 from = mtod((*mm), caddr_t *); 2588 memcpy(to, from, (*mm)->m_len); 2589 /* copy the length and free up the old */ 2590 m->m_len = (*mm)->m_len; 2591 sctp_m_freem(*mm); 2592 /* sucess, back copy */ 2593 *mm = m; 2594 } else { 2595 /* We are in trouble in the mbuf world .. yikes */ 2596 m = *mm; 2597 } 2598 } 2599 /* get pointer to the first chunk header */ 2600 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset, 2601 sizeof(chunk_buf), (u_int8_t *)&chunk_buf); 2602 if (ch == NULL) { 2603 kprintf(" ... its short\n"); 2604 return (1); 2605 } 2606 /* 2607 * process all DATA chunks... 2608 */ 2609 2610 #ifdef SCTP_DEBUG 2611 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2612 kprintf("In process data off:%d length:%d iphlen:%d ch->type:%d\n", 2613 *offset, length, iphlen, (int)ch->ch.chunk_type); 2614 } 2615 #endif 2616 2617 *high_tsn = asoc->cumulative_tsn; 2618 break_flag = 0; 2619 while (ch->ch.chunk_type == SCTP_DATA) { 2620 /* validate chunk length */ 2621 chk_length = ntohs(ch->ch.chunk_length); 2622 if ((size_t)chk_length < sizeof(struct sctp_data_chunk) + 1 || 2623 length - *offset < chk_length) { 2624 /* 2625 * Need to send an abort since we had a invalid 2626 * data chunk. 2627 */ 2628 struct mbuf *op_err; 2629 MGET(op_err, MB_DONTWAIT, MT_DATA); 2630 if (op_err) { 2631 struct sctp_paramhdr *ph; 2632 u_int32_t *ippp; 2633 2634 op_err->m_len = sizeof(struct sctp_paramhdr) + 2635 sizeof(*ippp); 2636 ph = mtod(op_err, struct sctp_paramhdr *); 2637 ph->param_type = 2638 htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 2639 ph->param_length = htons(op_err->m_len); 2640 ippp = (u_int32_t *)(ph + 1); 2641 *ippp = htonl(0x30000001); 2642 } 2643 sctp_abort_association(inp, stcb, m, iphlen, sh, 2644 op_err); 2645 return (2); 2646 } 2647 #ifdef SCTP_DEBUG 2648 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2649 kprintf("A chunk of len:%d to process (tot:%d)\n", 2650 chk_length, length - *offset); 2651 } 2652 #endif 2653 2654 #ifdef SCTP_AUDITING_ENABLED 2655 sctp_audit_log(0xB1, 0); 2656 #endif 2657 if (SCTP_SIZE32(chk_length) == *offset - length) { 2658 last_chunk = 1; 2659 } else { 2660 last_chunk = 0; 2661 } 2662 if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset, ch, 2663 chk_length, net, high_tsn, &abort_flag, &break_flag, 2664 last_chunk)) { 2665 num_chunks++; 2666 #ifdef SCTP_DEBUG 2667 if (sctp_debug_on & SCTP_DEBUG_INPUT1) { 2668 kprintf("Now incr num_chunks to %d\n", 2669 num_chunks); 2670 } 2671 #endif 2672 } 2673 if (abort_flag) 2674 return (2); 2675 2676 if (break_flag) { 2677 /* 2678 * Set because of out of rwnd space and no drop rep 2679 * space left. 2680 */ 2681 break; 2682 } 2683 2684 *offset += SCTP_SIZE32(chk_length); 2685 if (*offset >= length) { 2686 /* no more data left in the mbuf chain */ 2687 break; 2688 } 2689 ch = (struct sctp_data_chunk *)sctp_m_getptr(m, *offset, 2690 sizeof(chunk_buf), (u_int8_t *)&chunk_buf); 2691 if (ch == NULL) { 2692 *offset = length; 2693 break; 2694 } 2695 } /* while */ 2696 if (break_flag) { 2697 /* 2698 * we need to report rwnd overrun drops. 2699 */ 2700 sctp_send_packet_dropped(stcb, net, *mm, iphlen, 0); 2701 } 2702 if (num_chunks) { 2703 /* 2704 * Did we get data, if so update the time for 2705 * auto-close and give peer credit for being 2706 * alive. 2707 */ 2708 sctp_pegs[SCTP_DATA_DG_RECV]++; 2709 stcb->asoc.overall_error_count = 0; 2710 SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd); 2711 } 2712 /* now service all of the reassm queue and delivery queue */ 2713 sctp_service_queues(stcb, asoc, 0); 2714 if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) { 2715 /* 2716 * Assure that we ack right away by making 2717 * sure that a d-ack timer is running. So the 2718 * sack_check will send a sack. 2719 */ 2720 sctp_timer_start(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, 2721 net); 2722 } 2723 /* Start a sack timer or QUEUE a SACK for sending */ 2724 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag); 2725 if (abort_flag) 2726 return (2); 2727 2728 return (0); 2729 } 2730 2731 static void 2732 sctp_handle_segments(struct sctp_tcb *stcb, struct sctp_association *asoc, 2733 struct sctp_sack_chunk *ch, u_long last_tsn, u_long *biggest_tsn_acked, 2734 u_long *biggest_newly_acked_tsn, int num_seg, int *ecn_seg_sums) 2735 { 2736 /************************************************/ 2737 /* process fragments and update sendqueue */ 2738 /************************************************/ 2739 struct sctp_sack *sack; 2740 struct sctp_gap_ack_block *frag; 2741 struct sctp_tmit_chunk *tp1; 2742 int i; 2743 unsigned int j; 2744 #ifdef SCTP_FR_LOGGING 2745 int num_frs=0; 2746 #endif 2747 uint16_t frag_strt, frag_end, primary_flag_set; 2748 u_long last_frag_high; 2749 2750 if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) { 2751 primary_flag_set = 1; 2752 } else { 2753 primary_flag_set = 0; 2754 } 2755 2756 sack = &ch->sack; 2757 frag = (struct sctp_gap_ack_block *)((caddr_t)sack + 2758 sizeof(struct sctp_sack)); 2759 tp1 = NULL; 2760 last_frag_high = 0; 2761 for (i = 0; i < num_seg; i++) { 2762 frag_strt = ntohs(frag->start); 2763 frag_end = ntohs(frag->end); 2764 /* some sanity checks on the fargment offsets */ 2765 if (frag_strt > frag_end) { 2766 /* this one is malformed, skip */ 2767 frag++; 2768 continue; 2769 } 2770 if (compare_with_wrap((frag_end+last_tsn), *biggest_tsn_acked, 2771 MAX_TSN)) 2772 *biggest_tsn_acked = frag_end+last_tsn; 2773 2774 /* mark acked dgs and find out the highestTSN being acked */ 2775 if (tp1 == NULL) { 2776 tp1 = TAILQ_FIRST(&asoc->sent_queue); 2777 2778 /* save the locations of the last frags */ 2779 last_frag_high = frag_end + last_tsn; 2780 } else { 2781 /* 2782 * now lets see if we need to reset the queue 2783 * due to a out-of-order SACK fragment 2784 */ 2785 if (compare_with_wrap(frag_strt+last_tsn, 2786 last_frag_high, MAX_TSN)) { 2787 /* 2788 * if the new frag starts after the last TSN 2789 * frag covered, we are ok 2790 * and this one is beyond the last one 2791 */ 2792 ; 2793 } else { 2794 /* 2795 * ok, they have reset us, so we need to reset 2796 * the queue this will cause extra hunting but 2797 * hey, they chose the performance 2798 * hit when they failed to order there gaps.. 2799 */ 2800 tp1 = TAILQ_FIRST(&asoc->sent_queue); 2801 } 2802 last_frag_high = frag_end + last_tsn; 2803 } 2804 for (j = frag_strt + last_tsn; j <= frag_end + last_tsn; j++) { 2805 while (tp1) { 2806 #ifdef SCTP_FR_LOGGING 2807 if (tp1->rec.data.doing_fast_retransmit) 2808 num_frs++; 2809 #endif 2810 2811 if (tp1->rec.data.TSN_seq == j) { 2812 if (tp1->sent != SCTP_DATAGRAM_UNSENT) { 2813 /* must be held until cum-ack passes */ 2814 /* ECN Nonce: Add the nonce value to the sender's nonce sum */ 2815 if (tp1->sent < SCTP_DATAGRAM_ACKED) { 2816 /* 2817 * If it is less than 2818 * ACKED, it is now 2819 * no-longer in flight. 2820 * Higher values may 2821 * already be set via 2822 * previous Gap Ack 2823 * Blocks... 2824 * i.e. ACKED or MARKED. 2825 */ 2826 if (compare_with_wrap(tp1->rec.data.TSN_seq, 2827 *biggest_newly_acked_tsn, 2828 MAX_TSN)) { 2829 *biggest_newly_acked_tsn = 2830 tp1->rec.data.TSN_seq; 2831 } 2832 tp1->whoTo->flight_size -= tp1->book_size; 2833 if (tp1->whoTo->flight_size < 0) { 2834 tp1->whoTo->flight_size = 0; 2835 } 2836 asoc->total_flight -= 2837 tp1->book_size; 2838 2839 if (asoc->total_flight < 0) { 2840 asoc->total_flight = 0; 2841 } 2842 2843 asoc->total_flight_count--; 2844 if (asoc->total_flight_count < 0) { 2845 asoc->total_flight_count = 0; 2846 } 2847 2848 if (tp1->snd_count < 2) { 2849 /* True non-retransmited chunk */ 2850 tp1->whoTo->net_ack2 += 2851 tp1->send_size; 2852 2853 /* update RTO too? */ 2854 if (tp1->do_rtt) { 2855 tp1->whoTo->RTO = 2856 sctp_calculate_rto(stcb, 2857 asoc, 2858 tp1->whoTo, 2859 &tp1->sent_rcv_time); 2860 tp1->whoTo->rto_pending = 0; 2861 tp1->do_rtt = 0; 2862 } 2863 } 2864 } 2865 if (tp1->sent <= SCTP_DATAGRAM_RESEND && 2866 tp1->sent != SCTP_DATAGRAM_UNSENT && 2867 compare_with_wrap(tp1->rec.data.TSN_seq, 2868 asoc->this_sack_highest_gap, 2869 MAX_TSN)) { 2870 asoc->this_sack_highest_gap = 2871 tp1->rec.data.TSN_seq; 2872 if (primary_flag_set) { 2873 tp1->whoTo->cacc_saw_newack = 1; 2874 } 2875 } 2876 if (tp1->sent == SCTP_DATAGRAM_RESEND) { 2877 #ifdef SCTP_DEBUG 2878 if (sctp_debug_on & 2879 SCTP_DEBUG_INDATA3) { 2880 kprintf("Hmm. one that is in RESEND that is now ACKED\n"); 2881 } 2882 #endif 2883 asoc->sent_queue_retran_cnt--; 2884 #ifdef SCTP_AUDITING_ENABLED 2885 sctp_audit_log(0xB2, 2886 (asoc->sent_queue_retran_cnt & 0x000000ff)); 2887 #endif 2888 2889 if (asoc->sent_queue_retran_cnt < 0) { 2890 kprintf("huh3 retran went negative?