inet/sctp/sctp_input.c

0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * CDDL HEADER START
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
1676Sjpk * Common Development and Distribution License (the "License").
1676Sjpk * You may not use this file except in compliance with the License.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
0Sstevel@tonic-gate * See the License for the specific language governing permissions
0Sstevel@tonic-gate * and limitations under the License.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * CDDL HEADER END
0Sstevel@tonic-gate */
1735Skcpoon
0Sstevel@tonic-gate/*
8778SErik.Nordmark@Sun.COM * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
0Sstevel@tonic-gate * Use is subject to license terms.
0Sstevel@tonic-gate */
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include <sys/types.h>
0Sstevel@tonic-gate#include <sys/systm.h>
0Sstevel@tonic-gate#include <sys/stream.h>
0Sstevel@tonic-gate#include <sys/cmn_err.h>
0Sstevel@tonic-gate#include <sys/kmem.h>
0Sstevel@tonic-gate#define	_SUN_TPI_VERSION 2
0Sstevel@tonic-gate#include <sys/tihdr.h>
0Sstevel@tonic-gate#include <sys/socket.h>
0Sstevel@tonic-gate#include <sys/strsun.h>
0Sstevel@tonic-gate#include <sys/strsubr.h>
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include <netinet/in.h>
0Sstevel@tonic-gate#include <netinet/ip6.h>
0Sstevel@tonic-gate#include <netinet/tcp_seq.h>
0Sstevel@tonic-gate#include <netinet/sctp.h>
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include <inet/common.h>
0Sstevel@tonic-gate#include <inet/ip.h>
*11042SErik.Nordmark@Sun.COM#include <inet/ip_if.h>
0Sstevel@tonic-gate#include <inet/ip6.h>
0Sstevel@tonic-gate#include <inet/mib2.h>
0Sstevel@tonic-gate#include <inet/ipclassifier.h>
0Sstevel@tonic-gate#include <inet/ipp_common.h>
0Sstevel@tonic-gate#include <inet/ipsec_impl.h>
0Sstevel@tonic-gate#include <inet/sctp_ip.h>
0Sstevel@tonic-gate
0Sstevel@tonic-gate#include "sctp_impl.h"
0Sstevel@tonic-gate#include "sctp_asconf.h"
0Sstevel@tonic-gate#include "sctp_addr.h"
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic struct kmem_cache *sctp_kmem_set_cache;
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * PR-SCTP comments.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * When we get a valid Forward TSN chunk, we check the fragment list for this
0Sstevel@tonic-gate * SSN and preceeding SSNs free all them. Further, if this Forward TSN causes
0Sstevel@tonic-gate * the next expected SSN to be present in the stream queue, we deliver any
0Sstevel@tonic-gate * such stranded messages upstream. We also update the SACK info. appropriately.
0Sstevel@tonic-gate * When checking for advancing the cumulative ack (in sctp_cumack()) we must
0Sstevel@tonic-gate * check for abandoned chunks and messages. While traversing the tramsmit
0Sstevel@tonic-gate * list if we come across an abandoned chunk, we can skip the message (i.e.
0Sstevel@tonic-gate * take it out of the (re)transmit list) since this message, and hence this
0Sstevel@tonic-gate * chunk, has been marked abandoned by sctp_rexmit(). If we come across an
0Sstevel@tonic-gate * unsent chunk for a message this now abandoned we need to check if a
0Sstevel@tonic-gate * Forward TSN needs to be sent, this could be a case where we deferred sending
0Sstevel@tonic-gate * a Forward TSN in sctp_get_msg_to_send(). Further, after processing a
0Sstevel@tonic-gate * SACK we check if the Advanced peer ack point can be moved ahead, i.e.
0Sstevel@tonic-gate * if we can send a Forward TSN via sctp_check_abandoned_data().
0Sstevel@tonic-gate */
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_free_set(sctp_set_t *s)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_set_t *p;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	while (s) {
0Sstevel@tonic-gate		p = s->next;
0Sstevel@tonic-gate		kmem_cache_free(sctp_kmem_set_cache, s);
0Sstevel@tonic-gate		s = p;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_ack_add(sctp_set_t **head, uint32_t tsn, int *num)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_set_t *p, *t;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (head == NULL || num == NULL)
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(*num >= 0);
0Sstevel@tonic-gate	ASSERT((*num == 0 && *head == NULL) || (*num > 0 && *head != NULL));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (*head == NULL) {
0Sstevel@tonic-gate		*head = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate		if (*head == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		(*head)->prev = (*head)->next = NULL;
0Sstevel@tonic-gate		(*head)->begin = tsn;
0Sstevel@tonic-gate		(*head)->end = tsn;
0Sstevel@tonic-gate		*num = 1;
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT((*head)->prev == NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Handle this special case here so we don't have to check
0Sstevel@tonic-gate	 * for it each time in the loop.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (SEQ_LT(tsn + 1, (*head)->begin)) {
0Sstevel@tonic-gate		/* add a new set, and move the head pointer */
0Sstevel@tonic-gate		t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate		if (t == NULL)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		t->next = *head;
0Sstevel@tonic-gate		t->prev = NULL;
0Sstevel@tonic-gate		(*head)->prev = t;
0Sstevel@tonic-gate		t->begin = tsn;
0Sstevel@tonic-gate		t->end = tsn;
0Sstevel@tonic-gate		(*num)++;
0Sstevel@tonic-gate		*head = t;
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We need to handle the following cases, where p points to
0Sstevel@tonic-gate	 * the current set (as we walk through the loop):
0Sstevel@tonic-gate	 *
0Sstevel@tonic-gate	 * 1. tsn is entirely less than p; create a new set before p.
0Sstevel@tonic-gate	 * 2. tsn borders p from less; coalesce p with tsn.
0Sstevel@tonic-gate	 * 3. tsn is withing p; do nothing.
0Sstevel@tonic-gate	 * 4. tsn borders p from greater; coalesce p with tsn.
0Sstevel@tonic-gate	 * 4a. p may now border p->next from less; if so, coalesce those
0Sstevel@tonic-gate	 *    two sets.
0Sstevel@tonic-gate	 * 5. tsn is entirely greater then all sets; add a new set at
0Sstevel@tonic-gate	 *    the end.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	for (p = *head; ; p = p->next) {
0Sstevel@tonic-gate		if (SEQ_LT(tsn + 1, p->begin)) {
0Sstevel@tonic-gate			/* 1: add a new set before p. */
0Sstevel@tonic-gate			t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate			if (t == NULL)
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			t->next = p;
0Sstevel@tonic-gate			t->prev = NULL;
0Sstevel@tonic-gate			t->begin = tsn;
0Sstevel@tonic-gate			t->end = tsn;
0Sstevel@tonic-gate			if (p->prev) {
0Sstevel@tonic-gate				t->prev = p->prev;
0Sstevel@tonic-gate				p->prev->next = t;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			p->prev = t;
0Sstevel@tonic-gate			(*num)++;
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if ((tsn + 1) == p->begin) {
0Sstevel@tonic-gate			/* 2: adjust p->begin */
0Sstevel@tonic-gate			p->begin = tsn;
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (SEQ_GEQ(tsn, p->begin) && SEQ_LEQ(tsn, p->end)) {
0Sstevel@tonic-gate			/* 3; do nothing */
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if ((p->end + 1) == tsn) {
0Sstevel@tonic-gate			/* 4; adjust p->end */
0Sstevel@tonic-gate			p->end = tsn;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			if (p->next != NULL && (tsn + 1) == p->next->begin) {
0Sstevel@tonic-gate				/* 4a: coalesce p and p->next */
0Sstevel@tonic-gate				t = p->next;
0Sstevel@tonic-gate				p->end = t->end;
0Sstevel@tonic-gate				p->next = t->next;
0Sstevel@tonic-gate				if (t->next != NULL)
0Sstevel@tonic-gate					t->next->prev = p;
0Sstevel@tonic-gate				kmem_cache_free(sctp_kmem_set_cache, t);
0Sstevel@tonic-gate				(*num)--;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (p->next == NULL) {
0Sstevel@tonic-gate			/* 5: add new set at the end */
0Sstevel@tonic-gate			t = kmem_cache_alloc(sctp_kmem_set_cache, KM_NOSLEEP);
0Sstevel@tonic-gate			if (t == NULL)
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			t->next = NULL;
0Sstevel@tonic-gate			t->prev = p;
0Sstevel@tonic-gate			t->begin = tsn;
0Sstevel@tonic-gate			t->end = tsn;
0Sstevel@tonic-gate			p->next = t;
0Sstevel@tonic-gate			(*num)++;
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (SEQ_GT(tsn, p->end + 1))
0Sstevel@tonic-gate			continue;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_ack_rem(sctp_set_t **head, uint32_t end, int *num)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_set_t *p, *t;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (head == NULL || *head == NULL || num == NULL)
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Nothing to remove */
0Sstevel@tonic-gate	if (SEQ_LT(end, (*head)->begin))
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Find out where to start removing sets */
0Sstevel@tonic-gate	for (p = *head; p->next; p = p->next) {
0Sstevel@tonic-gate		if (SEQ_LEQ(end, p->end))
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (SEQ_LT(end, p->end) && SEQ_GEQ(end, p->begin)) {
0Sstevel@tonic-gate		/* adjust p */
0Sstevel@tonic-gate		p->begin = end + 1;
0Sstevel@tonic-gate		/* all done */
0Sstevel@tonic-gate		if (p == *head)
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate	} else if (SEQ_GEQ(end, p->end)) {
0Sstevel@tonic-gate		/* remove this set too */
0Sstevel@tonic-gate		p = p->next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* unlink everything before this set */
0Sstevel@tonic-gate	t = *head;
0Sstevel@tonic-gate	*head = p;
0Sstevel@tonic-gate	if (p != NULL && p->prev != NULL) {
0Sstevel@tonic-gate		p->prev->next = NULL;
0Sstevel@tonic-gate		p->prev = NULL;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_free_set(t);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* recount the number of sets */
0Sstevel@tonic-gate	*num = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	for (p = *head; p != NULL; p = p->next)
0Sstevel@tonic-gate		(*num)++;
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_sets_init()
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_kmem_set_cache = kmem_cache_create("sctp_set_cache",
0Sstevel@tonic-gate	    sizeof (sctp_set_t), 0, NULL, NULL, NULL, NULL,
0Sstevel@tonic-gate	    NULL, 0);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_sets_fini()
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	kmem_cache_destroy(sctp_kmem_set_cache);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatesctp_chunk_hdr_t *
0Sstevel@tonic-gatesctp_first_chunk(uchar_t *rptr, ssize_t remaining)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_chunk_hdr_t *ch;
0Sstevel@tonic-gate	uint16_t ch_len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (remaining < sizeof (*ch)) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ch = (sctp_chunk_hdr_t *)rptr;
0Sstevel@tonic-gate	ch_len = ntohs(ch->sch_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (ch_len < sizeof (*ch) || remaining < ch_len) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (ch);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatesctp_chunk_hdr_t *
0Sstevel@tonic-gatesctp_next_chunk(sctp_chunk_hdr_t *ch, ssize_t *remaining)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	int pad;
0Sstevel@tonic-gate	uint16_t ch_len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (!ch) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ch_len = ntohs(ch->sch_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if ((pad = ch_len & (SCTP_ALIGN - 1)) != 0) {
0Sstevel@tonic-gate		pad = SCTP_ALIGN - pad;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	*remaining -= (ch_len + pad);
0Sstevel@tonic-gate	ch = (sctp_chunk_hdr_t *)((char *)ch + ch_len + pad);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (sctp_first_chunk((uchar_t *)ch, *remaining));
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Attach ancillary data to a received SCTP segments.
0Sstevel@tonic-gate * If the source address (fp) is not the primary, send up a
0Sstevel@tonic-gate * unitdata_ind so recvfrom() can populate the msg_name field.
0Sstevel@tonic-gate * If ancillary data is also requested, we append it to the
0Sstevel@tonic-gate * unitdata_req. Otherwise, we just send up an optdata_ind.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_input_add_ancillary(sctp_t *sctp, mblk_t **mp, sctp_data_hdr_t *dcp,
*11042SErik.Nordmark@Sun.COM    sctp_faddr_t *fp, ip_pkt_t *ipp, ip_recv_attr_t *ira)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	struct T_unitdata_ind	*tudi;
0Sstevel@tonic-gate	int			optlen;
0Sstevel@tonic-gate	int			hdrlen;
0Sstevel@tonic-gate	uchar_t			*optptr;
0Sstevel@tonic-gate	struct cmsghdr		*cmsg;
0Sstevel@tonic-gate	mblk_t			*mp1;
0Sstevel@tonic-gate	struct sockaddr_in6	sin_buf[1];
0Sstevel@tonic-gate	struct sockaddr_in6	*sin6;
0Sstevel@tonic-gate	struct sockaddr_in	*sin4;
*11042SErik.Nordmark@Sun.COM	crb_t			 addflag;	/* Which pieces to add */
*11042SErik.Nordmark@Sun.COM	conn_t			*connp = sctp->sctp_connp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sin4 = NULL;
0Sstevel@tonic-gate	sin6 = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	optlen = hdrlen = 0;
*11042SErik.Nordmark@Sun.COM	addflag.crb_all = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Figure out address size */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_family == AF_INET) {
0Sstevel@tonic-gate		sin4 = (struct sockaddr_in *)sin_buf;
0Sstevel@tonic-gate		sin4->sin_family = AF_INET;
*11042SErik.Nordmark@Sun.COM		sin4->sin_port = connp->conn_fport;
0Sstevel@tonic-gate		IN6_V4MAPPED_TO_IPADDR(&fp->faddr, sin4->sin_addr.s_addr);
0Sstevel@tonic-gate		hdrlen = sizeof (*tudi) + sizeof (*sin4);
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		sin6 = sin_buf;
0Sstevel@tonic-gate		sin6->sin6_family = AF_INET6;
*11042SErik.Nordmark@Sun.COM		sin6->sin6_port = connp->conn_fport;
0Sstevel@tonic-gate		sin6->sin6_addr = fp->faddr;
0Sstevel@tonic-gate		hdrlen = sizeof (*tudi) + sizeof (*sin6);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked to receive send / recv info */
*11042SErik.Nordmark@Sun.COM	if (sctp->sctp_recvsndrcvinfo)
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + sizeof (struct sctp_sndrcvinfo);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_all == 0)
0Sstevel@tonic-gate		goto noancillary;
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
*11042SErik.Nordmark@Sun.COM	    ira->ira_ruifindex != sctp->sctp_recvifindex) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + sizeof (struct in6_pktinfo);
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ip_recvpktinfo = 1;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for hoplimit and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
*11042SErik.Nordmark@Sun.COM	    ipp->ipp_hoplimit != sctp->sctp_recvhops) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + sizeof (uint_t);
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ipv6_recvhoplimit = 1;
*11042SErik.Nordmark@Sun.COM	}
*11042SErik.Nordmark@Sun.COM	/* If app asked for tclass and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
*11042SErik.Nordmark@Sun.COM	    ipp->ipp_tclass != sctp->sctp_recvtclass) {
*11042SErik.Nordmark@Sun.COM		optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
*11042SErik.Nordmark@Sun.COM		if (hdrlen == 0)
*11042SErik.Nordmark@Sun.COM			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ipv6_recvtclass = 1;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for hopbyhop headers and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
1676Sjpk	    ip_cmpbuf(sctp->sctp_hopopts, sctp->sctp_hopoptslen,
4964Skcpoon	    (ipp->ipp_fields & IPPF_HOPOPTS),
4964Skcpoon	    ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
1676Sjpk		optlen += sizeof (*cmsg) + ipp->ipp_hopoptslen -
1676Sjpk		    sctp->sctp_v6label_len;
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ipv6_recvhopopts = 1;
1676Sjpk		if (!ip_allocbuf((void **)&sctp->sctp_hopopts,
0Sstevel@tonic-gate		    &sctp->sctp_hopoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_HOPOPTS),
0Sstevel@tonic-gate		    ipp->ipp_hopopts, ipp->ipp_hopoptslen))
0Sstevel@tonic-gate			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for dst headers before routing headers ... */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
*11042SErik.Nordmark@Sun.COM	    ip_cmpbuf(sctp->sctp_rthdrdstopts, sctp->sctp_rthdrdstoptslen,
*11042SErik.Nordmark@Sun.COM	    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
*11042SErik.Nordmark@Sun.COM	    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
*11042SErik.Nordmark@Sun.COM		optlen += sizeof (*cmsg) + ipp->ipp_rthdrdstoptslen;
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ipv6_recvrthdrdstopts = 1;
*11042SErik.Nordmark@Sun.COM		if (!ip_allocbuf((void **)&sctp->sctp_rthdrdstopts,
*11042SErik.Nordmark@Sun.COM		    &sctp->sctp_rthdrdstoptslen,
*11042SErik.Nordmark@Sun.COM		    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
*11042SErik.Nordmark@Sun.COM		    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
0Sstevel@tonic-gate			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for routing headers and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
*11042SErik.Nordmark@Sun.COM	    ip_cmpbuf(sctp->sctp_rthdr, sctp->sctp_rthdrlen,
*11042SErik.Nordmark@Sun.COM	    (ipp->ipp_fields & IPPF_RTHDR),
*11042SErik.Nordmark@Sun.COM	    ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
*11042SErik.Nordmark@Sun.COM		optlen += sizeof (*cmsg) + ipp->ipp_rthdrlen;
*11042SErik.Nordmark@Sun.COM		if (hdrlen == 0)
*11042SErik.Nordmark@Sun.COM			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ipv6_recvrthdr = 1;
*11042SErik.Nordmark@Sun.COM		if (!ip_allocbuf((void **)&sctp->sctp_rthdr,
*11042SErik.Nordmark@Sun.COM		    &sctp->sctp_rthdrlen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_RTHDR),
*11042SErik.Nordmark@Sun.COM		    ipp->ipp_rthdr, ipp->ipp_rthdrlen))
*11042SErik.Nordmark@Sun.COM			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for dest headers and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_ipv6_recvdstopts &&
1676Sjpk	    ip_cmpbuf(sctp->sctp_dstopts, sctp->sctp_dstoptslen,
4964Skcpoon	    (ipp->ipp_fields & IPPF_DSTOPTS),
4964Skcpoon	    ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
0Sstevel@tonic-gate		optlen += sizeof (*cmsg) + ipp->ipp_dstoptslen;
0Sstevel@tonic-gate		if (hdrlen == 0)
0Sstevel@tonic-gate			hdrlen = sizeof (struct T_unitdata_ind);
*11042SErik.Nordmark@Sun.COM		addflag.crb_ipv6_recvdstopts = 1;
1676Sjpk		if (!ip_allocbuf((void **)&sctp->sctp_dstopts,
0Sstevel@tonic-gate		    &sctp->sctp_dstoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_DSTOPTS),
0Sstevel@tonic-gate		    ipp->ipp_dstopts, ipp->ipp_dstoptslen))
0Sstevel@tonic-gate			return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gatenoancillary:
0Sstevel@tonic-gate	/* Nothing to add */
0Sstevel@tonic-gate	if (hdrlen == 0)
0Sstevel@tonic-gate		return (-1);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	mp1 = allocb(hdrlen + optlen + sizeof (void *), BPRI_MED);
0Sstevel@tonic-gate	if (mp1 == NULL)
0Sstevel@tonic-gate		return (-1);
0Sstevel@tonic-gate	mp1->b_cont = *mp;
0Sstevel@tonic-gate	*mp = mp1;
0Sstevel@tonic-gate	mp1->b_rptr += sizeof (void *);  /* pointer worth of padding */
0Sstevel@tonic-gate	mp1->b_wptr = mp1->b_rptr + hdrlen + optlen;
0Sstevel@tonic-gate	DB_TYPE(mp1) = M_PROTO;
0Sstevel@tonic-gate	tudi = (struct T_unitdata_ind *)mp1->b_rptr;
0Sstevel@tonic-gate	tudi->PRIM_type = T_UNITDATA_IND;
0Sstevel@tonic-gate	tudi->SRC_length = sin4 ? sizeof (*sin4) : sizeof (*sin6);
0Sstevel@tonic-gate	tudi->SRC_offset = sizeof (*tudi);
0Sstevel@tonic-gate	tudi->OPT_offset = sizeof (*tudi) + tudi->SRC_length;
0Sstevel@tonic-gate	tudi->OPT_length = optlen;
0Sstevel@tonic-gate	if (sin4) {
0Sstevel@tonic-gate		bcopy(sin4, tudi + 1, sizeof (*sin4));
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		bcopy(sin6, tudi + 1, sizeof (*sin6));
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	optptr = (uchar_t *)tudi + tudi->OPT_offset;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_recvsndrcvinfo) {
0Sstevel@tonic-gate		/* XXX need backout method if memory allocation fails. */
0Sstevel@tonic-gate		struct sctp_sndrcvinfo *sri;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_SCTP;
0Sstevel@tonic-gate		cmsg->cmsg_type = SCTP_SNDRCV;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*sri);
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		sri = (struct sctp_sndrcvinfo *)(cmsg + 1);
0Sstevel@tonic-gate		ASSERT(OK_32PTR(sri));
0Sstevel@tonic-gate		sri->sinfo_stream = ntohs(dcp->sdh_sid);
0Sstevel@tonic-gate		sri->sinfo_ssn = ntohs(dcp->sdh_ssn);
0Sstevel@tonic-gate		if (SCTP_DATA_GET_UBIT(dcp)) {
0Sstevel@tonic-gate			sri->sinfo_flags = MSG_UNORDERED;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			sri->sinfo_flags = 0;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sri->sinfo_ppid = dcp->sdh_payload_id;
0Sstevel@tonic-gate		sri->sinfo_context = 0;
0Sstevel@tonic-gate		sri->sinfo_timetolive = 0;
0Sstevel@tonic-gate		sri->sinfo_tsn = ntohl(dcp->sdh_tsn);
0Sstevel@tonic-gate		sri->sinfo_cumtsn = sctp->sctp_ftsn;
0Sstevel@tonic-gate		sri->sinfo_assoc_id = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		optptr += sizeof (*sri);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If app asked for pktinfo and the index has changed ...
0Sstevel@tonic-gate	 * Note that the local address never changes for the connection.
