The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_input.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
    3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
    4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions are met:
    8  *
    9  * a) Redistributions of source code must retain the above copyright notice,
   10  *    this list of conditions and the following disclaimer.
   11  *
   12  * b) Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in
   14  *    the documentation and/or other materials provided with the distribution.
   15  *
   16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
   17  *    contributors may be used to endorse or promote products derived
   18  *    from this software without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
   22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
   24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   30  * THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/cdefs.h>
   34 __FBSDID("$FreeBSD: releng/10.1/sys/netinet/sctp_input.c 277808 2015-01-27 19:37:02Z delphij $");
   35 
   36 #include <netinet/sctp_os.h>
   37 #include <netinet/sctp_var.h>
   38 #include <netinet/sctp_sysctl.h>
   39 #include <netinet/sctp_pcb.h>
   40 #include <netinet/sctp_header.h>
   41 #include <netinet/sctputil.h>
   42 #include <netinet/sctp_output.h>
   43 #include <netinet/sctp_input.h>
   44 #include <netinet/sctp_auth.h>
   45 #include <netinet/sctp_indata.h>
   46 #include <netinet/sctp_asconf.h>
   47 #include <netinet/sctp_bsd_addr.h>
   48 #include <netinet/sctp_timer.h>
   49 #include <netinet/sctp_crc32.h>
   50 #if defined(INET) || defined(INET6)
   51 #include <netinet/udp.h>
   52 #endif
   53 #include <sys/smp.h>
   54 
   55 
   56 
   57 static void
   58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
   59 {
   60         struct sctp_nets *net;
   61 
   62         /*
   63          * This now not only stops all cookie timers it also stops any INIT
   64          * timers as well. This will make sure that the timers are stopped
   65          * in all collision cases.
   66          */
   67         SCTP_TCB_LOCK_ASSERT(stcb);
   68         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
   69                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
   70                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
   71                             stcb->sctp_ep,
   72                             stcb,
   73                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
   74                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
   75                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
   76                             stcb->sctp_ep,
   77                             stcb,
   78                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
   79                 }
   80         }
   81 }
   82 
   83 /* INIT handler */
   84 static void
   85 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
   86     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
   87     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
   88     struct sctp_tcb *stcb, int *abort_no_unlock,
   89     uint8_t use_mflowid, uint32_t mflowid,
   90     uint32_t vrf_id, uint16_t port)
   91 {
   92         struct sctp_init *init;
   93         struct mbuf *op_err;
   94 
   95         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
   96             (void *)stcb);
   97         if (stcb == NULL) {
   98                 SCTP_INP_RLOCK(inp);
   99         }
  100         /* validate length */
  101         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
  102                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  103                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  104                     use_mflowid, mflowid,
  105                     vrf_id, port);
  106                 if (stcb)
  107                         *abort_no_unlock = 1;
  108                 goto outnow;
  109         }
  110         /* validate parameters */
  111         init = &cp->init;
  112         if (init->initiate_tag == 0) {
  113                 /* protocol error... send abort */
  114                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  115                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  116                     use_mflowid, mflowid,
  117                     vrf_id, port);
  118                 if (stcb)
  119                         *abort_no_unlock = 1;
  120                 goto outnow;
  121         }
  122         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
  123                 /* invalid parameter... send abort */
  124                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  125                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  126                     use_mflowid, mflowid,
  127                     vrf_id, port);
  128                 if (stcb)
  129                         *abort_no_unlock = 1;
  130                 goto outnow;
  131         }
  132         if (init->num_inbound_streams == 0) {
  133                 /* protocol error... send abort */
  134                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  135                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  136                     use_mflowid, mflowid,
  137                     vrf_id, port);
  138                 if (stcb)
  139                         *abort_no_unlock = 1;
  140                 goto outnow;
  141         }
  142         if (init->num_outbound_streams == 0) {
  143                 /* protocol error... send abort */
  144                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  145                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  146                     use_mflowid, mflowid,
  147                     vrf_id, port);
  148                 if (stcb)
  149                         *abort_no_unlock = 1;
  150                 goto outnow;
  151         }
  152         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
  153             offset + ntohs(cp->ch.chunk_length))) {
  154                 /* auth parameter(s) error... send abort */
  155                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
  156                     "Problem with AUTH parameters");
  157                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  158                     use_mflowid, mflowid,
  159                     vrf_id, port);
  160                 if (stcb)
  161                         *abort_no_unlock = 1;
  162                 goto outnow;
  163         }
  164         /*
  165          * We are only accepting if we have a socket with positive
  166          * so_qlimit.
  167          */
  168         if ((stcb == NULL) &&
  169             ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
  170             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
  171             (inp->sctp_socket == NULL) ||
  172             (inp->sctp_socket->so_qlimit == 0))) {
  173                 /*
  174                  * FIX ME ?? What about TCP model and we have a
  175                  * match/restart case? Actually no fix is needed. the lookup
  176                  * will always find the existing assoc so stcb would not be
  177                  * NULL. It may be questionable to do this since we COULD
  178                  * just send back the INIT-ACK and hope that the app did
  179                  * accept()'s by the time the COOKIE was sent. But there is
  180                  * a price to pay for COOKIE generation and I don't want to
  181                  * pay it on the chance that the app will actually do some
  182                  * accepts(). The App just looses and should NOT be in this
  183                  * state :-)
  184                  */
  185                 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
  186                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
  187                             "No listener");
  188                         sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
  189                             use_mflowid, mflowid,
  190                             vrf_id, port);
  191                 }
  192                 goto outnow;
  193         }
  194         if ((stcb != NULL) &&
  195             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
  196                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
  197                 sctp_send_shutdown_ack(stcb, NULL);
  198                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
  199         } else {
  200                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
  201                 sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, src, dst,
  202                     sh, cp,
  203                     use_mflowid, mflowid,
  204                     vrf_id, port,
  205                     ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
  206         }
  207 outnow:
  208         if (stcb == NULL) {
  209                 SCTP_INP_RUNLOCK(inp);
  210         }
  211 }
  212 
  213 /*
  214  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
  215  */
  216 
  217 int
  218 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
  219 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
  220     SCTP_UNUSED
  221 #endif
  222 )
  223 {
  224         int unsent_data = 0;
  225         unsigned int i;
  226         struct sctp_stream_queue_pending *sp;
  227         struct sctp_association *asoc;
  228 
  229         /*
  230          * This function returns the number of streams that have true unsent
  231          * data on them. Note that as it looks through it will clean up any
  232          * places that have old data that has been sent but left at top of
  233          * stream queue.
  234          */
  235         asoc = &stcb->asoc;
  236         SCTP_TCB_SEND_LOCK(stcb);
  237         if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
  238                 /* Check to see if some data queued */
  239                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
  240                         /* sa_ignore FREED_MEMORY */
  241                         sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
  242                         if (sp == NULL) {
  243                                 continue;
  244                         }
  245                         if ((sp->msg_is_complete) &&
  246                             (sp->length == 0) &&
  247                             (sp->sender_all_done)) {
  248                                 /*
  249                                  * We are doing differed cleanup. Last time
  250                                  * through when we took all the data the
  251                                  * sender_all_done was not set.
  252                                  */
  253                                 if (sp->put_last_out == 0) {
  254                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
  255                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
  256                                             sp->sender_all_done,
  257                                             sp->length,
  258                                             sp->msg_is_complete,
  259                                             sp->put_last_out);
  260                                 }
  261                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
  262                                 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
  263                                 if (sp->net) {
  264                                         sctp_free_remote_addr(sp->net);
  265                                         sp->net = NULL;
  266                                 }
  267                                 if (sp->data) {
  268                                         sctp_m_freem(sp->data);
  269                                         sp->data = NULL;
  270                                 }
  271                                 sctp_free_a_strmoq(stcb, sp, so_locked);
  272                         } else {
  273                                 unsent_data++;
  274                                 break;
  275                         }
  276                 }
  277         }
  278         SCTP_TCB_SEND_UNLOCK(stcb);
  279         return (unsent_data);
  280 }
  281 
  282 static int
  283 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
  284 {
  285         struct sctp_init *init;
  286         struct sctp_association *asoc;
  287         struct sctp_nets *lnet;
  288         unsigned int i;
  289 
  290         init = &cp->init;
  291         asoc = &stcb->asoc;
  292         /* save off parameters */
  293         asoc->peer_vtag = ntohl(init->initiate_tag);
  294         asoc->peers_rwnd = ntohl(init->a_rwnd);
  295         /* init tsn's */
  296         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
  297 
  298         if (!TAILQ_EMPTY(&asoc->nets)) {
  299                 /* update any ssthresh's that may have a default */
  300                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
  301                         lnet->ssthresh = asoc->peers_rwnd;
  302                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
  303                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
  304                         }
  305                 }
  306         }
  307         SCTP_TCB_SEND_LOCK(stcb);
  308         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
  309                 unsigned int newcnt;
  310                 struct sctp_stream_out *outs;
  311                 struct sctp_stream_queue_pending *sp, *nsp;
  312                 struct sctp_tmit_chunk *chk, *nchk;
  313 
  314                 /* abandon the upper streams */
  315                 newcnt = ntohs(init->num_inbound_streams);
  316                 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
  317                         if (chk->rec.data.stream_number >= newcnt) {
  318                                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
  319                                 asoc->send_queue_cnt--;
  320                                 if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
  321                                         asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
  322 #ifdef INVARIANTS
  323                                 } else {
  324                                         panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
  325 #endif
  326                                 }
  327                                 if (chk->data != NULL) {
  328                                         sctp_free_bufspace(stcb, asoc, chk, 1);
  329                                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
  330                                             0, chk, SCTP_SO_NOT_LOCKED);
  331                                         if (chk->data) {
  332                                                 sctp_m_freem(chk->data);
  333                                                 chk->data = NULL;
  334                                         }
  335                                 }
  336                                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
  337                                 /* sa_ignore FREED_MEMORY */
  338                         }
  339                 }
  340                 if (asoc->strmout) {
  341                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
  342                                 outs = &asoc->strmout[i];
  343                                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
  344                                         TAILQ_REMOVE(&outs->outqueue, sp, next);
  345                                         asoc->stream_queue_cnt--;
  346                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
  347                                             stcb, 0, sp, SCTP_SO_NOT_LOCKED);
  348                                         if (sp->data) {
  349                                                 sctp_m_freem(sp->data);
  350                                                 sp->data = NULL;
  351                                         }
  352                                         if (sp->net) {
  353                                                 sctp_free_remote_addr(sp->net);
  354                                                 sp->net = NULL;
  355                                         }
  356                                         /* Free the chunk */
  357                                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
  358                                         /* sa_ignore FREED_MEMORY */
  359                                 }
  360                         }
  361                 }
  362                 /* cut back the count */
  363                 asoc->pre_open_streams = newcnt;
  364         }
  365         SCTP_TCB_SEND_UNLOCK(stcb);
  366         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams;
  367 
  368         /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
  369         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
  370         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
  371                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
  372         }
  373         /* This is the next one we expect */
  374         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
  375 
  376         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
  377         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
  378 
  379         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
  380         /* open the requested streams */
  381 
  382         if (asoc->strmin != NULL) {
  383                 /* Free the old ones */
  384                 struct sctp_queued_to_read *ctl, *nctl;
  385 
  386                 for (i = 0; i < asoc->streamincnt; i++) {
  387                         TAILQ_FOREACH_SAFE(ctl, &asoc->strmin[i].inqueue, next, nctl) {
  388                                 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
  389                                 sctp_free_remote_addr(ctl->whoFrom);
  390                                 ctl->whoFrom = NULL;
  391                                 sctp_m_freem(ctl->data);
  392                                 ctl->data = NULL;
  393                                 sctp_free_a_readq(stcb, ctl);
  394                         }
  395                 }
  396                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
  397         }
  398         if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
  399                 asoc->streamincnt = ntohs(init->num_outbound_streams);
  400         } else {
  401                 asoc->streamincnt = asoc->max_inbound_streams;
  402         }
  403         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
  404             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
  405         if (asoc->strmin == NULL) {
  406                 /* we didn't get memory for the streams! */
  407                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
  408                 return (-1);
  409         }
  410         for (i = 0; i < asoc->streamincnt; i++) {
  411                 asoc->strmin[i].stream_no = i;
  412                 asoc->strmin[i].last_sequence_delivered = 0xffff;
  413                 TAILQ_INIT(&asoc->strmin[i].inqueue);
  414                 asoc->strmin[i].delivery_started = 0;
  415         }
  416         /*
  417          * load_address_from_init will put the addresses into the
  418          * association when the COOKIE is processed or the INIT-ACK is
  419          * processed. Both types of COOKIE's existing and new call this
  420          * routine. It will remove addresses that are no longer in the
  421          * association (for the restarting case where addresses are
  422          * removed). Up front when the INIT arrives we will discard it if it
  423          * is a restart and new addresses have been added.
  424          */
  425         /* sa_ignore MEMLEAK */
  426         return (0);
  427 }
  428 
  429 /*
  430  * INIT-ACK message processing/consumption returns value < 0 on error
  431  */
  432 static int
  433 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
  434     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
  435     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
  436     struct sctp_nets *net, int *abort_no_unlock,
  437     uint8_t use_mflowid, uint32_t mflowid,
  438     uint32_t vrf_id)
  439 {
  440         struct sctp_association *asoc;
  441         struct mbuf *op_err;
  442         int retval, abort_flag;
  443         uint32_t initack_limit;
  444         int nat_friendly = 0;
  445 
  446         /* First verify that we have no illegal param's */
  447         abort_flag = 0;
  448 
  449         op_err = sctp_arethere_unrecognized_parameters(m,
  450             (offset + sizeof(struct sctp_init_chunk)),
  451             &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
  452         if (abort_flag) {
  453                 /* Send an abort and notify peer */
  454                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
  455                 *abort_no_unlock = 1;
  456                 return (-1);
  457         }
  458         asoc = &stcb->asoc;
  459         asoc->peer_supports_nat = (uint8_t) nat_friendly;
  460         /* process the peer's parameters in the INIT-ACK */
  461         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
  462         if (retval < 0) {
  463                 return (retval);
  464         }
  465         initack_limit = offset + ntohs(cp->ch.chunk_length);
  466         /* load all addresses */
  467         if ((retval = sctp_load_addresses_from_init(stcb, m,
  468             (offset + sizeof(struct sctp_init_chunk)), initack_limit,
  469             src, dst, NULL))) {
  470                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
  471                     "Problem with address parameters");
  472                 SCTPDBG(SCTP_DEBUG_INPUT1,
  473                     "Load addresses from INIT causes an abort %d\n",
  474                     retval);
  475                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
  476                     src, dst, sh, op_err,
  477                     use_mflowid, mflowid,
  478                     vrf_id, net->port);
  479                 *abort_no_unlock = 1;
  480                 return (-1);
  481         }
  482         /* if the peer doesn't support asconf, flush the asconf queue */
  483         if (asoc->asconf_supported == 0) {
  484                 struct sctp_asconf_addr *param, *nparam;
  485 
  486                 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
  487                         TAILQ_REMOVE(&asoc->asconf_queue, param, next);
  488                         SCTP_FREE(param, SCTP_M_ASC_ADDR);
  489                 }
  490         }
  491         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
  492             stcb->asoc.local_hmacs);
  493         if (op_err) {
  494                 sctp_queue_op_err(stcb, op_err);
  495                 /* queuing will steal away the mbuf chain to the out queue */
  496                 op_err = NULL;
  497         }
  498         /* extract the cookie and queue it to "echo" it back... */
  499         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
  500                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
  501                     stcb->asoc.overall_error_count,
  502                     0,
  503                     SCTP_FROM_SCTP_INPUT,
  504                     __LINE__);
  505         }
  506         stcb->asoc.overall_error_count = 0;
  507         net->error_count = 0;
  508 
  509         /*
  510          * Cancel the INIT timer, We do this first before queueing the
  511          * cookie. We always cancel at the primary to assue that we are
  512          * canceling the timer started by the INIT which always goes to the
  513          * primary.
  514          */
  515         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
  516             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
  517 
  518         /* calculate the RTO */
  519         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
  520             SCTP_RTT_FROM_NON_DATA);
  521 
  522         retval = sctp_send_cookie_echo(m, offset, stcb, net);
  523         if (retval < 0) {
  524                 /*
  525                  * No cookie, we probably should send a op error. But in any
  526                  * case if there is no cookie in the INIT-ACK, we can
  527                  * abandon the peer, its broke.
  528                  */
  529                 if (retval == -3) {
  530                         /* We abort with an error of missing mandatory param */
  531                         op_err = sctp_generate_cause(SCTP_CAUSE_MISSING_PARAM, "");
  532                         if (op_err) {
  533                                 /*
  534                                  * Expand beyond to include the mandatory
  535                                  * param cookie
  536                                  */
  537                                 struct sctp_inv_mandatory_param *mp;
  538 
  539                                 SCTP_BUF_LEN(op_err) =
  540                                     sizeof(struct sctp_inv_mandatory_param);
  541                                 mp = mtod(op_err,
  542                                     struct sctp_inv_mandatory_param *);
  543                                 /* Subtract the reserved param */
  544                                 mp->length =
  545                                     htons(sizeof(struct sctp_inv_mandatory_param) - 2);
  546                                 mp->num_param = htonl(1);
  547                                 mp->param = htons(SCTP_STATE_COOKIE);
  548                                 mp->resv = 0;
  549                         }
  550                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
  551                             src, dst, sh, op_err,
  552                             use_mflowid, mflowid,
  553                             vrf_id, net->port);
  554                         *abort_no_unlock = 1;
  555                 }
  556                 return (retval);
  557         }
  558         return (0);
  559 }
  560 
  561 static void
  562 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
  563     struct sctp_tcb *stcb, struct sctp_nets *net)
  564 {
  565         union sctp_sockstore store;
  566         struct sctp_nets *r_net, *f_net;
  567         struct timeval tv;
  568         int req_prim = 0;
  569         uint16_t old_error_counter;
  570 
  571         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
  572                 /* Invalid length */
  573                 return;
  574         }
  575         memset(&store, 0, sizeof(store));
  576         switch (cp->heartbeat.hb_info.addr_family) {
  577 #ifdef INET
  578         case AF_INET:
  579                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
  580                         store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
  581                         store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
  582                         store.sin.sin_port = stcb->rport;
  583                         memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
  584                             sizeof(store.sin.sin_addr));
  585                 } else {
  586                         return;
  587                 }
  588                 break;
  589 #endif
  590 #ifdef INET6
  591         case AF_INET6:
  592                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
  593                         store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
  594                         store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
  595                         store.sin6.sin6_port = stcb->rport;
  596                         memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
  597                 } else {
  598                         return;
  599                 }
  600                 break;
  601 #endif
  602         default:
  603                 return;
  604         }
  605         r_net = sctp_findnet(stcb, &store.sa);
  606         if (r_net == NULL) {
  607                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
  608                 return;
  609         }
  610         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
  611             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
  612             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
  613                 /*
  614                  * If the its a HB and it's random value is correct when can
  615                  * confirm the destination.
  616                  */
  617                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
  618                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
  619                         stcb->asoc.primary_destination = r_net;
  620                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
  621                         f_net = TAILQ_FIRST(&stcb->asoc.nets);
  622                         if (f_net != r_net) {
  623                                 /*
  624                                  * first one on the list is NOT the primary
  625                                  * sctp_cmpaddr() is much more efficent if
  626                                  * the primary is the first on the list,
  627                                  * make it so.