\n"); 2891 #ifdef SCTP_AUDITING_ENABLED 2892 sctp_auditing(30, 2893 inp, tcb, 2894 NULL); 2895 #else 2896 asoc->sent_queue_retran_cnt = 0; 2897 #endif 2898 } 2899 } 2900 (*ecn_seg_sums) += tp1->rec.data.ect_nonce; 2901 (*ecn_seg_sums) &= SCTP_SACK_NONCE_SUM; 2902 tp1->sent = SCTP_DATAGRAM_MARKED; 2903 } 2904 break; 2905 } /* if (tp1->TSN_seq == j) */ 2906 if (compare_with_wrap(tp1->rec.data.TSN_seq, j, 2907 MAX_TSN)) 2908 break; 2909 tp1 = TAILQ_NEXT(tp1, sctp_next); 2910 }/* end while (tp1) */ 2911 } /* end for (j = fragStart */ 2912 frag++; /* next one */ 2913 } 2914 #ifdef SCTP_FR_LOGGING 2915 if (num_frs) 2916 sctp_log_fr(*biggest_tsn_acked, *biggest_newly_acked_tsn, 2917 last_tsn, SCTP_FR_LOG_BIGGEST_TSNS); 2918 #endif 2919 } 2920 2921 static void 2922 sctp_check_for_revoked(struct sctp_association *asoc, u_long cum_ack, 2923 u_long biggest_tsn_acked) 2924 { 2925 struct sctp_tmit_chunk *tp1; 2926 int tot_revoked=0; 2927 2928 tp1 = TAILQ_FIRST(&asoc->sent_queue); 2929 while (tp1) { 2930 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack, 2931 MAX_TSN)) { 2932 /* 2933 * ok this guy is either ACK or MARKED. If it is ACKED 2934 * it has been previously acked but not this time i.e. 2935 * revoked. If it is MARKED it was ACK'ed again. 2936 */ 2937 if (tp1->sent == SCTP_DATAGRAM_ACKED) { 2938 /* it has been revoked */ 2939 /* 2940 * We do NOT add back to flight size here since 2941 * it is really NOT in flight. Resend (when/if 2942 * it occurs will add to flight size 2943 */ 2944 tp1->sent = SCTP_DATAGRAM_SENT; 2945 tot_revoked++; 2946 } else if (tp1->sent == SCTP_DATAGRAM_MARKED) { 2947 /* it has been re-acked in this SACK */ 2948 tp1->sent = SCTP_DATAGRAM_ACKED; 2949 } 2950 } 2951 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked, 2952 MAX_TSN)) { 2953 /* above the sack */ 2954 break; 2955 } 2956 if (tp1->sent == SCTP_DATAGRAM_UNSENT) 2957 break; 2958 tp1 = TAILQ_NEXT(tp1, sctp_next); 2959 } 2960 if (tot_revoked > 0) { 2961 /* Setup the ecn nonce re-sync point. We 2962 * do this since once data is revoked 2963 * we begin to retransmit things, which 2964 * do NOT have the ECN bits set. This means 2965 * we are now out of sync and must wait until 2966 * we get back in sync with the peer to 2967 * check ECN bits. 2968 */ 2969 tp1 = TAILQ_FIRST(&asoc->send_queue); 2970 if (tp1 == NULL) { 2971 asoc->nonce_resync_tsn = asoc->sending_seq; 2972 } else { 2973 asoc->nonce_resync_tsn = tp1->rec.data.TSN_seq; 2974 } 2975 asoc->nonce_wait_for_ecne = 0; 2976 asoc->nonce_sum_check = 0; 2977 } 2978 2979 } 2980 2981 extern int sctp_peer_chunk_oh; 2982 2983 static void 2984 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc, 2985 u_long biggest_tsn_acked, int strike_enabled, 2986 u_long biggest_tsn_newly_acked, int accum_moved) 2987 { 2988 struct sctp_tmit_chunk *tp1; 2989 int strike_flag=0; 2990 struct timeval now; 2991 int tot_retrans=0; 2992 u_int32_t sending_seq; 2993 int primary_switch_active = 0; 2994 int double_switch_active = 0; 2995 2996 /* select the sending_seq, this is 2997 * either the next thing ready to 2998 * be sent but not transmitted, OR, 2999 * the next seq we assign. 3000 */ 3001 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue); 3002 if (tp1 == NULL) { 3003 sending_seq = asoc->sending_seq; 3004 } else { 3005 sending_seq = tp1->rec.data.TSN_seq; 3006 } 3007 3008 if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) { 3009 primary_switch_active = 1; 3010 } 3011 if (asoc->primary_destination->dest_state & SCTP_ADDR_DOUBLE_SWITCH) { 3012 double_switch_active = 1; 3013 } 3014 if (stcb->asoc.peer_supports_prsctp ) { 3015 SCTP_GETTIME_TIMEVAL(&now); 3016 } 3017 tp1 = TAILQ_FIRST(&asoc->sent_queue); 3018 while (tp1) { 3019 strike_flag=0; 3020 if (compare_with_wrap(tp1->rec.data.TSN_seq, biggest_tsn_acked, 3021 MAX_TSN) || 3022 tp1->sent == SCTP_DATAGRAM_UNSENT) { 3023 /* done */ 3024 break; 3025 } 3026 if ((tp1->flags & (SCTP_PR_SCTP_ENABLED|SCTP_PR_SCTP_BUFFER)) == 3027 SCTP_PR_SCTP_ENABLED && 3028 tp1->sent < SCTP_DATAGRAM_ACKED) { 3029 /* Is it expired? */ 3030 #ifndef __FreeBSD__ 3031 if (timercmp(&now, &tp1->rec.data.timetodrop, >)) 3032 #else 3033 if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) 3034 #endif 3035 { 3036 /* Yes so drop it */ 3037 if (tp1->data != NULL) { 3038 sctp_release_pr_sctp_chunk(stcb, tp1, 3039 (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT), 3040 &asoc->sent_queue); 3041 } 3042 tp1 = TAILQ_NEXT(tp1, sctp_next); 3043 continue; 3044 } 3045 } 3046 3047 if (compare_with_wrap(tp1->rec.data.TSN_seq, 3048 asoc->this_sack_highest_gap, MAX_TSN)) { 3049 /* we are beyond the tsn in the sack */ 3050 break; 3051 } 3052 if (tp1->sent >= SCTP_DATAGRAM_RESEND) { 3053 /* either a RESEND, ACKED, or MARKED */ 3054 /* skip */ 3055 tp1 = TAILQ_NEXT(tp1, sctp_next); 3056 continue; 3057 } 3058 if (primary_switch_active && (strike_enabled == 0)) { 3059 if (tp1->whoTo != asoc->primary_destination) { 3060 /* 3061 * We can only strike things on the primary if 3062 * the strike_enabled flag is clear 3063 */ 3064 tp1 = TAILQ_NEXT(tp1, sctp_next); 3065 continue; 3066 } 3067 } else if (primary_switch_active) { 3068 if (tp1->whoTo->cacc_saw_newack == 0) { 3069 /* 3070 * Only one was received but it was NOT 3071 * this one. 3072 */ 3073 tp1 = TAILQ_NEXT(tp1, sctp_next); 3074 continue; 3075 } 3076 } 3077 if (double_switch_active && 3078 (compare_with_wrap(asoc->primary_destination->next_tsn_at_change, 3079 tp1->rec.data.TSN_seq, MAX_TSN))) { 3080 /* 3081 * With a double switch we do NOT mark unless we 3082 * are beyond the switch point. 3083 */ 3084 tp1 = TAILQ_NEXT(tp1, sctp_next); 3085 continue; 3086 } 3087 /* 3088 * Here we check to see if we were have already done a FR 3089 * and if so we see if the biggest TSN we saw in the sack is 3090 * smaller than the recovery point. If so we don't strike the 3091 * tsn... otherwise we CAN strike the TSN. 3092 */ 3093 if (accum_moved && asoc->fast_retran_loss_recovery) { 3094 /* 3095 * Strike the TSN if in fast-recovery and 3096 * cum-ack moved. 3097 */ 3098 tp1->sent++; 3099 } else if (tp1->rec.data.doing_fast_retransmit) { 3100 /* 3101 * For those that have done a FR we must 3102 * take special consideration if we strike. I.e 3103 * the biggest_newly_acked must be higher 3104 * than the sending_seq at the time we did 3105 * the FR. 3106 */ 3107 #ifdef SCTP_FR_TO_ALTERNATE 3108 /* 3109 * If FR's go to new networks, then we 3110 * must only do this for singly homed asoc's. However 3111 * if the FR's go to the same network (Armando's work) 3112 * then its ok to FR multiple times. 3113 */ 3114 if (asoc->numnets < 2) 3115 #else 3116 if (1) 3117 #endif 3118 { 3119 if ((compare_with_wrap(biggest_tsn_newly_acked, 3120 tp1->rec.data.fast_retran_tsn, MAX_TSN)) || 3121 (biggest_tsn_newly_acked == 3122 tp1->rec.data.fast_retran_tsn)) { 3123 /* 3124 * Strike the TSN, since this ack is 3125 * beyond where things were when we did 3126 * a FR. 3127 */ 3128 #ifdef SCTP_FR_LOGGING 3129 sctp_log_fr(biggest_tsn_newly_acked, 3130 tp1->rec.data.TSN_seq, 3131 tp1->rec.data.fast_retran_tsn, 3132 SCTP_FR_LOG_STRIKE_CHUNK); 3133 #endif 3134 tp1->sent++; 3135 strike_flag=1; 3136 } 3137 } 3138 } else if (compare_with_wrap(tp1->rec.data.TSN_seq, 3139 biggest_tsn_newly_acked, MAX_TSN)) { 3140 /* 3141 * We don't strike these: 3142 * This is the HTNA algorithm i.e. we don't strike 3143 * If our TSN is larger than the Highest TSN Newly 3144 * Acked. 