0Sstevel@tonic-gate	 */
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ip_recvpktinfo) {
0Sstevel@tonic-gate		struct in6_pktinfo *pkti;
*11042SErik.Nordmark@Sun.COM		uint_t ifindex;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		ifindex = ira->ira_ruifindex;
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_PKTINFO;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (*pkti);
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		pkti = (struct in6_pktinfo *)optptr;
*11042SErik.Nordmark@Sun.COM		if (connp->conn_family == AF_INET6)
0Sstevel@tonic-gate			pkti->ipi6_addr = sctp->sctp_ip6h->ip6_src;
0Sstevel@tonic-gate		else
0Sstevel@tonic-gate			IN6_IPADDR_TO_V4MAPPED(sctp->sctp_ipha->ipha_src,
0Sstevel@tonic-gate			    &pkti->ipi6_addr);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		pkti->ipi6_ifindex = ifindex;
0Sstevel@tonic-gate		optptr += sizeof (*pkti);
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as "last" value */
*11042SErik.Nordmark@Sun.COM		sctp->sctp_recvifindex = ifindex;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If app asked for hoplimit and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ipv6_recvhoplimit) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_HOPLIMIT;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (uint_t);
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		*(uint_t *)optptr = ipp->ipp_hoplimit;
0Sstevel@tonic-gate		optptr += sizeof (uint_t);
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as "last" value */
0Sstevel@tonic-gate		sctp->sctp_recvhops = ipp->ipp_hoplimit;
0Sstevel@tonic-gate	}
*11042SErik.Nordmark@Sun.COM	/* If app asked for tclass and it has changed ... */
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ipv6_recvtclass) {
*11042SErik.Nordmark@Sun.COM		cmsg = (struct cmsghdr *)optptr;
*11042SErik.Nordmark@Sun.COM		cmsg->cmsg_level = IPPROTO_IPV6;
*11042SErik.Nordmark@Sun.COM		cmsg->cmsg_type = IPV6_TCLASS;
*11042SErik.Nordmark@Sun.COM		cmsg->cmsg_len = sizeof (*cmsg) + sizeof (uint_t);
*11042SErik.Nordmark@Sun.COM		optptr += sizeof (*cmsg);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		*(uint_t *)optptr = ipp->ipp_tclass;
*11042SErik.Nordmark@Sun.COM		optptr += sizeof (uint_t);
*11042SErik.Nordmark@Sun.COM		ASSERT(OK_32PTR(optptr));
*11042SErik.Nordmark@Sun.COM		/* Save as "last" value */
*11042SErik.Nordmark@Sun.COM		sctp->sctp_recvtclass = ipp->ipp_tclass;
*11042SErik.Nordmark@Sun.COM	}
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ipv6_recvhopopts) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_HOPOPTS;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_hopoptslen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
0Sstevel@tonic-gate		optptr += ipp->ipp_hopoptslen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_hopopts,
0Sstevel@tonic-gate		    &sctp->sctp_hopoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_HOPOPTS),
0Sstevel@tonic-gate		    ipp->ipp_hopopts, ipp->ipp_hopoptslen);
0Sstevel@tonic-gate	}
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ipv6_recvrthdrdstopts) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_RTHDRDSTOPTS;
*11042SErik.Nordmark@Sun.COM		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rthdrdstoptslen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM		bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
*11042SErik.Nordmark@Sun.COM		optptr += ipp->ipp_rthdrdstoptslen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
*11042SErik.Nordmark@Sun.COM		ip_savebuf((void **)&sctp->sctp_rthdrdstopts,
*11042SErik.Nordmark@Sun.COM		    &sctp->sctp_rthdrdstoptslen,
*11042SErik.Nordmark@Sun.COM		    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
*11042SErik.Nordmark@Sun.COM		    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
0Sstevel@tonic-gate	}
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ipv6_recvrthdr) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_RTHDR;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_rthdrlen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
0Sstevel@tonic-gate		optptr += ipp->ipp_rthdrlen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_rthdr,
0Sstevel@tonic-gate		    &sctp->sctp_rthdrlen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_RTHDR),
0Sstevel@tonic-gate		    ipp->ipp_rthdr, ipp->ipp_rthdrlen);
0Sstevel@tonic-gate	}
*11042SErik.Nordmark@Sun.COM	if (addflag.crb_ipv6_recvdstopts) {
0Sstevel@tonic-gate		cmsg = (struct cmsghdr *)optptr;
0Sstevel@tonic-gate		cmsg->cmsg_level = IPPROTO_IPV6;
0Sstevel@tonic-gate		cmsg->cmsg_type = IPV6_DSTOPTS;
0Sstevel@tonic-gate		cmsg->cmsg_len = sizeof (*cmsg) + ipp->ipp_dstoptslen;
0Sstevel@tonic-gate		optptr += sizeof (*cmsg);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
0Sstevel@tonic-gate		optptr += ipp->ipp_dstoptslen;
0Sstevel@tonic-gate		ASSERT(OK_32PTR(optptr));
0Sstevel@tonic-gate		/* Save as last value */
1676Sjpk		ip_savebuf((void **)&sctp->sctp_dstopts,
0Sstevel@tonic-gate		    &sctp->sctp_dstoptslen,
0Sstevel@tonic-gate		    (ipp->ipp_fields & IPPF_DSTOPTS),
0Sstevel@tonic-gate		    ipp->ipp_dstopts, ipp->ipp_dstoptslen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(optptr == mp1->b_wptr);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (0);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_free_reass(sctp_instr_t *sip)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *mp, *mpnext, *mctl;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	for (mp = sip->istr_reass; mp != NULL; mp = mpnext) {
0Sstevel@tonic-gate		mpnext = mp->b_next;
0Sstevel@tonic-gate		mp->b_next = NULL;
0Sstevel@tonic-gate		mp->b_prev = NULL;
0Sstevel@tonic-gate		if (DB_TYPE(mp) == M_CTL) {
0Sstevel@tonic-gate			mctl = mp;
0Sstevel@tonic-gate			ASSERT(mp->b_cont != NULL);
0Sstevel@tonic-gate			mp = mp->b_cont;
0Sstevel@tonic-gate			mctl->b_cont = NULL;
0Sstevel@tonic-gate			freeb(mctl);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		freemsg(mp);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * If the series of data fragments of which dmp is a part is successfully
0Sstevel@tonic-gate * reassembled, the first mblk in the series is returned. dc is adjusted
0Sstevel@tonic-gate * to point at the data chunk in the lead mblk, and b_rptr also points to
0Sstevel@tonic-gate * the data chunk; the following mblk's b_rptr's point at the actual payload.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * If the series is not yet reassembled, NULL is returned. dc is not changed.
0Sstevel@tonic-gate * XXX should probably move this up into the state machine.
0Sstevel@tonic-gate */
0Sstevel@tonic-gate
0Sstevel@tonic-gate/* Fragment list for un-ordered messages. Partial delivery is not supported */
0Sstevel@tonic-gatestatic mblk_t *
0Sstevel@tonic-gatesctp_uodata_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*begin = NULL;
0Sstevel@tonic-gate	mblk_t		*end = NULL;
0Sstevel@tonic-gate	sctp_data_hdr_t	*qdc;
0Sstevel@tonic-gate	uint32_t	ntsn;
0Sstevel@tonic-gate	uint32_t	tsn = ntohl((*dc)->sdh_tsn);
0Sstevel@tonic-gate#ifdef	DEBUG
0Sstevel@tonic-gate	mblk_t		*mp1;
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* First frag. */
0Sstevel@tonic-gate	if (sctp->sctp_uo_frags == NULL) {
0Sstevel@tonic-gate		sctp->sctp_uo_frags = dmp;
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	hmp = sctp->sctp_uo_frags;
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Insert the segment according to the TSN, fragmented unordered
0Sstevel@tonic-gate	 * chunks are sequenced by TSN.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate		ntsn = ntohl(qdc->sdh_tsn);
0Sstevel@tonic-gate		if (SEQ_GT(ntsn, tsn)) {
0Sstevel@tonic-gate			if (hmp->b_prev == NULL) {
0Sstevel@tonic-gate				dmp->b_next = hmp;
0Sstevel@tonic-gate				hmp->b_prev = dmp;
0Sstevel@tonic-gate				sctp->sctp_uo_frags = dmp;
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				dmp->b_next = hmp;
0Sstevel@tonic-gate				dmp->b_prev = hmp->b_prev;
0Sstevel@tonic-gate				hmp->b_prev->b_next = dmp;
0Sstevel@tonic-gate				hmp->b_prev = dmp;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (hmp->b_next == NULL) {
0Sstevel@tonic-gate			hmp->b_next = dmp;
0Sstevel@tonic-gate			dmp->b_prev = hmp;
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		hmp = hmp->b_next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* check if we completed a msg */
0Sstevel@tonic-gate	if (SCTP_DATA_GET_BBIT(*dc)) {
0Sstevel@tonic-gate		begin = dmp;
0Sstevel@tonic-gate	} else if (SCTP_DATA_GET_EBIT(*dc)) {
0Sstevel@tonic-gate		end = dmp;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We walk consecutive TSNs backwards till we get a seg. with
0Sstevel@tonic-gate	 * the B bit
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (begin == NULL) {
0Sstevel@tonic-gate		for (hmp = dmp->b_prev; hmp != NULL; hmp = hmp->b_prev) {
0Sstevel@tonic-gate			qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate			ntsn = ntohl(qdc->sdh_tsn);
0Sstevel@tonic-gate			if ((int32_t)(tsn - ntsn) > 1) {
0Sstevel@tonic-gate				return (NULL);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			if (SCTP_DATA_GET_BBIT(qdc)) {
0Sstevel@tonic-gate				begin = hmp;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			tsn = ntsn;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	tsn = ntohl((*dc)->sdh_tsn);
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We walk consecutive TSNs till we get a seg. with the E bit
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (end == NULL) {
0Sstevel@tonic-gate		for (hmp = dmp->b_next; hmp != NULL; hmp = hmp->b_next) {
0Sstevel@tonic-gate			qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate			ntsn = ntohl(qdc->sdh_tsn);
0Sstevel@tonic-gate			if ((int32_t)(ntsn - tsn) > 1) {
0Sstevel@tonic-gate				return (NULL);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			if (SCTP_DATA_GET_EBIT(qdc)) {
0Sstevel@tonic-gate				end = hmp;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			tsn = ntsn;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (begin == NULL || end == NULL) {
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* Got one!, Remove the msg from the list */
0Sstevel@tonic-gate	if (sctp->sctp_uo_frags == begin) {
0Sstevel@tonic-gate		ASSERT(begin->b_prev == NULL);
0Sstevel@tonic-gate		sctp->sctp_uo_frags = end->b_next;
0Sstevel@tonic-gate		if (end->b_next != NULL)
0Sstevel@tonic-gate			end->b_next->b_prev = NULL;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		begin->b_prev->b_next = end->b_next;
0Sstevel@tonic-gate		if (end->b_next != NULL)
0Sstevel@tonic-gate			end->b_next->b_prev = begin->b_prev;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	begin->b_prev = NULL;
0Sstevel@tonic-gate	end->b_next = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Null out b_next and b_prev and chain using b_cont.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	dmp = end = begin;
0Sstevel@tonic-gate	hmp = begin->b_next;
0Sstevel@tonic-gate	*dc = (sctp_data_hdr_t *)begin->b_rptr;
0Sstevel@tonic-gate	begin->b_next = NULL;
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate		hmp->b_rptr = (uchar_t *)(qdc + 1);
0Sstevel@tonic-gate		end = hmp->b_next;
0Sstevel@tonic-gate		dmp->b_cont = hmp;
0Sstevel@tonic-gate		dmp = hmp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (end != NULL)
0Sstevel@tonic-gate			hmp->b_next = NULL;
0Sstevel@tonic-gate		hmp->b_prev = NULL;
0Sstevel@tonic-gate		hmp = end;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_reassmsgs);
0Sstevel@tonic-gate#ifdef	DEBUG
0Sstevel@tonic-gate	mp1 = begin;
0Sstevel@tonic-gate	while (mp1 != NULL) {
0Sstevel@tonic-gate		ASSERT(mp1->b_next == NULL);
0Sstevel@tonic-gate		ASSERT(mp1->b_prev == NULL);
0Sstevel@tonic-gate		mp1 = mp1->b_cont;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate	return (begin);
0Sstevel@tonic-gate}
3845Svi117747
3845Svi117747/*
3845Svi117747 * Try partial delivery.
3845Svi117747 */
3845Svi117747static mblk_t *
3845Svi117747sctp_try_partial_delivery(sctp_t *sctp, mblk_t *hmp, sctp_reass_t *srp,
3845Svi117747    sctp_data_hdr_t **dc)
3845Svi117747{
3845Svi117747	mblk_t		*mp;
3845Svi117747	mblk_t		*dmp;
3845Svi117747	mblk_t		*qmp;
3845Svi117747	mblk_t		*prev;
3845Svi117747	sctp_data_hdr_t	*qdc;
3845Svi117747	uint32_t	tsn;
3845Svi117747
3845Svi117747	ASSERT(DB_TYPE(hmp) == M_CTL);
3845Svi117747
3845Svi117747	dprint(4, ("trypartial: got=%d, needed=%d\n",
3845Svi117747	    (int)(srp->got), (int)(srp->needed)));
3845Svi117747
*11042SErik.Nordmark@Sun.COM	mp = hmp->b_cont;
3845Svi117747	qdc = (sctp_data_hdr_t *)mp->b_rptr;
3845Svi117747
3845Svi117747	ASSERT(SCTP_DATA_GET_BBIT(qdc) && srp->hasBchunk);
3845Svi117747
3845Svi117747	tsn = ntohl(qdc->sdh_tsn) + 1;
3845Svi117747
3845Svi117747	/*
3845Svi117747	 * This loop has two exit conditions: the
3845Svi117747	 * end of received chunks has been reached, or
3845Svi117747	 * there is a break in the sequence. We want
3845Svi117747	 * to chop the reassembly list as follows (the
3845Svi117747	 * numbers are TSNs):
3845Svi117747	 *   10 -> 11 -> 	(end of chunks)
3845Svi117747	 *   10 -> 11 -> | 13   (break in sequence)
3845Svi117747	 */
3845Svi117747	prev = mp;
3845Svi117747	mp = mp->b_cont;
3845Svi117747	while (mp != NULL) {
3845Svi117747		qdc = (sctp_data_hdr_t *)mp->b_rptr;
3845Svi117747		if (ntohl(qdc->sdh_tsn) != tsn)
3845Svi117747			break;
3845Svi117747		prev = mp;
3845Svi117747		mp = mp->b_cont;
3845Svi117747		tsn++;
3845Svi117747	}
3845Svi117747	/*
3845Svi117747	 * We are sending all the fragments upstream, we have to retain
3845Svi117747	 * the srp info for further fragments.
3845Svi117747	 */
3845Svi117747	if (mp == NULL) {
3845Svi117747		dmp = hmp->b_cont;
3845Svi117747		hmp->b_cont = NULL;
3845Svi117747		srp->nexttsn = tsn;
3845Svi117747		srp->msglen = 0;
3845Svi117747		srp->needed = 0;
3845Svi117747		srp->got = 0;
3845Svi117747		srp->partial_delivered = B_TRUE;
3845Svi117747		srp->tail = NULL;
3845Svi117747	} else {
3845Svi117747		dmp = hmp->b_cont;
3845Svi117747		hmp->b_cont = mp;
3845Svi117747	}
3845Svi117747	srp->hasBchunk = B_FALSE;
3845Svi117747	/*
3845Svi117747	 * mp now points at the last chunk in the sequence,
3845Svi117747	 * and prev points to mp's previous in the list.
3845Svi117747	 * We chop the list at prev, and convert mp into the
3845Svi117747	 * new list head by setting the B bit. Subsequence
3845Svi117747	 * fragment deliveries will follow the normal reassembly
3845Svi117747	 * path.
3845Svi117747	 */
3845Svi117747	prev->b_cont = NULL;
3845Svi117747	srp->partial_delivered = B_TRUE;
3845Svi117747
3845Svi117747	dprint(4, ("trypartial: got some, got=%d, needed=%d\n",
3845Svi117747	    (int)(srp->got), (int)(srp->needed)));
3845Svi117747
3845Svi117747	/*
3845Svi117747	 * Adjust all mblk's except the lead so their rptr's point to the
3845Svi117747	 * payload. sctp_data_chunk() will need to process the lead's
3845Svi117747	 * data chunk section, so leave it's rptr pointing at the data chunk.
3845Svi117747	 */
3845Svi117747	*dc = (sctp_data_hdr_t *)dmp->b_rptr;
3845Svi117747	if (srp->tail != NULL) {
3845Svi117747		srp->got--;
3845Svi117747		ASSERT(srp->got != 0);
3845Svi117747		if (srp->needed != 0) {
3845Svi117747			srp->needed--;
3845Svi117747			ASSERT(srp->needed != 0);
3845Svi117747		}
3845Svi117747		srp->msglen -= ntohs((*dc)->sdh_len);
3845Svi117747	}
3845Svi117747	for (qmp = dmp->b_cont; qmp != NULL; qmp = qmp->b_cont) {
3845Svi117747		qdc = (sctp_data_hdr_t *)qmp->b_rptr;
3845Svi117747		qmp->b_rptr = (uchar_t *)(qdc + 1);
3845Svi117747
3845Svi117747		/*
3845Svi117747		 * Deduct the balance from got and needed here, now that
3845Svi117747		 * we know we are actually delivering these data.
3845Svi117747		 */
3845Svi117747		if (srp->tail != NULL) {
3845Svi117747			srp->got--;
3845Svi117747			ASSERT(srp->got != 0);
3845Svi117747			if (srp->needed != 0) {
3845Svi117747				srp->needed--;
3845Svi117747				ASSERT(srp->needed != 0);
3845Svi117747			}
3845Svi117747			srp->msglen -= ntohs(qdc->sdh_len);
3845Svi117747		}
3845Svi117747	}
3845Svi117747	ASSERT(srp->msglen == 0);
3845Svi117747	BUMP_LOCAL(sctp->sctp_reassmsgs);
3845Svi117747
3845Svi117747	return (dmp);
3845Svi117747}
3845Svi117747
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Fragment list for ordered messages.
0Sstevel@tonic-gate * If no error occures, error is set to 0. If we run out of memory, error
0Sstevel@tonic-gate * is set to 1. If the peer commits a fatal error (like using different
0Sstevel@tonic-gate * sequence numbers for the same data fragment series), the association is
3845Svi117747 * aborted and error is set to 2. tpfinished indicates whether we have
3845Svi117747 * assembled a complete message, this is used in sctp_data_chunk() to
3845Svi117747 * see if we can try to send any queued message for this stream.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic mblk_t *
0Sstevel@tonic-gatesctp_data_frag(sctp_t *sctp, mblk_t *dmp, sctp_data_hdr_t **dc, int *error,
3845Svi117747    sctp_instr_t *sip, boolean_t *tpfinished)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*pmp;
0Sstevel@tonic-gate	mblk_t		*qmp;
0Sstevel@tonic-gate	mblk_t		*first_mp;
0Sstevel@tonic-gate	sctp_reass_t	*srp;
0Sstevel@tonic-gate	sctp_data_hdr_t	*qdc;
0Sstevel@tonic-gate	sctp_data_hdr_t	*bdc;
0Sstevel@tonic-gate	sctp_data_hdr_t	*edc;
0Sstevel@tonic-gate	uint32_t	tsn;
3845Svi117747	uint16_t	fraglen = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	*error = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* find the reassembly queue for this data chunk */
0Sstevel@tonic-gate	hmp = qmp = sip->istr_reass;
0Sstevel@tonic-gate	for (; hmp != NULL; hmp = hmp->b_next) {
0Sstevel@tonic-gate		srp = (sctp_reass_t *)DB_BASE(hmp);
0Sstevel@tonic-gate		if (ntohs((*dc)->sdh_ssn) == srp->ssn)
0Sstevel@tonic-gate			goto foundit;
0Sstevel@tonic-gate		else if (SSN_GT(srp->ssn, ntohs((*dc)->sdh_ssn)))
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		qmp = hmp;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
3845Svi117747	/*
3845Svi117747	 * Allocate a M_CTL that will contain information about this
3845Svi117747	 * fragmented message.
3845Svi117747	 */
3845Svi117747	if ((pmp = allocb(sizeof (*srp), BPRI_MED)) == NULL) {
3845Svi117747		*error = 1;
3845Svi117747		return (NULL);
3845Svi117747	}
3845Svi117747	DB_TYPE(pmp) = M_CTL;
3845Svi117747	srp = (sctp_reass_t *)DB_BASE(pmp);
3845Svi117747	pmp->b_cont = dmp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (hmp != NULL) {
0Sstevel@tonic-gate		if (sip->istr_reass == hmp) {
0Sstevel@tonic-gate			sip->istr_reass = pmp;
0Sstevel@tonic-gate			pmp->b_next = hmp;
0Sstevel@tonic-gate			pmp->b_prev = NULL;
0Sstevel@tonic-gate			hmp->b_prev = pmp;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			qmp->b_next = pmp;
0Sstevel@tonic-gate			pmp->b_prev = qmp;
0Sstevel@tonic-gate			pmp->b_next = hmp;
0Sstevel@tonic-gate			hmp->b_prev = pmp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		/* make a new reass head and stick it on the end */
0Sstevel@tonic-gate		if (sip->istr_reass == NULL) {
0Sstevel@tonic-gate			sip->istr_reass = pmp;
0Sstevel@tonic-gate			pmp->b_prev = NULL;
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			qmp->b_next = pmp;
0Sstevel@tonic-gate			pmp->b_prev = qmp;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		pmp->b_next = NULL;
0Sstevel@tonic-gate	}
3845Svi117747	srp->partial_delivered = B_FALSE;
3845Svi117747	srp->ssn = ntohs((*dc)->sdh_ssn);
3845Svi117747empty_srp:
3845Svi117747	srp->needed = 0;
3845Svi117747	srp->got = 1;
3845Svi117747	srp->tail = dmp;
3845Svi117747	if (SCTP_DATA_GET_BBIT(*dc)) {
3845Svi117747		srp->msglen = ntohs((*dc)->sdh_len);
3845Svi117747		srp->nexttsn = ntohl((*dc)->sdh_tsn) + 1;
3845Svi117747		srp->hasBchunk = B_TRUE;
3845Svi117747	} else if (srp->partial_delivered &&
3845Svi117747	    srp->nexttsn == ntohl((*dc)->sdh_tsn)) {
3845Svi117747		SCTP_DATA_SET_BBIT(*dc);
3845Svi117747		/* Last fragment */
3845Svi117747		if (SCTP_DATA_GET_EBIT(*dc)) {
3845Svi117747			srp->needed = 1;
3845Svi117747			goto frag_done;
3845Svi117747		}
3845Svi117747		srp->hasBchunk = B_TRUE;
3845Svi117747		srp->msglen = ntohs((*dc)->sdh_len);
3845Svi117747		srp->nexttsn++;
3845Svi117747	}
0Sstevel@tonic-gate	return (NULL);
0Sstevel@tonic-gatefoundit:
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * else already have a reassembly queue. Insert the new data chunk
0Sstevel@tonic-gate	 * in the reassemble queue. Try the tail first, on the assumption
0Sstevel@tonic-gate	 * that the fragments are coming in in order.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	qmp = srp->tail;
3845Svi117747
3845Svi117747	/*
3845Svi117747	 * This means the message was partially delivered.
3845Svi117747	 */
3845Svi117747	if (qmp == NULL) {
3845Svi117747		ASSERT(srp->got == 0 && srp->needed == 0 &&
3845Svi117747		    srp->partial_delivered);
3845Svi117747		ASSERT(hmp->b_cont == NULL);
3845Svi117747		hmp->b_cont = dmp;
3845Svi117747		goto empty_srp;
3845Svi117747	}
0Sstevel@tonic-gate	qdc = (sctp_data_hdr_t *)qmp->b_rptr;
0Sstevel@tonic-gate	ASSERT(qmp->b_cont == NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* XXXIs it fine to do this just here? */
0Sstevel@tonic-gate	if ((*dc)->sdh_sid != qdc->sdh_sid) {
0Sstevel@tonic-gate		/* our peer is fatally confused; XXX abort the assc */
0Sstevel@tonic-gate		*error = 2;
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (SEQ_GT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
0Sstevel@tonic-gate		qmp->b_cont = dmp;
0Sstevel@tonic-gate		srp->tail = dmp;
0Sstevel@tonic-gate		dmp->b_cont = NULL;
3845Svi117747		if (srp->hasBchunk && srp->nexttsn == ntohl((*dc)->sdh_tsn)) {
3845Svi117747			srp->msglen += ntohs((*dc)->sdh_len);
3845Svi117747			srp->nexttsn++;
3845Svi117747		}
0Sstevel@tonic-gate		goto inserted;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Next check for insertion at the beginning */
3845Svi117747	qmp = hmp->b_cont;
0Sstevel@tonic-gate	qdc = (sctp_data_hdr_t *)qmp->b_rptr;
0Sstevel@tonic-gate	if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
3845Svi117747		dmp->b_cont = qmp;
3845Svi117747		hmp->b_cont = dmp;
3845Svi117747		if (SCTP_DATA_GET_BBIT(*dc)) {
3845Svi117747			srp->hasBchunk = B_TRUE;
3845Svi117747			srp->nexttsn = ntohl((*dc)->sdh_tsn);
0Sstevel@tonic-gate		}
3845Svi117747		goto preinserted;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Insert somewhere in the middle */
0Sstevel@tonic-gate	for (;;) {
0Sstevel@tonic-gate		/* Tail check above should have caught this */
0Sstevel@tonic-gate		ASSERT(qmp->b_cont != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)qmp->b_cont->b_rptr;
0Sstevel@tonic-gate		if (SEQ_LT(ntohl((*dc)->sdh_tsn), ntohl(qdc->sdh_tsn))) {
0Sstevel@tonic-gate			/* insert here */
0Sstevel@tonic-gate			dmp->b_cont = qmp->b_cont;
0Sstevel@tonic-gate			qmp->b_cont = dmp;
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		qmp = qmp->b_cont;
0Sstevel@tonic-gate	}
3845Svi117747preinserted:
3845Svi117747	if (!srp->hasBchunk || ntohl((*dc)->sdh_tsn) != srp->nexttsn)
3845Svi117747		goto inserted;
3845Svi117747	/*
3845Svi117747	 * fraglen contains the length of consecutive chunks of fragments.
3845Svi117747	 * starting from the chunk inserted recently.
3845Svi117747	 */
3845Svi117747	tsn = srp->nexttsn;
3845Svi117747	for (qmp = dmp; qmp != NULL; qmp = qmp->b_cont) {
3845Svi117747		qdc = (sctp_data_hdr_t *)qmp->b_rptr;
3845Svi117747		if (tsn != ntohl(qdc->sdh_tsn))
3845Svi117747			break;
3845Svi117747		fraglen += ntohs(qdc->sdh_len);
3845Svi117747		tsn++;
3845Svi117747	}
3845Svi117747	srp->nexttsn = tsn;
3845Svi117747	srp->msglen += fraglen;
0Sstevel@tonic-gateinserted:
3845Svi117747	srp->got++;
3845Svi117747	first_mp = hmp->b_cont;
0Sstevel@tonic-gate	if (srp->needed == 0) {
0Sstevel@tonic-gate		/* check if we have the first and last fragments */
0Sstevel@tonic-gate		bdc = (sctp_data_hdr_t *)first_mp->b_rptr;
0Sstevel@tonic-gate		edc = (sctp_data_hdr_t *)srp->tail->b_rptr;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* calculate how many fragments are needed, if possible  */
3845Svi117747		if (SCTP_DATA_GET_BBIT(bdc) && SCTP_DATA_GET_EBIT(edc)) {
0Sstevel@tonic-gate			srp->needed = ntohl(edc->sdh_tsn) -
0Sstevel@tonic-gate			    ntohl(bdc->sdh_tsn) + 1;
0Sstevel@tonic-gate		}
3845Svi117747	}
3845Svi117747
3845Svi117747	/*
3845Svi117747	 * Try partial delivery if the message length has exceeded the
3845Svi117747	 * partial delivery point. Only do this if we can immediately
3845Svi117747	 * deliver the partially assembled message, and only partially
3845Svi117747	 * deliver one message at a time (i.e. messages cannot be
3845Svi117747	 * intermixed arriving at the upper layer). A simple way to
3845Svi117747	 * enforce this is to only try partial delivery if this TSN is
3845Svi117747	 * the next expected TSN. Partial Delivery not supported
3845Svi117747	 * for un-ordered message.