  628                                  */
  629                                 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
  630                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
  631                         }
  632                         req_prim = 1;
  633                 }
  634                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
  635                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
  636                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
  637                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
  638         }
  639         old_error_counter = r_net->error_count;
  640         r_net->error_count = 0;
  641         r_net->hb_responded = 1;
  642         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
  643         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
  644         /* Now lets do a RTO with this */
  645         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
  646             SCTP_RTT_FROM_NON_DATA);
  647         if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
  648                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
  649                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
  650                     0, (void *)r_net, SCTP_SO_NOT_LOCKED);
  651         }
  652         if (r_net->dest_state & SCTP_ADDR_PF) {
  653                 r_net->dest_state &= ~SCTP_ADDR_PF;
  654                 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
  655         }
  656         if (old_error_counter > 0) {
  657                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
  658                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
  659         }
  660         if (r_net == stcb->asoc.primary_destination) {
  661                 if (stcb->asoc.alternate) {
  662                         /* release the alternate, primary is good */
  663                         sctp_free_remote_addr(stcb->asoc.alternate);
  664                         stcb->asoc.alternate = NULL;
  665                 }
  666         }
  667         /* Mobility adaptation */
  668         if (req_prim) {
  669                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
  670                     SCTP_MOBILITY_BASE) ||
  671                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  672                     SCTP_MOBILITY_FASTHANDOFF)) &&
  673                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  674                     SCTP_MOBILITY_PRIM_DELETED)) {
  675 
  676                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
  677                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  678                             SCTP_MOBILITY_FASTHANDOFF)) {
  679                                 sctp_assoc_immediate_retrans(stcb,
  680                                     stcb->asoc.primary_destination);
  681                         }
  682                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  683                             SCTP_MOBILITY_BASE)) {
  684                                 sctp_move_chunks_from_net(stcb,
  685                                     stcb->asoc.deleted_primary);
  686                         }
  687                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
  688                             stcb->asoc.deleted_primary);
  689                 }
  690         }
  691 }
  692 
  693 static int
  694 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
  695 {
  696         /*
  697          * return 0 means we want you to proceed with the abort non-zero
  698          * means no abort processing
  699          */
  700         struct sctpasochead *head;
  701 
  702         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
  703                 /* generate a new vtag and send init */
  704                 LIST_REMOVE(stcb, sctp_asocs);
  705                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
  706                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
  707                 /*
  708                  * put it in the bucket in the vtag hash of assoc's for the
  709                  * system
  710                  */
  711                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
  712                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
  713                 return (1);
  714         }
  715         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
  716                 /*
  717                  * treat like a case where the cookie expired i.e.: - dump
  718                  * current cookie. - generate a new vtag. - resend init.
  719                  */
  720                 /* generate a new vtag and send init */
  721                 LIST_REMOVE(stcb, sctp_asocs);
  722                 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
  723                 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
  724                 sctp_stop_all_cookie_timers(stcb);
  725                 sctp_toss_old_cookies(stcb, &stcb->asoc);
  726                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
  727                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
  728                 /*
  729                  * put it in the bucket in the vtag hash of assoc's for the
  730                  * system
  731                  */
  732                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
  733                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
  734                 return (1);
  735         }
  736         return (0);
  737 }
  738 
  739 static int
  740 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
  741     struct sctp_nets *net)
  742 {
  743         /*
  744          * return 0 means we want you to proceed with the abort non-zero
  745          * means no abort processing
  746          */
  747         if (stcb->asoc.auth_supported == 0) {
  748                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
  749                 return (0);
  750         }
  751         sctp_asconf_send_nat_state_update(stcb, net);
  752         return (1);
  753 }
  754 
  755 
  756 static void
  757 sctp_handle_abort(struct sctp_abort_chunk *abort,
  758     struct sctp_tcb *stcb, struct sctp_nets *net)
  759 {
  760 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  761         struct socket *so;
  762 
  763 #endif
  764         uint16_t len;
  765         uint16_t error;
  766 
  767         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
  768         if (stcb == NULL)
  769                 return;
  770 
  771         len = ntohs(abort->ch.chunk_length);
  772         if (len > sizeof(struct sctp_chunkhdr)) {
  773                 /*
  774                  * Need to check the cause codes for our two magic nat
  775                  * aborts which don't kill the assoc necessarily.
  776                  */
  777                 struct sctp_missing_nat_state *natc;
  778 
  779                 natc = (struct sctp_missing_nat_state *)(abort + 1);
  780                 error = ntohs(natc->cause);
  781                 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
  782                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
  783                             abort->ch.chunk_flags);
  784                         if (sctp_handle_nat_colliding_state(stcb)) {
  785                                 return;
  786                         }
  787                 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
  788                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
  789                             abort->ch.chunk_flags);
  790                         if (sctp_handle_nat_missing_state(stcb, net)) {
  791                                 return;
  792                         }
  793                 }
  794         } else {
  795                 error = 0;
  796         }
  797         /* stop any receive timers */
  798         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
  799         /* notify user of the abort and clean up... */
  800         sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
  801         /* free the tcb */
  802         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
  803         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
  804             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
  805                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
  806         }
  807 #ifdef SCTP_ASOCLOG_OF_TSNS
  808         sctp_print_out_track_log(stcb);
  809 #endif
  810 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  811         so = SCTP_INP_SO(stcb->sctp_ep);
  812         atomic_add_int(&stcb->asoc.refcnt, 1);
  813         SCTP_TCB_UNLOCK(stcb);
  814         SCTP_SOCKET_LOCK(so, 1);
  815         SCTP_TCB_LOCK(stcb);
  816         atomic_subtract_int(&stcb->asoc.refcnt, 1);
  817 #endif
  818         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
  819         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
  820             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
  821 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  822         SCTP_SOCKET_UNLOCK(so, 1);
  823 #endif
  824         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
  825 }
  826 
  827 static void
  828 sctp_start_net_timers(struct sctp_tcb *stcb)
  829 {
  830         uint32_t cnt_hb_sent;
  831         struct sctp_nets *net;
  832 
  833         cnt_hb_sent = 0;
  834         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  835                 /*
  836                  * For each network start: 1) A pmtu timer. 2) A HB timer 3)
  837                  * If the dest in unconfirmed send a hb as well if under
  838                  * max_hb_burst have been sent.
  839                  */
  840                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
  841                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
  842                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
  843                     (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
  844                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
  845                         cnt_hb_sent++;
  846                 }
  847         }
  848         if (cnt_hb_sent) {
  849                 sctp_chunk_output(stcb->sctp_ep, stcb,
  850                     SCTP_OUTPUT_FROM_COOKIE_ACK,
  851                     SCTP_SO_NOT_LOCKED);
  852         }
  853 }
  854 
  855 
  856 static void
  857 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
  858     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
  859 {
  860         struct sctp_association *asoc;
  861         int some_on_streamwheel;
  862 
  863 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  864         struct socket *so;
  865 
  866 #endif
  867 
  868         SCTPDBG(SCTP_DEBUG_INPUT2,
  869             "sctp_handle_shutdown: handling SHUTDOWN\n");
  870         if (stcb == NULL)
  871                 return;
  872         asoc = &stcb->asoc;
  873         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
  874             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
  875                 return;
  876         }
  877         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
  878                 /* Shutdown NOT the expected size */
  879                 return;
  880         } else {
  881                 sctp_update_acked(stcb, cp, abort_flag);
  882                 if (*abort_flag) {
  883                         return;
  884                 }
  885         }
  886         if (asoc->control_pdapi) {
  887                 /*
  888                  * With a normal shutdown we assume the end of last record.
  889                  */
  890                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
  891                 asoc->control_pdapi->end_added = 1;
  892                 asoc->control_pdapi->pdapi_aborted = 1;
  893                 asoc->control_pdapi = NULL;
  894                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
  895 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  896                 so = SCTP_INP_SO(stcb->sctp_ep);
  897                 atomic_add_int(&stcb->asoc.refcnt, 1);
  898                 SCTP_TCB_UNLOCK(stcb);
  899                 SCTP_SOCKET_LOCK(so, 1);
  900                 SCTP_TCB_LOCK(stcb);
  901                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
  902                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
  903                         /* assoc was freed while we were unlocked */
  904                         SCTP_SOCKET_UNLOCK(so, 1);
  905                         return;
  906                 }
  907 #endif
  908                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
  909 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  910                 SCTP_SOCKET_UNLOCK(so, 1);
  911 #endif
  912         }
  913         /* goto SHUTDOWN_RECEIVED state to block new requests */
  914         if (stcb->sctp_socket) {
  915                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
  916                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
  917                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
  918                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
  919                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
  920                         /*
  921                          * notify upper layer that peer has initiated a
  922                          * shutdown
  923                          */
  924                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
  925 
  926                         /* reset time */
  927                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
  928                 }
  929         }
  930         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
  931                 /*
  932                  * stop the shutdown timer, since we WILL move to
  933                  * SHUTDOWN-ACK-SENT.
  934                  */
  935                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
  936         }
  937         /* Now is there unsent data on a stream somewhere? */
  938         some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
  939 
  940         if (!TAILQ_EMPTY(&asoc->send_queue) ||
  941             !TAILQ_EMPTY(&asoc->sent_queue) ||
  942             some_on_streamwheel) {
  943                 /* By returning we will push more data out */
  944                 return;
  945         } else {
  946                 /* no outstanding data to send, so move on... */
  947                 /* send SHUTDOWN-ACK */
  948                 /* move to SHUTDOWN-ACK-SENT state */
  949                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
  950                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
  951                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
  952                 }
  953                 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
  954                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
  955                 sctp_stop_timers_for_shutdown(stcb);
  956                 sctp_send_shutdown_ack(stcb, net);
  957                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
  958                     stcb, net);
  959         }
  960 }
  961 
  962 static void
  963 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
  964     struct sctp_tcb *stcb,
  965     struct sctp_nets *net)
  966 {
  967         struct sctp_association *asoc;
  968 
  969 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  970         struct socket *so;
  971 
  972         so = SCTP_INP_SO(stcb->sctp_ep);
  973 #endif
  974         SCTPDBG(SCTP_DEBUG_INPUT2,
  975             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
  976         if (stcb == NULL)
  977                 return;
  978 
  979         asoc = &stcb->asoc;
  980         /* process according to association state */
  981         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
  982             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
  983                 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
  984                 sctp_send_shutdown_complete(stcb, net, 1);
  985                 SCTP_TCB_UNLOCK(stcb);
  986                 return;
  987         }
  988         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
  989             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
  990                 /* unexpected SHUTDOWN-ACK... so ignore... */
  991                 SCTP_TCB_UNLOCK(stcb);
  992                 return;
  993         }
  994         if (asoc->control_pdapi) {
  995                 /*
  996                  * With a normal shutdown we assume the end of last record.
  997                  */
  998                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
  999                 asoc->control_pdapi->end_added = 1;
 1000                 asoc->control_pdapi->pdapi_aborted = 1;
 1001                 asoc->control_pdapi = NULL;
 1002                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 1003 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1004                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1005                 SCTP_TCB_UNLOCK(stcb);
 1006                 SCTP_SOCKET_LOCK(so, 1);
 1007                 SCTP_TCB_LOCK(stcb);
 1008                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1009                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1010                         /* assoc was freed while we were unlocked */
 1011                         SCTP_SOCKET_UNLOCK(so, 1);
 1012                         return;
 1013                 }
 1014 #endif
 1015                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 1016 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1017                 SCTP_SOCKET_UNLOCK(so, 1);
 1018 #endif
 1019         }
 1020 #ifdef INVARIANTS
 1021         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 1022             !TAILQ_EMPTY(&asoc->sent_queue) ||
 1023             !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 1024                 panic("Queues are not empty when handling SHUTDOWN-ACK");
 1025         }
 1026 #endif
 1027         /* stop the timer */
 1028         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
 1029         /* send SHUTDOWN-COMPLETE */
 1030         sctp_send_shutdown_complete(stcb, net, 0);
 1031         /* notify upper layer protocol */
 1032         if (stcb->sctp_socket) {
 1033                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1034                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 1035                         stcb->sctp_socket->so_snd.sb_cc = 0;
 1036                 }
 1037                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 1038         }
 1039         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 1040         /* free the TCB but first save off the ep */
 1041 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1042         atomic_add_int(&stcb->asoc.refcnt, 1);
 1043         SCTP_TCB_UNLOCK(stcb);
 1044         SCTP_SOCKET_LOCK(so, 1);
 1045         SCTP_TCB_LOCK(stcb);
 1046         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1047 #endif
 1048         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 1049             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
 1050 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1051         SCTP_SOCKET_UNLOCK(so, 1);
 1052 #endif
 1053 }
 1054 
 1055 /*
 1056  * Skip past the param header and then we will find the chunk that caused the
 1057  * problem. There are two possiblities ASCONF or FWD-TSN other than that and
 1058  * our peer must be broken.
 1059  */
 1060 static void
 1061 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
 1062     struct sctp_nets *net)
 1063 {
 1064         struct sctp_chunkhdr *chk;
 1065 
 1066         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
 1067         switch (chk->chunk_type) {
 1068         case SCTP_ASCONF_ACK:
 1069         case SCTP_ASCONF:
 1070                 sctp_asconf_cleanup(stcb, net);
 1071                 break;
 1072         case SCTP_FORWARD_CUM_TSN:
 1073                 stcb->asoc.prsctp_supported = 0;
 1074                 break;
 1075         default:
 1076                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1077                     "Peer does not support chunk type %d(%x)??\n",
 1078                     chk->chunk_type, (uint32_t) chk->chunk_type);
 1079                 break;
 1080         }
 1081 }
 1082 
 1083 /*
 1084  * Skip past the param header and then we will find the param that caused the
 1085  * problem.  There are a number of param's in a ASCONF OR the prsctp param
 1086  * these will turn of specific features.
 1087  * XXX: Is this the right thing to do?
 1088  */
 1089 static void
 1090 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
 1091 {
 1092         struct sctp_paramhdr *pbad;
 1093 
 1094         pbad = phdr + 1;
 1095         switch (ntohs(pbad->param_type)) {
 1096                 /* pr-sctp draft */
 1097         case SCTP_PRSCTP_SUPPORTED:
 1098                 stcb->asoc.prsctp_supported = 0;
 1099                 break;
 1100         case SCTP_SUPPORTED_CHUNK_EXT:
 1101                 break;
 1102                 /* draft-ietf-tsvwg-addip-sctp */
 1103         case SCTP_HAS_NAT_SUPPORT:
 1104                 stcb->asoc.peer_supports_nat = 0;
 1105                 break;
 1106         case SCTP_ADD_IP_ADDRESS:
 1107         case SCTP_DEL_IP_ADDRESS:
 1108         case SCTP_SET_PRIM_ADDR:
 1109                 stcb->asoc.asconf_supported = 0;
 1110                 break;
 1111         case SCTP_SUCCESS_REPORT:
 1112         case SCTP_ERROR_CAUSE_IND:
 1113                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
 1114                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1115                     "Turning off ASCONF to this strange peer\n");
 1116                 stcb->asoc.asconf_supported = 0;
 1117                 break;
 1118         default:
 1119                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1120                     "Peer does not support param type %d(%x)??\n",
 1121                     pbad->param_type, (uint32_t) pbad->param_type);
 1122                 break;
 1123         }
 1124 }
 1125 
 1126 static int
 1127 sctp_handle_error(struct sctp_chunkhdr *ch,
 1128     struct sctp_tcb *stcb, struct sctp_nets *net)
 1129 {
 1130         int chklen;
 1131         struct sctp_paramhdr *phdr;
 1132         uint16_t error, error_type;
 1133         uint16_t error_len;
 1134         struct sctp_association *asoc;
 1135         int adjust;
 1136 
 1137 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1138         struct socket *so;
 1139 
 1140 #endif
 1141 
 1142         /* parse through all of the errors and process */
 1143         asoc = &stcb->asoc;
 1144         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
 1145             sizeof(struct sctp_chunkhdr));
 1146         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
 1147         error = 0;
 1148         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
 1149                 /* Process an Error Cause */
 1150                 error_type = ntohs(phdr->param_type);
 1151                 error_len = ntohs(phdr->param_length);
 1152                 if ((error_len > chklen) || (error_len == 0)) {
 1153                         /* invalid param length for this param */
 1154                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
 1155                             chklen, error_len);
 1156                         return (0);
 1157                 }
 1158                 if (error == 0) {
 1159                         /* report the first error cause */
 1160                         error = error_type;
 1161                 }
 1162                 switch (error_type) {
 1163                 case SCTP_CAUSE_INVALID_STREAM:
 1164                 case SCTP_CAUSE_MISSING_PARAM:
 1165                 case SCTP_CAUSE_INVALID_PARAM:
 1166                 case SCTP_CAUSE_NO_USER_DATA:
 1167                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
 1168                             error_type);
 1169                         break;
 1170                 case SCTP_CAUSE_NAT_COLLIDING_STATE:
 1171                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
 1172                             ch->chunk_flags);
 1173                         if (sctp_handle_nat_colliding_state(stcb)) {
 1174                                 return (0);
 1175                         }
 1176                         break;
 1177                 case SCTP_CAUSE_NAT_MISSING_STATE:
 1178                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
 1179                             ch->chunk_flags);
 1180                         if (sctp_handle_nat_missing_state(stcb, net)) {
 1181                                 return (0);
 1182                         }
 1183                         break;
 1184                 case SCTP_CAUSE_STALE_COOKIE:
 1185                         /*
 1186                          * We only act if we have echoed a cookie and are
 1187                          * waiting.
 1188                          */
 1189                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 1190                                 int *p;
 1191 
 1192                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
 1193                                 /* Save the time doubled */
 1194                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
 1195                                 asoc->stale_cookie_count++;
 1196                                 if (asoc->stale_cookie_count >
 1197                                     asoc->max_init_times) {
 1198                                         sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
 1199                                         /* now free the asoc */
 1200 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1201                                         so = SCTP_INP_SO(stcb->sctp_ep);
 1202                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 1203                                         SCTP_TCB_UNLOCK(stcb);
 1204                                         SCTP_SOCKET_LOCK(so, 1);
 1205                                         SCTP_TCB_LOCK(stcb);
 1206                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1207 #endif
 1208                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 1209                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
 1210 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1211                                         SCTP_SOCKET_UNLOCK(so, 1);
 1212 #endif
 1213                                         return (-1);
 1214                                 }
 1215                                 /* blast back to INIT state */
 1216                                 sctp_toss_old_cookies(stcb, &stcb->asoc);
 1217                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
 1218                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
 1219                                 sctp_stop_all_cookie_timers(stcb);
 1220                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 1221                         }
 1222                         break;
 1223                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
 1224                         /*
 1225                          * Nothing we can do here, we don't do hostname
 1226                          * addresses so if the peer does not like my IPv6
 1227                          * (or IPv4 for that matter) it does not matter. If
 1228                          * they don't support that type of address, they can
 1229                          * NOT possibly get that packet type... i.e. with no
 1230                          * IPv6 you can't recieve a IPv6 packet. so we can
 1231                          * safely ignore this one. If we ever added support
 1232                          * for HOSTNAME Addresses, then we would need to do
 1233                          * something here.
 1234                          */
 1235                         break;
 1236                 case SCTP_CAUSE_UNRECOG_CHUNK:
 1237                         sctp_process_unrecog_chunk(stcb, phdr, net);
 1238                         break;
 1239                 case SCTP_CAUSE_UNRECOG_PARAM:
 1240                         sctp_process_unrecog_param(stcb, phdr);
 1241                         break;
 1242                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
 1243                         /*
 1244                          * We ignore this since the timer will drive out a
 1245                          * new cookie anyway and there timer will drive us
 1246                          * to send a SHUTDOWN_COMPLETE. We can't send one
 1247                          * here since we don't have their tag.
 1248                          */
 1249                         break;
 1250                 case SCTP_CAUSE_DELETING_LAST_ADDR:
 1251                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
 1252                 case SCTP_CAUSE_DELETING_SRC_ADDR:
 1253                         /*
 1254                          * We should NOT get these here, but in a
 1255                          * ASCONF-ACK.
 1256                          */
 1257                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
 1258                             error_type);
 1259                         break;
 1260                 case SCTP_CAUSE_OUT_OF_RESC:
 1261                         /*
 1262                          * And what, pray tell do we do with the fact that
 1263                          * the peer is out of resources? Not really sure we
 1264                          * could do anything but abort. I suspect this
 1265                          * should have came WITH an abort instead of in a
 1266                          * OP-ERROR.