3145 */ 3146 ; 3147 } else { 3148 /* Strike the TSN */ 3149 tp1->sent++; 3150 } 3151 if (tp1->sent == SCTP_DATAGRAM_RESEND) { 3152 /* Increment the count to resend */ 3153 struct sctp_nets *alt; 3154 3155 #ifdef SCTP_FR_LOGGING 3156 sctp_log_fr(tp1->rec.data.TSN_seq, tp1->snd_count, 3157 0, SCTP_FR_MARKED); 3158 #endif 3159 if (strike_flag) { 3160 /* This is a subsequent FR */ 3161 sctp_pegs[SCTP_DUP_FR]++; 3162 } 3163 asoc->sent_queue_retran_cnt++; 3164 #ifdef SCTP_FR_TO_ALTERNATE 3165 /* Can we find an alternate? */ 3166 alt = sctp_find_alternate_net(stcb, tp1->whoTo); 3167 #else 3168 /* 3169 * default behavior is to NOT retransmit FR's 3170 * to an alternate. Armando Caro's paper details 3171 * why. 3172 */ 3173 alt = tp1->whoTo; 3174 #endif 3175 tp1->rec.data.doing_fast_retransmit = 1; 3176 tot_retrans++; 3177 /* mark the sending seq for possible subsequent FR's */ 3178 if (TAILQ_EMPTY(&asoc->send_queue)) { 3179 /* 3180 * If the queue of send is empty then its the 3181 * next sequence number that will be assigned so 3182 * we subtract one from this to get the one we 3183 * last sent. 3184 */ 3185 tp1->rec.data.fast_retran_tsn = sending_seq - 1; 3186 } else { 3187 /* 3188 * If there are chunks on the send queue 3189 * (unsent data that has made it from the 3190 * stream queues but not out the door, we take 3191 * the first one (which will have the lowest 3192 * TSN) and subtract one to get the one we last 3193 * sent. 3194 */ 3195 struct sctp_tmit_chunk *ttt; 3196 ttt = TAILQ_FIRST(&asoc->send_queue); 3197 tp1->rec.data.fast_retran_tsn = 3198 ttt->rec.data.TSN_seq - 1; 3199 } 3200 if (tp1->do_rtt) { 3201 /* 3202 * this guy had a RTO calculation pending on it, 3203 * cancel it 3204 */ 3205 tp1->whoTo->rto_pending = 0; 3206 tp1->do_rtt = 0; 3207 } 3208 /* fix counts and things */ 3209 3210 tp1->whoTo->net_ack++; 3211 tp1->whoTo->flight_size -= tp1->book_size; 3212 if (tp1->whoTo->flight_size < 0) { 3213 tp1->whoTo->flight_size = 0; 3214 } 3215 #ifdef SCTP_LOG_RWND 3216 sctp_log_rwnd(SCTP_INCREASE_PEER_RWND, 3217 asoc->peers_rwnd , tp1->send_size, sctp_peer_chunk_oh); 3218 #endif 3219 /* add back to the rwnd */ 3220 asoc->peers_rwnd += (tp1->send_size + sctp_peer_chunk_oh); 3221 3222 /* remove from the total flight */ 3223 asoc->total_flight -= tp1->book_size; 3224 if (asoc->total_flight < 0) { 3225 asoc->total_flight = 0; 3226 } 3227 asoc->total_flight_count--; 3228 if (asoc->total_flight_count < 0) { 3229 asoc->total_flight_count = 0; 3230 } 3231 if (alt != tp1->whoTo) { 3232 /* yes, there is an alternate. */ 3233 sctp_free_remote_addr(tp1->whoTo); 3234 tp1->whoTo = alt; 3235 alt->ref_count++; 3236 } 3237 } 3238 tp1 = TAILQ_NEXT(tp1, sctp_next); 3239 } /* while (tp1) */ 3240 3241 if (tot_retrans > 0) { 3242 /* Setup the ecn nonce re-sync point. We 3243 * do this since once we go to FR something 3244 * we introduce a Karn's rule scenario and 3245 * won't know the totals for the ECN bits. 3246 */ 3247 asoc->nonce_resync_tsn = sending_seq; 3248 asoc->nonce_wait_for_ecne = 0; 3249 asoc->nonce_sum_check = 0; 3250 } 3251 3252 } 3253 3254 struct sctp_tmit_chunk * 3255 sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb, 3256 struct sctp_association *asoc) 3257 { 3258 struct sctp_tmit_chunk *tp1, *tp2, *a_adv=NULL; 3259 struct timeval now; 3260 int now_filled=0; 3261 3262 if (asoc->peer_supports_prsctp == 0) { 3263 return (NULL); 3264 } 3265 tp1 = TAILQ_FIRST(&asoc->sent_queue); 3266 while (tp1) { 3267 if (tp1->sent != SCTP_FORWARD_TSN_SKIP && 3268 tp1->sent != SCTP_DATAGRAM_RESEND) { 3269 /* no chance to advance, out of here */ 3270 break; 3271 } 3272 if ((tp1->flags & SCTP_PR_SCTP_ENABLED) == 0) { 3273 /* 3274 * We can't fwd-tsn past any that are reliable 3275 * aka retransmitted until the asoc fails. 3276 */ 3277 break; 3278 } 3279 if (!now_filled) { 3280 SCTP_GETTIME_TIMEVAL(&now); 3281 now_filled = 1; 3282 } 3283 tp2 = TAILQ_NEXT(tp1, sctp_next); 3284 /* 3285 * now we got a chunk which is marked for another 3286 * retransmission to a PR-stream but has run 3287 * out its chances already maybe OR has been 3288 * marked to skip now. Can we skip it if its a 3289 * resend? 3290 */ 3291 if (tp1->sent == SCTP_DATAGRAM_RESEND && 3292 (tp1->flags & SCTP_PR_SCTP_BUFFER) == 0) { 3293 /* 3294 * Now is this one marked for resend and its time 3295 * is now up? 3296 */ 3297 #ifndef __FreeBSD__ 3298 if (timercmp(&now, &tp1->rec.data.timetodrop, >)) 3299 #else 3300 if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) 3301 #endif 3302 { 3303 /* Yes so drop it */ 3304 if (tp1->data) { 3305 sctp_release_pr_sctp_chunk(stcb, tp1, 3306 (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT), 3307 &asoc->sent_queue); 3308 } 3309 } else { 3310 /* 3311 * No, we are done when hit one for resend whos 3312 * time as not expired. 3313 */ 3314 break; 3315 } 3316 } 3317 /* 3318 * Ok now if this chunk is marked to drop it 3319 * we can clean up the chunk, advance our peer ack point 3320 * and we can check the next chunk. 3321 */ 3322 if (tp1->sent == SCTP_FORWARD_TSN_SKIP) { 3323 /* advance PeerAckPoint goes forward */ 3324 asoc->advanced_peer_ack_point = tp1->rec.data.TSN_seq; 3325 a_adv = tp1; 3326 /* 3327 * we don't want to de-queue it here. Just wait for the 3328 * next peer SACK to come with a new cumTSN and then 3329 * the chunk will be droped in the normal fashion. 3330 */ 3331 if (tp1->data) { 3332 sctp_free_bufspace(stcb, asoc, tp1); 3333 #ifdef SCTP_DEBUG 3334 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 3335 kprintf("--total out:%lu total_mbuf_out:%lu\n", 3336 (u_long)asoc->total_output_queue_size, 3337 (u_long)asoc->total_output_mbuf_queue_size); 3338 } 3339 #endif 3340 /* 3341 * Maybe there should be another notification 3342 * type 3343 */ 3344 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, 3345 (SCTP_RESPONSE_TO_USER_REQ|SCTP_NOTIFY_DATAGRAM_SENT), 3346 tp1); 3347 sctp_m_freem(tp1->data); 3348 tp1->data = NULL; 3349 sctp_sowwakeup(stcb->sctp_ep, 3350 stcb->sctp_socket); 3351 } 3352 } else { 3353 /* If it is still in RESEND we can advance no further */ 3354 break; 3355 } 3356 /* 3357 * If we hit here we just dumped tp1, move to next 3358 * tsn on sent queue. 3359 */ 3360 tp1 = tp2; 3361 } 3362 return (a_adv); 3363 } 3364 3365 #ifdef SCTP_HIGH_SPEED 3366 struct sctp_hs_raise_drop { 3367 int32_t cwnd; 3368 int32_t increase; 3369 int32_t drop_percent; 3370 }; 3371 3372 #define SCTP_HS_TABLE_SIZE 73 3373 3374 struct sctp_hs_raise_drop sctp_cwnd_adjust[SCTP_HS_TABLE_SIZE] = { 3375 {38,1,50}, /* 0 */ 3376 {118,2,44}, /* 1 */ 3377 {221,3,41}, /* 2 */ 3378 {347,4,38}, /* 3 */ 3379 {495,5,37}, /* 4 */ 3380 {663,6,35}, /* 5 */ 3381 {851,7,34}, /* 6 */ 3382 {1058,8,33}, /* 7 */ 3383 {1284,9,32}, /* 8 */ 3384 {1529,10,31}, /* 9 */ 3385 {1793,11,30}, /* 10 */ 3386 {2076,12,29}, /* 11 */ 3387 {2378,13,28}, /* 12 */ 3388 {2699,14,28}, /* 13 */ 3389 {3039,15,27}, /* 14 */ 3390 {3399,16,27}, /* 15 */ 3391 {3778,17,26}, /* 16 */ 3392 {4177,18,26}, /* 17 */ 3393 {4596,19,25}, /* 18 */ 3394 {5036,20,25}, /* 19 */ 3395 {5497,21,24}, /* 20 */ 3396 {5979,22,24}, /* 21 */ 3397 {6483,23,23}, /* 22 */ 3398 {7009,24,23}, /* 23 */ 3399 {7558,25,22}, /* 24 */ 3400 {8130,26,22}, /* 25 */ 3401 {8726,27,22}, /* 26 */ 3402 {9346,28,21}, /* 27 */ 3403 {9991,29,21}, /* 28 */ 3404 {10661,30,21}, /* 29 */ 3405 {11358,31,20}, /* 30 */ 3406 {12082,32,20}, /* 31 */ 3407 {12834,33,20}, /* 32 */ 3408 {13614,34,19}, /* 33 */ 3409 {14424,35,19}, /* 34 */ 3410 {15265,36,19}, /* 35 */ 3411 {16137,37,19}, /* 36 */ 3412 {17042,38,18}, /* 37 */ 3413 {17981,39,18}, /* 38 */ 3414 {18955,40,18}, /* 39 */ 3415 {19965,41,17}, /* 40 */ 3416 {21013,42,17}, /* 41 */ 3417 {22101,43,17}, /* 42 */ 3418 {23230,44,17}, /* 43 */ 3419 {24402,45,16}, /* 44 */ 3420 {25618,46,16}, /* 45 */ 3421 {26881,47,16}, /* 46 */ 3422 {28193,48,16}, /* 47 */ 3423 {29557,49,15}, /* 48 */ 3424 {30975,50,15}, /* 49 */ 3425 {32450,51,15}, /* 50 */ 3426 {33986,52,15}, /* 51 */ 3427 {35586,53,14}, /* 52 */ 3428 {37253,54,14}, /* 53 */ 3429 {38992,55,14}, /* 54 */ 3430 {40808,56,14}, /* 55 */ 3431 {42707,57,13}, /* 56 */ 3432 {44694,58,13}, /* 57 */ 3433 {46776,59,13}, /* 58 */ 3434 {48961,60,13}, /* 59 */ 3435 {51258,61,13}, /* 60 */ 3436 {53677,62,12}, /* 61 */ 3437 {56230,63,12}, /* 62 */ 3438 {58932,64,12}, /* 63 */ 3439 {61799,65,12}, /* 64 */ 3440 {64851,66,11}, /* 65 */ 3441 {68113,67,11}, /* 66 */ 3442 {71617,68,11}, /* 67 */ 3443 {75401,69,10}, /* 68 */ 3444 {79517,70,10}, /* 69 */ 3445 {84035,71,10}, /* 70 */ 3446 {89053,72,10}, /* 71 */ 3447 {94717,73,9} /* 72 */ 3448 }; 3449 3450 static void 3451 sctp_hs_cwnd_increase(struct sctp_nets *net) 3452 { 3453 int cur_val, i, indx, incr; 3454 3455 cur_val = net->cwnd >> 10; 3456 indx = SCTP_HS_TABLE_SIZE - 1; 3457 3458 if (cur_val < sctp_cwnd_adjust[0].cwnd) { 3459 /* normal mode */ 3460 if (net->net_ack > net->mtu) { 3461 net->cwnd += net->mtu; 3462 #ifdef SCTP_CWND_LOGGING 3463 sctp_log_cwnd(net, net->mtu, SCTP_CWND_LOG_FROM_SS); 3464 #endif 3465 } else { 3466 net->cwnd += net->net_ack; 3467 #ifdef SCTP_CWND_LOGGING 3468 sctp_log_cwnd(net, net->net_ack, SCTP_CWND_LOG_FROM_SS); 3469 #endif 3470 } 3471 } else { 3472 for (i=net->last_hs_used; i<SCTP_HS_TABLE_SIZE; i++) { 3473 if (cur_val < sctp_cwnd_adjust[i].cwnd) { 3474 indx = i; 3475 break; 3476 } 3477 } 3478 net->last_hs_used = indx; 3479 incr = ((sctp_cwnd_adjust[indx].increase) << 10); 3480 net->cwnd += incr; 3481 #ifdef SCTP_CWND_LOGGING 3482 sctp_log_cwnd(net, incr, SCTP_CWND_LOG_FROM_SS); 3483 #endif 3484 } 3485 } 3486 3487 static void 3488 sctp_hs_cwnd_decrease(struct sctp_nets *net) 3489 { 3490 int cur_val, i, indx; 3491 #ifdef SCTP_CWND_LOGGING 3492 int old_cwnd = net->cwnd; 3493 #endif 3494 3495 cur_val = net->cwnd >> 10; 3496 indx = net->last_hs_used; 3497 if (cur_val < sctp_cwnd_adjust[0].cwnd) { 3498 /* normal mode */ 3499 net->ssthresh = net->cwnd / 2; 3500 if (net->ssthresh < (net->mtu*2)) { 3501 net->ssthresh = 2 * net->mtu; 3502 } 3503 net->cwnd = net->ssthresh; 3504 #ifdef SCTP_CWND_LOGGING 3505 sctp_log_cwnd(net, (net->cwnd-old_cwnd), SCTP_CWND_LOG_FROM_FR); 3506 #endif 3507 } else { 3508 /* drop by the proper amount */ 3509 net->ssthresh = net->cwnd - (int)((net->cwnd / 100) * 3510 sctp_cwnd_adjust[net->last_hs_used].drop_percent); 3511 net->cwnd = net->ssthresh; 3512 /* now where are we */ 3513 indx = net->last_hs_used; 3514 cur_val = net->cwnd >> 10; 3515 /* reset where we are in the table */ 3516 if (cur_val < sctp_cwnd_adjust[0].cwnd) { 3517 /* feel out of hs */ 3518 net->last_hs_used = 0; 3519 } else { 3520 for (i = indx; i >= 1; i--) { 3521 if (cur_val > sctp_cwnd_adjust[i - 1].cwnd) { 3522 break; 3523 } 3524 } 3525 net->last_hs_used = indx; 3526 } 3527 } 3528 } 3529 #endif 3530 3531 void 3532 sctp_handle_sack(struct sctp_sack_chunk *ch, struct sctp_tcb *stcb, 3533 struct sctp_nets *net_from, int *abort_now) 3534 { 3535 struct sctp_association *asoc; 3536 struct sctp_sack *sack; 3537 struct sctp_tmit_chunk *tp1, *tp2; 3538 u_long cum_ack, last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked; 3539 uint16_t num_seg; 3540 unsigned int sack_length; 3541 uint32_t send_s; 3542 int some_on_streamwheel; 3543 int strike_enabled = 0, cnt_of_cacc = 0; 3544 int accum_moved = 0; 3545 int marking_allowed = 1; 3546 int will_exit_fast_recovery=0; 3547 u_int32_t a_rwnd; 3548 struct sctp_nets *net = NULL; 3549 int nonce_sum_flag, ecn_seg_sums=0; 3550 asoc = &stcb->asoc; 3551 3552 /* 3553 * Handle the incoming sack on data I have been sending. 3554 */ 3555 3556 /* 3557 * we take any chance we can to service our queues since we 3558 * cannot get awoken when the socket is read from :< 3559 */ 3560 asoc->overall_error_count = 0; 3561 3562 if (asoc->sent_queue_retran_cnt) { 3563 #ifdef SCTP_DEBUG 3564 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 3565 kprintf("Handling SACK for asoc:%p retran:%d\n", 3566 asoc, asoc->sent_queue_retran_cnt); 3567 } 3568 #endif 3569 } 3570 3571 sctp_service_queues(stcb, asoc, 0); 3572 3573 /* 3574 * Now perform the actual SACK handling: 3575 * 1) Verify that it is not an old sack, if so discard. 3576 * 2) If there is nothing left in the send queue (cum-ack is equal 3577 * to last acked) then you have a duplicate too, update any rwnd 3578 * change and verify no timers are running. then return. 3579 * 3) Process any new consequtive data i.e. cum-ack moved 3580 * process these first and note that it moved. 3581 * 4) Process any sack blocks. 3582 * 5) Drop any acked from the queue. 3583 * 6) Check for any revoked blocks and mark. 3584 * 7) Update the cwnd. 3585 * 8) Nothing left, sync up flightsizes and things, stop all timers 3586 * and also check for shutdown_pending state. If so then go ahead 3587 * and send off the shutdown. If in shutdown recv, send off the 3588 * shutdown-ack and start that timer, Ret. 3589 * 9) Strike any non-acked things and do FR procedure if needed being 3590 * sure to set the FR flag. 3591 * 10) Do pr-sctp procedures. 3592 * 11) Apply any FR penalties. 3593 * 12) Assure we will SACK if in shutdown_recv state. 3594 */ 3595 3596 sack_length = ntohs(ch->ch.chunk_length); 3597 if (sack_length < sizeof(struct sctp_sack_chunk)) { 3598 #ifdef SCTP_DEBUG 3599 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 3600 kprintf("Bad size on sack chunk .. to small\n"); 3601 } 3602 #endif 3603 return; 3604 } 3605 /* ECN Nonce */ 3606 nonce_sum_flag = ch->ch.chunk_flags & SCTP_SACK_NONCE_SUM; 3607 sack = &ch->sack; 3608 cum_ack = last_tsn = ntohl(sack->cum_tsn_ack); 3609 num_seg = ntohs(sack->num_gap_ack_blks); 3610 3611 /* reality check */ 3612 if (TAILQ_EMPTY(&asoc->send_queue)) { 3613 send_s = asoc->sending_seq; 3614 } else { 3615 tp1 = TAILQ_FIRST(&asoc->send_queue); 3616 send_s = tp1->rec.data.TSN_seq; 3617 } 3618 3619 if (sctp_strict_sacks) { 3620 if (cum_ack == send_s || 3621 compare_with_wrap(cum_ack, send_s, MAX_TSN)) { 3622 struct mbuf *oper; 3623 /* 3624 * no way, we have not even sent this TSN out yet. 3625 * Peer is hopelessly messed up with us. 3626 */ 3627 hopeless_peer: 3628 *abort_now = 1; 3629 /* XXX */ 3630 MGET(oper, MB_DONTWAIT, MT_DATA); 3631 if (oper) { 3632 struct sctp_paramhdr *ph; 3633 u_int32_t *ippp; 3634 3635 oper->m_len = sizeof(struct sctp_paramhdr) + 3636 sizeof(*ippp); 3637 ph = mtod(oper, struct sctp_paramhdr *); 3638 ph->param_type = htons(SCTP_CAUSE_PROTOCOL_VIOLATION); 3639 ph->param_length = htons(oper->m_len); 3640 ippp = (u_int32_t *)(ph + 1); 3641 *ippp = htonl(0x30000002); 3642 } 3643 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_PEER_FAULTY, oper); 3644 return; 3645 } 3646 } 3647 /* update the Rwnd of the peer */ 3648 a_rwnd = (u_int32_t)ntohl(sack->a_rwnd); 3649 if (asoc->sent_queue_retran_cnt) { 3650 #ifdef SCTP_DEBUG 3651 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 3652 kprintf("cum_ack:%lx num_seg:%u last_acked_seq:%x\n", 3653 cum_ack, (u_int)num_seg, asoc->last_acked_seq); 3654 } 3655 #endif 3656 } 3657 if (compare_with_wrap(asoc->t3timeout_highest_marked, cum_ack, MAX_TSN)) { 3658 /* we are not allowed to mark for FR */ 3659 marking_allowed = 0; 3660 } 3661 /**********************/ 3662 /* 1) check the range */ 3663 /**********************/ 3664 if (compare_with_wrap(asoc->last_acked_seq, last_tsn, MAX_TSN)) { 3665 /* acking something behind */ 3666 if (asoc->sent_queue_retran_cnt) { 3667 #ifdef SCTP_DEBUG 3668 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 3669 kprintf("The cum-ack is behind us\n"); 3670 } 3671 #endif 3672 } 3673 return; 3674 } 3675 3676 if (TAILQ_EMPTY(&asoc->sent_queue)) { 3677 /* nothing left on sendqueue.. consider done */ 3678 #ifdef SCTP_LOG_RWND 3679 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK, 3680 asoc->peers_rwnd, 0, 0, a_rwnd); 3681 #endif 3682 asoc->peers_rwnd = a_rwnd; 3683 if (asoc->sent_queue_retran_cnt) { 3684 #ifdef SCTP_DEBUG 3685 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 3686 kprintf("Huh? retran set but none on queue\n"); 3687 } 3688 #endif 3689 asoc->sent_queue_retran_cnt = 0; 3690 } 3691 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 3692 /* SWS sender side engages */ 3693 asoc->peers_rwnd = 0; 3694 } 3695 /* stop any timers */ 3696 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3697 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 3698 stcb, net); 3699 net->partial_bytes_acked = 0; 3700 net->flight_size = 0; 3701 } 3702 asoc->total_flight = 0; 3703 asoc->total_flight_count = 0; 3704 return; 3705 } 3706 /* 3707 * We init netAckSz and netAckSz2 to 0. These are used to track 2 3708 * things. The total byte count acked is tracked in netAckSz AND 3709 * netAck2 is used to track the total bytes acked that are un- 3710 * amibguious and were never retransmitted. We track these on a 3711 * per destination address basis. 