3845Svi117747	 */
3845Svi117747	if (srp->needed != srp->got) {
3845Svi117747		dmp = NULL;
3845Svi117747		if (ntohl((*dc)->sdh_tsn) == sctp->sctp_ftsn &&
3845Svi117747		    srp->msglen >= sctp->sctp_pd_point) {
3845Svi117747			dmp = sctp_try_partial_delivery(sctp, hmp, srp, dc);
3845Svi117747			*tpfinished = B_FALSE;
0Sstevel@tonic-gate		}
3845Svi117747		return (dmp);
0Sstevel@tonic-gate	}
3845Svi117747frag_done:
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * else reassembly done; prepare the data for delivery.
0Sstevel@tonic-gate	 * First unlink hmp from the ssn list.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sip->istr_reass == hmp) {
0Sstevel@tonic-gate		sip->istr_reass = hmp->b_next;
3845Svi117747		if (hmp->b_next)
0Sstevel@tonic-gate			hmp->b_next->b_prev = NULL;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		ASSERT(hmp->b_prev != NULL);
0Sstevel@tonic-gate		hmp->b_prev->b_next = hmp->b_next;
3845Svi117747		if (hmp->b_next)
0Sstevel@tonic-gate			hmp->b_next->b_prev = hmp->b_prev;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Using b_prev and b_next was a little sinful, but OK since
0Sstevel@tonic-gate	 * this mblk is never put*'d. However, freeb() will still
0Sstevel@tonic-gate	 * ASSERT that they are unused, so we need to NULL them out now.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	hmp->b_next = NULL;
0Sstevel@tonic-gate	hmp->b_prev = NULL;
0Sstevel@tonic-gate	dmp = hmp;
3845Svi117747	dmp = dmp->b_cont;
3845Svi117747	hmp->b_cont = NULL;
3845Svi117747	freeb(hmp);
3845Svi117747	*tpfinished = B_TRUE;
3845Svi117747
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Adjust all mblk's except the lead so their rptr's point to the
0Sstevel@tonic-gate	 * payload. sctp_data_chunk() will need to process the lead's
0Sstevel@tonic-gate	 * data chunk section, so leave it's rptr pointing at the data chunk.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	*dc = (sctp_data_hdr_t *)dmp->b_rptr;
3845Svi117747	for (qmp = dmp->b_cont; qmp != NULL; qmp = qmp->b_cont) {
0Sstevel@tonic-gate		qdc = (sctp_data_hdr_t *)qmp->b_rptr;
0Sstevel@tonic-gate		qmp->b_rptr = (uchar_t *)(qdc + 1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_reassmsgs);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (dmp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_add_dup(uint32_t tsn, mblk_t **dups)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *mp;
0Sstevel@tonic-gate	size_t bsize = SCTP_DUP_MBLK_SZ * sizeof (tsn);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (dups == NULL) {
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* first time? */
0Sstevel@tonic-gate	if (*dups == NULL) {
0Sstevel@tonic-gate		*dups = allocb(bsize, BPRI_MED);
0Sstevel@tonic-gate		if (*dups == NULL) {
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	mp = *dups;
0Sstevel@tonic-gate	if ((mp->b_wptr - mp->b_rptr) >= bsize) {
0Sstevel@tonic-gate		/* maximum reached */
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* add the duplicate tsn */
0Sstevel@tonic-gate	bcopy(&tsn, mp->b_wptr, sizeof (tsn));
0Sstevel@tonic-gate	mp->b_wptr += sizeof (tsn);
0Sstevel@tonic-gate	ASSERT((mp->b_wptr - mp->b_rptr) <= bsize);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_data_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *mp, mblk_t **dups,
*11042SErik.Nordmark@Sun.COM    sctp_faddr_t *fp, ip_pkt_t *ipp, ip_recv_attr_t *ira)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_data_hdr_t *dc;
0Sstevel@tonic-gate	mblk_t *dmp, *pmp;
0Sstevel@tonic-gate	sctp_instr_t *instr;
0Sstevel@tonic-gate	int ubit;
0Sstevel@tonic-gate	int isfrag;
0Sstevel@tonic-gate	uint16_t ssn;
0Sstevel@tonic-gate	uint32_t oftsn;
0Sstevel@tonic-gate	boolean_t can_deliver = B_TRUE;
0Sstevel@tonic-gate	uint32_t tsn;
0Sstevel@tonic-gate	int dlen;
3845Svi117747	boolean_t tpfinished = B_TRUE;
0Sstevel@tonic-gate	int32_t new_rwnd;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
8348SEric.Yu@Sun.COM	int	error;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* The following are used multiple times, so we inline them */
0Sstevel@tonic-gate#define	SCTP_ACK_IT(sctp, tsn)						\
0Sstevel@tonic-gate	if (tsn == sctp->sctp_ftsn) {					\
0Sstevel@tonic-gate		dprint(2, ("data_chunk: acking next %x\n", tsn));	\
1932Svi117747		(sctp)->sctp_ftsn++;					\
1932Svi117747		if ((sctp)->sctp_sack_gaps > 0)				\
1932Svi117747			(sctp)->sctp_force_sack = 1;			\
0Sstevel@tonic-gate	} else if (SEQ_GT(tsn, sctp->sctp_ftsn)) {			\
0Sstevel@tonic-gate		/* Got a gap; record it */				\
10212SGeorge.Shepherd@Sun.COM		BUMP_LOCAL(sctp->sctp_outseqtsns);			\
0Sstevel@tonic-gate		dprint(2, ("data_chunk: acking gap %x\n", tsn));	\
1932Svi117747		sctp_ack_add(&sctp->sctp_sack_info, tsn,		\
1932Svi117747		    &sctp->sctp_sack_gaps);				\
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;				\
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dmp = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dc = (sctp_data_hdr_t *)ch;
0Sstevel@tonic-gate	tsn = ntohl(dc->sdh_tsn);
0Sstevel@tonic-gate
1676Sjpk	dprint(3, ("sctp_data_chunk: mp=%p tsn=%x\n", (void *)mp, tsn));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Check for duplicates */
0Sstevel@tonic-gate	if (SEQ_LT(tsn, sctp->sctp_ftsn)) {
0Sstevel@tonic-gate		dprint(4, ("sctp_data_chunk: dropping duplicate\n"));
10212SGeorge.Shepherd@Sun.COM		BUMP_LOCAL(sctp->sctp_idupchunks);
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		sctp_add_dup(dc->sdh_tsn, dups);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		sctp_set_t *sp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		for (sp = sctp->sctp_sack_info; sp; sp = sp->next) {
0Sstevel@tonic-gate			if (SEQ_GEQ(tsn, sp->begin) && SEQ_LEQ(tsn, sp->end)) {
0Sstevel@tonic-gate				dprint(4,
4964Skcpoon				    ("sctp_data_chunk: dropping dup > "
4964Skcpoon				    "cumtsn\n"));
10212SGeorge.Shepherd@Sun.COM				BUMP_LOCAL(sctp->sctp_idupchunks);
0Sstevel@tonic-gate				sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate				sctp_add_dup(dc->sdh_tsn, dups);
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* We cannot deliver anything up now but we still need to handle it. */
0Sstevel@tonic-gate	if (SCTP_IS_DETACHED(sctp)) {
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpInClosed);
0Sstevel@tonic-gate		can_deliver = B_FALSE;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dlen = ntohs(dc->sdh_len) - sizeof (*dc);
0Sstevel@tonic-gate
10828SGeorge.Shepherd@Sun.COM	/*
10828SGeorge.Shepherd@Sun.COM	 * Check for buffer space. Note if this is the next expected TSN
10828SGeorge.Shepherd@Sun.COM	 * we have to take it to avoid deadlock because we cannot deliver
10828SGeorge.Shepherd@Sun.COM	 * later queued TSNs and thus clear buffer space without it.
10828SGeorge.Shepherd@Sun.COM	 * We drop anything that is purely zero window probe data here.
10828SGeorge.Shepherd@Sun.COM	 */
10828SGeorge.Shepherd@Sun.COM	if ((sctp->sctp_rwnd - sctp->sctp_rxqueued < dlen) &&
10828SGeorge.Shepherd@Sun.COM	    (tsn != sctp->sctp_ftsn || sctp->sctp_rwnd == 0)) {
0Sstevel@tonic-gate		/* Drop and SACK, but don't advance the cumulative TSN. */
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		dprint(0, ("sctp_data_chunk: exceed rwnd %d rxqueued %d "
3795Skcpoon		    "dlen %d ssn %d tsn %x\n", sctp->sctp_rwnd,
3795Skcpoon		    sctp->sctp_rxqueued, dlen, ntohs(dc->sdh_ssn),
3795Skcpoon		    ntohl(dc->sdh_tsn)));
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (ntohs(dc->sdh_sid) >= sctp->sctp_num_istr) {
9451SGeorge.Shepherd@Sun.COM		sctp_bsc_t	inval_parm;
9451SGeorge.Shepherd@Sun.COM
9451SGeorge.Shepherd@Sun.COM		/* Will populate the CAUSE block in the ERROR chunk. */
9451SGeorge.Shepherd@Sun.COM		inval_parm.bsc_sid = dc->sdh_sid;
9451SGeorge.Shepherd@Sun.COM		/* RESERVED, ignored at the receiving end */
9451SGeorge.Shepherd@Sun.COM		inval_parm.bsc_pad = 0;
9451SGeorge.Shepherd@Sun.COM
0Sstevel@tonic-gate		/* ack and drop it */
9451SGeorge.Shepherd@Sun.COM		sctp_add_err(sctp, SCTP_ERR_BAD_SID, (void *)&inval_parm,
9451SGeorge.Shepherd@Sun.COM		    sizeof (sctp_bsc_t), fp);
0Sstevel@tonic-gate		SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ubit = SCTP_DATA_GET_UBIT(dc);
0Sstevel@tonic-gate	ASSERT(sctp->sctp_instr != NULL);
0Sstevel@tonic-gate	instr = &sctp->sctp_instr[ntohs(dc->sdh_sid)];
0Sstevel@tonic-gate	/* Initialize the stream, if not yet used */
0Sstevel@tonic-gate	if (instr->sctp == NULL)
0Sstevel@tonic-gate		instr->sctp = sctp;
3845Svi117747
0Sstevel@tonic-gate	isfrag = !(SCTP_DATA_GET_BBIT(dc) && SCTP_DATA_GET_EBIT(dc));
0Sstevel@tonic-gate	ssn = ntohs(dc->sdh_ssn);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dmp = dupb(mp);
0Sstevel@tonic-gate	if (dmp == NULL) {
0Sstevel@tonic-gate		/* drop it and don't ack it, causing the peer to retransmit */
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	dmp->b_wptr = (uchar_t *)ch + ntohs(ch->sch_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp->sctp_rxqueued += dlen;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	oftsn = sctp->sctp_ftsn;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (isfrag) {
8348SEric.Yu@Sun.COM
8348SEric.Yu@Sun.COM		error = 0;
0Sstevel@tonic-gate		/* fragmented data chunk */
0Sstevel@tonic-gate		dmp->b_rptr = (uchar_t *)dc;
0Sstevel@tonic-gate		if (ubit) {
0Sstevel@tonic-gate			dmp = sctp_uodata_frag(sctp, dmp, &dc);
0Sstevel@tonic-gate#if	DEBUG
0Sstevel@tonic-gate			if (dmp != NULL) {
0Sstevel@tonic-gate				ASSERT(instr ==
0Sstevel@tonic-gate				    &sctp->sctp_instr[ntohs(dc->sdh_sid)]);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			dmp = sctp_data_frag(sctp, dmp, &dc, &error, instr,
3845Svi117747			    &tpfinished);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		if (error != 0) {
0Sstevel@tonic-gate			sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate			if (error == 1) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * out of memory; don't ack it so
0Sstevel@tonic-gate				 * the peer retransmits
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			} else if (error == 2) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * fatal error (i.e. peer used different
0Sstevel@tonic-gate				 * ssn's for same fragmented data) --
0Sstevel@tonic-gate				 * the association has been aborted.
0Sstevel@tonic-gate				 * XXX need to return errval so state
0Sstevel@tonic-gate				 * machine can also abort processing.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				dprint(0, ("error 2: must not happen!\n"));
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (dmp == NULL) {
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * Can't process this data now, but the cumulative
0Sstevel@tonic-gate			 * TSN may be advanced, so do the checks at done.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
6374Sgeorges	/*
6374Sgeorges	 * Insert complete messages in correct order for ordered delivery.
6374Sgeorges	 * tpfinished is true when the incoming chunk contains a complete
6374Sgeorges	 * message or is the final missing fragment which completed a message.
6374Sgeorges	 */
6374Sgeorges	if (!ubit && tpfinished && ssn != instr->nextseq) {
0Sstevel@tonic-gate		/* Adjust rptr to point at the data chunk for compares */
0Sstevel@tonic-gate		dmp->b_rptr = (uchar_t *)dc;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		dprint(2,
0Sstevel@tonic-gate		    ("data_chunk: inserted %x in pq (ssn %d expected %d)\n",
0Sstevel@tonic-gate		    ntohl(dc->sdh_tsn), (int)(ssn), (int)(instr->nextseq)));
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (instr->istr_msgs == NULL) {
0Sstevel@tonic-gate			instr->istr_msgs = dmp;
0Sstevel@tonic-gate			ASSERT(dmp->b_prev == NULL && dmp->b_next == NULL);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			mblk_t			*imblk = instr->istr_msgs;
0Sstevel@tonic-gate			sctp_data_hdr_t		*idc;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * XXXNeed to take sequence wraps into account,
0Sstevel@tonic-gate			 * ... and a more efficient insertion algo.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			for (;;) {
0Sstevel@tonic-gate				idc = (sctp_data_hdr_t *)imblk->b_rptr;
0Sstevel@tonic-gate				if (SSN_GT(ntohs(idc->sdh_ssn),
4964Skcpoon				    ntohs(dc->sdh_ssn))) {
0Sstevel@tonic-gate					if (instr->istr_msgs == imblk) {
0Sstevel@tonic-gate						instr->istr_msgs = dmp;
0Sstevel@tonic-gate						dmp->b_next = imblk;
0Sstevel@tonic-gate						imblk->b_prev = dmp;
0Sstevel@tonic-gate					} else {
0Sstevel@tonic-gate						ASSERT(imblk->b_prev != NULL);
0Sstevel@tonic-gate						imblk->b_prev->b_next = dmp;
0Sstevel@tonic-gate						dmp->b_prev = imblk->b_prev;
0Sstevel@tonic-gate						imblk->b_prev = dmp;
0Sstevel@tonic-gate						dmp->b_next = imblk;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (imblk->b_next == NULL) {
0Sstevel@tonic-gate					imblk->b_next = dmp;
0Sstevel@tonic-gate					dmp->b_prev = imblk;
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				imblk = imblk->b_next;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		(instr->istr_nmsgs)++;
0Sstevel@tonic-gate		(sctp->sctp_istr_nmsgs)++;
0Sstevel@tonic-gate		SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Else we can deliver the data directly. Recalculate
0Sstevel@tonic-gate	 * dlen now since we may have reassembled data.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	dlen = dmp->b_wptr - (uchar_t *)dc - sizeof (*dc);
0Sstevel@tonic-gate	for (pmp = dmp->b_cont; pmp != NULL; pmp = pmp->b_cont)
10828SGeorge.Shepherd@Sun.COM		dlen += MBLKL(pmp);
0Sstevel@tonic-gate	ASSERT(sctp->sctp_rxqueued >= dlen);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Deliver the message. */
0Sstevel@tonic-gate	sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (can_deliver) {
8348SEric.Yu@Sun.COM
0Sstevel@tonic-gate		dmp->b_rptr = (uchar_t *)(dc + 1);
*11042SErik.Nordmark@Sun.COM		if (sctp_input_add_ancillary(sctp, &dmp, dc, fp,
*11042SErik.Nordmark@Sun.COM		    ipp, ira) == 0) {
0Sstevel@tonic-gate			dprint(1, ("sctp_data_chunk: delivering %lu bytes\n",
0Sstevel@tonic-gate			    msgdsize(dmp)));
0Sstevel@tonic-gate			sctp->sctp_rwnd -= dlen;
8348SEric.Yu@Sun.COM			/*
8348SEric.Yu@Sun.COM			 * Override b_flag for SCTP sockfs internal use
8348SEric.Yu@Sun.COM			 */
8348SEric.Yu@Sun.COM			dmp->b_flag = tpfinished ? 0 : SCTP_PARTIAL_DATA;
0Sstevel@tonic-gate			new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd, dmp,
8348SEric.Yu@Sun.COM			    msgdsize(dmp), 0, &error, NULL);
10828SGeorge.Shepherd@Sun.COM			/*
10828SGeorge.Shepherd@Sun.COM			 * Since we always deliver the next TSN data chunk,
10828SGeorge.Shepherd@Sun.COM			 * we may buffer a little more than allowed. In
10828SGeorge.Shepherd@Sun.COM			 * that case, just mark the window as 0.
10828SGeorge.Shepherd@Sun.COM			 */
10828SGeorge.Shepherd@Sun.COM			if (new_rwnd < 0)
10828SGeorge.Shepherd@Sun.COM				sctp->sctp_rwnd = 0;
10828SGeorge.Shepherd@Sun.COM			else if (new_rwnd > sctp->sctp_rwnd)
0Sstevel@tonic-gate				sctp->sctp_rwnd = new_rwnd;
0Sstevel@tonic-gate			SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* Just free the message if we don't have memory. */
0Sstevel@tonic-gate			freemsg(dmp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		/* About to free the data */
0Sstevel@tonic-gate		freemsg(dmp);
0Sstevel@tonic-gate		SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * data, now enqueued, may already have been processed and free'd
0Sstevel@tonic-gate	 * by the ULP (or we may have just freed it above, if we could not
0Sstevel@tonic-gate	 * deliver it), so we must not reference it (this is why we kept
0Sstevel@tonic-gate	 * the ssn and ubit above).
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (ubit != 0) {
0Sstevel@tonic-gate		BUMP_LOCAL(sctp->sctp_iudchunks);
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_idchunks);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If there was a partial delivery and it has not finished,
0Sstevel@tonic-gate	 * don't pull anything from the pqueues.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (!tpfinished) {
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	instr->nextseq = ssn + 1;
0Sstevel@tonic-gate	/* Deliver any successive data chunks in the instr queue */
0Sstevel@tonic-gate	while (instr->istr_nmsgs > 0) {
0Sstevel@tonic-gate		dmp = (mblk_t *)instr->istr_msgs;
0Sstevel@tonic-gate		dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate		ssn = ntohs(dc->sdh_ssn);
0Sstevel@tonic-gate		/* Gap in the sequence */
0Sstevel@tonic-gate		if (ssn != instr->nextseq)
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* Else deliver the data */
0Sstevel@tonic-gate		(instr->istr_nmsgs)--;
0Sstevel@tonic-gate		(instr->nextseq)++;
0Sstevel@tonic-gate		(sctp->sctp_istr_nmsgs)--;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		instr->istr_msgs = instr->istr_msgs->b_next;
0Sstevel@tonic-gate		if (instr->istr_msgs != NULL)
0Sstevel@tonic-gate			instr->istr_msgs->b_prev = NULL;
0Sstevel@tonic-gate		dmp->b_next = dmp->b_prev = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		dprint(2, ("data_chunk: pulling %x from pq (ssn %d)\n",
0Sstevel@tonic-gate		    ntohl(dc->sdh_tsn), (int)ssn));
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * If this chunk was reassembled, each b_cont represents
0Sstevel@tonic-gate		 * another TSN; advance ftsn now.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc);
0Sstevel@tonic-gate		for (pmp = dmp->b_cont; pmp; pmp = pmp->b_cont)
10828SGeorge.Shepherd@Sun.COM			dlen += MBLKL(pmp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		ASSERT(sctp->sctp_rxqueued >= dlen);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate		if (can_deliver) {
0Sstevel@tonic-gate			dmp->b_rptr = (uchar_t *)(dc + 1);
0Sstevel@tonic-gate			if (sctp_input_add_ancillary(sctp, &dmp, dc, fp,
*11042SErik.Nordmark@Sun.COM			    ipp, ira) == 0) {
0Sstevel@tonic-gate				dprint(1, ("sctp_data_chunk: delivering %lu "
0Sstevel@tonic-gate				    "bytes\n", msgdsize(dmp)));
0Sstevel@tonic-gate				sctp->sctp_rwnd -= dlen;
8348SEric.Yu@Sun.COM				/*
8348SEric.Yu@Sun.COM				 * Override b_flag for SCTP sockfs internal use
8348SEric.Yu@Sun.COM				 */
8348SEric.Yu@Sun.COM				dmp->b_flag = tpfinished ?
8348SEric.Yu@Sun.COM				    0 : SCTP_PARTIAL_DATA;
0Sstevel@tonic-gate				new_rwnd = sctp->sctp_ulp_recv(sctp->sctp_ulpd,
8348SEric.Yu@Sun.COM				    dmp, msgdsize(dmp), 0, &error, NULL);
10828SGeorge.Shepherd@Sun.COM				if (new_rwnd < 0)
10828SGeorge.Shepherd@Sun.COM					sctp->sctp_rwnd = 0;
10828SGeorge.Shepherd@Sun.COM				else if (new_rwnd > sctp->sctp_rwnd)
0Sstevel@tonic-gate					sctp->sctp_rwnd = new_rwnd;
0Sstevel@tonic-gate				SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				freemsg(dmp);
0Sstevel@tonic-gate				return;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* About to free the data */
0Sstevel@tonic-gate			freemsg(dmp);
0Sstevel@tonic-gate			SCTP_ACK_IT(sctp, tsn);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gatedone:
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If there are gap reports pending, check if advancing
0Sstevel@tonic-gate	 * the ftsn here closes a gap. If so, we can advance
0Sstevel@tonic-gate	 * ftsn to the end of the set.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL &&
0Sstevel@tonic-gate	    sctp->sctp_ftsn == sctp->sctp_sack_info->begin) {
0Sstevel@tonic-gate		sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If ftsn has moved forward, maybe we can remove gap reports.
0Sstevel@tonic-gate	 * NB: dmp may now be NULL, so don't dereference it here.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (oftsn != sctp->sctp_ftsn && sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
0Sstevel@tonic-gate		    &sctp->sctp_sack_gaps);
0Sstevel@tonic-gate		dprint(2, ("data_chunk: removed acks before %x (num=%d)\n",
0Sstevel@tonic-gate		    sctp->sctp_ftsn - 1, sctp->sctp_sack_gaps));
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate#ifdef	DEBUG
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		ASSERT(sctp->sctp_ftsn != sctp->sctp_sack_info->begin);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate#endif
0Sstevel@tonic-gate
0Sstevel@tonic-gate#undef	SCTP_ACK_IT
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_fill_sack(sctp_t *sctp, unsigned char *dst, int sacklen)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_chunk_hdr_t *sch;
0Sstevel@tonic-gate	sctp_sack_chunk_t *sc;
0Sstevel@tonic-gate	sctp_sack_frag_t *sf;
0Sstevel@tonic-gate	uint16_t num_gaps = sctp->sctp_sack_gaps;
0Sstevel@tonic-gate	sctp_set_t *sp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Chunk hdr */
0Sstevel@tonic-gate	sch = (sctp_chunk_hdr_t *)dst;
0Sstevel@tonic-gate	sch->sch_id = CHUNK_SACK;
0Sstevel@tonic-gate	sch->sch_flags = 0;
0Sstevel@tonic-gate	sch->sch_len = htons(sacklen);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* SACK chunk */
0Sstevel@tonic-gate	sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sc = (sctp_sack_chunk_t *)(sch + 1);
0Sstevel@tonic-gate	sc->ssc_cumtsn = htonl(sctp->sctp_lastacked);
0Sstevel@tonic-gate	if (sctp->sctp_rxqueued < sctp->sctp_rwnd) {
0Sstevel@tonic-gate		sc->ssc_a_rwnd = htonl(sctp->sctp_rwnd - sctp->sctp_rxqueued);
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		sc->ssc_a_rwnd = 0;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sc->ssc_numfrags = htons(num_gaps);
0Sstevel@tonic-gate	sc->ssc_numdups = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* lay in gap reports */
0Sstevel@tonic-gate	sf = (sctp_sack_frag_t *)(sc + 1);
0Sstevel@tonic-gate	for (sp = sctp->sctp_sack_info; sp; sp = sp->next) {
0Sstevel@tonic-gate		uint16_t offset;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* start */
0Sstevel@tonic-gate		if (sp->begin > sctp->sctp_lastacked) {
0Sstevel@tonic-gate			offset = (uint16_t)(sp->begin - sctp->sctp_lastacked);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* sequence number wrap */
0Sstevel@tonic-gate			offset = (uint16_t)(UINT32_MAX - sctp->sctp_lastacked +
0Sstevel@tonic-gate			    sp->begin);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sf->ssf_start = htons(offset);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* end */
0Sstevel@tonic-gate		if (sp->end >= sp->begin) {
0Sstevel@tonic-gate			offset += (uint16_t)(sp->end - sp->begin);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* sequence number wrap */
0Sstevel@tonic-gate			offset += (uint16_t)(UINT32_MAX - sp->begin + sp->end);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sf->ssf_end = htons(offset);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		sf++;
0Sstevel@tonic-gate		/* This is just for debugging (a la the following assertion) */
0Sstevel@tonic-gate		num_gaps--;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(num_gaps == 0);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* If the SACK timer is running, stop it */
0Sstevel@tonic-gate	if (sctp->sctp_ack_timer_running) {
0Sstevel@tonic-gate		sctp_timer_stop(sctp->sctp_ack_mp);
0Sstevel@tonic-gate		sctp->sctp_ack_timer_running = B_FALSE;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_obchunks);
10212SGeorge.Shepherd@Sun.COM	BUMP_LOCAL(sctp->sctp_osacks);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatemblk_t *
0Sstevel@tonic-gatesctp_make_sack(sctp_t *sctp, sctp_faddr_t *sendto, mblk_t *dups)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *smp;
0Sstevel@tonic-gate	size_t slen;
0Sstevel@tonic-gate	sctp_chunk_hdr_t *sch;
0Sstevel@tonic-gate	sctp_sack_chunk_t *sc;
3430Skcpoon	int32_t acks_max;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
4964Skcpoon	uint32_t	dups_len;
4964Skcpoon	sctp_faddr_t	*fp;
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM	ASSERT(sendto != NULL);
*11042SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate	if (sctp->sctp_force_sack) {
0Sstevel@tonic-gate		sctp->sctp_force_sack = 0;
0Sstevel@tonic-gate		goto checks_done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
3448Sdh155122	acks_max = sctps->sctps_deferred_acks_max;
0Sstevel@tonic-gate	if (sctp->sctp_state == SCTPS_ESTABLISHED) {
3430Skcpoon		if (sctp->sctp_sack_toggle < acks_max) {
0Sstevel@tonic-gate			/* no need to SACK right now */
0Sstevel@tonic-gate			dprint(2, ("sctp_make_sack: %p no sack (toggle)\n",
1676Sjpk			    (void *)sctp));
0Sstevel@tonic-gate			return (NULL);
3430Skcpoon		} else if (sctp->sctp_sack_toggle >= acks_max) {
0Sstevel@tonic-gate			sctp->sctp_sack_toggle = 0;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_ftsn == sctp->sctp_lastacked + 1) {
1676Sjpk		dprint(2, ("sctp_make_sack: %p no sack (already)\n",
1676Sjpk		    (void *)sctp));
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gatechecks_done:
0Sstevel@tonic-gate	dprint(2, ("sctp_make_sack: acking %x\n", sctp->sctp_ftsn - 1));
0Sstevel@tonic-gate
4964Skcpoon	if (dups != NULL)
4964Skcpoon		dups_len = MBLKL(dups);
4964Skcpoon	else
4964Skcpoon		dups_len = 0;
0Sstevel@tonic-gate	slen = sizeof (*sch) + sizeof (*sc) +
0Sstevel@tonic-gate	    (sizeof (sctp_sack_frag_t) * sctp->sctp_sack_gaps);
4964Skcpoon
4964Skcpoon	/*
4964Skcpoon	 * If there are error chunks, check and see if we can send the
4964Skcpoon	 * SACK chunk and error chunks together in one packet.  If not,
4964Skcpoon	 * send the error chunks out now.