 1267                          */
 1268                         break;
 1269                 default:
 1270                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
 1271                             error_type);
 1272                         break;
 1273                 }
 1274                 adjust = SCTP_SIZE32(error_len);
 1275                 chklen -= adjust;
 1276                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
 1277         }
 1278         sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);
 1279         return (0);
 1280 }
 1281 
 1282 static int
 1283 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
 1284     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
 1285     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 1286     struct sctp_nets *net, int *abort_no_unlock,
 1287     uint8_t use_mflowid, uint32_t mflowid,
 1288     uint32_t vrf_id)
 1289 {
 1290         struct sctp_init_ack *init_ack;
 1291         struct mbuf *op_err;
 1292 
 1293         SCTPDBG(SCTP_DEBUG_INPUT2,
 1294             "sctp_handle_init_ack: handling INIT-ACK\n");
 1295 
 1296         if (stcb == NULL) {
 1297                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1298                     "sctp_handle_init_ack: TCB is null\n");
 1299                 return (-1);
 1300         }
 1301         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
 1302                 /* Invalid length */
 1303                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1304                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1305                     src, dst, sh, op_err,
 1306                     use_mflowid, mflowid,
 1307                     vrf_id, net->port);
 1308                 *abort_no_unlock = 1;
 1309                 return (-1);
 1310         }
 1311         init_ack = &cp->init;
 1312         /* validate parameters */
 1313         if (init_ack->initiate_tag == 0) {
 1314                 /* protocol error... send an abort */
 1315                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1316                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1317                     src, dst, sh, op_err,
 1318                     use_mflowid, mflowid,
 1319                     vrf_id, net->port);
 1320                 *abort_no_unlock = 1;
 1321                 return (-1);
 1322         }
 1323         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
 1324                 /* protocol error... send an abort */
 1325                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1326                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1327                     src, dst, sh, op_err,
 1328                     use_mflowid, mflowid,
 1329                     vrf_id, net->port);
 1330                 *abort_no_unlock = 1;
 1331                 return (-1);
 1332         }
 1333         if (init_ack->num_inbound_streams == 0) {
 1334                 /* protocol error... send an abort */
 1335                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1336                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1337                     src, dst, sh, op_err,
 1338                     use_mflowid, mflowid,
 1339                     vrf_id, net->port);
 1340                 *abort_no_unlock = 1;
 1341                 return (-1);
 1342         }
 1343         if (init_ack->num_outbound_streams == 0) {
 1344                 /* protocol error... send an abort */
 1345                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1346                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1347                     src, dst, sh, op_err,
 1348                     use_mflowid, mflowid,
 1349                     vrf_id, net->port);
 1350                 *abort_no_unlock = 1;
 1351                 return (-1);
 1352         }
 1353         /* process according to association state... */
 1354         switch (stcb->asoc.state & SCTP_STATE_MASK) {
 1355         case SCTP_STATE_COOKIE_WAIT:
 1356                 /* this is the expected state for this chunk */
 1357                 /* process the INIT-ACK parameters */
 1358                 if (stcb->asoc.primary_destination->dest_state &
 1359                     SCTP_ADDR_UNCONFIRMED) {
 1360                         /*
 1361                          * The primary is where we sent the INIT, we can
 1362                          * always consider it confirmed when the INIT-ACK is
 1363                          * returned. Do this before we load addresses
 1364                          * though.
 1365                          */
 1366                         stcb->asoc.primary_destination->dest_state &=
 1367                             ~SCTP_ADDR_UNCONFIRMED;
 1368                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 1369                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
 1370                 }
 1371                 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
 1372                     net, abort_no_unlock,
 1373                     use_mflowid, mflowid,
 1374                     vrf_id) < 0) {
 1375                         /* error in parsing parameters */
 1376                         return (-1);
 1377                 }
 1378                 /* update our state */
 1379                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
 1380                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
 1381 
 1382                 /* reset the RTO calc */
 1383                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 1384                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 1385                             stcb->asoc.overall_error_count,
 1386                             0,
 1387                             SCTP_FROM_SCTP_INPUT,
 1388                             __LINE__);
 1389                 }
 1390                 stcb->asoc.overall_error_count = 0;
 1391                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
 1392                 /*
 1393                  * collapse the init timer back in case of a exponential
 1394                  * backoff
 1395                  */
 1396                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
 1397                     stcb, net);
 1398                 /*
 1399                  * the send at the end of the inbound data processing will
 1400                  * cause the cookie to be sent
 1401                  */
 1402                 break;
 1403         case SCTP_STATE_SHUTDOWN_SENT:
 1404                 /* incorrect state... discard */
 1405                 break;
 1406         case SCTP_STATE_COOKIE_ECHOED:
 1407                 /* incorrect state... discard */
 1408                 break;
 1409         case SCTP_STATE_OPEN:
 1410                 /* incorrect state... discard */
 1411                 break;
 1412         case SCTP_STATE_EMPTY:
 1413         case SCTP_STATE_INUSE:
 1414         default:
 1415                 /* incorrect state... discard */
 1416                 return (-1);
 1417                 break;
 1418         }
 1419         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
 1420         return (0);
 1421 }
 1422 
 1423 static struct sctp_tcb *
 1424 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 1425     struct sockaddr *src, struct sockaddr *dst,
 1426     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1427     struct sctp_inpcb *inp, struct sctp_nets **netp,
 1428     struct sockaddr *init_src, int *notification,
 1429     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 1430     uint8_t use_mflowid, uint32_t mflowid,
 1431     uint32_t vrf_id, uint16_t port);
 1432 
 1433 
 1434 /*
 1435  * handle a state cookie for an existing association m: input packet mbuf
 1436  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
 1437  * "split" mbuf and the cookie signature does not exist offset: offset into
 1438  * mbuf to the cookie-echo chunk
 1439  */
 1440 static struct sctp_tcb *
 1441 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
 1442     struct sockaddr *src, struct sockaddr *dst,
 1443     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1444     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
 1445     struct sockaddr *init_src, int *notification,
 1446     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 1447     uint8_t use_mflowid, uint32_t mflowid,
 1448     uint32_t vrf_id, uint16_t port)
 1449 {
 1450         struct sctp_association *asoc;
 1451         struct sctp_init_chunk *init_cp, init_buf;
 1452         struct sctp_init_ack_chunk *initack_cp, initack_buf;
 1453         struct sctp_nets *net;
 1454         struct mbuf *op_err;
 1455         int init_offset, initack_offset, i;
 1456         int retval;
 1457         int spec_flag = 0;
 1458         uint32_t how_indx;
 1459 
 1460 #if defined(SCTP_DETAILED_STR_STATS)
 1461         int j;
 1462 
 1463 #endif
 1464 
 1465         net = *netp;
 1466         /* I know that the TCB is non-NULL from the caller */
 1467         asoc = &stcb->asoc;
 1468         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
 1469                 if (asoc->cookie_how[how_indx] == 0)
 1470                         break;
 1471         }
 1472         if (how_indx < sizeof(asoc->cookie_how)) {
 1473                 asoc->cookie_how[how_indx] = 1;
 1474         }
 1475         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 1476                 /* SHUTDOWN came in after sending INIT-ACK */
 1477                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
 1478                 op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
 1479                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
 1480                     use_mflowid, mflowid,
 1481                     vrf_id, net->port);
 1482                 if (how_indx < sizeof(asoc->cookie_how))
 1483                         asoc->cookie_how[how_indx] = 2;
 1484                 return (NULL);
 1485         }
 1486         /*
 1487          * find and validate the INIT chunk in the cookie (peer's info) the
 1488          * INIT should start after the cookie-echo header struct (chunk
 1489          * header, state cookie header struct)
 1490          */
 1491         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
 1492 
 1493         init_cp = (struct sctp_init_chunk *)
 1494             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
 1495             (uint8_t *) & init_buf);
 1496         if (init_cp == NULL) {
 1497                 /* could not pull a INIT chunk in cookie */
 1498                 return (NULL);
 1499         }
 1500         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
 1501                 return (NULL);
 1502         }
 1503         /*
 1504          * find and validate the INIT-ACK chunk in the cookie (my info) the
 1505          * INIT-ACK follows the INIT chunk
 1506          */
 1507         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
 1508         initack_cp = (struct sctp_init_ack_chunk *)
 1509             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
 1510             (uint8_t *) & initack_buf);
 1511         if (initack_cp == NULL) {
 1512                 /* could not pull INIT-ACK chunk in cookie */
 1513                 return (NULL);
 1514         }
 1515         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
 1516                 return (NULL);
 1517         }
 1518         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1519             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
 1520                 /*
 1521                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
 1522                  * to get into the OPEN state
 1523                  */
 1524                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
 1525                         /*-
 1526                          * Opps, this means that we somehow generated two vtag's
 1527                          * the same. I.e. we did:
 1528                          *  Us               Peer
 1529                          *   <---INIT(tag=a)------
 1530                          *   ----INIT-ACK(tag=t)-->
 1531                          *   ----INIT(tag=t)------> *1
 1532                          *   <---INIT-ACK(tag=a)---
 1533                          *   <----CE(tag=t)------------- *2
 1534                          *
 1535                          * At point *1 we should be generating a different
 1536                          * tag t'. Which means we would throw away the CE and send
 1537                          * ours instead. Basically this is case C (throw away side).
 1538                          */
 1539                         if (how_indx < sizeof(asoc->cookie_how))
 1540                                 asoc->cookie_how[how_indx] = 17;
 1541                         return (NULL);
 1542 
 1543                 }
 1544                 switch (SCTP_GET_STATE(asoc)) {
 1545                 case SCTP_STATE_COOKIE_WAIT:
 1546                 case SCTP_STATE_COOKIE_ECHOED:
 1547                         /*
 1548                          * INIT was sent but got a COOKIE_ECHO with the
 1549                          * correct tags... just accept it...but we must
 1550                          * process the init so that we can make sure we have
 1551                          * the right seq no's.
 1552                          */
 1553                         /* First we must process the INIT !! */
 1554                         retval = sctp_process_init(init_cp, stcb);
 1555                         if (retval < 0) {
 1556                                 if (how_indx < sizeof(asoc->cookie_how))
 1557                                         asoc->cookie_how[how_indx] = 3;
 1558                                 return (NULL);
 1559                         }
 1560                         /* we have already processed the INIT so no problem */
 1561                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
 1562                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
 1563                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
 1564                         /* update current state */
 1565                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
 1566                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 1567                         else
 1568                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1569 
 1570                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1571                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1572                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1573                                     stcb->sctp_ep, stcb, asoc->primary_destination);
 1574                         }
 1575                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1576                         sctp_stop_all_cookie_timers(stcb);
 1577                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1578                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 1579                             (inp->sctp_socket->so_qlimit == 0)
 1580                             ) {
 1581 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1582                                 struct socket *so;
 1583 
 1584 #endif
 1585                                 /*
 1586                                  * Here is where collision would go if we
 1587                                  * did a connect() and instead got a
 1588                                  * init/init-ack/cookie done before the
 1589                                  * init-ack came back..
 1590                                  */
 1591                                 stcb->sctp_ep->sctp_flags |=
 1592                                     SCTP_PCB_FLAGS_CONNECTED;
 1593 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1594                                 so = SCTP_INP_SO(stcb->sctp_ep);
 1595                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1596                                 SCTP_TCB_UNLOCK(stcb);
 1597                                 SCTP_SOCKET_LOCK(so, 1);
 1598                                 SCTP_TCB_LOCK(stcb);
 1599                                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1600                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1601                                         SCTP_SOCKET_UNLOCK(so, 1);
 1602                                         return (NULL);
 1603                                 }
 1604 #endif
 1605                                 soisconnected(stcb->sctp_socket);
 1606 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1607                                 SCTP_SOCKET_UNLOCK(so, 1);
 1608 #endif
 1609                         }
 1610                         /* notify upper layer */
 1611                         *notification = SCTP_NOTIFY_ASSOC_UP;
 1612                         /*
 1613                          * since we did not send a HB make sure we don't
 1614                          * double things
 1615                          */
 1616                         net->hb_responded = 1;
 1617                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
 1618                             &cookie->time_entered,
 1619                             sctp_align_unsafe_makecopy,
 1620                             SCTP_RTT_FROM_NON_DATA);
 1621 
 1622                         if (stcb->asoc.sctp_autoclose_ticks &&
 1623                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
 1624                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
 1625                                     inp, stcb, NULL);
 1626                         }
 1627                         break;
 1628                 default:
 1629                         /*
 1630                          * we're in the OPEN state (or beyond), so peer must
 1631                          * have simply lost the COOKIE-ACK
 1632                          */
 1633                         break;
 1634                 }               /* end switch */
 1635                 sctp_stop_all_cookie_timers(stcb);
 1636                 /*
 1637                  * We ignore the return code here.. not sure if we should
 1638                  * somehow abort.. but we do have an existing asoc. This
 1639                  * really should not fail.
 1640                  */
 1641                 if (sctp_load_addresses_from_init(stcb, m,
 1642                     init_offset + sizeof(struct sctp_init_chunk),
 1643                     initack_offset, src, dst, init_src)) {
 1644                         if (how_indx < sizeof(asoc->cookie_how))
 1645                                 asoc->cookie_how[how_indx] = 4;
 1646                         return (NULL);
 1647                 }
 1648                 /* respond with a COOKIE-ACK */
 1649                 sctp_toss_old_cookies(stcb, asoc);
 1650                 sctp_send_cookie_ack(stcb);
 1651                 if (how_indx < sizeof(asoc->cookie_how))
 1652                         asoc->cookie_how[how_indx] = 5;
 1653                 return (stcb);
 1654         }
 1655         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
 1656             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
 1657             cookie->tie_tag_my_vtag == 0 &&
 1658             cookie->tie_tag_peer_vtag == 0) {
 1659                 /*
 1660                  * case C in Section 5.2.4 Table 2: XMOO silently discard
 1661                  */
 1662                 if (how_indx < sizeof(asoc->cookie_how))
 1663                         asoc->cookie_how[how_indx] = 6;
 1664                 return (NULL);
 1665         }
 1666         /*
 1667          * If nat support, and the below and stcb is established, send back
 1668          * a ABORT(colliding state) if we are established.
 1669          */
 1670         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
 1671             (asoc->peer_supports_nat) &&
 1672             ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1673             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
 1674             (asoc->peer_vtag == 0)))) {
 1675                 /*
 1676                  * Special case - Peer's support nat. We may have two init's
 1677                  * that we gave out the same tag on since one was not
 1678                  * established.. i.e. we get INIT from host-1 behind the nat
 1679                  * and we respond tag-a, we get a INIT from host-2 behind
 1680                  * the nat and we get tag-a again. Then we bring up host-1
 1681                  * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
 1682                  * Now we have colliding state. We must send an abort here
 1683                  * with colliding state indication.
 1684                  */
 1685                 op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
 1686                 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
 1687                     use_mflowid, mflowid,
 1688                     vrf_id, port);
 1689                 return (NULL);
 1690         }
 1691         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1692             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
 1693             (asoc->peer_vtag == 0))) {
 1694                 /*
 1695                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
 1696                  * should be ok, re-accept peer info
 1697                  */
 1698                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
 1699                         /*
 1700                          * Extension of case C. If we hit this, then the
 1701                          * random number generator returned the same vtag
 1702                          * when we first sent our INIT-ACK and when we later
 1703                          * sent our INIT. The side with the seq numbers that
 1704                          * are different will be the one that normnally
 1705                          * would have hit case C. This in effect "extends"
 1706                          * our vtags in this collision case to be 64 bits.
 1707                          * The same collision could occur aka you get both
 1708                          * vtag and seq number the same twice in a row.. but
 1709                          * is much less likely. If it did happen then we
 1710                          * would proceed through and bring up the assoc.. we
 1711                          * may end up with the wrong stream setup however..
 1712                          * which would be bad.. but there is no way to
 1713                          * tell.. until we send on a stream that does not
 1714                          * exist :-)
 1715                          */
 1716                         if (how_indx < sizeof(asoc->cookie_how))
 1717                                 asoc->cookie_how[how_indx] = 7;
 1718 
 1719                         return (NULL);
 1720                 }
 1721                 if (how_indx < sizeof(asoc->cookie_how))
 1722                         asoc->cookie_how[how_indx] = 8;
 1723                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
 1724                 sctp_stop_all_cookie_timers(stcb);
 1725                 /*
 1726                  * since we did not send a HB make sure we don't double
 1727                  * things
 1728                  */
 1729                 net->hb_responded = 1;
 1730                 if (stcb->asoc.sctp_autoclose_ticks &&
 1731                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 1732                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
 1733                             NULL);
 1734                 }
 1735                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 1736                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
 1737 
 1738                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
 1739                         /*
 1740                          * Ok the peer probably discarded our data (if we
 1741                          * echoed a cookie+data). So anything on the
 1742                          * sent_queue should be marked for retransmit, we
 1743                          * may not get something to kick us so it COULD
 1744                          * still take a timeout to move these.. but it can't
 1745                          * hurt to mark them.
 1746                          */
 1747                         struct sctp_tmit_chunk *chk;
 1748 
 1749                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 1750                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
 1751                                         chk->sent = SCTP_DATAGRAM_RESEND;
 1752                                         sctp_flight_size_decrease(chk);
 1753                                         sctp_total_flight_decrease(stcb, chk);
 1754                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 1755                                         spec_flag++;
 1756                                 }
 1757                         }
 1758 
 1759                 }
 1760                 /* process the INIT info (peer's info) */
 1761                 retval = sctp_process_init(init_cp, stcb);
 1762                 if (retval < 0) {
 1763                         if (how_indx < sizeof(asoc->cookie_how))
 1764                                 asoc->cookie_how[how_indx] = 9;
 1765                         return (NULL);
 1766                 }
 1767                 if (sctp_load_addresses_from_init(stcb, m,
 1768                     init_offset + sizeof(struct sctp_init_chunk),
 1769                     initack_offset, src, dst, init_src)) {
 1770                         if (how_indx < sizeof(asoc->cookie_how))
 1771                                 asoc->cookie_how[how_indx] = 10;
 1772                         return (NULL);
 1773                 }
 1774                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
 1775                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
 1776                         *notification = SCTP_NOTIFY_ASSOC_UP;
 1777 
 1778                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1779                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 1780                             (inp->sctp_socket->so_qlimit == 0)) {
 1781 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1782                                 struct socket *so;
 1783 
 1784 #endif
 1785                                 stcb->sctp_ep->sctp_flags |=
 1786                                     SCTP_PCB_FLAGS_CONNECTED;
 1787 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1788                                 so = SCTP_INP_SO(stcb->sctp_ep);
 1789                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1790                                 SCTP_TCB_UNLOCK(stcb);
 1791                                 SCTP_SOCKET_LOCK(so, 1);
 1792                                 SCTP_TCB_LOCK(stcb);
 1793                                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1794                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1795                                         SCTP_SOCKET_UNLOCK(so, 1);
 1796                                         return (NULL);
 1797                                 }
 1798 #endif
 1799                                 soisconnected(stcb->sctp_socket);
 1800 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1801                                 SCTP_SOCKET_UNLOCK(so, 1);
 1802 #endif
 1803                         }
 1804                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
 1805                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 1806                         else
 1807                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1808                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1809                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
 1810                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
 1811                 } else {
 1812                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1813                 }
 1814                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1815                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1816                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1817                             stcb->sctp_ep, stcb, asoc->primary_destination);
 1818                 }
 1819                 sctp_stop_all_cookie_timers(stcb);
 1820                 sctp_toss_old_cookies(stcb, asoc);
 1821                 sctp_send_cookie_ack(stcb);
 1822                 if (spec_flag) {
 1823                         /*
 1824                          * only if we have retrans set do we do this. What
 1825                          * this call does is get only the COOKIE-ACK out and
 1826                          * then when we return the normal call to
 1827                          * sctp_chunk_output will get the retrans out behind
 1828                          * this.
 1829                          */
 1830                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
 1831                 }
 1832                 if (how_indx < sizeof(asoc->cookie_how))
 1833                         asoc->cookie_how[how_indx] = 11;
 1834 
 1835                 return (stcb);
 1836         }
 1837         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
 1838             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
 1839             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
 1840             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
 1841             cookie->tie_tag_peer_vtag != 0) {
 1842                 struct sctpasochead *head;
 1843 
 1844 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1845                 struct socket *so;
 1846 
 1847 #endif
 1848 
 1849                 if (asoc->peer_supports_nat) {
 1850                         /*
 1851                          * This is a gross gross hack. Just call the
 1852                          * cookie_new code since we are allowing a duplicate
 1853                          * association. I hope this works...