3712 */ 3713 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3714 net->prev_cwnd = net->cwnd; 3715 net->net_ack = 0; 3716 net->net_ack2 = 0; 3717 } 3718 /* process the new consecutive TSN first */ 3719 tp1 = TAILQ_FIRST(&asoc->sent_queue); 3720 while (tp1) { 3721 if (compare_with_wrap(last_tsn, tp1->rec.data.TSN_seq, 3722 MAX_TSN) || 3723 last_tsn == tp1->rec.data.TSN_seq) { 3724 if (tp1->sent != SCTP_DATAGRAM_UNSENT) { 3725 /* ECN Nonce: Add the nonce to the sender's nonce sum */ 3726 asoc->nonce_sum_expect_base += tp1->rec.data.ect_nonce; 3727 accum_moved = 1; 3728 if (tp1->sent < SCTP_DATAGRAM_ACKED) { 3729 /* 3730 * If it is less than ACKED, it is now 3731 * no-longer in flight. Higher values 3732 * may occur during marking 3733 */ 3734 if ((tp1->whoTo->dest_state & 3735 SCTP_ADDR_UNCONFIRMED) && 3736 (tp1->snd_count < 2) ) { 3737 /* 3738 * If there was no retran and 3739 * the address is un-confirmed 3740 * and we sent there and are 3741 * now sacked.. its confirmed, 3742 * mark it so. 3743 */ 3744 tp1->whoTo->dest_state &= 3745 ~SCTP_ADDR_UNCONFIRMED; 3746 } 3747 tp1->whoTo->flight_size -= 3748 tp1->book_size; 3749 if (tp1->whoTo->flight_size < 0) { 3750 tp1->whoTo->flight_size = 0; 3751 } 3752 asoc->total_flight -= tp1->book_size; 3753 if (asoc->total_flight < 0) { 3754 asoc->total_flight = 0; 3755 } 3756 asoc->total_flight_count--; 3757 if (asoc->total_flight_count < 0) { 3758 asoc->total_flight_count = 0; 3759 } 3760 tp1->whoTo->net_ack += tp1->send_size; 3761 if (tp1->snd_count < 2) { 3762 /* True non-retransmited chunk */ 3763 tp1->whoTo->net_ack2 += 3764 tp1->send_size; 3765 /* update RTO too? */ 3766 if (tp1->do_rtt) { 3767 tp1->whoTo->RTO = 3768 sctp_calculate_rto(stcb, 3769 asoc, tp1->whoTo, 3770 &tp1->sent_rcv_time); 3771 tp1->whoTo->rto_pending = 0; 3772 tp1->do_rtt = 0; 3773 } 3774 } 3775 } 3776 if (tp1->sent == SCTP_DATAGRAM_RESEND) { 3777 #ifdef SCTP_DEBUG 3778 if (sctp_debug_on & SCTP_DEBUG_INDATA3) { 3779 kprintf("Hmm. one that is in RESEND that is now ACKED\n"); 3780 } 3781 #endif 3782 asoc->sent_queue_retran_cnt--; 3783 #ifdef SCTP_AUDITING_ENABLED 3784 sctp_audit_log(0xB3, 3785 (asoc->sent_queue_retran_cnt & 0x000000ff)); 3786 #endif 3787 if (asoc->sent_queue_retran_cnt < 0) { 3788 kprintf("huh4 retran went negative?\n"); 3789 #ifdef SCTP_AUDITING_ENABLED 3790 sctp_auditing(31, inp, tcb, 3791 NULL); 3792 #else 3793 asoc->sent_queue_retran_cnt = 0; 3794 #endif 3795 } 3796 3797 } 3798 tp1->sent = SCTP_DATAGRAM_ACKED; 3799 } 3800 } else { 3801 break; 3802 } 3803 tp1 = TAILQ_NEXT(tp1, sctp_next); 3804 } 3805 /*******************************************/ 3806 /* cancel ALL T3-send timer if accum moved */ 3807 /*******************************************/ 3808 if (accum_moved) { 3809 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3810 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 3811 stcb, net); 3812 } 3813 } 3814 biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn; 3815 /* always set this up to cum-ack */ 3816 asoc->this_sack_highest_gap = last_tsn; 3817 3818 if (((num_seg * sizeof(struct sctp_gap_ack_block)) + sizeof(struct sctp_sack_chunk)) > sack_length) { 3819 /* skip corrupt segments */ 3820 strike_enabled = 0; 3821 goto skip_segments; 3822 } 3823 3824 if (num_seg > 0) { 3825 if (asoc->primary_destination->dest_state & 3826 SCTP_ADDR_SWITCH_PRIMARY) { 3827 /* clear the nets CACC flags */ 3828 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3829 net->cacc_saw_newack = 0; 3830 } 3831 } 3832 /* 3833 * thisSackHighestGap will increase while handling NEW segments 3834 */ 3835 3836 sctp_handle_segments(stcb, asoc, ch, last_tsn, 3837 &biggest_tsn_acked, &biggest_tsn_newly_acked, 3838 num_seg, &ecn_seg_sums); 3839 3840 if (sctp_strict_sacks) { 3841 /* validate the biggest_tsn_acked in the gap acks 3842 * if strict adherence is wanted. 3843 */ 3844 if ((biggest_tsn_acked == send_s) || 3845 (compare_with_wrap(biggest_tsn_acked, send_s, MAX_TSN))) { 3846 /* 3847 * peer is either confused or we are under 3848 * attack. We must abort. 3849 */ 3850 goto hopeless_peer; 3851 } 3852 } 3853 3854 if (asoc->primary_destination->dest_state & 3855 SCTP_ADDR_SWITCH_PRIMARY) { 3856 /* clear the nets CACC flags */ 3857 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3858 if (net->cacc_saw_newack) { 3859 cnt_of_cacc++; 3860 } 3861 } 3862 } 3863 3864 } 3865 3866 if (cnt_of_cacc < 2) { 3867 strike_enabled = 1; 3868 } else { 3869 strike_enabled = 0; 3870 } 3871 skip_segments: 3872 /********************************************/ 3873 /* drop the acked chunks from the sendqueue */ 3874 /********************************************/ 3875 asoc->last_acked_seq = cum_ack; 3876 if (asoc->primary_destination->dest_state & SCTP_ADDR_SWITCH_PRIMARY) { 3877 if ((cum_ack == asoc->primary_destination->next_tsn_at_change) || 3878 (compare_with_wrap(cum_ack, 3879 asoc->primary_destination->next_tsn_at_change, MAX_TSN))) { 3880 struct sctp_nets *lnet; 3881 /* Turn off the switch flag for ALL addresses */ 3882 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) { 3883 asoc->primary_destination->dest_state &= 3884 ~(SCTP_ADDR_SWITCH_PRIMARY|SCTP_ADDR_DOUBLE_SWITCH); 3885 } 3886 } 3887 } 3888 /* Drag along the t3 timeout point so we don't have a problem at wrap */ 3889 if (marking_allowed) { 3890 asoc->t3timeout_highest_marked = cum_ack; 3891 } 3892 tp1 = TAILQ_FIRST(&asoc->sent_queue); 3893 do { 3894 if (compare_with_wrap(tp1->rec.data.TSN_seq, cum_ack, 3895 MAX_TSN)) { 3896 break; 3897 } 3898 if (tp1->sent == SCTP_DATAGRAM_UNSENT) { 3899 /* no more sent on list */ 3900 break; 3901 } 3902 tp2 = TAILQ_NEXT(tp1, sctp_next); 3903 TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next); 3904 if (tp1->data) { 3905 sctp_free_bufspace(stcb, asoc, tp1); 3906 #ifdef SCTP_DEBUG 3907 if (sctp_debug_on & SCTP_DEBUG_OUTPUT2) { 3908 kprintf("--total out:%lu total_mbuf_out:%lu\n", 3909 (u_long)asoc->total_output_queue_size, 3910 (u_long)asoc->total_output_mbuf_queue_size); 3911 } 3912 #endif 3913 3914 sctp_m_freem(tp1->data); 3915 if (tp1->flags & SCTP_PR_SCTP_BUFFER) { 3916 asoc->sent_queue_cnt_removeable--; 3917 } 3918 3919 } 3920 tp1->data = NULL; 3921 asoc->sent_queue_cnt--; 3922 sctp_free_remote_addr(tp1->whoTo); 3923 sctppcbinfo.ipi_count_chunk--; 3924 asoc->chunks_on_out_queue--; 3925 3926 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 3927 panic("Chunk count is going negative"); 3928 } 3929 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, tp1); 3930 sctppcbinfo.ipi_gencnt_chunk++; 3931 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket); 3932 tp1 = tp2; 3933 } while (tp1 != NULL); 3934 3935 3936 if (asoc->fast_retran_loss_recovery && accum_moved) { 3937 if (compare_with_wrap(asoc->last_acked_seq, 3938 asoc->fast_recovery_tsn, MAX_TSN) || 3939 asoc->last_acked_seq == asoc->fast_recovery_tsn) { 3940 /* Setup so we will exit RFC2582 fast recovery */ 3941 will_exit_fast_recovery = 1; 3942 } 3943 } 3944 3945 /* Check for revoked fragments if we hand 3946 * fragments in a previous segment. If we 3947 * had no previous fragments we cannot have 3948 * a revoke issue. 3949 */ 3950 if (asoc->saw_sack_with_frags) 3951 sctp_check_for_revoked(asoc, cum_ack, biggest_tsn_acked); 3952 3953 if (num_seg) 3954 asoc->saw_sack_with_frags = 1; 3955 else 3956 asoc->saw_sack_with_frags = 0; 3957 3958 /******************************/ 3959 /* update cwnd */ 3960 /******************************/ 3961 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 3962 /* if nothing was acked on this destination skip it */ 3963 if (net->net_ack == 0) 3964 continue; 3965 3966 if (net->net_ack2 > 0) { 3967 /* 3968 * Karn's rule applies to clearing error count, 3969 * this is optional. 