4964Skcpoon	 */
4964Skcpoon	if (sctp->sctp_err_chunks != NULL) {
4964Skcpoon		fp = SCTP_CHUNK_DEST(sctp->sctp_err_chunks);
4964Skcpoon		if (sctp->sctp_err_len + slen + dups_len > fp->sfa_pmss) {
4964Skcpoon			if ((smp = sctp_make_mp(sctp, fp, 0)) == NULL) {
4964Skcpoon				SCTP_KSTAT(sctps, sctp_send_err_failed);
4964Skcpoon				SCTP_KSTAT(sctps, sctp_send_sack_failed);
4964Skcpoon				freemsg(sctp->sctp_err_chunks);
4964Skcpoon				sctp->sctp_err_chunks = NULL;
4964Skcpoon				sctp->sctp_err_len = 0;
4964Skcpoon				return (NULL);
4964Skcpoon			}
4964Skcpoon			smp->b_cont = sctp->sctp_err_chunks;
*11042SErik.Nordmark@Sun.COM			sctp_set_iplen(sctp, smp, fp->ixa);
*11042SErik.Nordmark@Sun.COM			(void) conn_ip_output(smp, fp->ixa);
*11042SErik.Nordmark@Sun.COM			BUMP_LOCAL(sctp->sctp_opkts);
4964Skcpoon			sctp->sctp_err_chunks = NULL;
4964Skcpoon			sctp->sctp_err_len = 0;
4964Skcpoon		}
4964Skcpoon	}
0Sstevel@tonic-gate	smp = sctp_make_mp(sctp, sendto, slen);
0Sstevel@tonic-gate	if (smp == NULL) {
3448Sdh155122		SCTP_KSTAT(sctps, sctp_send_sack_failed);
0Sstevel@tonic-gate		return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sch = (sctp_chunk_hdr_t *)smp->b_wptr;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_fill_sack(sctp, smp->b_wptr, slen);
0Sstevel@tonic-gate	smp->b_wptr += slen;
4964Skcpoon	if (dups != NULL) {
0Sstevel@tonic-gate		sc = (sctp_sack_chunk_t *)(sch + 1);
4964Skcpoon		sc->ssc_numdups = htons(MBLKL(dups) / sizeof (uint32_t));
4964Skcpoon		sch->sch_len = htons(slen + dups_len);
0Sstevel@tonic-gate		smp->b_cont = dups;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
4964Skcpoon	if (sctp->sctp_err_chunks != NULL) {
4964Skcpoon		linkb(smp, sctp->sctp_err_chunks);
4964Skcpoon		sctp->sctp_err_chunks = NULL;
4964Skcpoon		sctp->sctp_err_len = 0;
4964Skcpoon	}
0Sstevel@tonic-gate	return (smp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
4964Skcpoon/*
4964Skcpoon * Check and see if we need to send a SACK chunk.  If it is needed,
4964Skcpoon * send it out.  Return true if a SACK chunk is sent, false otherwise.
4964Skcpoon */
4964Skcpoonboolean_t
0Sstevel@tonic-gatesctp_sack(sctp_t *sctp, mblk_t *dups)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *smp;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* If we are shutting down, let send_shutdown() bundle the SACK */
0Sstevel@tonic-gate	if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
0Sstevel@tonic-gate		sctp_send_shutdown(sctp, 0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(sctp->sctp_lastdata != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if ((smp = sctp_make_sack(sctp, sctp->sctp_lastdata, dups)) == NULL) {
0Sstevel@tonic-gate		/* The caller of sctp_sack() will not free the dups mblk. */
0Sstevel@tonic-gate		if (dups != NULL)
0Sstevel@tonic-gate			freeb(dups);
4964Skcpoon		return (B_FALSE);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	dprint(2, ("sctp_sack: sending to %p %x:%x:%x:%x\n",
1676Sjpk	    (void *)sctp->sctp_lastdata,
1676Sjpk	    SCTP_PRINTADDR(sctp->sctp_lastdata->faddr)));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp->sctp_active = lbolt64;
0Sstevel@tonic-gate
3448Sdh155122	BUMP_MIB(&sctps->sctps_mib, sctpOutAck);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	sctp_set_iplen(sctp, smp, sctp->sctp_lastdata->ixa);
*11042SErik.Nordmark@Sun.COM	(void) conn_ip_output(smp, sctp->sctp_lastdata->ixa);
*11042SErik.Nordmark@Sun.COM	BUMP_LOCAL(sctp->sctp_opkts);
4964Skcpoon	return (B_TRUE);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * This is called if we have a message that was partially sent and is
0Sstevel@tonic-gate * abandoned. The cum TSN will be the last chunk sent for this message,
0Sstevel@tonic-gate * subsequent chunks will be marked ABANDONED. We send a Forward TSN
0Sstevel@tonic-gate * chunk in this case with the TSN of the last sent chunk so that the
0Sstevel@tonic-gate * peer can clean up its fragment list for this message. This message
0Sstevel@tonic-gate * will be removed from the transmit list when the peer sends a SACK
0Sstevel@tonic-gate * back.
0Sstevel@tonic-gate */
0Sstevel@tonic-gateint
0Sstevel@tonic-gatesctp_check_abandoned_msg(sctp_t *sctp, mblk_t *meta)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_data_hdr_t	*dh;
0Sstevel@tonic-gate	mblk_t		*nmp;
0Sstevel@tonic-gate	mblk_t		*head;
0Sstevel@tonic-gate	int32_t		unsent = 0;
0Sstevel@tonic-gate	mblk_t		*mp1 = meta->b_cont;
0Sstevel@tonic-gate	uint32_t	adv_pap = sctp->sctp_adv_pap;
0Sstevel@tonic-gate	sctp_faddr_t	*fp = sctp->sctp_current;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	dh = (sctp_data_hdr_t *)mp1->b_rptr;
0Sstevel@tonic-gate	if (SEQ_GEQ(sctp->sctp_lastack_rxd, ntohl(dh->sdh_tsn))) {
0Sstevel@tonic-gate		sctp_ftsn_set_t	*sets = NULL;
0Sstevel@tonic-gate		uint_t		nsets = 0;
0Sstevel@tonic-gate		uint32_t	seglen = sizeof (uint32_t);
0Sstevel@tonic-gate		boolean_t	ubit = SCTP_DATA_GET_UBIT(dh);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		while (mp1->b_next != NULL && SCTP_CHUNK_ISSENT(mp1->b_next))
0Sstevel@tonic-gate			mp1 = mp1->b_next;
0Sstevel@tonic-gate		dh = (sctp_data_hdr_t *)mp1->b_rptr;
0Sstevel@tonic-gate		sctp->sctp_adv_pap = ntohl(dh->sdh_tsn);
0Sstevel@tonic-gate		if (!ubit &&
0Sstevel@tonic-gate		    !sctp_add_ftsn_set(&sets, fp, meta, &nsets, &seglen)) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			return (ENOMEM);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		nmp = sctp_make_ftsn_chunk(sctp, fp, sets, nsets, seglen);
0Sstevel@tonic-gate		sctp_free_ftsn_set(sets);
0Sstevel@tonic-gate		if (nmp == NULL) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			return (ENOMEM);
0Sstevel@tonic-gate		}
252Svi117747		head = sctp_add_proto_hdr(sctp, fp, nmp, 0, NULL);
0Sstevel@tonic-gate		if (head == NULL) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			freemsg(nmp);
3448Sdh155122			SCTP_KSTAT(sctps, sctp_send_ftsn_failed);
0Sstevel@tonic-gate			return (ENOMEM);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		SCTP_MSG_SET_ABANDONED(meta);
*11042SErik.Nordmark@Sun.COM		sctp_set_iplen(sctp, head, fp->ixa);
*11042SErik.Nordmark@Sun.COM		(void) conn_ip_output(head, fp->ixa);
*11042SErik.Nordmark@Sun.COM		BUMP_LOCAL(sctp->sctp_opkts);
0Sstevel@tonic-gate		if (!fp->timer_running)
0Sstevel@tonic-gate			SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
0Sstevel@tonic-gate		mp1 = mp1->b_next;
0Sstevel@tonic-gate		while (mp1 != NULL) {
0Sstevel@tonic-gate			ASSERT(!SCTP_CHUNK_ISSENT(mp1));
0Sstevel@tonic-gate			ASSERT(!SCTP_CHUNK_ABANDONED(mp1));
0Sstevel@tonic-gate			SCTP_ABANDON_CHUNK(mp1);
0Sstevel@tonic-gate			dh = (sctp_data_hdr_t *)mp1->b_rptr;
0Sstevel@tonic-gate			unsent += ntohs(dh->sdh_len) - sizeof (*dh);
0Sstevel@tonic-gate			mp1 = mp1->b_next;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		ASSERT(sctp->sctp_unsent >= unsent);
0Sstevel@tonic-gate		sctp->sctp_unsent -= unsent;
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Update ULP the amount of queued data, which is
0Sstevel@tonic-gate		 * sent-unack'ed + unsent.
0Sstevel@tonic-gate		 */
8348SEric.Yu@Sun.COM		if (!SCTP_IS_DETACHED(sctp))
8348SEric.Yu@Sun.COM			SCTP_TXQ_UPDATE(sctp);
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (-1);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gateuint32_t
0Sstevel@tonic-gatesctp_cumack(sctp_t *sctp, uint32_t tsn, mblk_t **first_unacked)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t *ump, *nump, *mp = NULL;
0Sstevel@tonic-gate	uint16_t chunklen;
0Sstevel@tonic-gate	uint32_t xtsn;
0Sstevel@tonic-gate	sctp_faddr_t *fp;
0Sstevel@tonic-gate	sctp_data_hdr_t *sdc;
0Sstevel@tonic-gate	uint32_t cumack_forward = 0;
0Sstevel@tonic-gate	sctp_msg_hdr_t	*mhdr;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ump = sctp->sctp_xmit_head;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Free messages only when they're completely acked.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	while (ump != NULL) {
0Sstevel@tonic-gate		mhdr = (sctp_msg_hdr_t *)ump->b_rptr;
0Sstevel@tonic-gate		for (mp = ump->b_cont; mp != NULL; mp = mp->b_next) {
0Sstevel@tonic-gate			if (SCTP_CHUNK_ABANDONED(mp)) {
0Sstevel@tonic-gate				ASSERT(SCTP_IS_MSG_ABANDONED(ump));
0Sstevel@tonic-gate				mp = NULL;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * We check for abandoned message if we are PR-SCTP
0Sstevel@tonic-gate			 * aware, if this is not the first chunk in the
0Sstevel@tonic-gate			 * message (b_cont) and if the message is marked
0Sstevel@tonic-gate			 * abandoned.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (!SCTP_CHUNK_ISSENT(mp)) {
0Sstevel@tonic-gate				if (sctp->sctp_prsctp_aware &&
0Sstevel@tonic-gate				    mp != ump->b_cont &&
0Sstevel@tonic-gate				    (SCTP_IS_MSG_ABANDONED(ump) ||
0Sstevel@tonic-gate				    SCTP_MSG_TO_BE_ABANDONED(ump, mhdr,
0Sstevel@tonic-gate				    sctp))) {
0Sstevel@tonic-gate					(void) sctp_check_abandoned_msg(sctp,
0Sstevel@tonic-gate					    ump);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				goto cum_ack_done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			sdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			xtsn = ntohl(sdc->sdh_tsn);
0Sstevel@tonic-gate			if (SEQ_GEQ(sctp->sctp_lastack_rxd, xtsn))
0Sstevel@tonic-gate				continue;
0Sstevel@tonic-gate			if (SEQ_GEQ(tsn, xtsn)) {
0Sstevel@tonic-gate				fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate				chunklen = ntohs(sdc->sdh_len);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (sctp->sctp_out_time != 0 &&
0Sstevel@tonic-gate				    xtsn == sctp->sctp_rtt_tsn) {
0Sstevel@tonic-gate					/* Got a new RTT measurement */
0Sstevel@tonic-gate					sctp_update_rtt(sctp, fp,
0Sstevel@tonic-gate					    lbolt64 - sctp->sctp_out_time);
0Sstevel@tonic-gate					sctp->sctp_out_time = 0;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (SCTP_CHUNK_ISACKED(mp))
0Sstevel@tonic-gate					continue;
1735Skcpoon				SCTP_CHUNK_SET_SACKCNT(mp, 0);
0Sstevel@tonic-gate				SCTP_CHUNK_ACKED(mp);
0Sstevel@tonic-gate				ASSERT(fp->suna >= chunklen);
0Sstevel@tonic-gate				fp->suna -= chunklen;
0Sstevel@tonic-gate				fp->acked += chunklen;
0Sstevel@tonic-gate				cumack_forward += chunklen;
0Sstevel@tonic-gate				ASSERT(sctp->sctp_unacked >=
0Sstevel@tonic-gate				    (chunklen - sizeof (*sdc)));
0Sstevel@tonic-gate				sctp->sctp_unacked -=
0Sstevel@tonic-gate				    (chunklen - sizeof (*sdc));
0Sstevel@tonic-gate				if (fp->suna == 0) {
0Sstevel@tonic-gate					/* all outstanding data acked */
0Sstevel@tonic-gate					fp->pba = 0;
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_STOP(fp);
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_RESTART(sctp, fp,
0Sstevel@tonic-gate					    fp->rto);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				goto cum_ack_done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		nump = ump->b_next;
0Sstevel@tonic-gate		if (nump != NULL)
0Sstevel@tonic-gate			nump->b_prev = NULL;
0Sstevel@tonic-gate		if (ump == sctp->sctp_xmit_tail)
0Sstevel@tonic-gate			sctp->sctp_xmit_tail = nump;
0Sstevel@tonic-gate		if (SCTP_IS_MSG_ABANDONED(ump)) {
0Sstevel@tonic-gate			BUMP_LOCAL(sctp->sctp_prsctpdrop);
0Sstevel@tonic-gate			ump->b_next = NULL;
0Sstevel@tonic-gate			sctp_sendfail_event(sctp, ump, 0, B_TRUE);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			sctp_free_msg(ump);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sctp->sctp_xmit_head = ump = nump;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gatecum_ack_done:
0Sstevel@tonic-gate	*first_unacked = mp;
0Sstevel@tonic-gate	if (cumack_forward > 0) {
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpInAck);
0Sstevel@tonic-gate		if (SEQ_GT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn)) {
0Sstevel@tonic-gate			sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Update ULP the amount of queued data, which is
0Sstevel@tonic-gate		 * sent-unack'ed + unsent.
0Sstevel@tonic-gate		 */
8348SEric.Yu@Sun.COM		if (!SCTP_IS_DETACHED(sctp))
8348SEric.Yu@Sun.COM			SCTP_TXQ_UPDATE(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		/* Time to send a shutdown? */
0Sstevel@tonic-gate		if (sctp->sctp_state == SCTPS_SHUTDOWN_PENDING) {
0Sstevel@tonic-gate			sctp_send_shutdown(sctp, 0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		sctp->sctp_xmit_unacked = mp;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		/* dup ack */
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpInDupAck);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	sctp->sctp_lastack_rxd = tsn;
0Sstevel@tonic-gate	if (SEQ_LT(sctp->sctp_adv_pap, sctp->sctp_lastack_rxd))
0Sstevel@tonic-gate		sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
0Sstevel@tonic-gate	ASSERT(sctp->sctp_xmit_head || sctp->sctp_unacked == 0);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	return (cumack_forward);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_set_frwnd(sctp_t *sctp, uint32_t frwnd)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	uint32_t orwnd;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_unacked > frwnd) {
0Sstevel@tonic-gate		sctp->sctp_frwnd = 0;
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	orwnd = sctp->sctp_frwnd;
0Sstevel@tonic-gate	sctp->sctp_frwnd = frwnd - sctp->sctp_unacked;
0Sstevel@tonic-gate	if (orwnd < sctp->sctp_frwnd) {
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * For un-ordered messages.
0Sstevel@tonic-gate * Walk the sctp->sctp_uo_frag list and remove any fragments with TSN
0Sstevel@tonic-gate * less than/equal to ftsn. Fragments for un-ordered messages are
0Sstevel@tonic-gate * strictly in sequence (w.r.t TSN).
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_ftsn_check_uo_frag(sctp_t *sctp, uint32_t ftsn)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*hmp_next;
0Sstevel@tonic-gate	sctp_data_hdr_t	*dc;
0Sstevel@tonic-gate	int		dlen = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	hmp = sctp->sctp_uo_frags;
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		hmp_next = hmp->b_next;
0Sstevel@tonic-gate		dc = (sctp_data_hdr_t *)hmp->b_rptr;
0Sstevel@tonic-gate		if (SEQ_GT(ntohl(dc->sdh_tsn), ftsn))
0Sstevel@tonic-gate			return (dlen);
0Sstevel@tonic-gate		sctp->sctp_uo_frags = hmp_next;
0Sstevel@tonic-gate		if (hmp_next != NULL)
0Sstevel@tonic-gate			hmp_next->b_prev = NULL;
0Sstevel@tonic-gate		hmp->b_next = NULL;
0Sstevel@tonic-gate		dlen += ntohs(dc->sdh_len) - sizeof (*dc);
0Sstevel@tonic-gate		freeb(hmp);
0Sstevel@tonic-gate		hmp = hmp_next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (dlen);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * For ordered messages.