 1854                          */
 1855                         return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
 1856                             sh, cookie, cookie_len,
 1857                             inp, netp, init_src, notification,
 1858                             auth_skipped, auth_offset, auth_len,
 1859                             use_mflowid, mflowid,
 1860                             vrf_id, port));
 1861                 }
 1862                 /*
 1863                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
 1864                  */
 1865                 /* temp code */
 1866                 if (how_indx < sizeof(asoc->cookie_how))
 1867                         asoc->cookie_how[how_indx] = 12;
 1868                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
 1869                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 1870 
 1871                 /* notify upper layer */
 1872                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
 1873                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1874                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
 1875                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 1876                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 1877                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1878                 }
 1879                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
 1880                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
 1881                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
 1882                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
 1883                 }
 1884                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1885                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1886                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1887                             stcb->sctp_ep, stcb, asoc->primary_destination);
 1888 
 1889                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
 1890                         /* move to OPEN state, if not in SHUTDOWN_SENT */
 1891                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1892                 }
 1893                 asoc->pre_open_streams =
 1894                     ntohs(initack_cp->init.num_outbound_streams);
 1895                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
 1896                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
 1897                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 1898 
 1899                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
 1900 
 1901                 asoc->str_reset_seq_in = asoc->init_seq_number;
 1902 
 1903                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 1904                 if (asoc->mapping_array) {
 1905                         memset(asoc->mapping_array, 0,
 1906                             asoc->mapping_array_size);
 1907                 }
 1908                 if (asoc->nr_mapping_array) {
 1909                         memset(asoc->nr_mapping_array, 0,
 1910                             asoc->mapping_array_size);
 1911                 }
 1912                 SCTP_TCB_UNLOCK(stcb);
 1913 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1914                 so = SCTP_INP_SO(stcb->sctp_ep);
 1915                 SCTP_SOCKET_LOCK(so, 1);
 1916 #endif
 1917                 SCTP_INP_INFO_WLOCK();
 1918                 SCTP_INP_WLOCK(stcb->sctp_ep);
 1919                 SCTP_TCB_LOCK(stcb);
 1920                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1921                 /* send up all the data */
 1922                 SCTP_TCB_SEND_LOCK(stcb);
 1923 
 1924                 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);
 1925                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 1926                         stcb->asoc.strmout[i].chunks_on_queues = 0;
 1927 #if defined(SCTP_DETAILED_STR_STATS)
 1928                         for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
 1929                                 asoc->strmout[i].abandoned_sent[j] = 0;
 1930                                 asoc->strmout[i].abandoned_unsent[j] = 0;
 1931                         }
 1932 #else
 1933                         asoc->strmout[i].abandoned_sent[0] = 0;
 1934                         asoc->strmout[i].abandoned_unsent[0] = 0;
 1935 #endif
 1936                         stcb->asoc.strmout[i].stream_no = i;
 1937                         stcb->asoc.strmout[i].next_sequence_send = 0;
 1938                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
 1939                 }
 1940                 /* process the INIT-ACK info (my info) */
 1941                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
 1942                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 1943 
 1944                 /* pull from vtag hash */
 1945                 LIST_REMOVE(stcb, sctp_asocs);
 1946                 /* re-insert to new vtag position */
 1947                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
 1948                     SCTP_BASE_INFO(hashasocmark))];
 1949                 /*
 1950                  * put it in the bucket in the vtag hash of assoc's for the
 1951                  * system
 1952                  */
 1953                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 1954 
 1955                 SCTP_TCB_SEND_UNLOCK(stcb);
 1956                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 1957                 SCTP_INP_INFO_WUNLOCK();
 1958 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1959                 SCTP_SOCKET_UNLOCK(so, 1);
 1960 #endif
 1961                 asoc->total_flight = 0;
 1962                 asoc->total_flight_count = 0;
 1963                 /* process the INIT info (peer's info) */
 1964                 retval = sctp_process_init(init_cp, stcb);
 1965                 if (retval < 0) {
 1966                         if (how_indx < sizeof(asoc->cookie_how))
 1967                                 asoc->cookie_how[how_indx] = 13;
 1968 
 1969                         return (NULL);
 1970                 }
 1971                 /*
 1972                  * since we did not send a HB make sure we don't double
 1973                  * things
 1974                  */
 1975                 net->hb_responded = 1;
 1976 
 1977                 if (sctp_load_addresses_from_init(stcb, m,
 1978                     init_offset + sizeof(struct sctp_init_chunk),
 1979                     initack_offset, src, dst, init_src)) {
 1980                         if (how_indx < sizeof(asoc->cookie_how))
 1981                                 asoc->cookie_how[how_indx] = 14;
 1982 
 1983                         return (NULL);
 1984                 }
 1985                 /* respond with a COOKIE-ACK */
 1986                 sctp_stop_all_cookie_timers(stcb);
 1987                 sctp_toss_old_cookies(stcb, asoc);
 1988                 sctp_send_cookie_ack(stcb);
 1989                 if (how_indx < sizeof(asoc->cookie_how))
 1990                         asoc->cookie_how[how_indx] = 15;
 1991 
 1992                 return (stcb);
 1993         }
 1994         if (how_indx < sizeof(asoc->cookie_how))
 1995                 asoc->cookie_how[how_indx] = 16;
 1996         /* all other cases... */
 1997         return (NULL);
 1998 }
 1999 
 2000 
 2001 /*
 2002  * handle a state cookie for a new association m: input packet mbuf chain--
 2003  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
 2004  * and the cookie signature does not exist offset: offset into mbuf to the
 2005  * cookie-echo chunk length: length of the cookie chunk to: where the init
 2006  * was from returns a new TCB
 2007  */
 2008 static struct sctp_tcb *
 2009 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 2010     struct sockaddr *src, struct sockaddr *dst,
 2011     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 2012     struct sctp_inpcb *inp, struct sctp_nets **netp,
 2013     struct sockaddr *init_src, int *notification,
 2014     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 2015     uint8_t use_mflowid, uint32_t mflowid,
 2016     uint32_t vrf_id, uint16_t port)
 2017 {
 2018         struct sctp_tcb *stcb;
 2019         struct sctp_init_chunk *init_cp, init_buf;
 2020         struct sctp_init_ack_chunk *initack_cp, initack_buf;
 2021         union sctp_sockstore store;
 2022         struct sctp_association *asoc;
 2023         int init_offset, initack_offset, initack_limit;
 2024         int retval;
 2025         int error = 0;
 2026         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
 2027 
 2028 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2029         struct socket *so;
 2030 
 2031         so = SCTP_INP_SO(inp);
 2032 #endif
 2033 
 2034         /*
 2035          * find and validate the INIT chunk in the cookie (peer's info) the
 2036          * INIT should start after the cookie-echo header struct (chunk
 2037          * header, state cookie header struct)
 2038          */
 2039         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
 2040         init_cp = (struct sctp_init_chunk *)
 2041             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
 2042             (uint8_t *) & init_buf);
 2043         if (init_cp == NULL) {
 2044                 /* could not pull a INIT chunk in cookie */
 2045                 SCTPDBG(SCTP_DEBUG_INPUT1,
 2046                     "process_cookie_new: could not pull INIT chunk hdr\n");
 2047                 return (NULL);
 2048         }
 2049         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
 2050                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
 2051                 return (NULL);
 2052         }
 2053         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
 2054         /*
 2055          * find and validate the INIT-ACK chunk in the cookie (my info) the
 2056          * INIT-ACK follows the INIT chunk
 2057          */
 2058         initack_cp = (struct sctp_init_ack_chunk *)
 2059             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
 2060             (uint8_t *) & initack_buf);
 2061         if (initack_cp == NULL) {
 2062                 /* could not pull INIT-ACK chunk in cookie */
 2063                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
 2064                 return (NULL);
 2065         }
 2066         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
 2067                 return (NULL);
 2068         }
 2069         /*
 2070          * NOTE: We can't use the INIT_ACK's chk_length to determine the
 2071          * "initack_limit" value.  This is because the chk_length field
 2072          * includes the length of the cookie, but the cookie is omitted when
 2073          * the INIT and INIT_ACK are tacked onto the cookie...
 2074          */
 2075         initack_limit = offset + cookie_len;
 2076 
 2077         /*
 2078          * now that we know the INIT/INIT-ACK are in place, create a new TCB
 2079          * and popluate
 2080          */
 2081 
 2082         /*
 2083          * Here we do a trick, we set in NULL for the proc/thread argument.
 2084          * We do this since in effect we only use the p argument when the
 2085          * socket is unbound and we must do an implicit bind. Since we are
 2086          * getting a cookie, we cannot be unbound.
 2087          */
 2088         stcb = sctp_aloc_assoc(inp, init_src, &error,
 2089             ntohl(initack_cp->init.initiate_tag), vrf_id,
 2090             (struct thread *)NULL
 2091             );
 2092         if (stcb == NULL) {
 2093                 struct mbuf *op_err;
 2094 
 2095                 /* memory problem? */
 2096                 SCTPDBG(SCTP_DEBUG_INPUT1,
 2097                     "process_cookie_new: no room for another TCB!\n");
 2098                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 2099                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
 2100                     src, dst, sh, op_err,
 2101                     use_mflowid, mflowid,
 2102                     vrf_id, port);
 2103                 return (NULL);
 2104         }
 2105         /* get the correct sctp_nets */
 2106         if (netp)
 2107                 *netp = sctp_findnet(stcb, init_src);
 2108 
 2109         asoc = &stcb->asoc;
 2110         /* get scope variables out of cookie */
 2111         asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
 2112         asoc->scope.site_scope = cookie->site_scope;
 2113         asoc->scope.local_scope = cookie->local_scope;
 2114         asoc->scope.loopback_scope = cookie->loopback_scope;
 2115 
 2116         if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
 2117             (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
 2118                 struct mbuf *op_err;
 2119 
 2120                 /*
 2121                  * Houston we have a problem. The EP changed while the
 2122                  * cookie was in flight. Only recourse is to abort the
 2123                  * association.
 2124                  */
 2125                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2126                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 2127                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
 2128                     src, dst, sh, op_err,
 2129                     use_mflowid, mflowid,
 2130                     vrf_id, port);
 2131 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2132                 SCTP_TCB_UNLOCK(stcb);
 2133                 SCTP_SOCKET_LOCK(so, 1);
 2134                 SCTP_TCB_LOCK(stcb);
 2135 #endif
 2136                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2137                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 2138 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2139                 SCTP_SOCKET_UNLOCK(so, 1);
 2140 #endif
 2141                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2142                 return (NULL);
 2143         }
 2144         /* process the INIT-ACK info (my info) */
 2145         asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
 2146         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 2147         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
 2148         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
 2149         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
 2150         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 2151         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
 2152         asoc->str_reset_seq_in = asoc->init_seq_number;
 2153 
 2154         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 2155 
 2156         /* process the INIT info (peer's info) */
 2157         if (netp)
 2158                 retval = sctp_process_init(init_cp, stcb);
 2159         else
 2160                 retval = 0;
 2161         if (retval < 0) {
 2162                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2163 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2164                 SCTP_TCB_UNLOCK(stcb);
 2165                 SCTP_SOCKET_LOCK(so, 1);
 2166                 SCTP_TCB_LOCK(stcb);
 2167 #endif
 2168                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 2169 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2170                 SCTP_SOCKET_UNLOCK(so, 1);
 2171 #endif
 2172                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2173                 return (NULL);
 2174         }
 2175         /* load all addresses */
 2176         if (sctp_load_addresses_from_init(stcb, m,
 2177             init_offset + sizeof(struct sctp_init_chunk), initack_offset,
 2178             src, dst, init_src)) {
 2179                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2180 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2181                 SCTP_TCB_UNLOCK(stcb);
 2182                 SCTP_SOCKET_LOCK(so, 1);
 2183                 SCTP_TCB_LOCK(stcb);
 2184 #endif
 2185                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
 2186 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2187                 SCTP_SOCKET_UNLOCK(so, 1);
 2188 #endif
 2189                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2190                 return (NULL);
 2191         }
 2192         /*
 2193          * verify any preceding AUTH chunk that was skipped
 2194          */
 2195         /* pull the local authentication parameters from the cookie/init-ack */
 2196         sctp_auth_get_cookie_params(stcb, m,
 2197             initack_offset + sizeof(struct sctp_init_ack_chunk),
 2198             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
 2199         if (auth_skipped) {
 2200                 struct sctp_auth_chunk *auth;
 2201 
 2202                 auth = (struct sctp_auth_chunk *)
 2203                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
 2204                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
 2205                         /* auth HMAC failed, dump the assoc and packet */
 2206                         SCTPDBG(SCTP_DEBUG_AUTH1,
 2207                             "COOKIE-ECHO: AUTH failed\n");
 2208                         atomic_add_int(&stcb->asoc.refcnt, 1);
 2209 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2210                         SCTP_TCB_UNLOCK(stcb);
 2211                         SCTP_SOCKET_LOCK(so, 1);
 2212                         SCTP_TCB_LOCK(stcb);
 2213 #endif
 2214                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
 2215 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2216                         SCTP_SOCKET_UNLOCK(so, 1);
 2217 #endif
 2218                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2219                         return (NULL);
 2220                 } else {
 2221                         /* remaining chunks checked... good to go */
 2222                         stcb->asoc.authenticated = 1;
 2223                 }
 2224         }
 2225         /* update current state */
 2226         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
 2227         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 2228         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 2229                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 2230                     stcb->sctp_ep, stcb, asoc->primary_destination);
 2231         }
 2232         sctp_stop_all_cookie_timers(stcb);
 2233         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
 2234         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 2235 
 2236         /*
 2237          * if we're doing ASCONFs, check to see if we have any new local
 2238          * addresses that need to get added to the peer (eg. addresses
 2239          * changed while cookie echo in flight).  This needs to be done
 2240          * after we go to the OPEN state to do the correct asconf
 2241          * processing. else, make sure we have the correct addresses in our
 2242          * lists
 2243          */
 2244 
 2245         /* warning, we re-use sin, sin6, sa_store here! */
 2246         /* pull in local_address (our "from" address) */
 2247         switch (cookie->laddr_type) {
 2248 #ifdef INET
 2249         case SCTP_IPV4_ADDRESS:
 2250                 /* source addr is IPv4 */
 2251                 memset(&store.sin, 0, sizeof(struct sockaddr_in));
 2252                 store.sin.sin_family = AF_INET;
 2253                 store.sin.sin_len = sizeof(struct sockaddr_in);
 2254                 store.sin.sin_addr.s_addr = cookie->laddress[0];
 2255                 break;
 2256 #endif
 2257 #ifdef INET6
 2258         case SCTP_IPV6_ADDRESS:
 2259                 /* source addr is IPv6 */
 2260                 memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
 2261                 store.sin6.sin6_family = AF_INET6;
 2262                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
 2263                 store.sin6.sin6_scope_id = cookie->scope_id;
 2264                 memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
 2265                 break;
 2266 #endif
 2267         default:
 2268                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2269 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2270                 SCTP_TCB_UNLOCK(stcb);
 2271                 SCTP_SOCKET_LOCK(so, 1);
 2272                 SCTP_TCB_LOCK(stcb);
 2273 #endif
 2274                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
 2275 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2276                 SCTP_SOCKET_UNLOCK(so, 1);
 2277 #endif
 2278                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2279                 return (NULL);
 2280         }
 2281 
 2282         /* set up to notify upper layer */
 2283         *notification = SCTP_NOTIFY_ASSOC_UP;
 2284         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 2285             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 2286             (inp->sctp_socket->so_qlimit == 0)) {
 2287                 /*
 2288                  * This is an endpoint that called connect() how it got a
 2289                  * cookie that is NEW is a bit of a mystery. It must be that
 2290                  * the INIT was sent, but before it got there.. a complete
 2291                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
 2292                  * should have went to the other code.. not here.. oh well..
 2293                  * a bit of protection is worth having..
 2294                  */
 2295                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
 2296 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2297                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2298                 SCTP_TCB_UNLOCK(stcb);
 2299                 SCTP_SOCKET_LOCK(so, 1);
 2300                 SCTP_TCB_LOCK(stcb);
 2301                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2302                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 2303                         SCTP_SOCKET_UNLOCK(so, 1);
 2304                         return (NULL);
 2305                 }
 2306 #endif
 2307                 soisconnected(stcb->sctp_socket);
 2308 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2309                 SCTP_SOCKET_UNLOCK(so, 1);
 2310 #endif
 2311         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 2312             (inp->sctp_socket->so_qlimit)) {
 2313                 /*
 2314                  * We don't want to do anything with this one. Since it is
 2315                  * the listening guy. The timer will get started for
 2316                  * accepted connections in the caller.
 2317                  */
 2318                 ;
 2319         }
 2320         /* since we did not send a HB make sure we don't double things */
 2321         if ((netp) && (*netp))
 2322                 (*netp)->hb_responded = 1;
 2323 
 2324         if (stcb->asoc.sctp_autoclose_ticks &&
 2325             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 2326                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
 2327         }
 2328         /* calculate the RTT */
 2329         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
 2330         if ((netp) && (*netp)) {
 2331                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
 2332                     &cookie->time_entered, sctp_align_unsafe_makecopy,
 2333                     SCTP_RTT_FROM_NON_DATA);
 2334         }
 2335         /* respond with a COOKIE-ACK */
 2336         sctp_send_cookie_ack(stcb);
 2337 
 2338         /*
 2339          * check the address lists for any ASCONFs that need to be sent
 2340          * AFTER the cookie-ack is sent
 2341          */
 2342         sctp_check_address_list(stcb, m,
 2343             initack_offset + sizeof(struct sctp_init_ack_chunk),
 2344             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
 2345             &store.sa, cookie->local_scope, cookie->site_scope,
 2346             cookie->ipv4_scope, cookie->loopback_scope);
 2347 
 2348 
 2349         return (stcb);
 2350 }
 2351 
 2352 /*
 2353  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
 2354  * we NEED to make sure we are not already using the vtag. If so we
 2355  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
 2356         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
 2357                                                             SCTP_BASE_INFO(hashasocmark))];
 2358         LIST_FOREACH(stcb, head, sctp_asocs) {
 2359                 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
 2360                        -- SEND ABORT - TRY AGAIN --
 2361                 }
 2362         }
 2363 */
 2364 
 2365 /*
 2366  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
 2367  * existing (non-NULL) TCB
 2368  */
 2369 static struct mbuf *
 2370 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 2371     struct sockaddr *src, struct sockaddr *dst,
 2372     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
 2373     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
 2374     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 2375     struct sctp_tcb **locked_tcb,
 2376     uint8_t use_mflowid, uint32_t mflowid,
 2377     uint32_t vrf_id, uint16_t port)
 2378 {
 2379         struct sctp_state_cookie *cookie;
 2380         struct sctp_tcb *l_stcb = *stcb;
 2381         struct sctp_inpcb *l_inp;
 2382         struct sockaddr *to;
 2383         struct sctp_pcb *ep;
 2384         struct mbuf *m_sig;
 2385         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
 2386         uint8_t *sig;
 2387         uint8_t cookie_ok = 0;
 2388         unsigned int sig_offset, cookie_offset;
 2389         unsigned int cookie_len;
 2390         struct timeval now;
 2391         struct timeval time_expires;
 2392         int notification = 0;
 2393         struct sctp_nets *netl;
 2394         int had_a_existing_tcb = 0;
 2395         int send_int_conf = 0;
 2396 
 2397 #ifdef INET
 2398         struct sockaddr_in sin;
 2399 
 2400 #endif
 2401 #ifdef INET6
 2402         struct sockaddr_in6 sin6;
 2403 
 2404 #endif
 2405 
 2406         SCTPDBG(SCTP_DEBUG_INPUT2,
 2407             "sctp_handle_cookie: handling COOKIE-ECHO\n");
 2408 
 2409         if (inp_p == NULL) {
 2410                 return (NULL);
 2411         }
 2412         cookie = &cp->cookie;
 2413         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
 2414         cookie_len = ntohs(cp->ch.chunk_length);
 2415 
 2416         if ((cookie->peerport != sh->src_port) &&
 2417             (cookie->myport != sh->dest_port) &&
 2418             (cookie->my_vtag != sh->v_tag)) {
 2419                 /*
 2420                  * invalid ports or bad tag.  Note that we always leave the
 2421                  * v_tag in the header in network order and when we stored
 2422                  * it in the my_vtag slot we also left it in network order.
 2423                  * This maintains the match even though it may be in the
 2424                  * opposite byte order of the machine :->
 2425                  */
 2426                 return (NULL);
 2427         }
 2428         if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
 2429             sizeof(struct sctp_init_chunk) +
 2430             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
 2431                 /* cookie too small */
 2432                 return (NULL);
 2433         }
 2434         /*
 2435          * split off the signature into its own mbuf (since it should not be
 2436          * calculated in the sctp_hmac_m() call).
 2437          */
 2438         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
 2439         m_sig = m_split(m, sig_offset, M_NOWAIT);
 2440         if (m_sig == NULL) {
 2441                 /* out of memory or ?? */
 2442                 return (NULL);
 2443         }
 2444 #ifdef SCTP_MBUF_LOGGING
 2445         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 2446                 struct mbuf *mat;
 2447 
 2448                 for (mat = m_sig; mat; mat = SCTP_BUF_NEXT(mat)) {
 2449                         if (SCTP_BUF_IS_EXTENDED(mat)) {
 2450                                 sctp_log_mb(mat, SCTP_MBUF_SPLIT);
 2451                         }
 2452                 }
 2453         }
 2454 #endif
 2455 
 2456         /*
 2457          * compute the signature/digest for the cookie
 2458          */
 2459         ep = &(*inp_p)->sctp_ep;
 2460         l_inp = *inp_p;
 2461         if (l_stcb) {
 2462                 SCTP_TCB_UNLOCK(l_stcb);
 2463         }
 2464         SCTP_INP_RLOCK(l_inp);
 2465         if (l_stcb) {
 2466                 SCTP_TCB_LOCK(l_stcb);
 2467         }
 2468         /* which cookie is it? */
 2469         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
 2470             (ep->current_secret_number != ep->last_secret_number)) {
 2471                 /* it's the old cookie */
 2472                 (void)sctp_hmac_m(SCTP_HMAC,
 2473                     (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
 2474                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2475         } else {
 2476                 /* it's the current cookie */
 2477                 (void)sctp_hmac_m(SCTP_HMAC,
 2478                     (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
 2479                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2480         }
 2481         /* get the signature */
 2482         SCTP_INP_RUNLOCK(l_inp);
 2483         sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
 2484         if (sig == NULL) {
 2485                 /* couldn't find signature */
 2486                 sctp_m_freem(m_sig);
 2487                 return (NULL);
 2488         }
 2489         /* compare the received digest with the computed digest */
 2490         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
 2491                 /* try the old cookie? */
 2492                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
 2493                     (ep->current_secret_number != ep->last_secret_number)) {
 2494                         /* compute digest with old */
 2495                         (void)sctp_hmac_m(SCTP_HMAC,
 2496                             (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
 2497                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2498                         /* compare */
 2499                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
 2500                                 cookie_ok = 1;
 2501                 }
 2502         } else {
 2503                 cookie_ok = 1;
 2504         }
 2505 
 2506         /*
 2507          * Now before we continue we must reconstruct our mbuf so that
 2508          * normal processing of any other chunks will work.