3970 */ 3971 net->error_count = 0; 3972 if ((net->dest_state&SCTP_ADDR_NOT_REACHABLE) == 3973 SCTP_ADDR_NOT_REACHABLE) { 3974 /* addr came good */ 3975 net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE; 3976 net->dest_state |= SCTP_ADDR_REACHABLE; 3977 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb, 3978 SCTP_RECEIVED_SACK, (void *)net); 3979 /* now was it the primary? if so restore */ 3980 if (net->dest_state & SCTP_ADDR_WAS_PRIMARY) { 3981 sctp_set_primary_addr(stcb, NULL, net); 3982 } 3983 } 3984 } 3985 3986 if (asoc->fast_retran_loss_recovery && 3987 will_exit_fast_recovery == 0) { 3988 /* If we are in loss recovery we skip any cwnd update */ 3989 sctp_pegs[SCTP_CWND_SKIP]++; 3990 goto skip_cwnd_update; 3991 } 3992 if (accum_moved) { 3993 /* If the cumulative ack moved we can proceed */ 3994 if (net->cwnd <= net->ssthresh) { 3995 /* We are in slow start */ 3996 if (net->flight_size + net->net_ack >= 3997 net->cwnd ) { 3998 #ifdef SCTP_HIGH_SPEED 3999 sctp_hs_cwnd_increase(net); 4000 #else 4001 if (net->net_ack > net->mtu) { 4002 net->cwnd += net->mtu; 4003 #ifdef SCTP_CWND_LOGGING 4004 sctp_log_cwnd(net, net->mtu, 4005 SCTP_CWND_LOG_FROM_SS); 4006 #endif 4007 4008 } else { 4009 net->cwnd += net->net_ack; 4010 #ifdef SCTP_CWND_LOGGING 4011 sctp_log_cwnd(net, net->net_ack, 4012 SCTP_CWND_LOG_FROM_SS); 4013 #endif 4014 4015 } 4016 #endif 4017 sctp_pegs[SCTP_CWND_SS]++; 4018 } else { 4019 unsigned int dif; 4020 sctp_pegs[SCTP_CWND_NOUSE_SS]++; 4021 dif = net->cwnd - (net->flight_size + 4022 net->net_ack); 4023 #ifdef SCTP_CWND_LOGGING 4024 /* sctp_log_cwnd(net, net->net_ack, 4025 SCTP_CWND_LOG_NOADV_SS);*/ 4026 #endif 4027 if (dif > sctp_pegs[SCTP_CWND_DIFF_SA]) { 4028 sctp_pegs[SCTP_CWND_DIFF_SA] = 4029 dif; 4030 sctp_pegs[SCTP_OQS_AT_SS] = 4031 asoc->total_output_queue_size; 4032 sctp_pegs[SCTP_SQQ_AT_SS] = 4033 asoc->sent_queue_cnt; 4034 sctp_pegs[SCTP_SQC_AT_SS] = 4035 asoc->send_queue_cnt; 4036 } 4037 } 4038 } else { 4039 /* We are in congestion avoidance */ 4040 if (net->flight_size + net->net_ack >= 4041 net->cwnd) { 4042 /* 4043 * add to pba only if we had a cwnd's 4044 * worth (or so) in flight OR the 4045 * burst limit was applied. 4046 */ 4047 net->partial_bytes_acked += 4048 net->net_ack; 4049 4050 /* 4051 * Do we need to increase 4052 * (if pba is > cwnd)? 4053 */ 4054 if (net->partial_bytes_acked >= 4055 net->cwnd) { 4056 if (net->cwnd < 4057 net->partial_bytes_acked) { 4058 net->partial_bytes_acked -= 4059 net->cwnd; 4060 } else { 4061 net->partial_bytes_acked = 4062 0; 4063 } 4064 net->cwnd += net->mtu; 4065 #ifdef SCTP_CWND_LOGGING 4066 sctp_log_cwnd(net, net->mtu, 4067 SCTP_CWND_LOG_FROM_CA); 4068 #endif 4069 sctp_pegs[SCTP_CWND_CA]++; 4070 } 4071 } else { 4072 unsigned int dif; 4073 sctp_pegs[SCTP_CWND_NOUSE_CA]++; 4074 #ifdef SCTP_CWND_LOGGING 4075 /* sctp_log_cwnd(net, net->net_ack, 4076 SCTP_CWND_LOG_NOADV_CA); 4077 */ 4078 #endif 4079 dif = net->cwnd - (net->flight_size + 4080 net->net_ack); 4081 if (dif > sctp_pegs[SCTP_CWND_DIFF_CA]) { 4082 sctp_pegs[SCTP_CWND_DIFF_CA] = 4083 dif; 4084 sctp_pegs[SCTP_OQS_AT_CA] = 4085 asoc->total_output_queue_size; 4086 sctp_pegs[SCTP_SQQ_AT_CA] = 4087 asoc->sent_queue_cnt; 4088 sctp_pegs[SCTP_SQC_AT_CA] = 4089 asoc->send_queue_cnt; 4090 4091 } 4092 4093 } 4094 } 4095 } else { 4096 sctp_pegs[SCTP_CWND_NOCUM]++; 4097 } 4098 skip_cwnd_update: 4099 /* 4100 * NOW, according to Karn's rule do we need to restore the 4101 * RTO timer back? Check our net_ack2. If not set then we 4102 * have a ambiguity.. i.e. all data ack'd was sent to more 4103 * than one place. 4104 */ 4105 4106 if (net->net_ack2) { 4107 /* restore any doubled timers */ 4108 net->RTO = ((net->lastsa >> 2) + net->lastsv) >> 1; 4109 if (net->RTO < stcb->asoc.minrto) { 4110 net->RTO = stcb->asoc.minrto; 4111 } 4112 if (net->RTO > stcb->asoc.maxrto) { 4113 net->RTO = stcb->asoc.maxrto; 4114 } 4115 } 4116 if (net->cwnd > sctp_pegs[SCTP_MAX_CWND]) { 4117 sctp_pegs[SCTP_MAX_CWND] = net->cwnd; 4118 } 4119 } 4120 /**********************************/ 4121 /* Now what about shutdown issues */ 4122 /**********************************/ 4123 some_on_streamwheel = 0; 4124 if (!TAILQ_EMPTY(&asoc->out_wheel)) { 4125 /* Check to see if some data queued */ 4126 struct sctp_stream_out *outs; 4127 TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) { 4128 if (!TAILQ_EMPTY(&outs->outqueue)) { 4129 some_on_streamwheel = 1; 4130 break; 4131 } 4132 } 4133 } 4134 if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue) && 4135 some_on_streamwheel == 0) { 4136 /* nothing left on sendqueue.. consider done */ 4137 /* stop all timers */ 4138 #ifdef SCTP_LOG_RWND 4139 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK, 4140 asoc->peers_rwnd, 0, 0, a_rwnd); 4141 #endif 4142 asoc->peers_rwnd = a_rwnd; 4143 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 4144 /* SWS sender side engages */ 4145 asoc->peers_rwnd = 0; 4146 } 4147 /* stop any timers */ 4148 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 4149 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, 4150 stcb, net); 4151 net->flight_size = 0; 4152 net->partial_bytes_acked = 0; 4153 } 4154 asoc->total_flight = 0; 4155 asoc->total_flight_count = 0; 4156 /* clean up */ 4157 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) { 4158 asoc->state = SCTP_STATE_SHUTDOWN_SENT; 4159 #ifdef SCTP_DEBUG 4160 if (sctp_debug_on & SCTP_DEBUG_OUTPUT4) { 4161 kprintf("%s:%d sends a shutdown\n", 4162 __FILE__, 4163 __LINE__ 4164 ); 4165 } 4166 #endif 4167 sctp_send_shutdown(stcb, 4168 stcb->asoc.primary_destination); 4169 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, 4170 stcb->sctp_ep, stcb, asoc->primary_destination); 4171 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, 4172 stcb->sctp_ep, stcb, asoc->primary_destination); 4173 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED) { 4174 asoc->state = SCTP_STATE_SHUTDOWN_ACK_SENT; 4175 4176 sctp_send_shutdown_ack(stcb, 4177 stcb->asoc.primary_destination); 4178 4179 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, 4180 stcb->sctp_ep, stcb, asoc->primary_destination); 4181 } 4182 return; 4183 } 4184 /* 4185 * Now here we are going to recycle net_ack for a different 4186 * use... HEADS UP. 4187 */ 4188 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 4189 net->net_ack = 0; 4190 } 4191 if ((num_seg > 0) && marking_allowed) { 4192 sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked, 4193 strike_enabled, biggest_tsn_newly_acked, accum_moved); 4194 } 4195 4196 /*********************************************/ 4197 /* Here we perform PR-SCTP procedures */ 4198 /* (section 4.2) */ 4199 /*********************************************/ 4200 /* C1. update advancedPeerAckPoint */ 4201 if (compare_with_wrap(cum_ack, asoc->advanced_peer_ack_point, MAX_TSN)) { 4202 asoc->advanced_peer_ack_point = cum_ack; 4203 } 4204 /* C2. try to further move advancedPeerAckPoint ahead */ 4205 if (asoc->peer_supports_prsctp) { 4206 struct sctp_tmit_chunk *lchk; 4207 lchk = sctp_try_advance_peer_ack_point(stcb, asoc); 4208 /* C3. See if we need to send a Fwd-TSN */ 4209 if (compare_with_wrap(asoc->advanced_peer_ack_point, cum_ack, 4210 MAX_TSN)) { 4211 /* 4212 * ISSUE with ECN, see FWD-TSN processing for notes 4213 * on issues that will occur when the ECN NONCE stuff 4214 * is put into SCTP for cross checking. 4215 */ 4216 send_forward_tsn(stcb, asoc); 4217 4218 /* ECN Nonce: Disable Nonce Sum check when FWD TSN is sent and store resync tsn*/ 4219 asoc->nonce_sum_check = 0; 4220 asoc->nonce_resync_tsn = asoc->advanced_peer_ack_point; 4221 if (lchk) { 4222 /* Assure a timer is up */ 4223 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4224 stcb->sctp_ep, stcb, lchk->whoTo); 4225 } 4226 } 4227 } 4228 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 4229 if (asoc->fast_retran_loss_recovery == 0) { 4230 /* out of a RFC2582 Fast recovery window? */ 4231 if (net->net_ack > 0) { 4232 /* 4233 * per section 7.2.3, are there 4234 * any destinations that had a fast 4235 * retransmit to them. If so what we 4236 * need to do is adjust ssthresh and 4237 * cwnd. 4238 */ 4239 struct sctp_tmit_chunk *lchk; 4240 #ifdef SCTP_HIGH_SPEED 4241 sctp_hs_cwnd_decrease(net); 4242 #else 4243 #ifdef SCTP_CWND_LOGGING 4244 int old_cwnd = net->cwnd; 4245 #endif 4246 net->ssthresh = net->cwnd / 2; 4247 if (net->ssthresh < (net->mtu*2)) { 4248 net->ssthresh = 2 * net->mtu; 4249 } 4250 net->cwnd = net->ssthresh; 4251 #ifdef SCTP_CWND_LOGGING 4252 sctp_log_cwnd(net, (net->cwnd-old_cwnd), 4253 SCTP_CWND_LOG_FROM_FR); 4254 #endif 4255 #endif 4256 4257 lchk = TAILQ_FIRST(&asoc->send_queue); 4258 4259 net->partial_bytes_acked = 0; 4260 /* Turn on fast recovery window */ 4261 asoc->fast_retran_loss_recovery = 1; 4262 if (lchk == NULL) { 4263 /* Mark end of the window */ 4264 asoc->fast_recovery_tsn = asoc->sending_seq - 1; 4265 } else { 4266 asoc->fast_recovery_tsn = lchk->rec.data.TSN_seq - 1; 4267 } 4268 4269 4270 /* Disable Nonce Sum Checking and store the resync tsn*/ 4271 asoc->nonce_sum_check = 0; 4272 asoc->nonce_resync_tsn = asoc->fast_recovery_tsn + 1; 4273 4274 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, 4275 stcb->sctp_ep, stcb, net); 4276 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4277 stcb->sctp_ep, stcb, net); 4278 } 4279 } else if (net->net_ack > 0) { 4280 /* 4281 * Mark a peg that we WOULD have done a cwnd reduction 4282 * but RFC2582 prevented this action. 