0Sstevel@tonic-gate * Check for existing fragments for an sid-ssn pair reported as abandoned,
0Sstevel@tonic-gate * hence will not receive, in the Forward TSN. If there are fragments, then
0Sstevel@tonic-gate * we just nuke them. If and when Partial Delivery API is supported, we
0Sstevel@tonic-gate * would need to send a notification to the upper layer about this.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_ftsn_check_frag(sctp_t *sctp, uint16_t ssn, sctp_instr_t *sip)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_reass_t	*srp;
0Sstevel@tonic-gate	mblk_t		*hmp;
0Sstevel@tonic-gate	mblk_t		*dmp;
0Sstevel@tonic-gate	mblk_t		*hmp_next;
0Sstevel@tonic-gate	sctp_data_hdr_t	*dc;
0Sstevel@tonic-gate	int		dlen = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	hmp = sip->istr_reass;
0Sstevel@tonic-gate	while (hmp != NULL) {
0Sstevel@tonic-gate		hmp_next = hmp->b_next;
0Sstevel@tonic-gate		srp = (sctp_reass_t *)DB_BASE(hmp);
0Sstevel@tonic-gate		if (SSN_GT(srp->ssn, ssn))
0Sstevel@tonic-gate			return (dlen);
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * If we had sent part of this message up, send a partial
0Sstevel@tonic-gate		 * delivery event. Since this is ordered delivery, we should
0Sstevel@tonic-gate		 * have sent partial message only for the next in sequence,
0Sstevel@tonic-gate		 * hence the ASSERT. See comments in sctp_data_chunk() for
0Sstevel@tonic-gate		 * trypartial.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (srp->partial_delivered) {
0Sstevel@tonic-gate			ASSERT(sip->nextseq == srp->ssn);
0Sstevel@tonic-gate			sctp_partial_delivery_event(sctp);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* Take it out of the reass queue */
0Sstevel@tonic-gate		sip->istr_reass = hmp_next;
0Sstevel@tonic-gate		if (hmp_next != NULL)
0Sstevel@tonic-gate			hmp_next->b_prev = NULL;
0Sstevel@tonic-gate		hmp->b_next = NULL;
0Sstevel@tonic-gate		ASSERT(hmp->b_prev == NULL);
0Sstevel@tonic-gate		dmp = hmp;
3845Svi117747		ASSERT(DB_TYPE(hmp) == M_CTL);
3845Svi117747		dmp = hmp->b_cont;
3845Svi117747		hmp->b_cont = NULL;
3845Svi117747		freeb(hmp);
3845Svi117747		hmp = dmp;
0Sstevel@tonic-gate		while (dmp != NULL) {
0Sstevel@tonic-gate			dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate			dlen += ntohs(dc->sdh_len) - sizeof (*dc);
0Sstevel@tonic-gate			dmp = dmp->b_cont;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		freemsg(hmp);
0Sstevel@tonic-gate		hmp = hmp_next;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (dlen);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Update sctp_ftsn to the cumulative TSN from the Forward TSN chunk. Remove
0Sstevel@tonic-gate * any SACK gaps less than the newly updated sctp_ftsn. Walk through the
0Sstevel@tonic-gate * sid-ssn pair in the Forward TSN and for each, clean the fragment list
0Sstevel@tonic-gate * for this pair, if needed, and check if we can deliver subsequent
0Sstevel@tonic-gate * messages, if any, from the instream queue (that were waiting for this
0Sstevel@tonic-gate * sid-ssn message to show up). Once we are done try to update the SACK
0Sstevel@tonic-gate * info. We could get a duplicate Forward TSN, in which case just send
*11042SErik.Nordmark@Sun.COM * a SACK. If any of the sid values in the Forward TSN is invalid,
0Sstevel@tonic-gate * send back an "Invalid Stream Identifier" error and continue processing
0Sstevel@tonic-gate * the rest.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_process_forward_tsn(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp,
*11042SErik.Nordmark@Sun.COM    ip_pkt_t *ipp, ip_recv_attr_t *ira)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	uint32_t	*ftsn = (uint32_t *)(ch + 1);
0Sstevel@tonic-gate	ftsn_entry_t	*ftsn_entry;
0Sstevel@tonic-gate	sctp_instr_t	*instr;
0Sstevel@tonic-gate	boolean_t	can_deliver = B_TRUE;
0Sstevel@tonic-gate	size_t		dlen;
0Sstevel@tonic-gate	int		flen;
0Sstevel@tonic-gate	mblk_t		*dmp;
0Sstevel@tonic-gate	mblk_t		*pmp;
0Sstevel@tonic-gate	sctp_data_hdr_t	*dc;
0Sstevel@tonic-gate	ssize_t		remaining;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	*ftsn = ntohl(*ftsn);
0Sstevel@tonic-gate	remaining =  ntohs(ch->sch_len) - sizeof (*ch) - sizeof (*ftsn);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (SCTP_IS_DETACHED(sctp)) {
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpInClosed);
0Sstevel@tonic-gate		can_deliver = B_FALSE;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * un-ordered messages don't have SID-SSN pair entries, we check
0Sstevel@tonic-gate	 * for any fragments (for un-ordered message) to be discarded using
0Sstevel@tonic-gate	 * the cumulative FTSN.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	flen = sctp_ftsn_check_uo_frag(sctp, *ftsn);
0Sstevel@tonic-gate	if (flen > 0) {
0Sstevel@tonic-gate		ASSERT(sctp->sctp_rxqueued >= flen);
0Sstevel@tonic-gate		sctp->sctp_rxqueued -= flen;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ftsn_entry = (ftsn_entry_t *)(ftsn + 1);
0Sstevel@tonic-gate	while (remaining >= sizeof (*ftsn_entry)) {
0Sstevel@tonic-gate		ftsn_entry->ftsn_sid = ntohs(ftsn_entry->ftsn_sid);
0Sstevel@tonic-gate		ftsn_entry->ftsn_ssn = ntohs(ftsn_entry->ftsn_ssn);
0Sstevel@tonic-gate		if (ftsn_entry->ftsn_sid >= sctp->sctp_num_istr) {
9451SGeorge.Shepherd@Sun.COM			sctp_bsc_t	inval_parm;
9451SGeorge.Shepherd@Sun.COM
9451SGeorge.Shepherd@Sun.COM			/* Will populate the CAUSE block in the ERROR chunk. */
9451SGeorge.Shepherd@Sun.COM			inval_parm.bsc_sid = htons(ftsn_entry->ftsn_sid);
9451SGeorge.Shepherd@Sun.COM			/* RESERVED, ignored at the receiving end */
9451SGeorge.Shepherd@Sun.COM			inval_parm.bsc_pad = 0;
9451SGeorge.Shepherd@Sun.COM
9451SGeorge.Shepherd@Sun.COM			sctp_add_err(sctp, SCTP_ERR_BAD_SID,
9451SGeorge.Shepherd@Sun.COM			    (void *)&inval_parm, sizeof (sctp_bsc_t), fp);
0Sstevel@tonic-gate			ftsn_entry++;
0Sstevel@tonic-gate			remaining -= sizeof (*ftsn_entry);
0Sstevel@tonic-gate			continue;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		instr = &sctp->sctp_instr[ftsn_entry->ftsn_sid];
0Sstevel@tonic-gate		flen = sctp_ftsn_check_frag(sctp, ftsn_entry->ftsn_ssn, instr);
0Sstevel@tonic-gate		/* Indicates frags were nuked, update rxqueued */
0Sstevel@tonic-gate		if (flen > 0) {
0Sstevel@tonic-gate			ASSERT(sctp->sctp_rxqueued >= flen);
0Sstevel@tonic-gate			sctp->sctp_rxqueued -= flen;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * It is possible to receive an FTSN chunk with SSN smaller
0Sstevel@tonic-gate		 * than then nextseq if this chunk is a retransmission because
0Sstevel@tonic-gate		 * of incomplete processing when it was first processed.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (SSN_GE(ftsn_entry->ftsn_ssn, instr->nextseq))
0Sstevel@tonic-gate			instr->nextseq = ftsn_entry->ftsn_ssn + 1;
0Sstevel@tonic-gate		while (instr->istr_nmsgs > 0) {
0Sstevel@tonic-gate			mblk_t	*next;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			dmp = (mblk_t *)instr->istr_msgs;
0Sstevel@tonic-gate			dc = (sctp_data_hdr_t *)dmp->b_rptr;
0Sstevel@tonic-gate			if (ntohs(dc->sdh_ssn) != instr->nextseq)
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			next = dmp->b_next;
0Sstevel@tonic-gate			dlen = dmp->b_wptr - dmp->b_rptr - sizeof (*dc);
0Sstevel@tonic-gate			for (pmp = dmp->b_cont; pmp != NULL;
0Sstevel@tonic-gate			    pmp = pmp->b_cont) {
10828SGeorge.Shepherd@Sun.COM				dlen += MBLKL(pmp);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			if (can_deliver) {
0Sstevel@tonic-gate				int32_t	nrwnd;
8348SEric.Yu@Sun.COM				int error;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				dmp->b_rptr = (uchar_t *)(dc + 1);
0Sstevel@tonic-gate				dmp->b_next = NULL;
0Sstevel@tonic-gate				ASSERT(dmp->b_prev == NULL);
0Sstevel@tonic-gate				if (sctp_input_add_ancillary(sctp,
*11042SErik.Nordmark@Sun.COM				    &dmp, dc, fp, ipp, ira) == 0) {
0Sstevel@tonic-gate					sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate					sctp->sctp_rwnd -= dlen;
8348SEric.Yu@Sun.COM					/*
8348SEric.Yu@Sun.COM					 * Override b_flag for SCTP sockfs
8348SEric.Yu@Sun.COM					 * internal use
8348SEric.Yu@Sun.COM					 */
8348SEric.Yu@Sun.COM
8348SEric.Yu@Sun.COM					dmp->b_flag = 0;
0Sstevel@tonic-gate					nrwnd = sctp->sctp_ulp_recv(
8348SEric.Yu@Sun.COM					    sctp->sctp_ulpd, dmp, msgdsize(dmp),
8348SEric.Yu@Sun.COM					    0, &error, NULL);
10828SGeorge.Shepherd@Sun.COM					if (nrwnd < 0)
10828SGeorge.Shepherd@Sun.COM						sctp->sctp_rwnd = 0;
10828SGeorge.Shepherd@Sun.COM					else if (nrwnd > sctp->sctp_rwnd)
0Sstevel@tonic-gate						sctp->sctp_rwnd = nrwnd;
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * We will resume processing when
0Sstevel@tonic-gate					 * the FTSN chunk is re-xmitted.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate					dmp->b_rptr = (uchar_t *)dc;
0Sstevel@tonic-gate					dmp->b_next = next;
0Sstevel@tonic-gate					dprint(0,
0Sstevel@tonic-gate					    ("FTSN dequeuing %u failed\n",
0Sstevel@tonic-gate					    ntohs(dc->sdh_ssn)));
0Sstevel@tonic-gate					return;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				sctp->sctp_rxqueued -= dlen;
0Sstevel@tonic-gate				ASSERT(dmp->b_prev == NULL);
0Sstevel@tonic-gate				dmp->b_next = NULL;
0Sstevel@tonic-gate				freemsg(dmp);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			instr->istr_nmsgs--;
0Sstevel@tonic-gate			instr->nextseq++;
0Sstevel@tonic-gate			sctp->sctp_istr_nmsgs--;
0Sstevel@tonic-gate			if (next != NULL)
0Sstevel@tonic-gate				next->b_prev = NULL;
0Sstevel@tonic-gate			instr->istr_msgs = next;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		ftsn_entry++;
0Sstevel@tonic-gate		remaining -= sizeof (*ftsn_entry);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* Duplicate FTSN */
0Sstevel@tonic-gate	if (*ftsn <= (sctp->sctp_ftsn - 1)) {
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* Advance cum TSN to that reported in the Forward TSN chunk */
0Sstevel@tonic-gate	sctp->sctp_ftsn = *ftsn + 1;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Remove all the SACK gaps before the new cum TSN */
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL) {
0Sstevel@tonic-gate		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
0Sstevel@tonic-gate		    &sctp->sctp_sack_gaps);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If there are gap reports pending, check if advancing
0Sstevel@tonic-gate	 * the ftsn here closes a gap. If so, we can advance
0Sstevel@tonic-gate	 * ftsn to the end of the set.
0Sstevel@tonic-gate	 * If ftsn has moved forward, maybe we can remove gap reports.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_sack_info != NULL &&
0Sstevel@tonic-gate	    sctp->sctp_ftsn == sctp->sctp_sack_info->begin) {
0Sstevel@tonic-gate		sctp->sctp_ftsn = sctp->sctp_sack_info->end + 1;
0Sstevel@tonic-gate		sctp_ack_rem(&sctp->sctp_sack_info, sctp->sctp_ftsn - 1,
0Sstevel@tonic-gate		    &sctp->sctp_sack_gaps);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * When we have processed a SACK we check to see if we can advance the
0Sstevel@tonic-gate * cumulative TSN if there are abandoned chunks immediately following
0Sstevel@tonic-gate * the updated cumulative TSN. If there are, we attempt to send a
0Sstevel@tonic-gate * Forward TSN chunk.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_check_abandoned_data(sctp_t *sctp, sctp_faddr_t *fp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	mblk_t		*meta = sctp->sctp_xmit_head;
0Sstevel@tonic-gate	mblk_t		*mp;
0Sstevel@tonic-gate	mblk_t		*nmp;
0Sstevel@tonic-gate	uint32_t	seglen;
0Sstevel@tonic-gate	uint32_t	adv_pap = sctp->sctp_adv_pap;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We only check in the first meta since otherwise we can't
0Sstevel@tonic-gate	 * advance the cumulative ack point. We just look for chunks
0Sstevel@tonic-gate	 * marked for retransmission, else we might prematurely
0Sstevel@tonic-gate	 * send an FTSN for a sent, but unacked, chunk.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	for (mp = meta->b_cont; mp != NULL; mp = mp->b_next) {
0Sstevel@tonic-gate		if (!SCTP_CHUNK_ISSENT(mp))
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		if (SCTP_CHUNK_WANT_REXMIT(mp))
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (mp == NULL)
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	sctp_check_adv_ack_pt(sctp, meta, mp);
0Sstevel@tonic-gate	if (SEQ_GT(sctp->sctp_adv_pap, adv_pap)) {
0Sstevel@tonic-gate		sctp_make_ftsns(sctp, meta, mp, &nmp, fp, &seglen);
0Sstevel@tonic-gate		if (nmp == NULL) {
0Sstevel@tonic-gate			sctp->sctp_adv_pap = adv_pap;
0Sstevel@tonic-gate			if (!fp->timer_running)
0Sstevel@tonic-gate				SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
*11042SErik.Nordmark@Sun.COM		sctp_set_iplen(sctp, nmp, fp->ixa);
*11042SErik.Nordmark@Sun.COM		(void) conn_ip_output(nmp, fp->ixa);
*11042SErik.Nordmark@Sun.COM		BUMP_LOCAL(sctp->sctp_opkts);
0Sstevel@tonic-gate		if (!fp->timer_running)
0Sstevel@tonic-gate			SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
852Svi117747/*
852Svi117747 * The processing here follows the same logic in sctp_got_sack(), the reason
852Svi117747 * we do this separately is because, usually, gap blocks are ordered and
852Svi117747 * we can process it in sctp_got_sack(). However if they aren't we would
852Svi117747 * need to do some additional non-optimal stuff when we start processing the
852Svi117747 * unordered gaps. To that effect sctp_got_sack() does the processing in the
852Svi117747 * simple case and this does the same in the more involved case.
852Svi117747 */
852Svi117747static uint32_t
852Svi117747sctp_process_uo_gaps(sctp_t *sctp, uint32_t ctsn, sctp_sack_frag_t *ssf,
852Svi117747    int num_gaps, mblk_t *umphead, mblk_t *mphead, int *trysend,
852Svi117747    boolean_t *fast_recovery, uint32_t fr_xtsn)
852Svi117747{
852Svi117747	uint32_t		xtsn;
852Svi117747	uint32_t		gapstart = 0;
852Svi117747	uint32_t		gapend = 0;
852Svi117747	int			gapcnt;
852Svi117747	uint16_t		chunklen;
852Svi117747	sctp_data_hdr_t		*sdc;
852Svi117747	int			gstart;
852Svi117747	mblk_t			*ump = umphead;
852Svi117747	mblk_t			*mp = mphead;
852Svi117747	sctp_faddr_t		*fp;
852Svi117747	uint32_t		acked = 0;
3448Sdh155122	sctp_stack_t		*sctps = sctp->sctp_sctps;
852Svi117747
852Svi117747	/*
852Svi117747	 * gstart tracks the last (in the order of TSN) gapstart that
852Svi117747	 * we process in this SACK gaps walk.
852Svi117747	 */
852Svi117747	gstart = ctsn;
852Svi117747
852Svi117747	sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747	xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	for (gapcnt = 0; gapcnt < num_gaps; gapcnt++, ssf++) {
852Svi117747		if (gapstart != 0) {
852Svi117747			/*
852Svi117747			 * If we have reached the end of the transmit list or
852Svi117747			 * hit an unsent chunk or encountered an unordered gap
852Svi117747			 * block start from the ctsn again.
852Svi117747			 */
852Svi117747			if (ump == NULL || !SCTP_CHUNK_ISSENT(mp) ||
852Svi117747			    SEQ_LT(ctsn + ntohs(ssf->ssf_start), xtsn)) {
852Svi117747				ump = umphead;
852Svi117747				mp = mphead;
852Svi117747				sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747				xtsn = ntohl(sdc->sdh_tsn);
852Svi117747			}
852Svi117747		}
852Svi117747
852Svi117747		gapstart = ctsn + ntohs(ssf->ssf_start);
852Svi117747		gapend = ctsn + ntohs(ssf->ssf_end);
852Svi117747
10068SChandrasekar.Marimuthu@Sun.COM		/*
10068SChandrasekar.Marimuthu@Sun.COM		 * Sanity checks:
10068SChandrasekar.Marimuthu@Sun.COM		 *
10068SChandrasekar.Marimuthu@Sun.COM		 * 1. SACK for TSN we have not sent - ABORT
10068SChandrasekar.Marimuthu@Sun.COM		 * 2. Invalid or spurious gaps, ignore all gaps
10068SChandrasekar.Marimuthu@Sun.COM		 */
852Svi117747		if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) ||
852Svi117747		    SEQ_GT(gapend, sctp->sctp_ltsn - 1)) {
3448Sdh155122			BUMP_MIB(&sctps->sctps_mib, sctpInAckUnsent);
852Svi117747			*trysend = -1;
852Svi117747			return (acked);
10068SChandrasekar.Marimuthu@Sun.COM		} else if (SEQ_LT(gapend, gapstart) ||
10068SChandrasekar.Marimuthu@Sun.COM		    SEQ_LEQ(gapstart, ctsn)) {
852Svi117747			break;
852Svi117747		}
852Svi117747		/*
852Svi117747		 * The xtsn can be the TSN processed for the last gap
852Svi117747		 * (gapend) or it could be the cumulative TSN. We continue
852Svi117747		 * with the last xtsn as long as the gaps are ordered, when
852Svi117747		 * we hit an unordered gap, we re-start from the cumulative
852Svi117747		 * TSN. For the first gap it is always the cumulative TSN.
852Svi117747		 */
852Svi117747		while (xtsn != gapstart) {
852Svi117747			/*
852Svi117747			 * We can't reliably check for reneged chunks
852Svi117747			 * when walking the unordered list, so we don't.
852Svi117747			 * In case the peer reneges then we will end up
852Svi117747			 * sending the reneged chunk via timeout.
852Svi117747			 */
852Svi117747			mp = mp->b_next;
852Svi117747			if (mp == NULL) {
852Svi117747				ump = ump->b_next;
852Svi117747				/*
852Svi117747				 * ump can't be NULL because of the sanity
852Svi117747				 * check above.
852Svi117747				 */
852Svi117747				ASSERT(ump != NULL);
852Svi117747				mp = ump->b_cont;
852Svi117747			}
852Svi117747			/*
852Svi117747			 * mp can't be unsent because of the sanity check
852Svi117747			 * above.
852Svi117747			 */
852Svi117747			ASSERT(SCTP_CHUNK_ISSENT(mp));
852Svi117747			sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747			xtsn = ntohl(sdc->sdh_tsn);
852Svi117747		}
852Svi117747		/*
852Svi117747		 * Now that we have found the chunk with TSN == 'gapstart',
852Svi117747		 * let's walk till we hit the chunk with TSN == 'gapend'.
852Svi117747		 * All intermediate chunks will be marked ACKED, if they
852Svi117747		 * haven't already been.
852Svi117747		 */
852Svi117747		while (SEQ_LEQ(xtsn, gapend)) {
852Svi117747			/*
852Svi117747			 * SACKed
852Svi117747			 */
852Svi117747			SCTP_CHUNK_SET_SACKCNT(mp, 0);
852Svi117747			if (!SCTP_CHUNK_ISACKED(mp)) {
852Svi117747				SCTP_CHUNK_ACKED(mp);
852Svi117747
852Svi117747				fp = SCTP_CHUNK_DEST(mp);
852Svi117747				chunklen = ntohs(sdc->sdh_len);
852Svi117747				ASSERT(fp->suna >= chunklen);
852Svi117747				fp->suna -= chunklen;
852Svi117747				if (fp->suna == 0) {
852Svi117747					/* All outstanding data acked. */
852Svi117747					fp->pba = 0;
852Svi117747					SCTP_FADDR_TIMER_STOP(fp);
852Svi117747				}
852Svi117747				fp->acked += chunklen;
852Svi117747				acked += chunklen;
852Svi117747				sctp->sctp_unacked -= chunklen - sizeof (*sdc);
852Svi117747				ASSERT(sctp->sctp_unacked >= 0);
852Svi117747			}
852Svi117747			/*
852Svi117747			 * Move to the next message in the transmit list
852Svi117747			 * if we are done with all the chunks from the current
852Svi117747			 * message. Note, it is possible to hit the end of the
852Svi117747			 * transmit list here, i.e. if we have already completed
852Svi117747			 * processing the gap block.
852Svi117747			 */
852Svi117747			mp = mp->b_next;
852Svi117747			if (mp == NULL) {
852Svi117747				ump = ump->b_next;
852Svi117747				if (ump == NULL) {
852Svi117747					ASSERT(xtsn == gapend);
852Svi117747					break;
852Svi117747				}
852Svi117747				mp = ump->b_cont;
852Svi117747			}
852Svi117747			/*
852Svi117747			 * Likewise, we can hit an unsent chunk once we have
852Svi117747			 * completed processing the gap block.
852Svi117747			 */
852Svi117747			if (!SCTP_CHUNK_ISSENT(mp)) {
852Svi117747				ASSERT(xtsn == gapend);
852Svi117747				break;
852Svi117747			}
852Svi117747			sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747			xtsn = ntohl(sdc->sdh_tsn);
852Svi117747		}
852Svi117747		/*
852Svi117747		 * We keep track of the last gap we successfully processed
852Svi117747		 * so that we can terminate the walk below for incrementing
852Svi117747		 * the SACK count.
852Svi117747		 */
852Svi117747		if (SEQ_LT(gstart, gapstart))
852Svi117747			gstart = gapstart;
852Svi117747	}
852Svi117747	/*
852Svi117747	 * Check if have incremented the SACK count for all unacked TSNs in
852Svi117747	 * sctp_got_sack(), if so we are done.
852Svi117747	 */
852Svi117747	if (SEQ_LEQ(gstart, fr_xtsn))
852Svi117747		return (acked);
852Svi117747
852Svi117747	ump = umphead;
852Svi117747	mp = mphead;
852Svi117747	sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747	xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	while (SEQ_LT(xtsn, gstart)) {
852Svi117747		/*
852Svi117747		 * We have incremented SACK count for TSNs less than fr_tsn
852Svi117747		 * in sctp_got_sack(), so don't increment them again here.
852Svi117747		 */
852Svi117747		if (SEQ_GT(xtsn, fr_xtsn) && !SCTP_CHUNK_ISACKED(mp)) {
852Svi117747			SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1);
3448Sdh155122			if (SCTP_CHUNK_SACKCNT(mp) ==
3448Sdh155122			    sctps->sctps_fast_rxt_thresh) {
852Svi117747				SCTP_CHUNK_REXMIT(mp);
852Svi117747				sctp->sctp_chk_fast_rexmit = B_TRUE;
852Svi117747				*trysend = 1;
852Svi117747				if (!*fast_recovery) {
852Svi117747					/*
852Svi117747					 * Entering fast recovery.
852Svi117747					 */
852Svi117747					fp = SCTP_CHUNK_DEST(mp);
852Svi117747					fp->ssthresh = fp->cwnd / 2;
852Svi117747					if (fp->ssthresh < 2 * fp->sfa_pmss) {
852Svi117747						fp->ssthresh =
852Svi117747						    2 * fp->sfa_pmss;
852Svi117747					}
852Svi117747					fp->cwnd = fp->ssthresh;
852Svi117747					fp->pba = 0;
852Svi117747					sctp->sctp_recovery_tsn =
852Svi117747					    sctp->sctp_ltsn - 1;
852Svi117747					*fast_recovery = B_TRUE;
852Svi117747				}
852Svi117747			}
852Svi117747		}
852Svi117747		mp = mp->b_next;
852Svi117747		if (mp == NULL) {
852Svi117747			ump = ump->b_next;
852Svi117747			/* We can't get to the end of the transmit list here */
852Svi117747			ASSERT(ump != NULL);
852Svi117747			mp = ump->b_cont;
852Svi117747		}
852Svi117747		/* We can't hit an unsent chunk here */
852Svi117747		ASSERT(SCTP_CHUNK_ISSENT(mp));
852Svi117747		sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747		xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	}
852Svi117747	return (acked);
852Svi117747}
852Svi117747
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_got_sack(sctp_t *sctp, sctp_chunk_hdr_t *sch)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_sack_chunk_t	*sc;
0Sstevel@tonic-gate	sctp_data_hdr_t		*sdc;
0Sstevel@tonic-gate	sctp_sack_frag_t	*ssf;
0Sstevel@tonic-gate	mblk_t			*ump;
0Sstevel@tonic-gate	mblk_t			*mp;
852Svi117747	mblk_t			*mp1;
852Svi117747	uint32_t		cumtsn;
0Sstevel@tonic-gate	uint32_t		xtsn;
852Svi117747	uint32_t		gapstart = 0;
852Svi117747	uint32_t		gapend = 0;
0Sstevel@tonic-gate	uint32_t		acked = 0;
0Sstevel@tonic-gate	uint16_t		chunklen;
0Sstevel@tonic-gate	sctp_faddr_t		*fp;
0Sstevel@tonic-gate	int			num_gaps;
0Sstevel@tonic-gate	int			trysend = 0;
0Sstevel@tonic-gate	int			i;
0Sstevel@tonic-gate	boolean_t		fast_recovery = B_FALSE;
0Sstevel@tonic-gate	boolean_t		cumack_forward = B_FALSE;
0Sstevel@tonic-gate	boolean_t		fwd_tsn = B_FALSE;
3448Sdh155122	sctp_stack_t		*sctps = sctp->sctp_sctps;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ibchunks);
10212SGeorge.Shepherd@Sun.COM	BUMP_LOCAL(sctp->sctp_isacks);
0Sstevel@tonic-gate	chunklen = ntohs(sch->sch_len);
0Sstevel@tonic-gate	if (chunklen < (sizeof (*sch) + sizeof (*sc)))
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sc = (sctp_sack_chunk_t *)(sch + 1);
852Svi117747	cumtsn = ntohl(sc->ssc_cumtsn);
852Svi117747
852Svi117747	dprint(2, ("got sack cumtsn %x -> %x\n", sctp->sctp_lastack_rxd,
852Svi117747	    cumtsn));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* out of order */
852Svi117747	if (SEQ_LT(cumtsn, sctp->sctp_lastack_rxd))
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate
852Svi117747	if (SEQ_GT(cumtsn, sctp->sctp_ltsn - 1)) {
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpInAckUnsent);
852Svi117747		/* Send an ABORT */
852Svi117747		return (-1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Cwnd only done when not in fast recovery mode.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_recovery_tsn))
0Sstevel@tonic-gate		fast_recovery = B_TRUE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * .. and if the cum TSN is not moving ahead on account Forward TSN
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_adv_pap))
0Sstevel@tonic-gate		fwd_tsn = B_TRUE;
0Sstevel@tonic-gate
852Svi117747	if (cumtsn == sctp->sctp_lastack_rxd &&
0Sstevel@tonic-gate	    (sctp->sctp_xmit_unacked == NULL ||
0Sstevel@tonic-gate	    !SCTP_CHUNK_ABANDONED(sctp->sctp_xmit_unacked))) {
0Sstevel@tonic-gate		if (sctp->sctp_xmit_unacked != NULL)
0Sstevel@tonic-gate			mp = sctp->sctp_xmit_unacked;
0Sstevel@tonic-gate		else if (sctp->sctp_xmit_head != NULL)
0Sstevel@tonic-gate			mp = sctp->sctp_xmit_head->b_cont;
0Sstevel@tonic-gate		else
0Sstevel@tonic-gate			mp = NULL;
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpInDupAck);
1932Svi117747		/*
1932Svi117747		 * If we were doing a zero win probe and the win
1932Svi117747		 * has now opened to at least MSS, re-transmit the
1932Svi117747		 * zero win probe via sctp_rexmit_packet().
1932Svi117747		 */
1932Svi117747		if (mp != NULL && sctp->sctp_zero_win_probe &&
1932Svi117747		    ntohl(sc->ssc_a_rwnd) >= sctp->sctp_current->sfa_pmss) {
1932Svi117747			mblk_t	*pkt;
1932Svi117747			uint_t	pkt_len;
1932Svi117747			mblk_t	*mp1 = mp;
1932Svi117747			mblk_t	*meta = sctp->sctp_xmit_head;
1932Svi117747
1932Svi117747			/*
1932Svi117747			 * Reset the RTO since we have been backing-off
1932Svi117747			 * to send the ZWP.