 2509          */
 2510         {
 2511                 struct mbuf *m_at;
 2512 
 2513                 m_at = m;
 2514                 while (SCTP_BUF_NEXT(m_at) != NULL) {
 2515                         m_at = SCTP_BUF_NEXT(m_at);
 2516                 }
 2517                 SCTP_BUF_NEXT(m_at) = m_sig;
 2518         }
 2519 
 2520         if (cookie_ok == 0) {
 2521                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
 2522                 SCTPDBG(SCTP_DEBUG_INPUT2,
 2523                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
 2524                     (uint32_t) offset, cookie_offset, sig_offset);
 2525                 return (NULL);
 2526         }
 2527         /*
 2528          * check the cookie timestamps to be sure it's not stale
 2529          */
 2530         (void)SCTP_GETTIME_TIMEVAL(&now);
 2531         /* Expire time is in Ticks, so we convert to seconds */
 2532         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
 2533         time_expires.tv_usec = cookie->time_entered.tv_usec;
 2534         /*
 2535          * TODO sctp_constants.h needs alternative time macros when _KERNEL
 2536          * is undefined.
 2537          */
 2538         if (timevalcmp(&now, &time_expires, >)) {
 2539                 /* cookie is stale! */
 2540                 struct mbuf *op_err;
 2541                 struct sctp_stale_cookie_msg *scm;
 2542                 uint32_t tim;
 2543 
 2544                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
 2545                     0, M_NOWAIT, 1, MT_DATA);
 2546                 if (op_err == NULL) {
 2547                         /* FOOBAR */
 2548                         return (NULL);
 2549                 }
 2550                 /* Set the len */
 2551                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
 2552                 scm = mtod(op_err, struct sctp_stale_cookie_msg *);
 2553                 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
 2554                 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
 2555                     (sizeof(uint32_t))));
 2556                 /* seconds to usec */
 2557                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
 2558                 /* add in usec */
 2559                 if (tim == 0)
 2560                         tim = now.tv_usec - cookie->time_entered.tv_usec;
 2561                 scm->time_usec = htonl(tim);
 2562                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
 2563                     use_mflowid, mflowid,
 2564                     vrf_id, port);
 2565                 return (NULL);
 2566         }
 2567         /*
 2568          * Now we must see with the lookup address if we have an existing
 2569          * asoc. This will only happen if we were in the COOKIE-WAIT state
 2570          * and a INIT collided with us and somewhere the peer sent the
 2571          * cookie on another address besides the single address our assoc
 2572          * had for him. In this case we will have one of the tie-tags set at
 2573          * least AND the address field in the cookie can be used to look it
 2574          * up.
 2575          */
 2576         to = NULL;
 2577         switch (cookie->addr_type) {
 2578 #ifdef INET6
 2579         case SCTP_IPV6_ADDRESS:
 2580                 memset(&sin6, 0, sizeof(sin6));
 2581                 sin6.sin6_family = AF_INET6;
 2582                 sin6.sin6_len = sizeof(sin6);
 2583                 sin6.sin6_port = sh->src_port;
 2584                 sin6.sin6_scope_id = cookie->scope_id;
 2585                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
 2586                     sizeof(sin6.sin6_addr.s6_addr));
 2587                 to = (struct sockaddr *)&sin6;
 2588                 break;
 2589 #endif
 2590 #ifdef INET
 2591         case SCTP_IPV4_ADDRESS:
 2592                 memset(&sin, 0, sizeof(sin));
 2593                 sin.sin_family = AF_INET;
 2594                 sin.sin_len = sizeof(sin);
 2595                 sin.sin_port = sh->src_port;
 2596                 sin.sin_addr.s_addr = cookie->address[0];
 2597                 to = (struct sockaddr *)&sin;
 2598                 break;
 2599 #endif
 2600         default:
 2601                 /* This should not happen */
 2602                 return (NULL);
 2603         }
 2604         if ((*stcb == NULL) && to) {
 2605                 /* Yep, lets check */
 2606                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
 2607                 if (*stcb == NULL) {
 2608                         /*
 2609                          * We should have only got back the same inp. If we
 2610                          * got back a different ep we have a problem. The
 2611                          * original findep got back l_inp and now
 2612                          */
 2613                         if (l_inp != *inp_p) {
 2614                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
 2615                         }
 2616                 } else {
 2617                         if (*locked_tcb == NULL) {
 2618                                 /*
 2619                                  * In this case we found the assoc only
 2620                                  * after we locked the create lock. This
 2621                                  * means we are in a colliding case and we
 2622                                  * must make sure that we unlock the tcb if
 2623                                  * its one of the cases where we throw away
 2624                                  * the incoming packets.
 2625                                  */
 2626                                 *locked_tcb = *stcb;
 2627 
 2628                                 /*
 2629                                  * We must also increment the inp ref count
 2630                                  * since the ref_count flags was set when we
 2631                                  * did not find the TCB, now we found it
 2632                                  * which reduces the refcount.. we must
 2633                                  * raise it back out to balance it all :-)
 2634                                  */
 2635                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
 2636                                 if ((*stcb)->sctp_ep != l_inp) {
 2637                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
 2638                                             (void *)(*stcb)->sctp_ep, (void *)l_inp);
 2639                                 }
 2640                         }
 2641                 }
 2642         }
 2643         if (to == NULL) {
 2644                 return (NULL);
 2645         }
 2646         cookie_len -= SCTP_SIGNATURE_SIZE;
 2647         if (*stcb == NULL) {
 2648                 /* this is the "normal" case... get a new TCB */
 2649                 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
 2650                     cookie, cookie_len, *inp_p,
 2651                     netp, to, &notification,
 2652                     auth_skipped, auth_offset, auth_len,
 2653                     use_mflowid, mflowid,
 2654                     vrf_id, port);
 2655         } else {
 2656                 /* this is abnormal... cookie-echo on existing TCB */
 2657                 had_a_existing_tcb = 1;
 2658                 *stcb = sctp_process_cookie_existing(m, iphlen, offset,
 2659                     src, dst, sh,
 2660                     cookie, cookie_len, *inp_p, *stcb, netp, to,
 2661                     &notification, auth_skipped, auth_offset, auth_len,
 2662                     use_mflowid, mflowid,
 2663                     vrf_id, port);
 2664         }
 2665 
 2666         if (*stcb == NULL) {
 2667                 /* still no TCB... must be bad cookie-echo */
 2668                 return (NULL);
 2669         }
 2670         if ((*netp != NULL) && (use_mflowid != 0)) {
 2671                 (*netp)->flowid = mflowid;
 2672 #ifdef INVARIANTS
 2673                 (*netp)->flowidset = 1;
 2674 #endif
 2675         }
 2676         /*
 2677          * Ok, we built an association so confirm the address we sent the
 2678          * INIT-ACK to.
 2679          */
 2680         netl = sctp_findnet(*stcb, to);
 2681         /*
 2682          * This code should in theory NOT run but
 2683          */
 2684         if (netl == NULL) {
 2685                 /* TSNH! Huh, why do I need to add this address here? */
 2686                 if (sctp_add_remote_addr(*stcb, to, NULL, SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
 2687                         return (NULL);
 2688                 }
 2689                 netl = sctp_findnet(*stcb, to);
 2690         }
 2691         if (netl) {
 2692                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
 2693                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 2694                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
 2695                             netl);
 2696                         send_int_conf = 1;
 2697                 }
 2698         }
 2699         sctp_start_net_timers(*stcb);
 2700         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 2701                 if (!had_a_existing_tcb ||
 2702                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
 2703                         /*
 2704                          * If we have a NEW cookie or the connect never
 2705                          * reached the connected state during collision we
 2706                          * must do the TCP accept thing.
 2707                          */
 2708                         struct socket *so, *oso;
 2709                         struct sctp_inpcb *inp;
 2710 
 2711                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
 2712                                 /*
 2713                                  * For a restart we will keep the same
 2714                                  * socket, no need to do anything. I THINK!!
 2715                                  */
 2716                                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2717                                 if (send_int_conf) {
 2718                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2719                                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2720                                 }
 2721                                 return (m);
 2722                         }
 2723                         oso = (*inp_p)->sctp_socket;
 2724                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2725                         SCTP_TCB_UNLOCK((*stcb));
 2726                         CURVNET_SET(oso->so_vnet);
 2727                         so = sonewconn(oso, 0
 2728                             );
 2729                         CURVNET_RESTORE();
 2730                         SCTP_TCB_LOCK((*stcb));
 2731                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2732 
 2733                         if (so == NULL) {
 2734                                 struct mbuf *op_err;
 2735 
 2736 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2737                                 struct socket *pcb_so;
 2738 
 2739 #endif
 2740                                 /* Too many sockets */
 2741                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
 2742                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 2743                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
 2744                                     src, dst, sh, op_err,
 2745                                     use_mflowid, mflowid,
 2746                                     vrf_id, port);
 2747 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2748                                 pcb_so = SCTP_INP_SO(*inp_p);
 2749                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2750                                 SCTP_TCB_UNLOCK((*stcb));
 2751                                 SCTP_SOCKET_LOCK(pcb_so, 1);
 2752                                 SCTP_TCB_LOCK((*stcb));
 2753                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2754 #endif
 2755                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
 2756 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2757                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
 2758 #endif
 2759                                 return (NULL);
 2760                         }
 2761                         inp = (struct sctp_inpcb *)so->so_pcb;
 2762                         SCTP_INP_INCR_REF(inp);
 2763                         /*
 2764                          * We add the unbound flag here so that if we get an
 2765                          * soabort() before we get the move_pcb done, we
 2766                          * will properly cleanup.
 2767                          */
 2768                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
 2769                             SCTP_PCB_FLAGS_CONNECTED |
 2770                             SCTP_PCB_FLAGS_IN_TCPPOOL |
 2771                             SCTP_PCB_FLAGS_UNBOUND |
 2772                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
 2773                             SCTP_PCB_FLAGS_DONT_WAKE);
 2774                         inp->sctp_features = (*inp_p)->sctp_features;
 2775                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
 2776                         inp->sctp_socket = so;
 2777                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
 2778                         inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
 2779                         inp->ecn_supported = (*inp_p)->ecn_supported;
 2780                         inp->prsctp_supported = (*inp_p)->prsctp_supported;
 2781                         inp->auth_supported = (*inp_p)->auth_supported;
 2782                         inp->asconf_supported = (*inp_p)->asconf_supported;
 2783                         inp->reconfig_supported = (*inp_p)->reconfig_supported;
 2784                         inp->nrsack_supported = (*inp_p)->nrsack_supported;
 2785                         inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
 2786                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
 2787                         inp->sctp_context = (*inp_p)->sctp_context;
 2788                         inp->local_strreset_support = (*inp_p)->local_strreset_support;
 2789                         inp->inp_starting_point_for_iterator = NULL;
 2790                         /*
 2791                          * copy in the authentication parameters from the
 2792                          * original endpoint
 2793                          */
 2794                         if (inp->sctp_ep.local_hmacs)
 2795                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
 2796                         inp->sctp_ep.local_hmacs =
 2797                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
 2798                         if (inp->sctp_ep.local_auth_chunks)
 2799                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
 2800                         inp->sctp_ep.local_auth_chunks =
 2801                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
 2802 
 2803                         /*
 2804                          * Now we must move it from one hash table to
 2805                          * another and get the tcb in the right place.
 2806                          */
 2807 
 2808                         /*
 2809                          * This is where the one-2-one socket is put into
 2810                          * the accept state waiting for the accept!
 2811                          */
 2812                         if (*stcb) {
 2813                                 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
 2814                         }
 2815                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
 2816 
 2817                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2818                         SCTP_TCB_UNLOCK((*stcb));
 2819 
 2820                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
 2821                             0);
 2822                         SCTP_TCB_LOCK((*stcb));
 2823                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2824 
 2825 
 2826                         /*
 2827                          * now we must check to see if we were aborted while
 2828                          * the move was going on and the lock/unlock
 2829                          * happened.
 2830                          */
 2831                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 2832                                 /*
 2833                                  * yep it was, we leave the assoc attached
 2834                                  * to the socket since the sctp_inpcb_free()
 2835                                  * call will send an abort for us.
 2836                                  */
 2837                                 SCTP_INP_DECR_REF(inp);
 2838                                 return (NULL);
 2839                         }
 2840                         SCTP_INP_DECR_REF(inp);
 2841                         /* Switch over to the new guy */
 2842                         *inp_p = inp;
 2843                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2844                         if (send_int_conf) {
 2845                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2846                                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2847                         }
 2848                         /*
 2849                          * Pull it from the incomplete queue and wake the
 2850                          * guy
 2851                          */
 2852 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2853                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2854                         SCTP_TCB_UNLOCK((*stcb));
 2855                         SCTP_SOCKET_LOCK(so, 1);
 2856 #endif
 2857                         soisconnected(so);
 2858 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2859                         SCTP_TCB_LOCK((*stcb));
 2860                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2861                         SCTP_SOCKET_UNLOCK(so, 1);
 2862 #endif
 2863                         return (m);
 2864                 }
 2865         }
 2866         if (notification) {
 2867                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2868         }
 2869         if (send_int_conf) {
 2870                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2871                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2872         }
 2873         return (m);
 2874 }
 2875 
 2876 static void
 2877 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
 2878     struct sctp_tcb *stcb, struct sctp_nets *net)
 2879 {
 2880         /* cp must not be used, others call this without a c-ack :-) */
 2881         struct sctp_association *asoc;
 2882 
 2883         SCTPDBG(SCTP_DEBUG_INPUT2,
 2884             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
 2885         if ((stcb == NULL) || (net == NULL)) {
 2886                 return;
 2887         }
 2888         asoc = &stcb->asoc;
 2889 
 2890         sctp_stop_all_cookie_timers(stcb);
 2891         /* process according to association state */
 2892         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 2893                 /* state change only needed when I am in right state */
 2894                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
 2895                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 2896                 sctp_start_net_timers(stcb);
 2897                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 2898                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 2899                             stcb->sctp_ep, stcb, asoc->primary_destination);
 2900 
 2901                 }
 2902                 /* update RTO */
 2903                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 2904                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 2905                 if (asoc->overall_error_count == 0) {
 2906                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
 2907                             &asoc->time_entered, sctp_align_safe_nocopy,
 2908                             SCTP_RTT_FROM_NON_DATA);
 2909                 }
 2910                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 2911                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2912                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 2913                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 2914 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2915                         struct socket *so;
 2916 
 2917 #endif
 2918                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
 2919 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2920                         so = SCTP_INP_SO(stcb->sctp_ep);
 2921                         atomic_add_int(&stcb->asoc.refcnt, 1);
 2922                         SCTP_TCB_UNLOCK(stcb);
 2923                         SCTP_SOCKET_LOCK(so, 1);
 2924                         SCTP_TCB_LOCK(stcb);
 2925                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2926 #endif
 2927                         if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
 2928                                 soisconnected(stcb->sctp_socket);
 2929                         }
 2930 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2931                         SCTP_SOCKET_UNLOCK(so, 1);
 2932 #endif
 2933                 }
 2934                 /*
 2935                  * since we did not send a HB make sure we don't double
 2936                  * things
 2937                  */
 2938                 net->hb_responded = 1;
 2939 
 2940                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 2941                         /*
 2942                          * We don't need to do the asconf thing, nor hb or
 2943                          * autoclose if the socket is closed.
 2944                          */
 2945                         goto closed_socket;
 2946                 }
 2947                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 2948                     stcb, net);
 2949 
 2950 
 2951                 if (stcb->asoc.sctp_autoclose_ticks &&
 2952                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 2953                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
 2954                             stcb->sctp_ep, stcb, NULL);
 2955                 }
 2956                 /*
 2957                  * send ASCONF if parameters are pending and ASCONFs are
 2958                  * allowed (eg. addresses changed when init/cookie echo were
 2959                  * in flight)
 2960                  */
 2961                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
 2962                     (stcb->asoc.asconf_supported == 1) &&
 2963                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
 2964 #ifdef SCTP_TIMER_BASED_ASCONF
 2965                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2966                             stcb->sctp_ep, stcb,
 2967                             stcb->asoc.primary_destination);
 2968 #else
 2969                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
 2970                             SCTP_ADDR_NOT_LOCKED);
 2971 #endif
 2972                 }
 2973         }
 2974 closed_socket:
 2975         /* Toss the cookie if I can */
 2976         sctp_toss_old_cookies(stcb, asoc);
 2977         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
 2978                 /* Restart the timer if we have pending data */
 2979                 struct sctp_tmit_chunk *chk;
 2980 
 2981                 chk = TAILQ_FIRST(&asoc->sent_queue);
 2982                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
 2983         }
 2984 }
 2985 
 2986 static void
 2987 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
 2988     struct sctp_tcb *stcb)
 2989 {
 2990         struct sctp_nets *net;
 2991         struct sctp_tmit_chunk *lchk;
 2992         struct sctp_ecne_chunk bkup;
 2993         uint8_t override_bit;
 2994         uint32_t tsn, window_data_tsn;
 2995         int len;
 2996         unsigned int pkt_cnt;
 2997 
 2998         len = ntohs(cp->ch.chunk_length);
 2999         if ((len != sizeof(struct sctp_ecne_chunk)) &&
 3000             (len != sizeof(struct old_sctp_ecne_chunk))) {
 3001                 return;
 3002         }
 3003         if (len == sizeof(struct old_sctp_ecne_chunk)) {
 3004                 /* Its the old format */
 3005                 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
 3006                 bkup.num_pkts_since_cwr = htonl(1);
 3007                 cp = &bkup;
 3008         }
 3009         SCTP_STAT_INCR(sctps_recvecne);
 3010         tsn = ntohl(cp->tsn);
 3011         pkt_cnt = ntohl(cp->num_pkts_since_cwr);
 3012         lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
 3013         if (lchk == NULL) {
 3014                 window_data_tsn = stcb->asoc.sending_seq - 1;
 3015         } else {
 3016                 window_data_tsn = lchk->rec.data.TSN_seq;
 3017         }
 3018 
 3019         /* Find where it was sent to if possible. */
 3020         net = NULL;
 3021         TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
 3022                 if (lchk->rec.data.TSN_seq == tsn) {
 3023                         net = lchk->whoTo;
 3024                         net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
 3025                         break;
 3026                 }
 3027                 if (SCTP_TSN_GT(lchk->rec.data.TSN_seq, tsn)) {
 3028                         break;
 3029                 }
 3030         }
 3031         if (net == NULL) {
 3032                 /*
 3033                  * What to do. A previous send of a CWR was possibly lost.
 3034                  * See how old it is, we may have it marked on the actual
 3035                  * net.
 3036                  */
 3037                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 3038                         if (tsn == net->last_cwr_tsn) {
 3039                                 /* Found him, send it off */
 3040                                 break;
 3041                         }
 3042                 }
 3043                 if (net == NULL) {
 3044                         /*
 3045                          * If we reach here, we need to send a special CWR
 3046                          * that says hey, we did this a long time ago and
 3047                          * you lost the response.
 3048                          */
 3049                         net = TAILQ_FIRST(&stcb->asoc.nets);
 3050                         if (net == NULL) {
 3051                                 /* TSNH */
 3052                                 return;
 3053                         }
 3054                         override_bit = SCTP_CWR_REDUCE_OVERRIDE;
 3055                 } else {
 3056                         override_bit = 0;
 3057                 }
 3058         } else {
 3059                 override_bit = 0;
 3060         }
 3061         if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
 3062             ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
 3063                 /*
 3064                  * JRS - Use the congestion control given in the pluggable
 3065                  * CC module
 3066                  */
 3067                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
 3068                 /*
 3069                  * We reduce once every RTT. So we will only lower cwnd at
 3070                  * the next sending seq i.e. the window_data_tsn
 3071                  */
 3072                 net->cwr_window_tsn = window_data_tsn;
 3073                 net->ecn_ce_pkt_cnt += pkt_cnt;
 3074                 net->lost_cnt = pkt_cnt;
 3075                 net->last_cwr_tsn = tsn;
 3076         } else {
 3077                 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
 3078                 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
 3079                     ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
 3080                         /*
 3081                          * Another loss in the same window update how many
 3082                          * marks/packets lost we have had.