4283 */ 4284 sctp_pegs[SCTP_FR_INAWINDOW]++; 4285 } 4286 } 4287 4288 4289 /****************************************************************** 4290 * Here we do the stuff with ECN Nonce checking. 4291 * We basically check to see if the nonce sum flag was incorrect 4292 * or if resynchronization needs to be done. Also if we catch a 4293 * misbehaving receiver we give him the kick. 4294 ******************************************************************/ 4295 4296 if (asoc->ecn_nonce_allowed) { 4297 if (asoc->nonce_sum_check) { 4298 if (nonce_sum_flag != ((asoc->nonce_sum_expect_base + ecn_seg_sums) & SCTP_SACK_NONCE_SUM)) { 4299 if (asoc->nonce_wait_for_ecne == 0) { 4300 struct sctp_tmit_chunk *lchk; 4301 lchk = TAILQ_FIRST(&asoc->send_queue); 4302 asoc->nonce_wait_for_ecne = 1; 4303 if (lchk) { 4304 asoc->nonce_wait_tsn = lchk->rec.data.TSN_seq; 4305 } else { 4306 asoc->nonce_wait_tsn = asoc->sending_seq; 4307 } 4308 } else { 4309 if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_wait_tsn, MAX_TSN) || 4310 (asoc->last_acked_seq == asoc->nonce_wait_tsn)) { 4311 /* Misbehaving peer. We need to react to this guy */ 4312 kprintf("Mis-behaving peer detected\n"); 4313 asoc->ecn_allowed = 0; 4314 asoc->ecn_nonce_allowed = 0; 4315 } 4316 } 4317 } 4318 } else { 4319 /* See if Resynchronization Possible */ 4320 if (compare_with_wrap(asoc->last_acked_seq, asoc->nonce_resync_tsn, MAX_TSN)) { 4321 asoc->nonce_sum_check = 1; 4322 /* now we must calculate what the base 4323 * is. We do this based on two things, we know 4324 * the total's for all the segments gap-acked 4325 * in the SACK, its stored in ecn_seg_sums. 4326 * We also know the SACK's nonce sum, its 4327 * in nonce_sum_flag. So we can build a truth 4328 * table to back-calculate the new value of asoc->nonce_sum_expect_base: 4329 * 4330 * SACK-flag-Value Seg-Sums Base 4331 * 0 0 0 4332 * 1 0 1 4333 * 0 1 1 4334 * 1 1 0 4335 */ 4336 asoc->nonce_sum_expect_base = (ecn_seg_sums ^ nonce_sum_flag) & SCTP_SACK_NONCE_SUM; 4337 } 4338 } 4339 } 4340 /* Now are we exiting loss recovery ? */ 4341 if (will_exit_fast_recovery) { 4342 /* Ok, we must exit fast recovery */ 4343 asoc->fast_retran_loss_recovery = 0; 4344 } 4345 if ((asoc->sat_t3_loss_recovery) && 4346 ((compare_with_wrap(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn, 4347 MAX_TSN) || 4348 (asoc->last_acked_seq == asoc->sat_t3_recovery_tsn)))) { 4349 /* end satellite t3 loss recovery */ 4350 asoc->sat_t3_loss_recovery = 0; 4351 } 4352 /* Adjust and set the new rwnd value */ 4353 #ifdef SCTP_LOG_RWND 4354 sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK, 4355 asoc->peers_rwnd, asoc->total_flight, (asoc->sent_queue_cnt * sctp_peer_chunk_oh), a_rwnd); 4356 #endif 4357 4358 asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd, 4359 (u_int32_t)(asoc->total_flight + (asoc->sent_queue_cnt * sctp_peer_chunk_oh))); 4360 if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) { 4361 /* SWS sender side engages */ 4362 asoc->peers_rwnd = 0; 4363 } 4364 /* 4365 * Now we must setup so we have a timer up for anyone with 4366 * outstanding data. 4367 */ 4368 TAILQ_FOREACH(net, &asoc->nets, sctp_next) { 4369 struct sctp_tmit_chunk *chk; 4370 TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) { 4371 if (chk->whoTo == net && 4372 (chk->sent < SCTP_DATAGRAM_ACKED || 4373 chk->sent == SCTP_FORWARD_TSN_SKIP)) { 4374 /* 4375 * Not ack'ed and still outstanding to this 4376 * destination or marked and must be 4377 * sacked after fwd-tsn sent. 4378 */ 4379 sctp_timer_start(SCTP_TIMER_TYPE_SEND, 4380 stcb->sctp_ep, stcb, net); 4381 break; 4382 } 4383 } 4384 } 4385 } 4386 4387 void 4388 sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp, 4389 struct sctp_nets *netp, int *abort_flag) 4390 { 4391 /* Mutate a shutdown into a SACK */ 4392 struct sctp_sack_chunk sack; 4393 4394 /* Copy cum-ack */ 4395 sack.sack.cum_tsn_ack = cp->cumulative_tsn_ack; 4396 /* Arrange so a_rwnd does NOT change */ 4397 sack.ch.chunk_type = SCTP_SELECTIVE_ACK; 4398 sack.ch.chunk_flags = 0; 4399 sack.ch.chunk_length = ntohs(sizeof(struct sctp_sack_chunk)); 4400 sack.sack.a_rwnd = 4401 htonl(stcb->asoc.peers_rwnd + stcb->asoc.total_flight); 4402 /* 4403 * no gaps in this one. This may cause a temporal view to reneging, 4404 * but hopefully the second chunk is a true SACK in the packet and 4405 * will correct this view. One will come soon after no matter what 4406 * to fix this. 4407 */ 4408 sack.sack.num_gap_ack_blks = 0; 4409 sack.sack.num_dup_tsns = 0; 4410 /* Now call the SACK processor */ 4411 sctp_handle_sack(&sack, stcb, netp, abort_flag); 4412 } 4413 4414 static void 4415 sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb, 4416 struct sctp_stream_in *strmin) 4417 { 4418 struct sctp_tmit_chunk *chk, *nchk; 4419 struct sctp_association *asoc; 4420 int tt; 4421 4422 asoc = &stcb->asoc; 4423 tt = strmin->last_sequence_delivered; 4424 /* 4425 * First deliver anything prior to and including the stream no that 4426 * came in 4427 */ 4428 chk = TAILQ_FIRST(&strmin->inqueue); 4429 while (chk) { 4430 nchk = TAILQ_NEXT(chk, sctp_next); 4431 if (compare_with_wrap(tt, chk->rec.data.stream_seq, MAX_SEQ) || 4432 (tt == chk->rec.data.stream_seq)) { 4433 /* this is deliverable now */ 4434 TAILQ_REMOVE(&strmin->inqueue, chk, sctp_next); 4435 /* subtract pending on streams */ 4436 asoc->size_on_all_streams -= chk->send_size; 4437 asoc->cnt_on_all_streams--; 4438 /* deliver it to at least the delivery-q */ 4439 sctp_deliver_data(stcb, &stcb->asoc, chk, 0); 4440 } else { 4441 /* no more delivery now. */ 4442 break; 4443 } 4444 chk = nchk; 4445 } 4446 /* 4447 * now we must deliver things in queue the normal way if any 4448 * are now ready. 4449 */ 4450 tt = strmin->last_sequence_delivered + 1; 4451 chk = TAILQ_FIRST(&strmin->inqueue); 4452 while (chk) { 4453 nchk = TAILQ_NEXT(chk, sctp_next); 4454 if (tt == chk->rec.data.stream_seq) { 4455 /* this is deliverable now */ 4456 TAILQ_REMOVE(&strmin->inqueue, chk, sctp_next); 4457 /* subtract pending on streams */ 4458 asoc->size_on_all_streams -= chk->send_size; 4459 asoc->cnt_on_all_streams--; 4460 /* deliver it to at least the delivery-q */ 4461 strmin->last_sequence_delivered = 4462 chk->rec.data.stream_seq; 4463 sctp_deliver_data(stcb, &stcb->asoc, chk, 0); 4464 tt = strmin->last_sequence_delivered + 1; 4465 } else { 4466 break; 4467 } 4468 chk = nchk; 4469 } 4470 4471 } 4472 4473 void 4474 sctp_handle_forward_tsn(struct sctp_tcb *stcb, 4475 struct sctp_forward_tsn_chunk *fwd, int *abort_flag) 4476 { 4477 /* 4478 * ISSUES that MUST be fixed for ECN! When we are the 4479 * sender of the forward TSN, when the SACK comes back 4480 * that acknowledges the FWD-TSN we must reset the 4481 * NONCE sum to match correctly. This will get quite 4482 * tricky since we may have sent more data interveneing and 4483 * must carefully account for what the SACK says on the 4484 * nonce and any gaps that are reported. This work 4485 * will NOT be done here, but I note it here since 4486 * it is really related to PR-SCTP and FWD-TSN's 4487 */ 4488 4489 /* The pr-sctp fwd tsn */ 4490 /* 4491 * here we will perform all the data receiver side steps for 4492 * processing FwdTSN, as required in by pr-sctp draft: 4493 * 4494 * Assume we get FwdTSN(x): 4495 * 4496 * 1) update local cumTSN to x 4497 * 2) try to further advance cumTSN to x + others we have 4498 * 3) examine and update re-ordering queue on pr-in-streams 4499 * 4) clean up re-assembly queue 4500 * 5) Send a sack to report where we are. 4501 */ 4502 struct sctp_strseq *stseq; 4503 struct sctp_association *asoc; 4504 u_int32_t new_cum_tsn, gap, back_out_htsn; 4505 unsigned int i, cnt_gone, fwd_sz, cumack_set_flag, m_size; 4506 struct sctp_stream_in *strm; 4507 struct sctp_tmit_chunk *chk, *at; 4508 4509 cumack_set_flag = 0; 4510 asoc = &stcb->asoc; 4511 cnt_gone = 0; 4512 if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) { 4513 #ifdef SCTP_DEBUG 4514 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 4515 kprintf("Bad size too small/big