1932Svi117747			 */
1932Svi117747			fp = sctp->sctp_current;
1932Svi117747			fp->rto = fp->srtt + 4 * fp->rttvar;
10212SGeorge.Shepherd@Sun.COM			SCTP_MAX_RTO(sctp, fp);
1932Svi117747			/* Resend the ZWP */
1932Svi117747			pkt = sctp_rexmit_packet(sctp, &meta, &mp1, fp,
1932Svi117747			    &pkt_len);
1932Svi117747			if (pkt == NULL) {
3448Sdh155122				SCTP_KSTAT(sctps, sctp_ss_rexmit_failed);
1932Svi117747				return (0);
1932Svi117747			}
1932Svi117747			ASSERT(pkt_len <= fp->sfa_pmss);
1932Svi117747			sctp->sctp_zero_win_probe = B_FALSE;
1932Svi117747			sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
1932Svi117747			sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
*11042SErik.Nordmark@Sun.COM			sctp_set_iplen(sctp, pkt, fp->ixa);
*11042SErik.Nordmark@Sun.COM			(void) conn_ip_output(pkt, fp->ixa);
*11042SErik.Nordmark@Sun.COM			BUMP_LOCAL(sctp->sctp_opkts);
1932Svi117747		}
0Sstevel@tonic-gate	} else {
1932Svi117747		if (sctp->sctp_zero_win_probe) {
1932Svi117747			/*
1932Svi117747			 * Reset the RTO since we have been backing-off
1932Svi117747			 * to send the ZWP.
1932Svi117747			 */
1932Svi117747			fp = sctp->sctp_current;
1932Svi117747			fp->rto = fp->srtt + 4 * fp->rttvar;
10212SGeorge.Shepherd@Sun.COM			SCTP_MAX_RTO(sctp, fp);
1932Svi117747			sctp->sctp_zero_win_probe = B_FALSE;
1932Svi117747			/* This is probably not required */
1932Svi117747			if (!sctp->sctp_rexmitting) {
1932Svi117747				sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
1932Svi117747				sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
1932Svi117747			}
1932Svi117747		}
852Svi117747		acked = sctp_cumack(sctp, cumtsn, &mp);
0Sstevel@tonic-gate		sctp->sctp_xmit_unacked = mp;
0Sstevel@tonic-gate		if (acked > 0) {
0Sstevel@tonic-gate			trysend = 1;
0Sstevel@tonic-gate			cumack_forward = B_TRUE;
0Sstevel@tonic-gate			if (fwd_tsn && SEQ_GEQ(sctp->sctp_lastack_rxd,
0Sstevel@tonic-gate			    sctp->sctp_adv_pap)) {
0Sstevel@tonic-gate				cumack_forward = B_FALSE;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	num_gaps = ntohs(sc->ssc_numfrags);
10212SGeorge.Shepherd@Sun.COM	UPDATE_LOCAL(sctp->sctp_gapcnt, num_gaps);
0Sstevel@tonic-gate	if (num_gaps == 0 || mp == NULL || !SCTP_CHUNK_ISSENT(mp) ||
0Sstevel@tonic-gate	    chunklen < (sizeof (*sch) + sizeof (*sc) +
0Sstevel@tonic-gate	    num_gaps * sizeof (*ssf))) {
0Sstevel@tonic-gate		goto ret;
0Sstevel@tonic-gate	}
852Svi117747#ifdef	DEBUG
852Svi117747	/*
852Svi117747	 * Since we delete any message that has been acked completely,
852Svi117747	 * the unacked chunk must belong to sctp_xmit_head (as
852Svi117747	 * we don't have a back pointer from the mp to the meta data
852Svi117747	 * we do this).
852Svi117747	 */
852Svi117747	{
852Svi117747		mblk_t	*mp2 = sctp->sctp_xmit_head->b_cont;
852Svi117747
852Svi117747		while (mp2 != NULL) {
852Svi117747			if (mp2 == mp)
852Svi117747				break;
852Svi117747			mp2 = mp2->b_next;
852Svi117747		}
852Svi117747		ASSERT(mp2 != NULL);
852Svi117747	}
852Svi117747#endif
0Sstevel@tonic-gate	ump = sctp->sctp_xmit_head;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
852Svi117747	 * Just remember where we started from, in case we need to call
852Svi117747	 * sctp_process_uo_gaps() if the gap blocks are unordered.
852Svi117747	 */
852Svi117747	mp1 = mp;
852Svi117747
852Svi117747	sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747	xtsn = ntohl(sdc->sdh_tsn);
852Svi117747	ASSERT(xtsn == cumtsn + 1);
852Svi117747
852Svi117747	/*
0Sstevel@tonic-gate	 * Go through SACK gaps. They are ordered based on start TSN.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	ssf = (sctp_sack_frag_t *)(sc + 1);
852Svi117747	for (i = 0; i < num_gaps; i++, ssf++) {
852Svi117747		if (gapstart != 0) {
852Svi117747			/* check for unordered gap */
852Svi117747			if (SEQ_LEQ(cumtsn + ntohs(ssf->ssf_start), gapstart)) {
852Svi117747				acked += sctp_process_uo_gaps(sctp,
852Svi117747				    cumtsn, ssf, num_gaps - i,
852Svi117747				    sctp->sctp_xmit_head, mp1,
852Svi117747				    &trysend, &fast_recovery, gapstart);
852Svi117747				if (trysend < 0) {
3448Sdh155122					BUMP_MIB(&sctps->sctps_mib,
3448Sdh155122					    sctpInAckUnsent);
852Svi117747					return (-1);
852Svi117747				}
852Svi117747				break;
852Svi117747			}
852Svi117747		}
852Svi117747		gapstart = cumtsn + ntohs(ssf->ssf_start);
852Svi117747		gapend = cumtsn + ntohs(ssf->ssf_end);
852Svi117747
10068SChandrasekar.Marimuthu@Sun.COM		/*
10068SChandrasekar.Marimuthu@Sun.COM		 * Sanity checks:
10068SChandrasekar.Marimuthu@Sun.COM		 *
10068SChandrasekar.Marimuthu@Sun.COM		 * 1. SACK for TSN we have not sent - ABORT
10068SChandrasekar.Marimuthu@Sun.COM		 * 2. Invalid or spurious gaps, ignore all gaps
10068SChandrasekar.Marimuthu@Sun.COM		 */
852Svi117747		if (SEQ_GT(gapstart, sctp->sctp_ltsn - 1) ||
852Svi117747		    SEQ_GT(gapend, sctp->sctp_ltsn - 1)) {
3448Sdh155122			BUMP_MIB(&sctps->sctps_mib, sctpInAckUnsent);
852Svi117747			return (-1);
10068SChandrasekar.Marimuthu@Sun.COM		} else if (SEQ_LT(gapend, gapstart) ||
10068SChandrasekar.Marimuthu@Sun.COM		    SEQ_LEQ(gapstart, cumtsn)) {
852Svi117747			break;
852Svi117747		}
852Svi117747		/*
852Svi117747		 * Let's start at the current TSN (for the 1st gap we start
852Svi117747		 * from the cumulative TSN, for subsequent ones we start from
852Svi117747		 * where the previous gapend was found - second while loop
852Svi117747		 * below) and walk the transmit list till we find the TSN
852Svi117747		 * corresponding to gapstart. All the unacked chunks till we
852Svi117747		 * get to the chunk with TSN == gapstart will have their
852Svi117747		 * SACKCNT incremented by 1. Note since the gap blocks are
852Svi117747		 * ordered, we won't be incrementing the SACKCNT for an
852Svi117747		 * unacked chunk by more than one while processing the gap
852Svi117747		 * blocks. If the SACKCNT for any unacked chunk exceeds
852Svi117747		 * the fast retransmit threshold, we will fast retransmit
852Svi117747		 * after processing all the gap blocks.
852Svi117747		 */
10068SChandrasekar.Marimuthu@Sun.COM		ASSERT(SEQ_LEQ(xtsn, gapstart));
0Sstevel@tonic-gate		while (xtsn != gapstart) {
0Sstevel@tonic-gate			SCTP_CHUNK_SET_SACKCNT(mp, SCTP_CHUNK_SACKCNT(mp) + 1);
3448Sdh155122			if (SCTP_CHUNK_SACKCNT(mp) ==
3448Sdh155122			    sctps->sctps_fast_rxt_thresh) {
0Sstevel@tonic-gate				SCTP_CHUNK_REXMIT(mp);
0Sstevel@tonic-gate				sctp->sctp_chk_fast_rexmit = B_TRUE;
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				if (!fast_recovery) {
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * Entering fast recovery.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate					fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate					fp->ssthresh = fp->cwnd / 2;
0Sstevel@tonic-gate					if (fp->ssthresh < 2 * fp->sfa_pmss) {
0Sstevel@tonic-gate						fp->ssthresh =
0Sstevel@tonic-gate						    2 * fp->sfa_pmss;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate					fp->cwnd = fp->ssthresh;
0Sstevel@tonic-gate					fp->pba = 0;
0Sstevel@tonic-gate					sctp->sctp_recovery_tsn =
0Sstevel@tonic-gate					    sctp->sctp_ltsn - 1;
0Sstevel@tonic-gate					fast_recovery = B_TRUE;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * Peer may have reneged on this chunk, so un-sack
0Sstevel@tonic-gate			 * it now. If the peer did renege, we need to
0Sstevel@tonic-gate			 * readjust unacked.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (SCTP_CHUNK_ISACKED(mp)) {
0Sstevel@tonic-gate				chunklen = ntohs(sdc->sdh_len);
0Sstevel@tonic-gate				fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate				fp->suna += chunklen;
0Sstevel@tonic-gate				sctp->sctp_unacked += chunklen - sizeof (*sdc);
0Sstevel@tonic-gate				SCTP_CHUNK_CLEAR_ACKED(mp);
0Sstevel@tonic-gate				if (!fp->timer_running) {
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_RESTART(sctp, fp,
0Sstevel@tonic-gate					    fp->rto);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate
0Sstevel@tonic-gate			mp = mp->b_next;
0Sstevel@tonic-gate			if (mp == NULL) {
0Sstevel@tonic-gate				ump = ump->b_next;
852Svi117747				/*
852Svi117747				 * ump can't be NULL given the sanity check
10068SChandrasekar.Marimuthu@Sun.COM				 * above.  But if it is NULL, it means that
10068SChandrasekar.Marimuthu@Sun.COM				 * there is a data corruption.  We'd better
10068SChandrasekar.Marimuthu@Sun.COM				 * panic.
852Svi117747				 */
10068SChandrasekar.Marimuthu@Sun.COM				if (ump == NULL) {
10068SChandrasekar.Marimuthu@Sun.COM					panic("Memory corruption detected: gap "
10068SChandrasekar.Marimuthu@Sun.COM					    "start TSN 0x%x missing from the "
10068SChandrasekar.Marimuthu@Sun.COM					    "xmit list: %p", gapstart,
10068SChandrasekar.Marimuthu@Sun.COM					    (void *)sctp);
10068SChandrasekar.Marimuthu@Sun.COM				}
0Sstevel@tonic-gate				mp = ump->b_cont;
0Sstevel@tonic-gate			}
852Svi117747			/*
852Svi117747			 * mp can't be unsent given the sanity check above.
852Svi117747			 */
852Svi117747			ASSERT(SCTP_CHUNK_ISSENT(mp));
0Sstevel@tonic-gate			sdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			xtsn = ntohl(sdc->sdh_tsn);
0Sstevel@tonic-gate		}
852Svi117747		/*
852Svi117747		 * Now that we have found the chunk with TSN == 'gapstart',
852Svi117747		 * let's walk till we hit the chunk with TSN == 'gapend'.
852Svi117747		 * All intermediate chunks will be marked ACKED, if they
852Svi117747		 * haven't already been.
852Svi117747		 */
0Sstevel@tonic-gate		while (SEQ_LEQ(xtsn, gapend)) {
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * SACKed
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			SCTP_CHUNK_SET_SACKCNT(mp, 0);
0Sstevel@tonic-gate			if (!SCTP_CHUNK_ISACKED(mp)) {
0Sstevel@tonic-gate				SCTP_CHUNK_ACKED(mp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				fp = SCTP_CHUNK_DEST(mp);
0Sstevel@tonic-gate				chunklen = ntohs(sdc->sdh_len);
0Sstevel@tonic-gate				ASSERT(fp->suna >= chunklen);
0Sstevel@tonic-gate				fp->suna -= chunklen;
0Sstevel@tonic-gate				if (fp->suna == 0) {
0Sstevel@tonic-gate					/* All outstanding data acked. */
0Sstevel@tonic-gate					fp->pba = 0;
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_STOP(fp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				fp->acked += chunklen;
0Sstevel@tonic-gate				acked += chunklen;
0Sstevel@tonic-gate				sctp->sctp_unacked -= chunklen - sizeof (*sdc);
0Sstevel@tonic-gate				ASSERT(sctp->sctp_unacked >= 0);
0Sstevel@tonic-gate			}
852Svi117747			/* Go to the next chunk of the current message */
0Sstevel@tonic-gate			mp = mp->b_next;
852Svi117747			/*
852Svi117747			 * Move to the next message in the transmit list
852Svi117747			 * if we are done with all the chunks from the current
852Svi117747			 * message. Note, it is possible to hit the end of the
852Svi117747			 * transmit list here, i.e. if we have already completed
10068SChandrasekar.Marimuthu@Sun.COM			 * processing the gap block.  But the TSN must be equal
10068SChandrasekar.Marimuthu@Sun.COM			 * to the gapend because of the above sanity check.
10068SChandrasekar.Marimuthu@Sun.COM			 * If it is not equal, it means that some data is
10068SChandrasekar.Marimuthu@Sun.COM			 * missing.
852Svi117747			 * Also, note that we break here, which means we
852Svi117747			 * continue processing gap blocks, if any. In case of
852Svi117747			 * ordered gap blocks there can't be any following
852Svi117747			 * this (if there is it will fail the sanity check
852Svi117747			 * above). In case of un-ordered gap blocks we will
852Svi117747			 * switch to sctp_process_uo_gaps().  In either case
852Svi117747			 * it should be fine to continue with NULL ump/mp,
852Svi117747			 * but we just reset it to xmit_head.
852Svi117747			 */
0Sstevel@tonic-gate			if (mp == NULL) {
0Sstevel@tonic-gate				ump = ump->b_next;
0Sstevel@tonic-gate				if (ump == NULL) {
10068SChandrasekar.Marimuthu@Sun.COM					if (xtsn != gapend) {
10068SChandrasekar.Marimuthu@Sun.COM						panic("Memory corruption "
10068SChandrasekar.Marimuthu@Sun.COM						    "detected: gap end TSN "
10068SChandrasekar.Marimuthu@Sun.COM						    "0x%x missing from the "
10068SChandrasekar.Marimuthu@Sun.COM						    "xmit list: %p", gapend,
10068SChandrasekar.Marimuthu@Sun.COM						    (void *)sctp);
10068SChandrasekar.Marimuthu@Sun.COM					}
852Svi117747					ump = sctp->sctp_xmit_head;
852Svi117747					mp = mp1;
852Svi117747					sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747					xtsn = ntohl(sdc->sdh_tsn);
852Svi117747					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				mp = ump->b_cont;
0Sstevel@tonic-gate			}
852Svi117747			/*
852Svi117747			 * Likewise, we could hit an unsent chunk once we have
852Svi117747			 * completed processing the gap block. Again, it is
852Svi117747			 * fine to continue processing gap blocks with mp
852Svi117747			 * pointing to the unsent chunk, because if there
852Svi117747			 * are more ordered gap blocks, they will fail the
852Svi117747			 * sanity check, and if there are un-ordered gap blocks,
852Svi117747			 * we will continue processing in sctp_process_uo_gaps()
852Svi117747			 * We just reset the mp to the one we started with.
852Svi117747			 */
0Sstevel@tonic-gate			if (!SCTP_CHUNK_ISSENT(mp)) {
852Svi117747				ASSERT(xtsn == gapend);
852Svi117747				ump = sctp->sctp_xmit_head;
852Svi117747				mp = mp1;
852Svi117747				sdc = (sctp_data_hdr_t *)mp->b_rptr;
852Svi117747				xtsn = ntohl(sdc->sdh_tsn);
852Svi117747				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			sdc = (sctp_data_hdr_t *)mp->b_rptr;
0Sstevel@tonic-gate			xtsn = ntohl(sdc->sdh_tsn);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (sctp->sctp_prsctp_aware)
0Sstevel@tonic-gate		sctp_check_abandoned_data(sctp, sctp->sctp_current);
0Sstevel@tonic-gate	if (sctp->sctp_chk_fast_rexmit)
0Sstevel@tonic-gate		sctp_fast_rexmit(sctp);
0Sstevel@tonic-gateret:
0Sstevel@tonic-gate	trysend += sctp_set_frwnd(sctp, ntohl(sc->ssc_a_rwnd));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * If receive window is closed while there is unsent data,
0Sstevel@tonic-gate	 * set a timer for doing zero window probes.
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_frwnd == 0 && sctp->sctp_unacked == 0 &&
0Sstevel@tonic-gate	    sctp->sctp_unsent != 0) {
0Sstevel@tonic-gate		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
0Sstevel@tonic-gate		    sctp->sctp_current->rto);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Set cwnd for all destinations.
0Sstevel@tonic-gate	 * Congestion window gets increased only when cumulative
0Sstevel@tonic-gate	 * TSN moves forward, we're not in fast recovery, and
0Sstevel@tonic-gate	 * cwnd has been fully utilized (almost fully, need to allow
0Sstevel@tonic-gate	 * some leeway due to non-MSS sized messages).
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	if (sctp->sctp_current->acked == acked) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Fast-path, only data sent to sctp_current got acked.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		fp = sctp->sctp_current;
0Sstevel@tonic-gate		if (cumack_forward && !fast_recovery &&
0Sstevel@tonic-gate		    (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) {
0Sstevel@tonic-gate			if (fp->cwnd < fp->ssthresh) {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Slow start
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (fp->acked > fp->sfa_pmss) {
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					fp->cwnd += fp->acked;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Congestion avoidance
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				fp->pba += fp->acked;
0Sstevel@tonic-gate				if (fp->pba >= fp->cwnd) {
0Sstevel@tonic-gate					fp->pba -= fp->cwnd;
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate					fp->cwnd = MIN(fp->cwnd,
0Sstevel@tonic-gate					    sctp->sctp_cwnd_max);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * Limit the burst of transmitted data segments.
0Sstevel@tonic-gate		 */
3448Sdh155122		if (fp->suna + sctps->sctps_maxburst * fp->sfa_pmss <
3448Sdh155122		    fp->cwnd) {
3448Sdh155122			fp->cwnd = fp->suna + sctps->sctps_maxburst *
3448Sdh155122			    fp->sfa_pmss;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		fp->acked = 0;
1735Skcpoon		goto check_ss_rxmit;
0Sstevel@tonic-gate	}
1932Svi117747	for (fp = sctp->sctp_faddrs; fp != NULL; fp = fp->next) {
0Sstevel@tonic-gate		if (cumack_forward && fp->acked && !fast_recovery &&
0Sstevel@tonic-gate		    (fp->acked + fp->suna > fp->cwnd - fp->sfa_pmss)) {
0Sstevel@tonic-gate			if (fp->cwnd < fp->ssthresh) {
0Sstevel@tonic-gate				if (fp->acked > fp->sfa_pmss) {
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate				} else {
0Sstevel@tonic-gate					fp->cwnd += fp->acked;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				fp->cwnd = MIN(fp->cwnd, sctp->sctp_cwnd_max);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				fp->pba += fp->acked;
0Sstevel@tonic-gate				if (fp->pba >= fp->cwnd) {
0Sstevel@tonic-gate					fp->pba -= fp->cwnd;
0Sstevel@tonic-gate					fp->cwnd += fp->sfa_pmss;
0Sstevel@tonic-gate					fp->cwnd = MIN(fp->cwnd,
0Sstevel@tonic-gate					    sctp->sctp_cwnd_max);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
3448Sdh155122		if (fp->suna + sctps->sctps_maxburst * fp->sfa_pmss <
3448Sdh155122		    fp->cwnd) {
3448Sdh155122			fp->cwnd = fp->suna + sctps->sctps_maxburst *
3448Sdh155122			    fp->sfa_pmss;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		fp->acked = 0;
0Sstevel@tonic-gate	}
4311Svi117747	fp = sctp->sctp_current;
1735Skcpooncheck_ss_rxmit:
1735Skcpoon	/*
1735Skcpoon	 * If this is a SACK following a timeout, check if there are
1735Skcpoon	 * still unacked chunks (sent before the timeout) that we can
1735Skcpoon	 * send.
1735Skcpoon	 */
1735Skcpoon	if (sctp->sctp_rexmitting) {
1735Skcpoon		if (SEQ_LT(sctp->sctp_lastack_rxd, sctp->sctp_rxt_maxtsn)) {
1735Skcpoon			/*
1735Skcpoon			 * As we are in retransmission phase, we may get a
1735Skcpoon			 * SACK which indicates some new chunks are received
1735Skcpoon			 * but cum_tsn does not advance.  During this
1735Skcpoon			 * phase, the other side advances cum_tsn only because
1735Skcpoon			 * it receives our retransmitted chunks.  Only
1735Skcpoon			 * this signals that some chunks are still
1735Skcpoon			 * missing.
1735Skcpoon			 */
3795Skcpoon			if (cumack_forward) {
3795Skcpoon				fp->rxt_unacked -= acked;
1735Skcpoon				sctp_ss_rexmit(sctp);
3795Skcpoon			}
1735Skcpoon		} else {
1735Skcpoon			sctp->sctp_rexmitting = B_FALSE;
1735Skcpoon			sctp->sctp_rxt_nxttsn = sctp->sctp_ltsn;
1735Skcpoon			sctp->sctp_rxt_maxtsn = sctp->sctp_ltsn;
3795Skcpoon			fp->rxt_unacked = 0;
1735Skcpoon		}
1735Skcpoon	}
0Sstevel@tonic-gate	return (trysend);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Returns 0 if the caller should stop processing any more chunks,
0Sstevel@tonic-gate * 1 if the caller should skip this chunk and continue processing.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_strange_chunk(sctp_t *sctp, sctp_chunk_hdr_t *ch, sctp_faddr_t *fp)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	size_t len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate	/* check top two bits for action required */
0Sstevel@tonic-gate	if (ch->sch_id & 0x40) {	/* also matches 0xc0 */
0Sstevel@tonic-gate		len = ntohs(ch->sch_len);
4964Skcpoon		sctp_add_err(sctp, SCTP_ERR_UNREC_CHUNK, ch, len, fp);
4964Skcpoon
0Sstevel@tonic-gate		if ((ch->sch_id & 0xc0) == 0xc0) {
0Sstevel@tonic-gate			/* skip and continue */
0Sstevel@tonic-gate			return (1);
0Sstevel@tonic-gate		} else {
0Sstevel@tonic-gate			/* stop processing */
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	if (ch->sch_id & 0x80) {
0Sstevel@tonic-gate		/* skip and continue, no error */
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* top two bits are clear; stop processing and no error */
0Sstevel@tonic-gate	return (0);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Basic sanity checks on all input chunks and parameters: they must
0Sstevel@tonic-gate * be of legitimate size for their purported type, and must follow
0Sstevel@tonic-gate * ordering conventions as defined in rfc2960.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * Returns 1 if the chunk and all encloded params are legitimate,
0Sstevel@tonic-gate * 0 otherwise.
0Sstevel@tonic-gate */
0Sstevel@tonic-gate/*ARGSUSED*/
0Sstevel@tonic-gatestatic int
0Sstevel@tonic-gatesctp_check_input(sctp_t *sctp, sctp_chunk_hdr_t *ch, ssize_t len, int first)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_parm_hdr_t	*ph;
0Sstevel@tonic-gate	void		*p = NULL;
0Sstevel@tonic-gate	ssize_t		clen;
0Sstevel@tonic-gate	uint16_t	ch_len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ch_len = ntohs(ch->sch_len);
0Sstevel@tonic-gate	if (ch_len > len) {
0Sstevel@tonic-gate		return (0);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	switch (ch->sch_id) {
0Sstevel@tonic-gate	case CHUNK_DATA:
0Sstevel@tonic-gate		if (ch_len < sizeof (sctp_data_hdr_t)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_INIT:
0Sstevel@tonic-gate	case CHUNK_INIT_ACK:
0Sstevel@tonic-gate		{
0Sstevel@tonic-gate			ssize_t	remlen = len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * INIT and INIT-ACK chunks must not be bundled with
0Sstevel@tonic-gate			 * any other.