 3083                          */
 3084                         int cnt = 1;
 3085 
 3086                         if (pkt_cnt > net->lost_cnt) {
 3087                                 /* Should be the case */
 3088                                 cnt = (pkt_cnt - net->lost_cnt);
 3089                                 net->ecn_ce_pkt_cnt += cnt;
 3090                         }
 3091                         net->lost_cnt = pkt_cnt;
 3092                         net->last_cwr_tsn = tsn;
 3093                         /*
 3094                          * Most CC functions will ignore this call, since we
 3095                          * are in-window yet of the initial CE the peer saw.
 3096                          */
 3097                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
 3098                 }
 3099         }
 3100         /*
 3101          * We always send a CWR this way if our previous one was lost our
 3102          * peer will get an update, or if it is not time again to reduce we
 3103          * still get the cwr to the peer. Note we set the override when we
 3104          * could not find the TSN on the chunk or the destination network.
 3105          */
 3106         sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
 3107 }
 3108 
 3109 static void
 3110 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
 3111 {
 3112         /*
 3113          * Here we get a CWR from the peer. We must look in the outqueue and
 3114          * make sure that we have a covered ECNE in the control chunk part.
 3115          * If so remove it.
 3116          */
 3117         struct sctp_tmit_chunk *chk;
 3118         struct sctp_ecne_chunk *ecne;
 3119         int override;
 3120         uint32_t cwr_tsn;
 3121 
 3122         cwr_tsn = ntohl(cp->tsn);
 3123 
 3124         override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
 3125         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
 3126                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
 3127                         continue;
 3128                 }
 3129                 if ((override == 0) && (chk->whoTo != net)) {
 3130                         /* Must be from the right src unless override is set */
 3131                         continue;
 3132                 }
 3133                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
 3134                 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
 3135                         /* this covers this ECNE, we can remove it */
 3136                         stcb->asoc.ecn_echo_cnt_onq--;
 3137                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
 3138                             sctp_next);
 3139                         if (chk->data) {
 3140                                 sctp_m_freem(chk->data);
 3141                                 chk->data = NULL;
 3142                         }
 3143                         stcb->asoc.ctrl_queue_cnt--;
 3144                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 3145                         if (override == 0) {
 3146                                 break;
 3147                         }
 3148                 }
 3149         }
 3150 }
 3151 
 3152 static void
 3153 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
 3154     struct sctp_tcb *stcb, struct sctp_nets *net)
 3155 {
 3156         struct sctp_association *asoc;
 3157 
 3158 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3159         struct socket *so;
 3160 
 3161 #endif
 3162 
 3163         SCTPDBG(SCTP_DEBUG_INPUT2,
 3164             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
 3165         if (stcb == NULL)
 3166                 return;
 3167 
 3168         asoc = &stcb->asoc;
 3169         /* process according to association state */
 3170         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
 3171                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
 3172                 SCTPDBG(SCTP_DEBUG_INPUT2,
 3173                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
 3174                 SCTP_TCB_UNLOCK(stcb);
 3175                 return;
 3176         }
 3177         /* notify upper layer protocol */
 3178         if (stcb->sctp_socket) {
 3179                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 3180         }
 3181 #ifdef INVARIANTS
 3182         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 3183             !TAILQ_EMPTY(&asoc->sent_queue) ||
 3184             !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 3185                 panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
 3186         }
 3187 #endif
 3188         /* stop the timer */
 3189         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
 3190         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 3191         /* free the TCB */
 3192         SCTPDBG(SCTP_DEBUG_INPUT2,
 3193             "sctp_handle_shutdown_complete: calls free-asoc\n");
 3194 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3195         so = SCTP_INP_SO(stcb->sctp_ep);
 3196         atomic_add_int(&stcb->asoc.refcnt, 1);
 3197         SCTP_TCB_UNLOCK(stcb);
 3198         SCTP_SOCKET_LOCK(so, 1);
 3199         SCTP_TCB_LOCK(stcb);
 3200         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 3201 #endif
 3202         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
 3203 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3204         SCTP_SOCKET_UNLOCK(so, 1);
 3205 #endif
 3206         return;
 3207 }
 3208 
 3209 static int
 3210 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
 3211     struct sctp_nets *net, uint8_t flg)
 3212 {
 3213         switch (desc->chunk_type) {
 3214         case SCTP_DATA:
 3215                 /* find the tsn to resend (possibly */
 3216                 {
 3217                         uint32_t tsn;
 3218                         struct sctp_tmit_chunk *tp1;
 3219 
 3220                         tsn = ntohl(desc->tsn_ifany);
 3221                         TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3222                                 if (tp1->rec.data.TSN_seq == tsn) {
 3223                                         /* found it */
 3224                                         break;
 3225                                 }
 3226                                 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, tsn)) {
 3227                                         /* not found */
 3228                                         tp1 = NULL;
 3229                                         break;
 3230                                 }
 3231                         }
 3232                         if (tp1 == NULL) {
 3233                                 /*
 3234                                  * Do it the other way , aka without paying
 3235                                  * attention to queue seq order.
 3236                                  */
 3237                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
 3238                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3239                                         if (tp1->rec.data.TSN_seq == tsn) {
 3240                                                 /* found it */
 3241                                                 break;
 3242                                         }
 3243                                 }
 3244                         }
 3245                         if (tp1 == NULL) {
 3246                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
 3247                         }
 3248                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
 3249                                 uint8_t *ddp;
 3250 
 3251                                 if (((flg & SCTP_BADCRC) == 0) &&
 3252                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
 3253                                         return (0);
 3254                                 }
 3255                                 if ((stcb->asoc.peers_rwnd == 0) &&
 3256                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
 3257                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
 3258                                         return (0);
 3259                                 }
 3260                                 if (stcb->asoc.peers_rwnd == 0 &&
 3261                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
 3262                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
 3263                                         return (0);
 3264                                 }
 3265                                 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
 3266                                     sizeof(struct sctp_data_chunk));
 3267                                 {
 3268                                         unsigned int iii;
 3269 
 3270                                         for (iii = 0; iii < sizeof(desc->data_bytes);
 3271                                             iii++) {
 3272                                                 if (ddp[iii] != desc->data_bytes[iii]) {
 3273                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
 3274                                                         return (-1);
 3275                                                 }
 3276                                         }
 3277                                 }
 3278 
 3279                                 if (tp1->do_rtt) {
 3280                                         /*
 3281                                          * this guy had a RTO calculation
 3282                                          * pending on it, cancel it
 3283                                          */
 3284                                         if (tp1->whoTo->rto_needed == 0) {
 3285                                                 tp1->whoTo->rto_needed = 1;
 3286                                         }
 3287                                         tp1->do_rtt = 0;
 3288                                 }
 3289                                 SCTP_STAT_INCR(sctps_pdrpmark);
 3290                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
 3291                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3292                                 /*
 3293                                  * mark it as if we were doing a FR, since
 3294                                  * we will be getting gap ack reports behind
 3295                                  * the info from the router.
 3296                                  */
 3297                                 tp1->rec.data.doing_fast_retransmit = 1;
 3298                                 /*
 3299                                  * mark the tsn with what sequences can
 3300                                  * cause a new FR.
 3301                                  */
 3302                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
 3303                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
 3304                                 } else {
 3305                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
 3306                                 }
 3307 
 3308                                 /* restart the timer */
 3309                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 3310                                     stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
 3311                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 3312                                     stcb, tp1->whoTo);
 3313 
 3314                                 /* fix counts and things */
 3315                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
 3316                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
 3317                                             tp1->whoTo->flight_size,
 3318                                             tp1->book_size,
 3319                                             (uintptr_t) stcb,
 3320                                             tp1->rec.data.TSN_seq);
 3321                                 }
 3322                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
 3323                                         sctp_flight_size_decrease(tp1);
 3324                                         sctp_total_flight_decrease(stcb, tp1);
 3325                                 }
 3326                                 tp1->sent = SCTP_DATAGRAM_RESEND;
 3327                         } {
 3328                                 /* audit code */
 3329                                 unsigned int audit;
 3330 
 3331                                 audit = 0;
 3332                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3333                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
 3334                                                 audit++;
 3335                                 }
 3336                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
 3337                                     sctp_next) {
 3338                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
 3339                                                 audit++;
 3340                                 }
 3341                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
 3342                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
 3343                                             audit, stcb->asoc.sent_queue_retran_cnt);
 3344 #ifndef SCTP_AUDITING_ENABLED
 3345                                         stcb->asoc.sent_queue_retran_cnt = audit;
 3346 #endif
 3347                                 }
 3348                         }
 3349                 }
 3350                 break;
 3351         case SCTP_ASCONF:
 3352                 {
 3353                         struct sctp_tmit_chunk *asconf;
 3354 
 3355                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
 3356                             sctp_next) {
 3357                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
 3358                                         break;
 3359                                 }
 3360                         }
 3361                         if (asconf) {
 3362                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
 3363                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3364                                 asconf->sent = SCTP_DATAGRAM_RESEND;
 3365                                 asconf->snd_count--;
 3366                         }
 3367                 }
 3368                 break;
 3369         case SCTP_INITIATION:
 3370                 /* resend the INIT */
 3371                 stcb->asoc.dropped_special_cnt++;
 3372                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
 3373                         /*
 3374                          * If we can get it in, in a few attempts we do
 3375                          * this, otherwise we let the timer fire.
 3376                          */
 3377                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
 3378                             stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
 3379                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 3380                 }
 3381                 break;
 3382         case SCTP_SELECTIVE_ACK:
 3383         case SCTP_NR_SELECTIVE_ACK:
 3384                 /* resend the sack */
 3385                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
 3386                 break;
 3387         case SCTP_HEARTBEAT_REQUEST:
 3388                 /* resend a demand HB */
 3389                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
 3390                         /*
 3391                          * Only retransmit if we KNOW we wont destroy the
 3392                          * tcb
 3393                          */
 3394                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 3395                 }
 3396                 break;
 3397         case SCTP_SHUTDOWN:
 3398                 sctp_send_shutdown(stcb, net);
 3399                 break;
 3400         case SCTP_SHUTDOWN_ACK:
 3401                 sctp_send_shutdown_ack(stcb, net);
 3402                 break;
 3403         case SCTP_COOKIE_ECHO:
 3404                 {
 3405                         struct sctp_tmit_chunk *cookie;
 3406 
 3407                         cookie = NULL;
 3408                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
 3409                             sctp_next) {
 3410                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
 3411                                         break;
 3412                                 }
 3413                         }
 3414                         if (cookie) {
 3415                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
 3416                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3417                                 cookie->sent = SCTP_DATAGRAM_RESEND;
 3418                                 sctp_stop_all_cookie_timers(stcb);
 3419                         }
 3420                 }
 3421                 break;
 3422         case SCTP_COOKIE_ACK:
 3423                 sctp_send_cookie_ack(stcb);
 3424                 break;
 3425         case SCTP_ASCONF_ACK:
 3426                 /* resend last asconf ack */
 3427                 sctp_send_asconf_ack(stcb);
 3428                 break;
 3429         case SCTP_FORWARD_CUM_TSN:
 3430                 send_forward_tsn(stcb, &stcb->asoc);
 3431                 break;
 3432                 /* can't do anything with these */
 3433         case SCTP_PACKET_DROPPED:
 3434         case SCTP_INITIATION_ACK:       /* this should not happen */
 3435         case SCTP_HEARTBEAT_ACK:
 3436         case SCTP_ABORT_ASSOCIATION:
 3437         case SCTP_OPERATION_ERROR:
 3438         case SCTP_SHUTDOWN_COMPLETE:
 3439         case SCTP_ECN_ECHO:
 3440         case SCTP_ECN_CWR:
 3441         default:
 3442                 break;
 3443         }
 3444         return (0);
 3445 }
 3446 
 3447 void
 3448 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
 3449 {
 3450         uint32_t i;
 3451         uint16_t temp;
 3452 
 3453         /*
 3454          * We set things to 0xffff since this is the last delivered sequence
 3455          * and we will be sending in 0 after the reset.
 3456          */
 3457 
 3458         if (number_entries) {
 3459                 for (i = 0; i < number_entries; i++) {
 3460                         temp = ntohs(list[i]);
 3461                         if (temp >= stcb->asoc.streamincnt) {
 3462                                 continue;
 3463                         }
 3464                         stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
 3465                 }
 3466         } else {
 3467                 list = NULL;
 3468                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
 3469                         stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
 3470                 }
 3471         }
 3472         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
 3473 }
 3474 
 3475 static void
 3476 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
 3477 {
 3478         uint32_t i;
 3479         uint16_t temp;
 3480 
 3481         if (number_entries > 0) {
 3482                 for (i = 0; i < number_entries; i++) {
 3483                         temp = ntohs(list[i]);
 3484                         if (temp >= stcb->asoc.streamoutcnt) {
 3485                                 /* no such stream */
 3486                                 continue;
 3487                         }
 3488                         stcb->asoc.strmout[temp].next_sequence_send = 0;
 3489                 }
 3490         } else {
 3491                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 3492                         stcb->asoc.strmout[i].next_sequence_send = 0;
 3493                 }
 3494         }
 3495         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
 3496 }
 3497 
 3498 
 3499 struct sctp_stream_reset_request *
 3500 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
 3501 {
 3502         struct sctp_association *asoc;
 3503         struct sctp_chunkhdr *ch;
 3504         struct sctp_stream_reset_request *r;
 3505         struct sctp_tmit_chunk *chk;
 3506         int len, clen;
 3507 
 3508         asoc = &stcb->asoc;
 3509         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
 3510                 asoc->stream_reset_outstanding = 0;
 3511                 return (NULL);
 3512         }
 3513         if (stcb->asoc.str_reset == NULL) {
 3514                 asoc->stream_reset_outstanding = 0;
 3515                 return (NULL);
 3516         }
 3517         chk = stcb->asoc.str_reset;
 3518         if (chk->data == NULL) {
 3519                 return (NULL);
 3520         }
 3521         if (bchk) {
 3522                 /* he wants a copy of the chk pointer */
 3523                 *bchk = chk;
 3524         }
 3525         clen = chk->send_size;
 3526         ch = mtod(chk->data, struct sctp_chunkhdr *);
 3527         r = (struct sctp_stream_reset_request *)(ch + 1);
 3528         if (ntohl(r->request_seq) == seq) {
 3529                 /* found it */
 3530                 return (r);
 3531         }
 3532         len = SCTP_SIZE32(ntohs(r->ph.param_length));
 3533         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
 3534                 /* move to the next one, there can only be a max of two */
 3535                 r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
 3536                 if (ntohl(r->request_seq) == seq) {
 3537                         return (r);
 3538                 }
 3539         }
 3540         /* that seq is not here */
 3541         return (NULL);
 3542 }
 3543 
 3544 static void
 3545 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
 3546 {
 3547         struct sctp_association *asoc;
 3548         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
 3549 
 3550         if (stcb->asoc.str_reset == NULL) {
 3551                 return;
 3552         }
 3553         asoc = &stcb->asoc;
 3554 
 3555         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
 3556         TAILQ_REMOVE(&asoc->control_send_queue,
 3557             chk,
 3558             sctp_next);
 3559         if (chk->data) {
 3560                 sctp_m_freem(chk->data);
 3561                 chk->data = NULL;
 3562         }
 3563         asoc->ctrl_queue_cnt--;
 3564         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 3565         /* sa_ignore NO_NULL_CHK */
 3566         stcb->asoc.str_reset = NULL;
 3567 }
 3568 
 3569 
 3570 static int
 3571 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
 3572     uint32_t seq, uint32_t action,
 3573     struct sctp_stream_reset_response *respin)
 3574 {
 3575         uint16_t type;
 3576         int lparm_len;
 3577         struct sctp_association *asoc = &stcb->asoc;
 3578         struct sctp_tmit_chunk *chk;
 3579         struct sctp_stream_reset_request *req_param;
 3580         struct sctp_stream_reset_out_request *req_out_param;
 3581         struct sctp_stream_reset_in_request *req_in_param;
 3582         uint32_t number_entries;
 3583 
 3584         if (asoc->stream_reset_outstanding == 0) {
 3585                 /* duplicate */
 3586                 return (0);
 3587         }
 3588         if (seq == stcb->asoc.str_reset_seq_out) {
 3589                 req_param = sctp_find_stream_reset(stcb, seq, &chk);
 3590                 if (req_param != NULL) {
 3591                         stcb->asoc.str_reset_seq_out++;
 3592                         type = ntohs(req_param->ph.param_type);
 3593                         lparm_len = ntohs(req_param->ph.param_length);
 3594                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
 3595                                 req_out_param = (struct sctp_stream_reset_out_request *)req_param;
 3596                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
 3597                                 asoc->stream_reset_out_is_outstanding = 0;
 3598                                 if (asoc->stream_reset_outstanding)
 3599                                         asoc->stream_reset_outstanding--;
 3600                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3601                                         /* do it */
 3602                                         sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
 3603                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3604                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3605                                 } else {
 3606                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3607                                 }
 3608                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
 3609                                 req_in_param = (struct sctp_stream_reset_in_request *)req_param;
 3610                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
 3611                                 if (asoc->stream_reset_outstanding)
 3612                                         asoc->stream_reset_outstanding--;
 3613                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3614                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
 3615                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3616                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3617                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
 3618                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3619                                 }
 3620                         } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
 3621                                 /* Ok we now may have more streams */
 3622                                 int num_stream;
 3623 
 3624                                 num_stream = stcb->asoc.strm_pending_add_size;
 3625                                 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
 3626                                         /* TSNH */
 3627                                         num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
 3628                                 }
 3629                                 stcb->asoc.strm_pending_add_size = 0;
 3630                                 if (asoc->stream_reset_outstanding)
 3631                                         asoc->stream_reset_outstanding--;
 3632                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3633                                         /* Put the new streams into effect */
 3634                                         stcb->asoc.streamoutcnt += num_stream;
 3635                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
 3636                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3637                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3638                                             SCTP_STREAM_CHANGE_DENIED);
 3639                                 } else {
 3640                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3641                                             SCTP_STREAM_CHANGE_FAILED);
 3642                                 }
 3643                         } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
 3644                                 if (asoc->stream_reset_outstanding)
 3645                                         asoc->stream_reset_outstanding--;
 3646                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3647                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3648                                             SCTP_STREAM_CHANGE_DENIED);
 3649                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3650                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3651                                             SCTP_STREAM_CHANGE_FAILED);
 3652                                 }
 3653                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
 3654                                 /**
 3655                                  * a) Adopt the new in tsn.
 3656                                  * b) reset the map
 3657                                  * c) Adopt the new out-tsn
 3658                                  */
 3659                                 struct sctp_stream_reset_response_tsn *resp;
 3660                                 struct sctp_forward_tsn_chunk fwdtsn;
 3661                                 int abort_flag = 0;
 3662 
 3663                                 if (respin == NULL) {
 3664                                         /* huh ? */
 3665                                         return (0);
 3666                                 }
 3667                                 if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
 3668                                         return (0);
 3669                                 }
 3670                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3671                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
 3672                                         asoc->stream_reset_outstanding--;
 3673                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
 3674                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 3675                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
 3676                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
 3677                                         if (abort_flag) {
 3678                                                 return (1);
 3679                                         }
 3680                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
 3681                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 3682                                                 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 3683                                         }
 3684                                         stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
 3685                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
 3686                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
 3687 
 3688                                         stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
 3689                                         memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
 3690 
 3691                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
 3692                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
 3693 
 3694                                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
 3695                                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
 3696                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
 3697                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3698                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
 3699                                             SCTP_ASSOC_RESET_DENIED);
 3700                                 } else {
 3701                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
 3702                                             SCTP_ASSOC_RESET_FAILED);
 3703                                 }
 3704                         }
 3705                         /* get rid of the request and get the request flags */
 3706                         if (asoc->stream_reset_outstanding == 0) {
 3707                                 sctp_clean_up_stream_reset(stcb);
 3708                         }
 3709                 }
 3710         }
 3711         return (0);
 3712 }
 3713 
 3714 static void
 3715 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
 3716     struct sctp_tmit_chunk *chk,
 3717     struct sctp_stream_reset_in_request *req, int trunc)
 3718 {
 3719         uint32_t seq;
 3720         int len, i;
 3721         int number_entries;
 3722         uint16_t temp;
 3723 
 3724         /*
 3725          * peer wants me to send a str-reset to him for my outgoing seq's if
 3726          * seq_in is right.