fwd-tsn\n"); 4516 } 4517 #endif 4518 return; 4519 } 4520 m_size = (stcb->asoc.mapping_array_size << 3); 4521 /*************************************************************/ 4522 /* 1. Here we update local cumTSN and shift the bitmap array */ 4523 /*************************************************************/ 4524 new_cum_tsn = ntohl(fwd->new_cumulative_tsn); 4525 4526 if (compare_with_wrap(asoc->cumulative_tsn, new_cum_tsn, MAX_TSN) || 4527 asoc->cumulative_tsn == new_cum_tsn) { 4528 /* Already got there ... */ 4529 return; 4530 } 4531 4532 back_out_htsn = asoc->highest_tsn_inside_map; 4533 if (compare_with_wrap(new_cum_tsn, asoc->highest_tsn_inside_map, 4534 MAX_TSN)) { 4535 asoc->highest_tsn_inside_map = new_cum_tsn; 4536 #ifdef SCTP_MAP_LOGGING 4537 sctp_log_map(0, 0, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 4538 #endif 4539 } 4540 /* 4541 * now we know the new TSN is more advanced, let's find the 4542 * actual gap 4543 */ 4544 if ((compare_with_wrap(new_cum_tsn, asoc->mapping_array_base_tsn, 4545 MAX_TSN)) || 4546 (new_cum_tsn == asoc->mapping_array_base_tsn)) { 4547 gap = new_cum_tsn - asoc->mapping_array_base_tsn; 4548 } else { 4549 /* try to prevent underflow here */ 4550 gap = new_cum_tsn + (MAX_TSN - asoc->mapping_array_base_tsn) + 1; 4551 } 4552 4553 if (gap > m_size || gap < 0) { 4554 asoc->highest_tsn_inside_map = back_out_htsn; 4555 if ((long)gap > sctp_sbspace(&stcb->sctp_socket->so_rcv)) { 4556 /* 4557 * out of range (of single byte chunks in the rwnd I 4558 * give out) 4559 * too questionable. better to drop it silently 4560 */ 4561 return; 4562 } 4563 if (asoc->highest_tsn_inside_map > 4564 asoc->mapping_array_base_tsn) { 4565 gap = asoc->highest_tsn_inside_map - 4566 asoc->mapping_array_base_tsn; 4567 } else { 4568 gap = asoc->highest_tsn_inside_map + 4569 (MAX_TSN - asoc->mapping_array_base_tsn) + 1; 4570 } 4571 cumack_set_flag = 1; 4572 } 4573 for (i = 0; i <= gap; i++) { 4574 SCTP_SET_TSN_PRESENT(asoc->mapping_array, i); 4575 } 4576 /* 4577 * Now after marking all, slide thing forward but no 4578 * sack please. 4579 */ 4580 sctp_sack_check(stcb, 0, 0, abort_flag); 4581 if (*abort_flag) 4582 return; 4583 4584 if (cumack_set_flag) { 4585 /* 4586 * fwd-tsn went outside my gap array - not a 4587 * common occurance. Do the same thing we 4588 * do when a cookie-echo arrives. 4589 */ 4590 asoc->highest_tsn_inside_map = new_cum_tsn - 1; 4591 asoc->mapping_array_base_tsn = new_cum_tsn; 4592 asoc->cumulative_tsn = asoc->highest_tsn_inside_map; 4593 #ifdef SCTP_MAP_LOGGING 4594 sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT); 4595 #endif 4596 asoc->last_echo_tsn = asoc->highest_tsn_inside_map; 4597 } 4598 /*************************************************************/ 4599 /* 2. Clear up re-assembly queue */ 4600 /*************************************************************/ 4601 4602 /* 4603 * First service it if pd-api is up, just in case we can 4604 * progress it forward 4605 */ 4606 if (asoc->fragmented_delivery_inprogress) { 4607 sctp_service_reassembly(stcb, asoc, 0); 4608 } 4609 if (!TAILQ_EMPTY(&asoc->reasmqueue)) { 4610 /* For each one on here see if we need to toss it */ 4611 /* 4612 * For now large messages held on the reasmqueue that are 4613 * complete will be tossed too. We could in theory do more 4614 * work to spin through and stop after dumping one msg 4615 * aka seeing the start of a new msg at the head, and call 4616 * the delivery function... to see if it can be delivered... 4617 * But for now we just dump everything on the queue. 4618 */ 4619 chk = TAILQ_FIRST(&asoc->reasmqueue); 4620 while (chk) { 4621 at = TAILQ_NEXT(chk, sctp_next); 4622 if (compare_with_wrap(asoc->cumulative_tsn, 4623 chk->rec.data.TSN_seq, MAX_TSN) || 4624 asoc->cumulative_tsn == chk->rec.data.TSN_seq) { 4625 /* It needs to be tossed */ 4626 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next); 4627 if (compare_with_wrap(chk->rec.data.TSN_seq, 4628 asoc->tsn_last_delivered, MAX_TSN)) { 4629 asoc->tsn_last_delivered = 4630 chk->rec.data.TSN_seq; 4631 asoc->str_of_pdapi = 4632 chk->rec.data.stream_number; 4633 asoc->ssn_of_pdapi = 4634 chk->rec.data.stream_seq; 4635 asoc->fragment_flags = 4636 chk->rec.data.rcv_flags; 4637 } 4638 asoc->size_on_reasm_queue -= chk->send_size; 4639 asoc->cnt_on_reasm_queue--; 4640 cnt_gone++; 4641 4642 /* Clear up any stream problem */ 4643 if ((chk->rec.data.rcv_flags & SCTP_DATA_UNORDERED) != 4644 SCTP_DATA_UNORDERED && 4645 (compare_with_wrap(chk->rec.data.stream_seq, 4646 asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered, 4647 MAX_SEQ))) { 4648 /* 4649 * We must dump forward this streams 4650 * sequence number if the chunk is not 4651 * unordered that is being skipped. 4652 * There is a chance that if the peer 4653 * does not include the last fragment 4654 * in its FWD-TSN we WILL have a problem 4655 * here since you would have a partial 4656 * chunk in queue that may not be 4657 * deliverable. 4658 * Also if a Partial delivery API as 4659 * started the user may get a partial 4660 * chunk. The next read returning a new 4661 * chunk... really ugly but I see no way 4662 * around it! Maybe a notify?? 4663 */ 4664 asoc->strmin[chk->rec.data.stream_number].last_sequence_delivered = 4665 chk->rec.data.stream_seq; 4666 } 4667 if (chk->data) { 4668 sctp_m_freem(chk->data); 4669 chk->data = NULL; 4670 } 4671 sctp_free_remote_addr(chk->whoTo); 4672 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk); 4673 sctppcbinfo.ipi_count_chunk--; 4674 if ((int)sctppcbinfo.ipi_count_chunk < 0) { 4675 panic("Chunk count is negative"); 4676 } 4677 sctppcbinfo.ipi_gencnt_chunk++; 4678 } else { 4679 /* 4680 * Ok we have gone beyond the end of the 4681 * fwd-tsn's mark. Some checks... 4682 */ 4683 if ((asoc->fragmented_delivery_inprogress) && 4684 (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) { 4685 /* Special case PD-API is up and what we fwd-tsn' 4686 * over includes one that had the LAST_FRAG. We 4687 * no longer need to do the PD-API. 4688 */ 4689 asoc->fragmented_delivery_inprogress = 0; 4690 sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION, 4691 stcb, SCTP_PARTIAL_DELIVERY_ABORTED, NULL); 4692 4693 } 4694 break; 4695 } 4696 chk = at; 4697 } 4698 } 4699 if (asoc->fragmented_delivery_inprogress) { 4700 /* 4701 * Ok we removed cnt_gone chunks in the PD-API queue that 4702 * were being delivered. So now we must turn off the 4703 * flag. 4704 */ 4705 sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION, 4706 stcb, SCTP_PARTIAL_DELIVERY_ABORTED, NULL); 4707 asoc->fragmented_delivery_inprogress = 0; 4708 } 4709 /*************************************************************/ 4710 /* 3. Update the PR-stream re-ordering queues */ 4711 /*************************************************************/ 4712 stseq = (struct sctp_strseq *)((caddr_t)fwd + sizeof(*fwd)); 4713 fwd_sz -= sizeof(*fwd); 4714 { 4715 /* New method. */ 4716 int num_str, i; 4717 num_str = fwd_sz/sizeof(struct sctp_strseq); 4718 #ifdef SCTP_DEBUG 4719 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 4720 kprintf("Using NEW method, %d strseq's reported in FWD-TSN\n", 4721 num_str); 4722 } 4723 #endif 4724 for (i = 0; i < num_str; i++) { 4725 u_int16_t st; 4726 /* Convert */ 4727 st = ntohs(stseq[i].stream); 4728 stseq[i].stream = st; 4729 st = ntohs(stseq[i].sequence); 4730 stseq[i].sequence = st; 4731 /* now process */ 4732 if (stseq[i].stream > asoc->streamincnt) { 4733 #ifdef SCTP_DEBUG 4734 if (sctp_debug_on & SCTP_DEBUG_INDATA1) { 4735 kprintf("Bogus stream number %d " 4736 "streamincnt is %d\n", 4737 stseq[i].stream, asoc->streamincnt); 4738 } 4739 #endif 4740 /* 4741 * It is arguable if we should continue. Since 4742 * the peer sent bogus stream info we may be in 4743 * deep trouble.. 4744 * a return may be a better choice? 4745 */ 4746 continue; 4747 } 4748 strm = &asoc->strmin[stseq[i].stream]; 4749 if (compare_with_wrap(stseq[i].sequence, 4750 strm->last_sequence_delivered, MAX_SEQ)) { 4751 /* Update the sequence number */ 4752 strm->last_sequence_delivered = 4753 stseq[i].sequence; 4754 } 4755 /* now kick the stream the new way */ 4756 sctp_kick_prsctp_reorder_queue(stcb, strm); 4757 } 4758 } 4759 }
Cache object: 337fe406b5afe9f1e1374b8e615512a4
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]