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (!first || sctp_next_chunk(ch, &remlen) != NULL ||
0Sstevel@tonic-gate			    (ch_len < (sizeof (*ch) +
0Sstevel@tonic-gate			    sizeof (sctp_init_chunk_t)))) {
0Sstevel@tonic-gate				return (0);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/* may have params that need checking */
0Sstevel@tonic-gate			p = (char *)(ch + 1) + sizeof (sctp_init_chunk_t);
0Sstevel@tonic-gate			clen = ch_len - (sizeof (*ch) +
0Sstevel@tonic-gate			    sizeof (sctp_init_chunk_t));
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SACK:
0Sstevel@tonic-gate		if (ch_len < (sizeof (*ch) + sizeof (sctp_sack_chunk_t))) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* dup and gap reports checked by got_sack() */
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN:
0Sstevel@tonic-gate		if (ch_len < (sizeof (*ch) + sizeof (uint32_t))) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_ABORT:
0Sstevel@tonic-gate	case CHUNK_ERROR:
0Sstevel@tonic-gate		if (ch_len < sizeof (*ch)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* may have params that need checking */
0Sstevel@tonic-gate		p = ch + 1;
0Sstevel@tonic-gate		clen = ch_len - sizeof (*ch);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_ECNE:
0Sstevel@tonic-gate	case CHUNK_CWR:
0Sstevel@tonic-gate	case CHUNK_HEARTBEAT:
0Sstevel@tonic-gate	case CHUNK_HEARTBEAT_ACK:
0Sstevel@tonic-gate	/* Full ASCONF chunk and parameter checks are in asconf.c */
0Sstevel@tonic-gate	case CHUNK_ASCONF:
0Sstevel@tonic-gate	case CHUNK_ASCONF_ACK:
0Sstevel@tonic-gate		if (ch_len < sizeof (*ch)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* heartbeat data checked by process_heartbeat() */
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate		{
0Sstevel@tonic-gate			ssize_t remlen = len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate			/*
0Sstevel@tonic-gate			 * SHUTDOWN-COMPLETE chunk must not be bundled with any
0Sstevel@tonic-gate			 * other
0Sstevel@tonic-gate			 */
0Sstevel@tonic-gate			if (!first || sctp_next_chunk(ch, &remlen) != NULL ||
0Sstevel@tonic-gate			    ch_len < sizeof (*ch)) {
0Sstevel@tonic-gate				return (0);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_COOKIE:
0Sstevel@tonic-gate	case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate		if (ch_len < sizeof (*ch) || !first) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	case CHUNK_FORWARD_TSN:
0Sstevel@tonic-gate		if (ch_len < (sizeof (*ch) + sizeof (uint32_t)))
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	default:
0Sstevel@tonic-gate		return (1);	/* handled by strange_chunk() */
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* check and byteorder parameters */
0Sstevel@tonic-gate	if (clen <= 0) {
0Sstevel@tonic-gate		return (1);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ASSERT(p != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ph = p;
0Sstevel@tonic-gate	while (ph != NULL && clen > 0) {
0Sstevel@tonic-gate		ch_len = ntohs(ph->sph_len);
0Sstevel@tonic-gate		if (ch_len > len || ch_len < sizeof (*ph)) {
0Sstevel@tonic-gate			return (0);
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		ph = sctp_next_parm(ph, &clen);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* All OK */
0Sstevel@tonic-gate	return (1);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COMstatic mblk_t *
*11042SErik.Nordmark@Sun.COMsctp_check_in_policy(mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	boolean_t policy_present;
0Sstevel@tonic-gate	ipha_t *ipha;
0Sstevel@tonic-gate	ip6_t *ip6h;
*11042SErik.Nordmark@Sun.COM	netstack_t	*ns = ipst->ips_netstack;
*11042SErik.Nordmark@Sun.COM	ipsec_stack_t	*ipss = ns->netstack_ipsec;
*11042SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate	if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
3448Sdh155122		policy_present = ipss->ipsec_inbound_v4_policy_present;
0Sstevel@tonic-gate		ipha = (ipha_t *)mp->b_rptr;
0Sstevel@tonic-gate		ip6h = NULL;
0Sstevel@tonic-gate	} else {
3448Sdh155122		policy_present = ipss->ipsec_inbound_v6_policy_present;
0Sstevel@tonic-gate		ipha = NULL;
0Sstevel@tonic-gate		ip6h = (ip6_t *)mp->b_rptr;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM	if (policy_present) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * The conn_t parameter is NULL because we already know
0Sstevel@tonic-gate		 * nobody's home.
0Sstevel@tonic-gate		 */
*11042SErik.Nordmark@Sun.COM		mp = ipsec_check_global_policy(mp, (conn_t *)NULL,
*11042SErik.Nordmark@Sun.COM		    ipha, ip6h, ira, ns);
*11042SErik.Nordmark@Sun.COM		if (mp == NULL)
0Sstevel@tonic-gate			return (NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	return (mp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/* Handle out-of-the-blue packets */
0Sstevel@tonic-gatevoid
*11042SErik.Nordmark@Sun.COMsctp_ootb_input(mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_t			*sctp;
0Sstevel@tonic-gate	sctp_chunk_hdr_t	*ch;
0Sstevel@tonic-gate	sctp_hdr_t		*sctph;
0Sstevel@tonic-gate	in6_addr_t		src, dst;
*11042SErik.Nordmark@Sun.COM	uint_t			ip_hdr_len = ira->ira_ip_hdr_length;
0Sstevel@tonic-gate	ssize_t			mlen;
3448Sdh155122	sctp_stack_t		*sctps;
*11042SErik.Nordmark@Sun.COM	boolean_t		secure;
*11042SErik.Nordmark@Sun.COM	zoneid_t		zoneid = ira->ira_zoneid;
*11042SErik.Nordmark@Sun.COM	uchar_t			*rptr;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	ASSERT(ira->ira_ill == NULL);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	secure = ira->ira_flags & IRAF_IPSEC_SECURE;
*11042SErik.Nordmark@Sun.COM
3448Sdh155122	sctps = ipst->ips_netstack->netstack_sctp;
3448Sdh155122
3448Sdh155122	BUMP_MIB(&sctps->sctps_mib, sctpOutOfBlue);
3448Sdh155122	BUMP_MIB(&sctps->sctps_mib, sctpInSCTPPkts);
3448Sdh155122
0Sstevel@tonic-gate	if (mp->b_cont != NULL) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * All subsequent code is vastly simplified if it can
0Sstevel@tonic-gate		 * assume a single contiguous chunk of data.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (pullupmsg(mp, -1) == 0) {
*11042SErik.Nordmark@Sun.COM			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
*11042SErik.Nordmark@Sun.COM			ip_drop_input("ipIfStatsInDiscards", mp, NULL);
*11042SErik.Nordmark@Sun.COM			freemsg(mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM	rptr = mp->b_rptr;
*11042SErik.Nordmark@Sun.COM	sctph = ((sctp_hdr_t *)&rptr[ip_hdr_len]);
*11042SErik.Nordmark@Sun.COM	if (ira->ira_flags & IRAF_IS_IPV4) {
*11042SErik.Nordmark@Sun.COM		ipha_t *ipha;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		ipha = (ipha_t *)rptr;
*11042SErik.Nordmark@Sun.COM		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &src);
*11042SErik.Nordmark@Sun.COM		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &dst);
*11042SErik.Nordmark@Sun.COM	} else {
*11042SErik.Nordmark@Sun.COM		ip6_t *ip6h;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		ip6h = (ip6_t *)rptr;
*11042SErik.Nordmark@Sun.COM		src = ip6h->ip6_src;
*11042SErik.Nordmark@Sun.COM		dst = ip6h->ip6_dst;
*11042SErik.Nordmark@Sun.COM	}
*11042SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate	mlen = mp->b_wptr - (uchar_t *)(sctph + 1);
0Sstevel@tonic-gate	if ((ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen)) == NULL) {
0Sstevel@tonic-gate		dprint(3, ("sctp_ootb_input: invalid packet\n"));
*11042SErik.Nordmark@Sun.COM		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
*11042SErik.Nordmark@Sun.COM		ip_drop_input("ipIfStatsInDiscards", mp, NULL);
*11042SErik.Nordmark@Sun.COM		freemsg(mp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	switch (ch->sch_id) {
0Sstevel@tonic-gate	case CHUNK_INIT:
0Sstevel@tonic-gate		/* no listener; send abort  */
*11042SErik.Nordmark@Sun.COM		if (secure && sctp_check_in_policy(mp, ira, ipst) == NULL)
0Sstevel@tonic-gate			return;
*11042SErik.Nordmark@Sun.COM		sctp_ootb_send_abort(sctp_init2vtag(ch), 0,
*11042SErik.Nordmark@Sun.COM		    NULL, 0, mp, 0, B_TRUE, ira, ipst);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_INIT_ACK:
0Sstevel@tonic-gate		/* check for changed src addr */
3510Svi117747		sctp = sctp_addrlist2sctp(mp, sctph, ch, zoneid, sctps);
0Sstevel@tonic-gate		if (sctp != NULL) {
0Sstevel@tonic-gate			/* success; proceed to normal path */
0Sstevel@tonic-gate			mutex_enter(&sctp->sctp_lock);
0Sstevel@tonic-gate			if (sctp->sctp_running) {
*11042SErik.Nordmark@Sun.COM				sctp_add_recvq(sctp, mp, B_FALSE, ira);
0Sstevel@tonic-gate				mutex_exit(&sctp->sctp_lock);
0Sstevel@tonic-gate			} else {
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * If the source address is changed, we
0Sstevel@tonic-gate				 * don't need to worry too much about
0Sstevel@tonic-gate				 * out of order processing.  So we don't
0Sstevel@tonic-gate				 * check if the recvq is empty or not here.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp->sctp_running = B_TRUE;
0Sstevel@tonic-gate				mutex_exit(&sctp->sctp_lock);
*11042SErik.Nordmark@Sun.COM				sctp_input_data(sctp, mp, ira);
0Sstevel@tonic-gate				WAKE_SCTP(sctp);
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* else bogus init ack; drop it */
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_ACK:
*11042SErik.Nordmark@Sun.COM		if (secure && sctp_check_in_policy(mp, ira, ipst) == NULL)
0Sstevel@tonic-gate			return;
*11042SErik.Nordmark@Sun.COM		sctp_ootb_shutdown_ack(mp, ip_hdr_len, ira, ipst);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	case CHUNK_ERROR:
0Sstevel@tonic-gate	case CHUNK_ABORT:
0Sstevel@tonic-gate	case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	default:
*11042SErik.Nordmark@Sun.COM		if (secure && sctp_check_in_policy(mp, ira, ipst) == NULL)
0Sstevel@tonic-gate			return;
*11042SErik.Nordmark@Sun.COM		sctp_ootb_send_abort(sctph->sh_verf, 0,
*11042SErik.Nordmark@Sun.COM		    NULL, 0, mp, 0, B_TRUE, ira, ipst);
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	freemsg(mp);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM/*
*11042SErik.Nordmark@Sun.COM * Handle sctp packets.
*11042SErik.Nordmark@Sun.COM * Note that we rele the sctp_t (the caller got a reference on it).
*11042SErik.Nordmark@Sun.COM */
0Sstevel@tonic-gatevoid
*11042SErik.Nordmark@Sun.COMsctp_input(conn_t *connp, ipha_t *ipha, ip6_t *ip6h, mblk_t *mp,
*11042SErik.Nordmark@Sun.COM    ip_recv_attr_t *ira)
0Sstevel@tonic-gate{
*11042SErik.Nordmark@Sun.COM	sctp_t		*sctp = CONN2SCTP(connp);
*11042SErik.Nordmark@Sun.COM	boolean_t	secure;
*11042SErik.Nordmark@Sun.COM	ill_t		*ill = ira->ira_ill;
*11042SErik.Nordmark@Sun.COM	ip_stack_t	*ipst = ill->ill_ipst;
3448Sdh155122	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
*11042SErik.Nordmark@Sun.COM	iaflags_t	iraflags = ira->ira_flags;
*11042SErik.Nordmark@Sun.COM	ill_t		*rill = ira->ira_rill;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	secure = iraflags & IRAF_IPSEC_SECURE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * We check some fields in conn_t without holding a lock.
0Sstevel@tonic-gate	 * This should be fine.
0Sstevel@tonic-gate	 */
*11042SErik.Nordmark@Sun.COM	if (((iraflags & IRAF_IS_IPV4) ?
*11042SErik.Nordmark@Sun.COM	    CONN_INBOUND_POLICY_PRESENT(connp, ipss) :
*11042SErik.Nordmark@Sun.COM	    CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss)) ||
*11042SErik.Nordmark@Sun.COM	    secure) {
*11042SErik.Nordmark@Sun.COM		mp = ipsec_check_inbound_policy(mp, connp, ipha,
*11042SErik.Nordmark@Sun.COM		    ip6h, ira);
*11042SErik.Nordmark@Sun.COM		if (mp == NULL) {
*11042SErik.Nordmark@Sun.COM			BUMP_MIB(ill->ill_ip_mib, ipIfStatsInDiscards);
*11042SErik.Nordmark@Sun.COM			/* Note that mp is NULL */
*11042SErik.Nordmark@Sun.COM			ip_drop_input("ipIfStatsInDiscards", mp, ill);
0Sstevel@tonic-gate			SCTP_REFRELE(sctp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
*11042SErik.Nordmark@Sun.COM	ira->ira_ill = ira->ira_rill = NULL;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	mutex_enter(&sctp->sctp_lock);
0Sstevel@tonic-gate	if (sctp->sctp_running) {
*11042SErik.Nordmark@Sun.COM		sctp_add_recvq(sctp, mp, B_FALSE, ira);
0Sstevel@tonic-gate		mutex_exit(&sctp->sctp_lock);
*11042SErik.Nordmark@Sun.COM		goto done;
0Sstevel@tonic-gate	} else {
0Sstevel@tonic-gate		sctp->sctp_running = B_TRUE;
0Sstevel@tonic-gate		mutex_exit(&sctp->sctp_lock);
0Sstevel@tonic-gate
0Sstevel@tonic-gate		mutex_enter(&sctp->sctp_recvq_lock);
0Sstevel@tonic-gate		if (sctp->sctp_recvq != NULL) {
*11042SErik.Nordmark@Sun.COM			sctp_add_recvq(sctp, mp, B_TRUE, ira);
0Sstevel@tonic-gate			mutex_exit(&sctp->sctp_recvq_lock);
0Sstevel@tonic-gate			WAKE_SCTP(sctp);
*11042SErik.Nordmark@Sun.COM			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	mutex_exit(&sctp->sctp_recvq_lock);
*11042SErik.Nordmark@Sun.COM	if (ira->ira_flags & IRAF_ICMP_ERROR)
*11042SErik.Nordmark@Sun.COM		sctp_icmp_error(sctp, mp);
*11042SErik.Nordmark@Sun.COM	else
*11042SErik.Nordmark@Sun.COM		sctp_input_data(sctp, mp, ira);
0Sstevel@tonic-gate	WAKE_SCTP(sctp);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COMdone:
0Sstevel@tonic-gate	SCTP_REFRELE(sctp);
*11042SErik.Nordmark@Sun.COM	ira->ira_ill = ill;
*11042SErik.Nordmark@Sun.COM	ira->ira_rill = rill;
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatestatic void
0Sstevel@tonic-gatesctp_process_abort(sctp_t *sctp, sctp_chunk_hdr_t *ch, int err)
0Sstevel@tonic-gate{
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
3448Sdh155122
3448Sdh155122	BUMP_MIB(&sctps->sctps_mib, sctpAborted);
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	sctp_assoc_event(sctp, SCTP_COMM_LOST,
0Sstevel@tonic-gate	    ntohs(((sctp_parm_hdr_t *)(ch + 1))->sph_type), ch);
0Sstevel@tonic-gate	sctp_clean_death(sctp, err);
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gatevoid
*11042SErik.Nordmark@Sun.COMsctp_input_data(sctp_t *sctp, mblk_t *mp, ip_recv_attr_t *ira)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	sctp_chunk_hdr_t	*ch;
0Sstevel@tonic-gate	ssize_t			mlen;
0Sstevel@tonic-gate	int			gotdata;
0Sstevel@tonic-gate	int			trysend;
0Sstevel@tonic-gate	sctp_faddr_t		*fp;
0Sstevel@tonic-gate	sctp_init_chunk_t	*iack;
0Sstevel@tonic-gate	uint32_t		tsn;
0Sstevel@tonic-gate	sctp_data_hdr_t		*sdc;
*11042SErik.Nordmark@Sun.COM	ip_pkt_t		ipp;
0Sstevel@tonic-gate	in6_addr_t		src;
0Sstevel@tonic-gate	in6_addr_t		dst;
0Sstevel@tonic-gate	uint_t			ifindex;
0Sstevel@tonic-gate	sctp_hdr_t		*sctph;
*11042SErik.Nordmark@Sun.COM	uint_t			ip_hdr_len = ira->ira_ip_hdr_length;
0Sstevel@tonic-gate	mblk_t			*dups = NULL;
5586Skcpoon	int			recv_adaptation;
0Sstevel@tonic-gate	boolean_t		wake_eager = B_FALSE;
0Sstevel@tonic-gate	in6_addr_t		peer_src;
0Sstevel@tonic-gate	int64_t			now;
3448Sdh155122	sctp_stack_t		*sctps = sctp->sctp_sctps;
3448Sdh155122	ip_stack_t		*ipst = sctps->sctps_netstack->netstack_ip;
4964Skcpoon	boolean_t		hb_already = B_FALSE;
8778SErik.Nordmark@Sun.COM	cred_t			*cr;
8778SErik.Nordmark@Sun.COM	pid_t			cpid;
*11042SErik.Nordmark@Sun.COM	uchar_t			*rptr;
*11042SErik.Nordmark@Sun.COM	conn_t			*connp = sctp->sctp_connp;
*11042SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate	ASSERT(DB_TYPE(mp) == M_DATA);
*11042SErik.Nordmark@Sun.COM	ASSERT(ira->ira_ill == NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (mp->b_cont != NULL) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * All subsequent code is vastly simplified if it can
0Sstevel@tonic-gate		 * assume a single contiguous chunk of data.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (pullupmsg(mp, -1) == 0) {
3448Sdh155122			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
*11042SErik.Nordmark@Sun.COM			ip_drop_input("ipIfStatsInDiscards", mp, NULL);
0Sstevel@tonic-gate			freemsg(mp);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	BUMP_LOCAL(sctp->sctp_ipkts);
*11042SErik.Nordmark@Sun.COM	ifindex = ira->ira_ruifindex;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	rptr = mp->b_rptr;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	ipp.ipp_fields = 0;
*11042SErik.Nordmark@Sun.COM	if (connp->conn_recv_ancillary.crb_all != 0) {
*11042SErik.Nordmark@Sun.COM		/*
*11042SErik.Nordmark@Sun.COM		 * Record packet information in the ip_pkt_t
*11042SErik.Nordmark@Sun.COM		 */
*11042SErik.Nordmark@Sun.COM		if (ira->ira_flags & IRAF_IS_IPV4) {
*11042SErik.Nordmark@Sun.COM			(void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
*11042SErik.Nordmark@Sun.COM			    B_FALSE);
*11042SErik.Nordmark@Sun.COM		} else {
*11042SErik.Nordmark@Sun.COM			uint8_t nexthdrp;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM			/*
*11042SErik.Nordmark@Sun.COM			 * IPv6 packets can only be received by applications
*11042SErik.Nordmark@Sun.COM			 * that are prepared to receive IPv6 addresses.
*11042SErik.Nordmark@Sun.COM			 * The IP fanout must ensure this.
*11042SErik.Nordmark@Sun.COM			 */
*11042SErik.Nordmark@Sun.COM			ASSERT(connp->conn_family == AF_INET6);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM			(void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
*11042SErik.Nordmark@Sun.COM			    &nexthdrp);
*11042SErik.Nordmark@Sun.COM			ASSERT(nexthdrp == IPPROTO_SCTP);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM			/* Could have caused a pullup? */
*11042SErik.Nordmark@Sun.COM			rptr = mp->b_rptr;
*11042SErik.Nordmark@Sun.COM		}
*11042SErik.Nordmark@Sun.COM	}
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	sctph = ((sctp_hdr_t *)&rptr[ip_hdr_len]);
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM	if (ira->ira_flags & IRAF_IS_IPV4) {
*11042SErik.Nordmark@Sun.COM		ipha_t *ipha;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		ipha = (ipha_t *)rptr;
*11042SErik.Nordmark@Sun.COM		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &src);
*11042SErik.Nordmark@Sun.COM		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &dst);
*11042SErik.Nordmark@Sun.COM	} else {
*11042SErik.Nordmark@Sun.COM		ip6_t *ip6h;
*11042SErik.Nordmark@Sun.COM
*11042SErik.Nordmark@Sun.COM		ip6h = (ip6_t *)rptr;
*11042SErik.Nordmark@Sun.COM		src = ip6h->ip6_src;
*11042SErik.Nordmark@Sun.COM		dst = ip6h->ip6_dst;
*11042SErik.Nordmark@Sun.COM	}
*11042SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate	mlen = mp->b_wptr - (uchar_t *)(sctph + 1);
0Sstevel@tonic-gate	ch = sctp_first_chunk((uchar_t *)(sctph + 1), mlen);
0Sstevel@tonic-gate	if (ch == NULL) {
3448Sdh155122		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
*11042SErik.Nordmark@Sun.COM		ip_drop_input("ipIfStatsInDiscards", mp, NULL);
0Sstevel@tonic-gate		freemsg(mp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (!sctp_check_input(sctp, ch, mlen, 1)) {
3448Sdh155122		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
*11042SErik.Nordmark@Sun.COM		ip_drop_input("ipIfStatsInDiscards", mp, NULL);
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/*
0Sstevel@tonic-gate	 * Check verfication tag (special handling for INIT,
0Sstevel@tonic-gate	 * COOKIE, SHUTDOWN_COMPLETE and SHUTDOWN_ACK chunks).
0Sstevel@tonic-gate	 * ABORTs are handled in the chunk processing loop, since
0Sstevel@tonic-gate	 * may not appear first. All other checked chunks must
0Sstevel@tonic-gate	 * appear first, or will have been dropped by check_input().
0Sstevel@tonic-gate	 */
0Sstevel@tonic-gate	switch (ch->sch_id) {
0Sstevel@tonic-gate	case CHUNK_INIT:
0Sstevel@tonic-gate		if (sctph->sh_verf != 0) {
0Sstevel@tonic-gate			/* drop it */
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate		if (sctph->sh_verf == sctp->sctp_lvtag)
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		if (sctph->sh_verf == sctp->sctp_fvtag &&
0Sstevel@tonic-gate		    SCTP_GET_TBIT(ch)) {
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* else drop it */
0Sstevel@tonic-gate		goto done;
0Sstevel@tonic-gate	case CHUNK_ABORT:
0Sstevel@tonic-gate	case CHUNK_COOKIE:
0Sstevel@tonic-gate		/* handled below */
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate		if (sctp->sctp_state > SCTPS_BOUND &&
0Sstevel@tonic-gate		    sctp->sctp_state < SCTPS_ESTABLISHED) {
0Sstevel@tonic-gate			/* treat as OOTB */
*11042SErik.Nordmark@Sun.COM			sctp_ootb_shutdown_ack(mp, ip_hdr_len, ira, ipst);
0Sstevel@tonic-gate			return;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		/* else fallthru */
0Sstevel@tonic-gate	default:
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * All other packets must have a valid
0Sstevel@tonic-gate		 * verification tag, however if this is a
0Sstevel@tonic-gate		 * listener, we use a refined version of
0Sstevel@tonic-gate		 * out-of-the-blue logic.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		if (sctph->sh_verf != sctp->sctp_lvtag &&
0Sstevel@tonic-gate		    sctp->sctp_state != SCTPS_LISTEN) {
0Sstevel@tonic-gate			/* drop it */
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate		break;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Have a valid sctp for this packet */
0Sstevel@tonic-gate	fp = sctp_lookup_faddr(sctp, &src);
1676Sjpk	dprint(2, ("sctp_dispatch_rput: mp=%p fp=%p sctp=%p\n", (void *)mp,
1676Sjpk	    (void *)fp, (void *)sctp));
0Sstevel@tonic-gate
0Sstevel@tonic-gate	gotdata = 0;
0Sstevel@tonic-gate	trysend = 0;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	now = lbolt64;
0Sstevel@tonic-gate	/* Process the chunks */
0Sstevel@tonic-gate	do {
0Sstevel@tonic-gate		dprint(3, ("sctp_dispatch_rput: state=%d, chunk id=%d\n",
0Sstevel@tonic-gate		    sctp->sctp_state, (int)(ch->sch_id)));
0Sstevel@tonic-gate
0Sstevel@tonic-gate		if (ch->sch_id == CHUNK_ABORT) {
0Sstevel@tonic-gate			if (sctph->sh_verf != sctp->sctp_lvtag &&
0Sstevel@tonic-gate			    sctph->sh_verf != sctp->sctp_fvtag) {
0Sstevel@tonic-gate				/* drop it */
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate
0Sstevel@tonic-gate		switch (sctp->sctp_state) {
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_ESTABLISHED:
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_PENDING:
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_SENT:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_DATA:
0Sstevel@tonic-gate				/* 0-length data chunks are not allowed */
0Sstevel@tonic-gate				if (ntohs(ch->sch_len) == sizeof (*sdc)) {
0Sstevel@tonic-gate					sdc = (sctp_data_hdr_t *)ch;
0Sstevel@tonic-gate					tsn = sdc->sdh_tsn;
0Sstevel@tonic-gate					sctp_send_abort(sctp, sctp->sctp_fvtag,
0Sstevel@tonic-gate					    SCTP_ERR_NO_USR_DATA, (char *)&tsn,
*11042SErik.Nordmark@Sun.COM					    sizeof (tsn), mp, 0, B_FALSE, ira);
0Sstevel@tonic-gate					sctp_assoc_event(sctp, SCTP_COMM_LOST,
0Sstevel@tonic-gate					    0, NULL);
0Sstevel@tonic-gate					sctp_clean_death(sctp, ECONNABORTED);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp->sctp_lastdata = fp;
*11042SErik.Nordmark@Sun.COM				sctp_data_chunk(sctp, ch, mp, &dups, fp,
*11042SErik.Nordmark@Sun.COM				    &ipp, ira);
0Sstevel@tonic-gate				gotdata = 1;
0Sstevel@tonic-gate				/* Restart shutdown timer if shutting down */
0Sstevel@tonic-gate				if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * If we have exceeded our max
0Sstevel@tonic-gate					 * wait bound for waiting for a
0Sstevel@tonic-gate					 * shutdown ack from the peer,
0Sstevel@tonic-gate					 * abort the association.