 3727          */
 3728         struct sctp_association *asoc = &stcb->asoc;
 3729 
 3730         seq = ntohl(req->request_seq);
 3731         if (asoc->str_reset_seq_in == seq) {
 3732                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3733                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
 3734                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3735                 } else if (trunc) {
 3736                         /* Can't do it, since they exceeded our buffer size  */
 3737                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3738                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
 3739                         len = ntohs(req->ph.param_length);
 3740                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
 3741                         for (i = 0; i < number_entries; i++) {
 3742                                 temp = ntohs(req->list_of_streams[i]);
 3743                                 req->list_of_streams[i] = temp;
 3744                         }
 3745                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3746                         sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
 3747                             asoc->str_reset_seq_out,
 3748                             seq, (asoc->sending_seq - 1));
 3749                         asoc->stream_reset_out_is_outstanding = 1;
 3750                         asoc->str_reset = chk;
 3751                         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
 3752                         stcb->asoc.stream_reset_outstanding++;
 3753                 } else {
 3754                         /* Can't do it, since we have sent one out */
 3755                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
 3756                 }
 3757                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3758                 asoc->str_reset_seq_in++;
 3759         } else if (asoc->str_reset_seq_in - 1 == seq) {
 3760                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3761         } else if (asoc->str_reset_seq_in - 2 == seq) {
 3762                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3763         } else {
 3764                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3765         }
 3766 }
 3767 
 3768 static int
 3769 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
 3770     struct sctp_tmit_chunk *chk,
 3771     struct sctp_stream_reset_tsn_request *req)
 3772 {
 3773         /* reset all in and out and update the tsn */
 3774         /*
 3775          * A) reset my str-seq's on in and out. B) Select a receive next,
 3776          * and set cum-ack to it. Also process this selected number as a
 3777          * fwd-tsn as well. C) set in the response my next sending seq.
 3778          */
 3779         struct sctp_forward_tsn_chunk fwdtsn;
 3780         struct sctp_association *asoc = &stcb->asoc;
 3781         int abort_flag = 0;
 3782         uint32_t seq;
 3783 
 3784         seq = ntohl(req->request_seq);
 3785         if (asoc->str_reset_seq_in == seq) {
 3786                 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
 3787                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
 3788                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3789                 } else {
 3790                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
 3791                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 3792                         fwdtsn.ch.chunk_flags = 0;
 3793                         fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
 3794                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
 3795                         if (abort_flag) {
 3796                                 return (1);
 3797                         }
 3798                         asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
 3799                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 3800                                 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 3801                         }
 3802                         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
 3803                         asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
 3804                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
 3805                         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
 3806                         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
 3807                         atomic_add_int(&asoc->sending_seq, 1);
 3808                         /* save off historical data for retrans */
 3809                         asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
 3810                         asoc->last_sending_seq[0] = asoc->sending_seq;
 3811                         asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
 3812                         asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
 3813                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
 3814                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
 3815                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3816                         sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
 3817                 }
 3818                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
 3819                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
 3820                 asoc->str_reset_seq_in++;
 3821         } else if (asoc->str_reset_seq_in - 1 == seq) {
 3822                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
 3823                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
 3824         } else if (asoc->str_reset_seq_in - 2 == seq) {
 3825                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
 3826                     asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
 3827         } else {
 3828                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3829         }
 3830         return (0);
 3831 }
 3832 
 3833 static void
 3834 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
 3835     struct sctp_tmit_chunk *chk,
 3836     struct sctp_stream_reset_out_request *req, int trunc)
 3837 {
 3838         uint32_t seq, tsn;
 3839         int number_entries, len;
 3840         struct sctp_association *asoc = &stcb->asoc;
 3841 
 3842         seq = ntohl(req->request_seq);
 3843 
 3844         /* now if its not a duplicate we process it */
 3845         if (asoc->str_reset_seq_in == seq) {
 3846                 len = ntohs(req->ph.param_length);
 3847                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
 3848                 /*
 3849                  * the sender is resetting, handle the list issue.. we must
 3850                  * a) verify if we can do the reset, if so no problem b) If
 3851                  * we can't do the reset we must copy the request. c) queue
 3852                  * it, and setup the data in processor to trigger it off
 3853                  * when needed and dequeue all the queued data.
 3854                  */
 3855                 tsn = ntohl(req->send_reset_at_tsn);
 3856 
 3857                 /* move the reset action back one */
 3858                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3859                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
 3860                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3861                 } else if (trunc) {
 3862                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3863                 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
 3864                         /* we can do it now */
 3865                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
 3866                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3867                 } else {
 3868                         /*
 3869                          * we must queue it up and thus wait for the TSN's
 3870                          * to arrive that are at or before tsn
 3871                          */
 3872                         struct sctp_stream_reset_list *liste;
 3873                         int siz;
 3874 
 3875                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
 3876                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
 3877                             siz, SCTP_M_STRESET);
 3878                         if (liste == NULL) {
 3879                                 /* gak out of memory */
 3880                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3881                                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3882                                 return;
 3883                         }
 3884                         liste->tsn = tsn;
 3885                         liste->number_entries = number_entries;
 3886                         memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
 3887                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
 3888                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3889                 }
 3890                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3891                 asoc->str_reset_seq_in++;
 3892         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 3893                 /*
 3894                  * one seq back, just echo back last action since my
 3895                  * response was lost.
 3896                  */
 3897                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3898         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 3899                 /*
 3900                  * two seq back, just echo back last action since my
 3901                  * response was lost.
 3902                  */
 3903                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3904         } else {
 3905                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3906         }
 3907 }
 3908 
 3909 static void
 3910 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
 3911     struct sctp_stream_reset_add_strm *str_add)
 3912 {
 3913         /*
 3914          * Peer is requesting to add more streams. If its within our
 3915          * max-streams we will allow it.
 3916          */
 3917         uint32_t num_stream, i;
 3918         uint32_t seq;
 3919         struct sctp_association *asoc = &stcb->asoc;
 3920         struct sctp_queued_to_read *ctl, *nctl;
 3921 
 3922         /* Get the number. */
 3923         seq = ntohl(str_add->request_seq);
 3924         num_stream = ntohs(str_add->number_of_streams);
 3925         /* Now what would be the new total? */
 3926         if (asoc->str_reset_seq_in == seq) {
 3927                 num_stream += stcb->asoc.streamincnt;
 3928                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 3929                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
 3930                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3931                 } else if ((num_stream > stcb->asoc.max_inbound_streams) ||
 3932                     (num_stream > 0xffff)) {
 3933                         /* We must reject it they ask for to many */
 3934         denied:
 3935                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3936                 } else {
 3937                         /* Ok, we can do that :-) */
 3938                         struct sctp_stream_in *oldstrm;
 3939 
 3940                         /* save off the old */
 3941                         oldstrm = stcb->asoc.strmin;
 3942                         SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
 3943                             (num_stream * sizeof(struct sctp_stream_in)),
 3944                             SCTP_M_STRMI);
 3945                         if (stcb->asoc.strmin == NULL) {
 3946                                 stcb->asoc.strmin = oldstrm;
 3947                                 goto denied;
 3948                         }
 3949                         /* copy off the old data */
 3950                         for (i = 0; i < stcb->asoc.streamincnt; i++) {
 3951                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
 3952                                 stcb->asoc.strmin[i].stream_no = i;
 3953                                 stcb->asoc.strmin[i].last_sequence_delivered = oldstrm[i].last_sequence_delivered;
 3954                                 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
 3955                                 /* now anything on those queues? */
 3956                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next, nctl) {
 3957                                         TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next);
 3958                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next);
 3959                                 }
 3960                         }
 3961                         /* Init the new streams */
 3962                         for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
 3963                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
 3964                                 stcb->asoc.strmin[i].stream_no = i;
 3965                                 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
 3966                                 stcb->asoc.strmin[i].delivery_started = 0;
 3967                         }
 3968                         SCTP_FREE(oldstrm, SCTP_M_STRMI);
 3969                         /* update the size */
 3970                         stcb->asoc.streamincnt = num_stream;
 3971                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3972                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
 3973                 }
 3974                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3975                 asoc->str_reset_seq_in++;
 3976         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 3977                 /*
 3978                  * one seq back, just echo back last action since my
 3979                  * response was lost.
 3980                  */
 3981                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3982         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 3983                 /*
 3984                  * two seq back, just echo back last action since my
 3985                  * response was lost.
 3986                  */
 3987                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3988         } else {
 3989                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3990 
 3991         }
 3992 }
 3993 
 3994 static void
 3995 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
 3996     struct sctp_stream_reset_add_strm *str_add)
 3997 {
 3998         /*
 3999          * Peer is requesting to add more streams. If its within our
 4000          * max-streams we will allow it.
 4001          */
 4002         uint16_t num_stream;
 4003         uint32_t seq;
 4004         struct sctp_association *asoc = &stcb->asoc;
 4005 
 4006         /* Get the number. */
 4007         seq = ntohl(str_add->request_seq);
 4008         num_stream = ntohs(str_add->number_of_streams);
 4009         /* Now what would be the new total? */
 4010         if (asoc->str_reset_seq_in == seq) {
 4011                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 4012                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
 4013                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4014                 } else if (stcb->asoc.stream_reset_outstanding) {
 4015                         /* We must reject it we have something pending */
 4016                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
 4017                 } else {
 4018                         /* Ok, we can do that :-) */
 4019                         int mychk;
 4020 
 4021                         mychk = stcb->asoc.streamoutcnt;
 4022                         mychk += num_stream;
 4023                         if (mychk < 0x10000) {
 4024                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 4025                                 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 0, 1, num_stream, 0, 1)) {
 4026                                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4027                                 }
 4028                         } else {
 4029                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4030                         }
 4031                 }
 4032                 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
 4033                 asoc->str_reset_seq_in++;
 4034         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 4035                 /*
 4036                  * one seq back, just echo back last action since my
 4037                  * response was lost.
 4038                  */
 4039                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 4040         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 4041                 /*
 4042                  * two seq back, just echo back last action since my
 4043                  * response was lost.
 4044                  */
 4045                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 4046         } else {
 4047                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 4048         }
 4049 }
 4050 
 4051 #ifdef __GNUC__
 4052 __attribute__((noinline))
 4053 #endif
 4054         static int
 4055             sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 4056         struct sctp_chunkhdr *ch_req)
 4057 {
 4058         uint16_t remaining_length, param_len, ptype;
 4059         struct sctp_paramhdr pstore;
 4060         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
 4061         uint32_t seq = 0;
 4062         int num_req = 0;
 4063         int trunc = 0;
 4064         struct sctp_tmit_chunk *chk;
 4065         struct sctp_chunkhdr *ch;
 4066         struct sctp_paramhdr *ph;
 4067         int ret_code = 0;
 4068         int num_param = 0;
 4069 
 4070         /* now it may be a reset or a reset-response */
 4071         remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
 4072 
 4073         /* setup for adding the response */
 4074         sctp_alloc_a_chunk(stcb, chk);
 4075         if (chk == NULL) {
 4076                 return (ret_code);
 4077         }
 4078         chk->copy_by_ref = 0;
 4079         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
 4080         chk->rec.chunk_id.can_take_data = 0;
 4081         chk->flags = 0;
 4082         chk->asoc = &stcb->asoc;
 4083         chk->no_fr_allowed = 0;
 4084         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
 4085         chk->book_size_scale = 0;
 4086         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
 4087         if (chk->data == NULL) {
 4088 strres_nochunk:
 4089                 if (chk->data) {
 4090                         sctp_m_freem(chk->data);
 4091                         chk->data = NULL;
 4092                 }
 4093                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 4094                 return (ret_code);
 4095         }
 4096         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
 4097 
 4098         /* setup chunk parameters */
 4099         chk->sent = SCTP_DATAGRAM_UNSENT;
 4100         chk->snd_count = 0;
 4101         chk->whoTo = NULL;
 4102 
 4103         ch = mtod(chk->data, struct sctp_chunkhdr *);
 4104         ch->chunk_type = SCTP_STREAM_RESET;
 4105         ch->chunk_flags = 0;
 4106         ch->chunk_length = htons(chk->send_size);
 4107         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
 4108         offset += sizeof(struct sctp_chunkhdr);
 4109         while (remaining_length >= sizeof(struct sctp_paramhdr)) {
 4110                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *) & pstore);
 4111                 if (ph == NULL) {
 4112                         /* TSNH */
 4113                         break;
 4114                 }
 4115                 param_len = ntohs(ph->param_length);
 4116                 if ((param_len > remaining_length) ||
 4117                     (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
 4118                         /* bad parameter length */
 4119                         break;
 4120                 }
 4121                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
 4122                     (uint8_t *) & cstore);
 4123                 if (ph == NULL) {
 4124                         /* TSNH */
 4125                         break;
 4126                 }
 4127                 ptype = ntohs(ph->param_type);
 4128                 num_param++;
 4129                 if (param_len > sizeof(cstore)) {
 4130                         trunc = 1;
 4131                 } else {
 4132                         trunc = 0;
 4133                 }
 4134                 if (num_param > SCTP_MAX_RESET_PARAMS) {
 4135                         /* hit the max of parameters already sorry.. */
 4136                         break;
 4137                 }
 4138                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
 4139                         struct sctp_stream_reset_out_request *req_out;
 4140 
 4141                         if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
 4142                                 break;
 4143                         }
 4144                         req_out = (struct sctp_stream_reset_out_request *)ph;
 4145                         num_req++;
 4146                         if (stcb->asoc.stream_reset_outstanding) {
 4147                                 seq = ntohl(req_out->response_seq);
 4148                                 if (seq == stcb->asoc.str_reset_seq_out) {
 4149                                         /* implicit ack */
 4150                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
 4151                                 }
 4152                         }
 4153                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
 4154                 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
 4155                         struct sctp_stream_reset_add_strm *str_add;
 4156 
 4157                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
 4158                                 break;
 4159                         }
 4160                         str_add = (struct sctp_stream_reset_add_strm *)ph;
 4161                         num_req++;
 4162                         sctp_handle_str_reset_add_strm(stcb, chk, str_add);
 4163                 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
 4164                         struct sctp_stream_reset_add_strm *str_add;
 4165 
 4166                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
 4167                                 break;
 4168                         }
 4169                         str_add = (struct sctp_stream_reset_add_strm *)ph;
 4170                         num_req++;
 4171                         sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
 4172                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
 4173                         struct sctp_stream_reset_in_request *req_in;
 4174 
 4175                         num_req++;
 4176                         req_in = (struct sctp_stream_reset_in_request *)ph;
 4177                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
 4178                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
 4179                         struct sctp_stream_reset_tsn_request *req_tsn;
 4180 
 4181                         num_req++;
 4182                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
 4183                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
 4184                                 ret_code = 1;
 4185                                 goto strres_nochunk;
 4186                         }
 4187                         /* no more */
 4188                         break;
 4189                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
 4190                         struct sctp_stream_reset_response *resp;
 4191                         uint32_t result;
 4192 
 4193                         if (param_len < sizeof(struct sctp_stream_reset_response)) {
 4194                                 break;
 4195                         }
 4196                         resp = (struct sctp_stream_reset_response *)ph;
 4197                         seq = ntohl(resp->response_seq);
 4198                         result = ntohl(resp->result);
 4199                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
 4200                                 ret_code = 1;
 4201                                 goto strres_nochunk;
 4202                         }
 4203                 } else {
 4204                         break;
 4205                 }
 4206                 offset += SCTP_SIZE32(param_len);
 4207                 if (remaining_length >= SCTP_SIZE32(param_len)) {
 4208                         remaining_length -= SCTP_SIZE32(param_len);
 4209                 } else {
 4210                         remaining_length = 0;
 4211                 }
 4212         }
 4213         if (num_req == 0) {
 4214                 /* we have no response free the stuff */
 4215                 goto strres_nochunk;
 4216         }
 4217         /* ok we have a chunk to link in */
 4218         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
 4219             chk,
 4220             sctp_next);
 4221         stcb->asoc.ctrl_queue_cnt++;
 4222         return (ret_code);
 4223 }
 4224 
 4225 /*
 4226  * Handle a router or endpoints report of a packet loss, there are two ways
 4227  * to handle this, either we get the whole packet and must disect it
 4228  * ourselves (possibly with truncation and or corruption) or it is a summary
 4229  * from a middle box that did the disectting for us.
 4230  */
 4231 static void
 4232 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
 4233     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
 4234 {
 4235         uint32_t bottle_bw, on_queue;
 4236         uint16_t trunc_len;
 4237         unsigned int chlen;
 4238         unsigned int at;
 4239         struct sctp_chunk_desc desc;
 4240         struct sctp_chunkhdr *ch;
 4241 
 4242         chlen = ntohs(cp->ch.chunk_length);
 4243         chlen -= sizeof(struct sctp_pktdrop_chunk);
 4244         /* XXX possible chlen underflow */
 4245         if (chlen == 0) {
 4246                 ch = NULL;
 4247                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
 4248                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
 4249         } else {
 4250                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
 4251                 chlen -= sizeof(struct sctphdr);
 4252                 /* XXX possible chlen underflow */
 4253                 memset(&desc, 0, sizeof(desc));
 4254         }
 4255         trunc_len = (uint16_t) ntohs(cp->trunc_len);
 4256         if (trunc_len > limit) {
 4257                 trunc_len = limit;
 4258         }
 4259         /* now the chunks themselves */
 4260         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
 4261                 desc.chunk_type = ch->chunk_type;
 4262                 /* get amount we need to move */
 4263                 at = ntohs(ch->chunk_length);
 4264                 if (at < sizeof(struct sctp_chunkhdr)) {
 4265                         /* corrupt chunk, maybe at the end? */
 4266                         SCTP_STAT_INCR(sctps_pdrpcrupt);
 4267                         break;
 4268                 }
 4269                 if (trunc_len == 0) {
 4270                         /* we are supposed to have all of it */
 4271                         if (at > chlen) {
 4272                                 /* corrupt skip it */
 4273                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
 4274                                 break;
 4275                         }
 4276                 } else {
 4277                         /* is there enough of it left ? */
 4278                         if (desc.chunk_type == SCTP_DATA) {
 4279                                 if (chlen < (sizeof(struct sctp_data_chunk) +
 4280                                     sizeof(desc.data_bytes))) {
 4281                                         break;
 4282                                 }
 4283                         } else {
 4284                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
 4285                                         break;
 4286                                 }
 4287                         }
 4288                 }
 4289                 if (desc.chunk_type == SCTP_DATA) {
 4290                         /* can we get out the tsn? */
 4291                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
 4292                                 SCTP_STAT_INCR(sctps_pdrpmbda);
 4293 
 4294                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
 4295                                 /* yep */
 4296                                 struct sctp_data_chunk *dcp;
 4297                                 uint8_t *ddp;
 4298                                 unsigned int iii;
 4299 
 4300                                 dcp = (struct sctp_data_chunk *)ch;
 4301                                 ddp = (uint8_t *) (dcp + 1);
 4302                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
 4303                                         desc.data_bytes[iii] = ddp[iii];
 4304                                 }
 4305                                 desc.tsn_ifany = dcp->dp.tsn;
 4306                         } else {
 4307                                 /* nope we are done. */
 4308                                 SCTP_STAT_INCR(sctps_pdrpnedat);
 4309                                 break;
 4310                         }
 4311                 } else {
 4312                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
 4313                                 SCTP_STAT_INCR(sctps_pdrpmbct);
 4314                 }
 4315 
 4316                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
 4317                         SCTP_STAT_INCR(sctps_pdrppdbrk);
 4318                         break;
 4319                 }
 4320                 if (SCTP_SIZE32(at) > chlen) {
 4321                         break;
 4322                 }
 4323                 chlen -= SCTP_SIZE32(at);
 4324                 if (chlen < sizeof(struct sctp_chunkhdr)) {
 4325                         /* done, none left */
 4326                         break;
 4327                 }
 4328                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
 4329         }
 4330         /* Now update any rwnd --- possibly */
 4331         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
 4332                 /* From a peer, we get a rwnd report */
 4333                 uint32_t a_rwnd;
 4334 
 4335                 SCTP_STAT_INCR(sctps_pdrpfehos);
 4336 
 4337                 bottle_bw = ntohl(cp->bottle_bw);
 4338                 on_queue = ntohl(cp->current_onq);
 4339                 if (bottle_bw && on_queue) {
 4340                         /* a rwnd report is in here */
 4341                         if (bottle_bw > on_queue)
 4342                                 a_rwnd = bottle_bw - on_queue;
 4343                         else
 4344                                 a_rwnd = 0;
 4345 
 4346                         if (a_rwnd == 0)
 4347                                 stcb->asoc.peers_rwnd = 0;
 4348                         else {
 4349                                 if (a_rwnd > stcb->asoc.total_flight) {
 4350                                         stcb->asoc.peers_rwnd =
 4351                                             a_rwnd - stcb->asoc.total_flight;
 4352                                 } else {
 4353                                         stcb->asoc.peers_rwnd = 0;
 4354                                 }
 4355                                 if (stcb->asoc.peers_rwnd <
 4356                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
 4357                                         /* SWS sender side engages */
 4358                                         stcb->asoc.peers_rwnd = 0;
 4359                                 }
 4360                         }
 4361                 }
 4362         } else {
 4363                 SCTP_STAT_INCR(sctps_pdrpfmbox);
 4364         }
 4365 
 4366         /* now middle boxes in sat networks get a cwnd bump */
 4367         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
 4368             (stcb->asoc.sat_t3_loss_recovery == 0) &&
 4369             (stcb->asoc.sat_network)) {
 4370                 /*
 4371                  * This is debateable but for sat networks it makes sense
 4372                  * Note if a T3 timer has went off, we will prohibit any
 4373                  * changes to cwnd until we exit the t3 loss recovery.