0Sstevel@tonic-gate					 */
3448Sdh155122					if (sctps->sctps_shutack_wait_bound !=
3448Sdh155122					    0 &&
0Sstevel@tonic-gate					    TICK_TO_MSEC(now -
0Sstevel@tonic-gate					    sctp->sctp_out_time) >
3448Sdh155122					    sctps->sctps_shutack_wait_bound) {
0Sstevel@tonic-gate						sctp_send_abort(sctp,
0Sstevel@tonic-gate						    sctp->sctp_fvtag, 0, NULL,
*11042SErik.Nordmark@Sun.COM						    0, mp, 0, B_FALSE, ira);
0Sstevel@tonic-gate						sctp_assoc_event(sctp,
0Sstevel@tonic-gate						    SCTP_COMM_LOST, 0, NULL);
0Sstevel@tonic-gate						sctp_clean_death(sctp,
0Sstevel@tonic-gate						    ECONNABORTED);
0Sstevel@tonic-gate						goto done;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate					SCTP_FADDR_TIMER_RESTART(sctp, fp,
0Sstevel@tonic-gate					    fp->rto);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SACK:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Peer is real and alive if it can ack our
0Sstevel@tonic-gate				 * data.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate				trysend = sctp_got_sack(sctp, ch);
852Svi117747				if (trysend < 0) {
852Svi117747					sctp_send_abort(sctp, sctph->sh_verf,
*11042SErik.Nordmark@Sun.COM					    0, NULL, 0, mp, 0, B_FALSE, ira);
852Svi117747					sctp_assoc_event(sctp,
852Svi117747					    SCTP_COMM_LOST, 0, NULL);
852Svi117747					sctp_clean_death(sctp,
852Svi117747					    ECONNABORTED);
852Svi117747					goto done;
852Svi117747				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
4964Skcpoon				if (!hb_already) {
4964Skcpoon					/*
4964Skcpoon					 * In any one packet, there should
4964Skcpoon					 * only be one heartbeat chunk.  So
4964Skcpoon					 * we should not process more than
4964Skcpoon					 * once.
4964Skcpoon					 */
4964Skcpoon					sctp_return_heartbeat(sctp, ch, mp);
4964Skcpoon					hb_already = B_TRUE;
4964Skcpoon				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT_ACK:
0Sstevel@tonic-gate				sctp_process_heartbeat(sctp, ch);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN:
0Sstevel@tonic-gate				sctp_shutdown_event(sctp);
0Sstevel@tonic-gate				trysend = sctp_shutdown_received(sctp, ch,
1735Skcpoon				    B_FALSE, B_FALSE, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				if (sctp->sctp_state == SCTPS_SHUTDOWN_SENT) {
0Sstevel@tonic-gate					sctp_shutdown_complete(sctp);
3448Sdh155122					BUMP_MIB(&sctps->sctps_mib,
3448Sdh155122					    sctpShutdowns);
0Sstevel@tonic-gate					sctp_assoc_event(sctp,
0Sstevel@tonic-gate					    SCTP_SHUTDOWN_COMP, 0, NULL);
0Sstevel@tonic-gate					sctp_clean_death(sctp, 0);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT: {
0Sstevel@tonic-gate				sctp_saddr_ipif_t *sp;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Ignore if delete pending */
852Svi117747				sp = sctp_saddr_lookup(sctp, &dst, 0);
0Sstevel@tonic-gate				ASSERT(sp != NULL);
0Sstevel@tonic-gate				if (sp->saddr_ipif_delete_pending) {
0Sstevel@tonic-gate					BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNRESET);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			case CHUNK_INIT:
*11042SErik.Nordmark@Sun.COM				sctp_send_initack(sctp, sctph, ch, mp, ira);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
*11042SErik.Nordmark@Sun.COM				    sctph, &recv_adaptation, NULL, ira) != -1) {
0Sstevel@tonic-gate					sctp_send_cookie_ack(sctp);
0Sstevel@tonic-gate					sctp_assoc_event(sctp, SCTP_RESTART,
0Sstevel@tonic-gate					    0, NULL);
5586Skcpoon					if (recv_adaptation) {
5586Skcpoon						sctp->sctp_recv_adaptation = 1;
5586Skcpoon						sctp_adaptation_event(sctp);
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate				} else {
3448Sdh155122					BUMP_MIB(&sctps->sctps_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ERROR: {
0Sstevel@tonic-gate				int error;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
*11042SErik.Nordmark@Sun.COM				error = sctp_handle_error(sctp, sctph, ch, mp,
*11042SErik.Nordmark@Sun.COM				    ira);
0Sstevel@tonic-gate				if (error != 0) {
3314Skcpoon					sctp_assoc_event(sctp, SCTP_COMM_LOST,
3314Skcpoon					    0, NULL);
0Sstevel@tonic-gate					sctp_clean_death(sctp, error);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			case CHUNK_ASCONF:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp_input_asconf(sctp, ch, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ASCONF_ACK:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate				sctp_input_asconf_ack(sctp, ch, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_FORWARD_TSN:
0Sstevel@tonic-gate				ASSERT(fp != NULL);
0Sstevel@tonic-gate				sctp->sctp_lastdata = fp;
*11042SErik.Nordmark@Sun.COM				sctp_process_forward_tsn(sctp, ch, fp,
*11042SErik.Nordmark@Sun.COM				    &ipp, ira);
0Sstevel@tonic-gate				gotdata = 1;
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_LISTEN:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_INIT:
*11042SErik.Nordmark@Sun.COM				sctp_send_initack(sctp, sctph, ch, mp, ira);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_COOKIE: {
0Sstevel@tonic-gate				sctp_t *eager;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
*11042SErik.Nordmark@Sun.COM				    sctph, &recv_adaptation, &peer_src,
*11042SErik.Nordmark@Sun.COM				    ira) == -1) {
3448Sdh155122					BUMP_MIB(&sctps->sctps_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * The cookie is good; ensure that
0Sstevel@tonic-gate				 * the peer used the verification
0Sstevel@tonic-gate				 * tag from the init ack in the header.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (iack->sic_inittag != sctph->sh_verf)
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				eager = sctp_conn_request(sctp, mp, ifindex,
*11042SErik.Nordmark@Sun.COM				    ip_hdr_len, iack, ira);
0Sstevel@tonic-gate				if (eager == NULL) {
0Sstevel@tonic-gate					sctp_send_abort(sctp, sctph->sh_verf,
0Sstevel@tonic-gate					    SCTP_ERR_NO_RESOURCES, NULL, 0, mp,
*11042SErik.Nordmark@Sun.COM					    0, B_FALSE, ira);
0Sstevel@tonic-gate					goto done;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * If there were extra chunks
0Sstevel@tonic-gate				 * bundled with the cookie,
0Sstevel@tonic-gate				 * they must be processed
0Sstevel@tonic-gate				 * on the eager's queue. We
0Sstevel@tonic-gate				 * accomplish this by refeeding
0Sstevel@tonic-gate				 * the whole packet into the
0Sstevel@tonic-gate				 * state machine on the right
0Sstevel@tonic-gate				 * q. The packet (mp) gets
0Sstevel@tonic-gate				 * there via the eager's
0Sstevel@tonic-gate				 * cookie_mp field (overloaded
0Sstevel@tonic-gate				 * with the active open role).
0Sstevel@tonic-gate				 * This is picked up when
0Sstevel@tonic-gate				 * processing the null bind
0Sstevel@tonic-gate				 * request put on the eager's
0Sstevel@tonic-gate				 * q by sctp_accept(). We must
0Sstevel@tonic-gate				 * first revert the cookie
0Sstevel@tonic-gate				 * chunk's length field to network
0Sstevel@tonic-gate				 * byteorder so it can be
0Sstevel@tonic-gate				 * properly reprocessed on the
0Sstevel@tonic-gate				 * eager's queue.
0Sstevel@tonic-gate				 */
3448Sdh155122				BUMP_MIB(&sctps->sctps_mib, sctpPassiveEstab);
0Sstevel@tonic-gate				if (mlen > ntohs(ch->sch_len)) {
0Sstevel@tonic-gate					eager->sctp_cookie_mp = dupb(mp);
0Sstevel@tonic-gate					/*
0Sstevel@tonic-gate					 * If no mem, just let
0Sstevel@tonic-gate					 * the peer retransmit.
0Sstevel@tonic-gate					 */
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_assoc_event(eager, SCTP_COMM_UP, 0, NULL);
5586Skcpoon				if (recv_adaptation) {
5586Skcpoon					eager->sctp_recv_adaptation = 1;
5586Skcpoon					eager->sctp_rx_adaptation_code =
5586Skcpoon					    sctp->sctp_rx_adaptation_code;
5586Skcpoon					sctp_adaptation_event(eager);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				eager->sctp_active = now;
0Sstevel@tonic-gate				sctp_send_cookie_ack(eager);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				wake_eager = B_TRUE;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Process rest of the chunks with eager.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp = eager;
0Sstevel@tonic-gate				fp = sctp_lookup_faddr(sctp, &peer_src);
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Confirm peer's original source.  fp can
0Sstevel@tonic-gate				 * only be NULL if peer does not use the
0Sstevel@tonic-gate				 * original source as one of its addresses...
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				if (fp == NULL)
0Sstevel@tonic-gate					fp = sctp_lookup_faddr(sctp, &src);
0Sstevel@tonic-gate				else
0Sstevel@tonic-gate					sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/*
0Sstevel@tonic-gate				 * Validate the peer addresses.  It also starts
0Sstevel@tonic-gate				 * the heartbeat timer.
0Sstevel@tonic-gate				 */
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			/* Anything else is considered out-of-the-blue */
0Sstevel@tonic-gate			case CHUNK_ERROR:
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate			case CHUNK_COOKIE_ACK:
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				sctp_send_abort(sctp, sctph->sh_verf, 0, NULL,
*11042SErik.Nordmark@Sun.COM				    0, mp, 0, B_TRUE, ira);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_COOKIE_WAIT:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_INIT_ACK:
0Sstevel@tonic-gate				sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, sctp->sctp_current);
*11042SErik.Nordmark@Sun.COM				sctp_send_cookie_echo(sctp, ch, mp, ira);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNREFUSED);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_INIT:
*11042SErik.Nordmark@Sun.COM				sctp_send_initack(sctp, sctph, ch, mp, ira);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
*11042SErik.Nordmark@Sun.COM				cr = ira->ira_cred;
*11042SErik.Nordmark@Sun.COM				cpid = ira->ira_cpid;
8778SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
*11042SErik.Nordmark@Sun.COM				    sctph, &recv_adaptation, NULL, ira) == -1) {
3448Sdh155122					BUMP_MIB(&sctps->sctps_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_send_cookie_ack(sctp);
0Sstevel@tonic-gate				sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				if (!SCTP_IS_DETACHED(sctp)) {
4964Skcpoon					sctp->sctp_ulp_connected(
8778SErik.Nordmark@Sun.COM					    sctp->sctp_ulpd, 0, cr, cpid);
4964Skcpoon					sctp_set_ulp_prop(sctp);
8778SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp->sctp_state = SCTPS_ESTABLISHED;
0Sstevel@tonic-gate				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
3448Sdh155122				BUMP_MIB(&sctps->sctps_mib, sctpActiveEstab);
0Sstevel@tonic-gate				if (sctp->sctp_cookie_mp) {
0Sstevel@tonic-gate					freemsg(sctp->sctp_cookie_mp);
0Sstevel@tonic-gate					sctp->sctp_cookie_mp = NULL;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Validate the peer addresses. */
0Sstevel@tonic-gate				sctp->sctp_active = now;
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
5586Skcpoon				if (recv_adaptation) {
5586Skcpoon					sctp->sctp_recv_adaptation = 1;
5586Skcpoon					sctp_adaptation_event(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				/* Try sending queued data, or ASCONFs */
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_COOKIE_ECHOED:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_COOKIE_ACK:
*11042SErik.Nordmark@Sun.COM				cr = ira->ira_cred;
*11042SErik.Nordmark@Sun.COM				cpid = ira->ira_cpid;
8778SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate				if (!SCTP_IS_DETACHED(sctp)) {
4964Skcpoon					sctp->sctp_ulp_connected(
8778SErik.Nordmark@Sun.COM					    sctp->sctp_ulpd, 0, cr, cpid);
4964Skcpoon					sctp_set_ulp_prop(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (sctp->sctp_unacked == 0)
0Sstevel@tonic-gate					sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				sctp->sctp_state = SCTPS_ESTABLISHED;
0Sstevel@tonic-gate				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
3448Sdh155122				BUMP_MIB(&sctps->sctps_mib, sctpActiveEstab);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				if (sctp->sctp_cookie_mp) {
0Sstevel@tonic-gate					freemsg(sctp->sctp_cookie_mp);
0Sstevel@tonic-gate					sctp->sctp_cookie_mp = NULL;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_faddr_alive(sctp, fp);
0Sstevel@tonic-gate				/* Validate the peer addresses. */
0Sstevel@tonic-gate				sctp->sctp_active = now;
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Try sending queued data, or ASCONFs */
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
5586Skcpoon				sctp_adaptation_event(sctp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNREFUSED);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
*11042SErik.Nordmark@Sun.COM				cr = ira->ira_cred;
*11042SErik.Nordmark@Sun.COM				cpid = ira->ira_cpid;
8778SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate				if (sctp_process_cookie(sctp, ch, mp, &iack,
*11042SErik.Nordmark@Sun.COM				    sctph, &recv_adaptation, NULL, ira) == -1) {
3448Sdh155122					BUMP_MIB(&sctps->sctps_mib,
0Sstevel@tonic-gate					    sctpInInvalidCookie);
0Sstevel@tonic-gate					break;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				sctp_send_cookie_ack(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				if (!SCTP_IS_DETACHED(sctp)) {
4964Skcpoon					sctp->sctp_ulp_connected(
8778SErik.Nordmark@Sun.COM					    sctp->sctp_ulpd, 0, cr, cpid);
4964Skcpoon					sctp_set_ulp_prop(sctp);
8778SErik.Nordmark@Sun.COM
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				if (sctp->sctp_unacked == 0)
0Sstevel@tonic-gate					sctp_stop_faddr_timers(sctp);
0Sstevel@tonic-gate				sctp->sctp_state = SCTPS_ESTABLISHED;
0Sstevel@tonic-gate				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
3448Sdh155122				BUMP_MIB(&sctps->sctps_mib, sctpActiveEstab);
0Sstevel@tonic-gate				if (sctp->sctp_cookie_mp) {
0Sstevel@tonic-gate					freemsg(sctp->sctp_cookie_mp);
0Sstevel@tonic-gate					sctp->sctp_cookie_mp = NULL;
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				/* Validate the peer addresses. */
0Sstevel@tonic-gate				sctp->sctp_active = now;
0Sstevel@tonic-gate				sctp_validate_peer(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_COMM_UP, 0, NULL);
5586Skcpoon				if (recv_adaptation) {
5586Skcpoon					sctp->sctp_recv_adaptation = 1;
5586Skcpoon					sctp_adaptation_event(sctp);
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				/* Try sending queued data, or ASCONFs */
0Sstevel@tonic-gate				trysend = 1;
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_INIT:
*11042SErik.Nordmark@Sun.COM				sctp_send_initack(sctp, sctph, ch, mp, ira);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ERROR: {
0Sstevel@tonic-gate				sctp_parm_hdr_t *p;
0Sstevel@tonic-gate
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				/* check for a stale cookie */
0Sstevel@tonic-gate				if (ntohs(ch->sch_len) >=
0Sstevel@tonic-gate				    (sizeof (*p) + sizeof (*ch)) +
0Sstevel@tonic-gate				    sizeof (uint32_t)) {
0Sstevel@tonic-gate
0Sstevel@tonic-gate					p = (sctp_parm_hdr_t *)(ch + 1);
0Sstevel@tonic-gate					if (p->sph_type ==
0Sstevel@tonic-gate					    htons(SCTP_ERR_STALE_COOKIE)) {
3448Sdh155122						BUMP_MIB(&sctps->sctps_mib,
0Sstevel@tonic-gate						    sctpAborted);
0Sstevel@tonic-gate						sctp_error_event(sctp, ch);
3314Skcpoon						sctp_assoc_event(sctp,
3314Skcpoon						    SCTP_COMM_LOST, 0, NULL);
0Sstevel@tonic-gate						sctp_clean_death(sctp,
0Sstevel@tonic-gate						    ECONNREFUSED);
0Sstevel@tonic-gate						goto done;
0Sstevel@tonic-gate					}
0Sstevel@tonic-gate				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
4964Skcpoon				if (!hb_already) {
4964Skcpoon					sctp_return_heartbeat(sctp, ch, mp);
4964Skcpoon					hb_already = B_TRUE;
4964Skcpoon				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate			} /* switch (ch->sch_id) */
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_ACK_SENT:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				/* Pass gathered wisdom to IP for keeping */
*11042SErik.Nordmark@Sun.COM				sctp_update_dce(sctp);
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, 0);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_COMPLETE:
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
3448Sdh155122				BUMP_MIB(&sctps->sctps_mib, sctpShutdowns);
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0,
0Sstevel@tonic-gate				    NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate				/* Pass gathered wisdom to IP for keeping */
*11042SErik.Nordmark@Sun.COM				sctp_update_dce(sctp);
0Sstevel@tonic-gate				sctp_clean_death(sctp, 0);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN_ACK:
0Sstevel@tonic-gate				sctp_shutdown_complete(sctp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
3448Sdh155122				BUMP_MIB(&sctps->sctps_mib, sctpShutdowns);
0Sstevel@tonic-gate				sctp_assoc_event(sctp, SCTP_SHUTDOWN_COMP, 0,
0Sstevel@tonic-gate				    NULL);
0Sstevel@tonic-gate				sctp_clean_death(sctp, 0);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_COOKIE:
0Sstevel@tonic-gate				(void) sctp_shutdown_received(sctp, NULL,
1735Skcpoon				    B_TRUE, B_FALSE, fp);
0Sstevel@tonic-gate				BUMP_LOCAL(sctp->sctp_ibchunks);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
4964Skcpoon				if (!hb_already) {
4964Skcpoon					sctp_return_heartbeat(sctp, ch, mp);
4964Skcpoon					hb_already = B_TRUE;
4964Skcpoon				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		case SCTPS_SHUTDOWN_RECEIVED:
0Sstevel@tonic-gate			switch (ch->sch_id) {
0Sstevel@tonic-gate			case CHUNK_SHUTDOWN:
0Sstevel@tonic-gate				trysend = sctp_shutdown_received(sctp, ch,
1735Skcpoon				    B_FALSE, B_FALSE, fp);
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_SACK:
0Sstevel@tonic-gate				trysend = sctp_got_sack(sctp, ch);
852Svi117747				if (trysend < 0) {
852Svi117747					sctp_send_abort(sctp, sctph->sh_verf,
*11042SErik.Nordmark@Sun.COM					    0, NULL, 0, mp, 0, B_FALSE, ira);
852Svi117747					sctp_assoc_event(sctp,
852Svi117747					    SCTP_COMM_LOST, 0, NULL);
852Svi117747					sctp_clean_death(sctp,
852Svi117747					    ECONNABORTED);
852Svi117747					goto done;
852Svi117747				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			case CHUNK_ABORT:
0Sstevel@tonic-gate				sctp_process_abort(sctp, ch, ECONNRESET);
0Sstevel@tonic-gate				goto done;
0Sstevel@tonic-gate			case CHUNK_HEARTBEAT:
4964Skcpoon				if (!hb_already) {
4964Skcpoon					sctp_return_heartbeat(sctp, ch, mp);
4964Skcpoon					hb_already = B_TRUE;
4964Skcpoon				}
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			default:
0Sstevel@tonic-gate				if (sctp_strange_chunk(sctp, ch, fp) == 0) {
0Sstevel@tonic-gate					goto nomorechunks;
0Sstevel@tonic-gate				} /* else skip and continue processing */
0Sstevel@tonic-gate				break;
0Sstevel@tonic-gate			}
0Sstevel@tonic-gate			break;
0Sstevel@tonic-gate
0Sstevel@tonic-gate		default:
1932Svi117747			/*
1932Svi117747			 * The only remaining states are SCTPS_IDLE and
1932Svi117747			 * SCTPS_BOUND, and we should not be getting here
1932Svi117747			 * for these.
1932Svi117747			 */
1932Svi117747			ASSERT(0);
0Sstevel@tonic-gate		} /* switch (sctp->sctp_state) */
0Sstevel@tonic-gate
0Sstevel@tonic-gate		ch = sctp_next_chunk(ch, &mlen);
0Sstevel@tonic-gate		if (ch != NULL && !sctp_check_input(sctp, ch, mlen, 0))
0Sstevel@tonic-gate			goto done;
0Sstevel@tonic-gate	} while (ch != NULL);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	/* Finished processing all chunks in packet */
0Sstevel@tonic-gate
0Sstevel@tonic-gatenomorechunks:
0Sstevel@tonic-gate	/* SACK if necessary */
0Sstevel@tonic-gate	if (gotdata) {
4964Skcpoon		boolean_t sack_sent;
4964Skcpoon
0Sstevel@tonic-gate		(sctp->sctp_sack_toggle)++;
4964Skcpoon		sack_sent = sctp_sack(sctp, dups);
0Sstevel@tonic-gate		dups = NULL;
0Sstevel@tonic-gate
4964Skcpoon		/* If a SACK is sent, no need to restart the timer. */
4964Skcpoon		if (!sack_sent && !sctp->sctp_ack_timer_running) {
0Sstevel@tonic-gate			sctp->sctp_ack_timer_running = B_TRUE;
0Sstevel@tonic-gate			sctp_timer(sctp, sctp->sctp_ack_mp,
3448Sdh155122			    MSEC_TO_TICK(sctps->sctps_deferred_ack_interval));
0Sstevel@tonic-gate		}
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (trysend) {
3795Skcpoon		sctp_output(sctp, UINT_MAX);
0Sstevel@tonic-gate		if (sctp->sctp_cxmit_list != NULL)
0Sstevel@tonic-gate			sctp_wput_asconf(sctp, NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	/* If there is unsent data, make sure a timer is running */
0Sstevel@tonic-gate	if (sctp->sctp_unsent > 0 && !sctp->sctp_current->timer_running) {
0Sstevel@tonic-gate		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
0Sstevel@tonic-gate		    sctp->sctp_current->rto);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate
0Sstevel@tonic-gatedone:
0Sstevel@tonic-gate	if (dups != NULL)
0Sstevel@tonic-gate		freeb(dups);
0Sstevel@tonic-gate	freemsg(mp);
0Sstevel@tonic-gate
4964Skcpoon	if (sctp->sctp_err_chunks != NULL)
4964Skcpoon		sctp_process_err(sctp);
4964Skcpoon
0Sstevel@tonic-gate	if (wake_eager) {
0Sstevel@tonic-gate		/*
0Sstevel@tonic-gate		 * sctp points to newly created control block, need to
*11042SErik.Nordmark@Sun.COM		 * release it before exiting.
0Sstevel@tonic-gate		 */
0Sstevel@tonic-gate		WAKE_SCTP(sctp);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate}
0Sstevel@tonic-gate
0Sstevel@tonic-gate/*
0Sstevel@tonic-gate * Some amount of data got removed from rx q.
0Sstevel@tonic-gate * Check if we should send a window update.
0Sstevel@tonic-gate *
0Sstevel@tonic-gate * Due to way sctp_rwnd updates are made, ULP can give reports out-of-order.
0Sstevel@tonic-gate * To keep from dropping incoming data due to this, we only update
0Sstevel@tonic-gate * sctp_rwnd when if it's larger than what we've reported to peer earlier.
0Sstevel@tonic-gate */
0Sstevel@tonic-gatevoid
0Sstevel@tonic-gatesctp_recvd(sctp_t *sctp, int len)
0Sstevel@tonic-gate{
0Sstevel@tonic-gate	int32_t old, new;
3448Sdh155122	sctp_stack_t	*sctps = sctp->sctp_sctps;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	ASSERT(sctp != NULL);
0Sstevel@tonic-gate	RUN_SCTP(sctp);
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (len < sctp->sctp_rwnd) {
0Sstevel@tonic-gate		WAKE_SCTP(sctp);
0Sstevel@tonic-gate		return;
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	ASSERT(sctp->sctp_rwnd >= sctp->sctp_rxqueued);
0Sstevel@tonic-gate	old = sctp->sctp_rwnd - sctp->sctp_rxqueued;
0Sstevel@tonic-gate	new = len - sctp->sctp_rxqueued;
0Sstevel@tonic-gate	sctp->sctp_rwnd = len;
0Sstevel@tonic-gate
0Sstevel@tonic-gate	if (sctp->sctp_state >= SCTPS_ESTABLISHED &&
0Sstevel@tonic-gate	    ((old <= new >> 1) || (old < sctp->sctp_mss))) {
0Sstevel@tonic-gate		sctp->sctp_force_sack = 1;
3448Sdh155122		BUMP_MIB(&sctps->sctps_mib, sctpOutWinUpdate);
4964Skcpoon		(void) sctp_sack(sctp, NULL);
0Sstevel@tonic-gate	}
0Sstevel@tonic-gate	WAKE_SCTP(sctp);
0Sstevel@tonic-gate}