 4374                  */
 4375                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
 4376                     net, cp, &bottle_bw, &on_queue);
 4377         }
 4378 }
 4379 
 4380 /*
 4381  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
 4382  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
 4383  * offset: offset into the mbuf chain to first chunkhdr - length: is the
 4384  * length of the complete packet outputs: - length: modified to remaining
 4385  * length after control processing - netp: modified to new sctp_nets after
 4386  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
 4387  * bad packet,...) otherwise return the tcb for this packet
 4388  */
 4389 #ifdef __GNUC__
 4390 __attribute__((noinline))
 4391 #endif
 4392         static struct sctp_tcb *
 4393                  sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
 4394              struct sockaddr *src, struct sockaddr *dst,
 4395              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
 4396              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
 4397              uint8_t use_mflowid, uint32_t mflowid,
 4398              uint32_t vrf_id, uint16_t port)
 4399 {
 4400         struct sctp_association *asoc;
 4401         struct mbuf *op_err;
 4402         char msg[SCTP_DIAG_INFO_LEN];
 4403         uint32_t vtag_in;
 4404         int num_chunks = 0;     /* number of control chunks processed */
 4405         uint32_t chk_length;
 4406         int ret;
 4407         int abort_no_unlock = 0;
 4408         int ecne_seen = 0;
 4409 
 4410         /*
 4411          * How big should this be, and should it be alloc'd? Lets try the
 4412          * d-mtu-ceiling for now (2k) and that should hopefully work ...
 4413          * until we get into jumbo grams and such..
 4414          */
 4415         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
 4416         struct sctp_tcb *locked_tcb = stcb;
 4417         int got_auth = 0;
 4418         uint32_t auth_offset = 0, auth_len = 0;
 4419         int auth_skipped = 0;
 4420         int asconf_cnt = 0;
 4421 
 4422 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4423         struct socket *so;
 4424 
 4425 #endif
 4426 
 4427         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
 4428             iphlen, *offset, length, (void *)stcb);
 4429 
 4430         /* validate chunk header length... */
 4431         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
 4432                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
 4433                     ntohs(ch->chunk_length));
 4434                 if (locked_tcb) {
 4435                         SCTP_TCB_UNLOCK(locked_tcb);
 4436                 }
 4437                 return (NULL);
 4438         }
 4439         /*
 4440          * validate the verification tag
 4441          */
 4442         vtag_in = ntohl(sh->v_tag);
 4443 
 4444         if (locked_tcb) {
 4445                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
 4446         }
 4447         if (ch->chunk_type == SCTP_INITIATION) {
 4448                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
 4449                     ntohs(ch->chunk_length), vtag_in);
 4450                 if (vtag_in != 0) {
 4451                         /* protocol error- silently discard... */
 4452                         SCTP_STAT_INCR(sctps_badvtag);
 4453                         if (locked_tcb) {
 4454                                 SCTP_TCB_UNLOCK(locked_tcb);
 4455                         }
 4456                         return (NULL);
 4457                 }
 4458         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
 4459                 /*
 4460                  * If there is no stcb, skip the AUTH chunk and process
 4461                  * later after a stcb is found (to validate the lookup was
 4462                  * valid.
 4463                  */
 4464                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
 4465                     (stcb == NULL) &&
 4466                     (inp->auth_supported == 1)) {
 4467                         /* save this chunk for later processing */
 4468                         auth_skipped = 1;
 4469                         auth_offset = *offset;
 4470                         auth_len = ntohs(ch->chunk_length);
 4471 
 4472                         /* (temporarily) move past this chunk */
 4473                         *offset += SCTP_SIZE32(auth_len);
 4474                         if (*offset >= length) {
 4475                                 /* no more data left in the mbuf chain */
 4476                                 *offset = length;
 4477                                 if (locked_tcb) {
 4478                                         SCTP_TCB_UNLOCK(locked_tcb);
 4479                                 }
 4480                                 return (NULL);
 4481                         }
 4482                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4483                             sizeof(struct sctp_chunkhdr), chunk_buf);
 4484                 }
 4485                 if (ch == NULL) {
 4486                         /* Help */
 4487                         *offset = length;
 4488                         if (locked_tcb) {
 4489                                 SCTP_TCB_UNLOCK(locked_tcb);
 4490                         }
 4491                         return (NULL);
 4492                 }
 4493                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
 4494                         goto process_control_chunks;
 4495                 }
 4496                 /*
 4497                  * first check if it's an ASCONF with an unknown src addr we
 4498                  * need to look inside to find the association
 4499                  */
 4500                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
 4501                         struct sctp_chunkhdr *asconf_ch = ch;
 4502                         uint32_t asconf_offset = 0, asconf_len = 0;
 4503 
 4504                         /* inp's refcount may be reduced */
 4505                         SCTP_INP_INCR_REF(inp);
 4506 
 4507                         asconf_offset = *offset;
 4508                         do {
 4509                                 asconf_len = ntohs(asconf_ch->chunk_length);
 4510                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
 4511                                         break;
 4512                                 stcb = sctp_findassociation_ep_asconf(m,
 4513                                     *offset,
 4514                                     dst,
 4515                                     sh, &inp, netp, vrf_id);
 4516                                 if (stcb != NULL)
 4517                                         break;
 4518                                 asconf_offset += SCTP_SIZE32(asconf_len);
 4519                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
 4520                                     sizeof(struct sctp_chunkhdr), chunk_buf);
 4521                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
 4522                         if (stcb == NULL) {
 4523                                 /*
 4524                                  * reduce inp's refcount if not reduced in
 4525                                  * sctp_findassociation_ep_asconf().
 4526                                  */
 4527                                 SCTP_INP_DECR_REF(inp);
 4528                         } else {
 4529                                 locked_tcb = stcb;
 4530                         }
 4531 
 4532                         /* now go back and verify any auth chunk to be sure */
 4533                         if (auth_skipped && (stcb != NULL)) {
 4534                                 struct sctp_auth_chunk *auth;
 4535 
 4536                                 auth = (struct sctp_auth_chunk *)
 4537                                     sctp_m_getptr(m, auth_offset,
 4538                                     auth_len, chunk_buf);
 4539                                 got_auth = 1;
 4540                                 auth_skipped = 0;
 4541                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
 4542                                     auth_offset)) {
 4543                                         /* auth HMAC failed so dump it */
 4544                                         *offset = length;
 4545                                         if (locked_tcb) {
 4546                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4547                                         }
 4548                                         return (NULL);
 4549                                 } else {
 4550                                         /* remaining chunks are HMAC checked */
 4551                                         stcb->asoc.authenticated = 1;
 4552                                 }
 4553                         }
 4554                 }
 4555                 if (stcb == NULL) {
 4556                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__);
 4557                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 4558                             msg);
 4559                         /* no association, so it's out of the blue... */
 4560                         sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
 4561                             use_mflowid, mflowid,
 4562                             vrf_id, port);
 4563                         *offset = length;
 4564                         if (locked_tcb) {
 4565                                 SCTP_TCB_UNLOCK(locked_tcb);
 4566                         }
 4567                         return (NULL);
 4568                 }
 4569                 asoc = &stcb->asoc;
 4570                 /* ABORT and SHUTDOWN can use either v_tag... */
 4571                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
 4572                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
 4573                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
 4574                         /* Take the T-bit always into account. */
 4575                         if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
 4576                             (vtag_in == asoc->my_vtag)) ||
 4577                             (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
 4578                             (vtag_in == asoc->peer_vtag))) {
 4579                                 /* this is valid */
 4580                         } else {
 4581                                 /* drop this packet... */
 4582                                 SCTP_STAT_INCR(sctps_badvtag);
 4583                                 if (locked_tcb) {
 4584                                         SCTP_TCB_UNLOCK(locked_tcb);
 4585                                 }
 4586                                 return (NULL);
 4587                         }
 4588                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
 4589                         if (vtag_in != asoc->my_vtag) {
 4590                                 /*
 4591                                  * this could be a stale SHUTDOWN-ACK or the
 4592                                  * peer never got the SHUTDOWN-COMPLETE and
 4593                                  * is still hung; we have started a new asoc
 4594                                  * but it won't complete until the shutdown
 4595                                  * is completed
 4596                                  */
 4597                                 if (locked_tcb) {
 4598                                         SCTP_TCB_UNLOCK(locked_tcb);
 4599                                 }
 4600                                 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__);
 4601                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 4602                                     msg);
 4603                                 sctp_handle_ootb(m, iphlen, *offset, src, dst,
 4604                                     sh, inp, op_err,
 4605                                     use_mflowid, mflowid,
 4606                                     vrf_id, port);
 4607                                 return (NULL);
 4608                         }
 4609                 } else {
 4610                         /* for all other chunks, vtag must match */
 4611                         if (vtag_in != asoc->my_vtag) {
 4612                                 /* invalid vtag... */
 4613                                 SCTPDBG(SCTP_DEBUG_INPUT3,
 4614                                     "invalid vtag: %xh, expect %xh\n",
 4615                                     vtag_in, asoc->my_vtag);
 4616                                 SCTP_STAT_INCR(sctps_badvtag);
 4617                                 if (locked_tcb) {
 4618                                         SCTP_TCB_UNLOCK(locked_tcb);
 4619                                 }
 4620                                 *offset = length;
 4621                                 return (NULL);
 4622                         }
 4623                 }
 4624         }                       /* end if !SCTP_COOKIE_ECHO */
 4625         /*
 4626          * process all control chunks...
 4627          */
 4628         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
 4629             (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
 4630             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
 4631             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 4632                 /* implied cookie-ack.. we must have lost the ack */
 4633                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 4634                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 4635                             stcb->asoc.overall_error_count,
 4636                             0,
 4637                             SCTP_FROM_SCTP_INPUT,
 4638                             __LINE__);
 4639                 }
 4640                 stcb->asoc.overall_error_count = 0;
 4641                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
 4642                     *netp);
 4643         }
 4644 process_control_chunks:
 4645         while (IS_SCTP_CONTROL(ch)) {
 4646                 /* validate chunk length */
 4647                 chk_length = ntohs(ch->chunk_length);
 4648                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
 4649                     ch->chunk_type, chk_length);
 4650                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
 4651                 if (chk_length < sizeof(*ch) ||
 4652                     (*offset + (int)chk_length) > length) {
 4653                         *offset = length;
 4654                         if (locked_tcb) {
 4655                                 SCTP_TCB_UNLOCK(locked_tcb);
 4656                         }
 4657                         return (NULL);
 4658                 }
 4659                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
 4660                 /*
 4661                  * INIT-ACK only gets the init ack "header" portion only
 4662                  * because we don't have to process the peer's COOKIE. All
 4663                  * others get a complete chunk.
 4664                  */
 4665                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
 4666                     (ch->chunk_type == SCTP_INITIATION)) {
 4667                         /* get an init-ack chunk */
 4668                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4669                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
 4670                         if (ch == NULL) {
 4671                                 *offset = length;
 4672                                 if (locked_tcb) {
 4673                                         SCTP_TCB_UNLOCK(locked_tcb);
 4674                                 }
 4675                                 return (NULL);
 4676                         }
 4677                 } else {
 4678                         /* For cookies and all other chunks. */
 4679                         if (chk_length > sizeof(chunk_buf)) {
 4680                                 /*
 4681                                  * use just the size of the chunk buffer so
 4682                                  * the front part of our chunks fit in
 4683                                  * contiguous space up to the chunk buffer
 4684                                  * size (508 bytes). For chunks that need to
 4685                                  * get more than that they must use the
 4686                                  * sctp_m_getptr() function or other means
 4687                                  * (e.g. know how to parse mbuf chains).
 4688                                  * Cookies do this already.
 4689                                  */
 4690                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4691                                     (sizeof(chunk_buf) - 4),
 4692                                     chunk_buf);
 4693                                 if (ch == NULL) {
 4694                                         *offset = length;
 4695                                         if (locked_tcb) {
 4696                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4697                                         }
 4698                                         return (NULL);
 4699                                 }
 4700                         } else {
 4701                                 /* We can fit it all */
 4702                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4703                                     chk_length, chunk_buf);
 4704                                 if (ch == NULL) {
 4705                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
 4706                                         *offset = length;
 4707                                         if (locked_tcb) {
 4708                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4709                                         }
 4710                                         return (NULL);
 4711                                 }
 4712                         }
 4713                 }
 4714                 num_chunks++;
 4715                 /* Save off the last place we got a control from */
 4716                 if (stcb != NULL) {
 4717                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
 4718                                 /*
 4719                                  * allow last_control to be NULL if
 4720                                  * ASCONF... ASCONF processing will find the
 4721                                  * right net later
 4722                                  */
 4723                                 if ((netp != NULL) && (*netp != NULL))
 4724                                         stcb->asoc.last_control_chunk_from = *netp;
 4725                         }
 4726                 }
 4727 #ifdef SCTP_AUDITING_ENABLED
 4728                 sctp_audit_log(0xB0, ch->chunk_type);
 4729 #endif
 4730 
 4731                 /* check to see if this chunk required auth, but isn't */
 4732                 if ((stcb != NULL) &&
 4733                     (stcb->asoc.auth_supported == 1) &&
 4734                     sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
 4735                     !stcb->asoc.authenticated) {
 4736                         /* "silently" ignore */
 4737                         SCTP_STAT_INCR(sctps_recvauthmissing);
 4738                         goto next_chunk;
 4739                 }
 4740                 switch (ch->chunk_type) {
 4741                 case SCTP_INITIATION:
 4742                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
 4743                         /* The INIT chunk must be the only chunk. */
 4744                         if ((num_chunks > 1) ||
 4745                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 4746                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 4747                                     "INIT not the only chunk");
 4748                                 sctp_abort_association(inp, stcb, m, iphlen,
 4749                                     src, dst, sh, op_err,
 4750                                     use_mflowid, mflowid,
 4751                                     vrf_id, port);
 4752                                 *offset = length;
 4753                                 return (NULL);
 4754                         }
 4755                         /* Honor our resource limit. */
 4756                         if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
 4757                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 4758                                 sctp_abort_association(inp, stcb, m, iphlen,
 4759                                     src, dst, sh, op_err,
 4760                                     use_mflowid, mflowid,
 4761                                     vrf_id, port);
 4762                                 *offset = length;
 4763                                 return (NULL);
 4764                         }
 4765                         sctp_handle_init(m, iphlen, *offset, src, dst, sh,
 4766                             (struct sctp_init_chunk *)ch, inp,
 4767                             stcb, &abort_no_unlock,
 4768                             use_mflowid, mflowid,
 4769                             vrf_id, port);
 4770                         *offset = length;
 4771                         if ((!abort_no_unlock) && (locked_tcb)) {
 4772                                 SCTP_TCB_UNLOCK(locked_tcb);
 4773                         }
 4774                         return (NULL);
 4775                         break;
 4776                 case SCTP_PAD_CHUNK:
 4777                         break;
 4778                 case SCTP_INITIATION_ACK:
 4779                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
 4780                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 4781                                 /* We are not interested anymore */
 4782                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 4783                                         ;
 4784                                 } else {
 4785                                         if (locked_tcb != stcb) {
 4786                                                 /* Very unlikely */
 4787                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4788                                         }
 4789                                         *offset = length;
 4790                                         if (stcb) {
 4791 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4792                                                 so = SCTP_INP_SO(inp);
 4793                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 4794                                                 SCTP_TCB_UNLOCK(stcb);
 4795                                                 SCTP_SOCKET_LOCK(so, 1);
 4796                                                 SCTP_TCB_LOCK(stcb);
 4797                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 4798 #endif
 4799                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
 4800 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4801                                                 SCTP_SOCKET_UNLOCK(so, 1);
 4802 #endif
 4803                                         }
 4804                                         return (NULL);
 4805                                 }
 4806                         }
 4807                         /* The INIT-ACK chunk must be the only chunk. */
 4808                         if ((num_chunks > 1) ||
 4809                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 4810                                 *offset = length;
 4811                                 if (locked_tcb) {
 4812                                         SCTP_TCB_UNLOCK(locked_tcb);
 4813                                 }
 4814                                 return (NULL);
 4815                         }
 4816                         if ((netp) && (*netp)) {
 4817                                 ret = sctp_handle_init_ack(m, iphlen, *offset,
 4818                                     src, dst, sh,
 4819                                     (struct sctp_init_ack_chunk *)ch,
 4820                                     stcb, *netp,
 4821                                     &abort_no_unlock,
 4822                                     use_mflowid, mflowid,
 4823                                     vrf_id);
 4824                         } else {
 4825                                 ret = -1;
 4826                         }
 4827                         *offset = length;
 4828                         if (abort_no_unlock) {
 4829                                 return (NULL);
 4830                         }
 4831                         /*
 4832                          * Special case, I must call the output routine to
 4833                          * get the cookie echoed
 4834                          */
 4835                         if ((stcb != NULL) && (ret == 0)) {
 4836                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 4837                         }
 4838                         if (locked_tcb) {
 4839                                 SCTP_TCB_UNLOCK(locked_tcb);
 4840                         }
 4841                         return (NULL);
 4842                         break;
 4843                 case SCTP_SELECTIVE_ACK:
 4844                         {
 4845                                 struct sctp_sack_chunk *sack;
 4846                                 int abort_now = 0;
 4847                                 uint32_t a_rwnd, cum_ack;
 4848                                 uint16_t num_seg, num_dup;
 4849                                 uint8_t flags;
 4850                                 int offset_seg, offset_dup;
 4851 
 4852                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
 4853                                 SCTP_STAT_INCR(sctps_recvsacks);
 4854                                 if (stcb == NULL) {
 4855                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
 4856                                         break;
 4857                                 }
 4858                                 if (chk_length < sizeof(struct sctp_sack_chunk)) {
 4859                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
 4860                                         break;
 4861                                 }
 4862                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 4863                                         /*-
 4864                                          * If we have sent a shutdown-ack, we will pay no
 4865                                          * attention to a sack sent in to us since
 4866                                          * we don't care anymore.
 4867                                          */
 4868                                         break;
 4869                                 }
 4870                                 sack = (struct sctp_sack_chunk *)ch;
 4871                                 flags = ch->chunk_flags;
 4872                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
 4873                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
 4874                                 num_dup = ntohs(sack->sack.num_dup_tsns);
 4875                                 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
 4876                                 if (sizeof(struct sctp_sack_chunk) +
 4877                                     num_seg * sizeof(struct sctp_gap_ack_block) +
 4878                                     num_dup * sizeof(uint32_t) != chk_length) {
 4879                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
 4880                                         break;
 4881                                 }
 4882                                 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
 4883                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
 4884                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
 4885                                     cum_ack, num_seg, a_rwnd);
 4886                                 stcb->asoc.seen_a_sack_this_pkt = 1;
 4887                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
 4888                                     (num_seg == 0) &&
 4889                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
 4890                                     (stcb->asoc.saw_sack_with_frags == 0) &&
 4891                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
 4892                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
 4893                                     ) {
 4894                                         /*
 4895                                          * We have a SIMPLE sack having no
 4896                                          * prior segments and data on sent
 4897                                          * queue to be acked.. Use the
 4898                                          * faster path sack processing. We
 4899                                          * also allow window update sacks
 4900                                          * with no missing segments to go
 4901                                          * this way too.
 4902                                          */
 4903                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
 4904                                 } else {
 4905                                         if (netp && *netp)
 4906                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
 4907                                                     num_seg, 0, num_dup, &abort_now, flags,
 4908                                                     cum_ack, a_rwnd, ecne_seen);
 4909                                 }
 4910                                 if (abort_now) {
 4911                                         /* ABORT signal from sack processing */
 4912                                         *offset = length;
 4913                                         return (NULL);
 4914                                 }
 4915                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
 4916                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
 4917                                     (stcb->asoc.stream_queue_cnt == 0)) {
 4918                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 4919                                 }
 4920                         }
 4921                         break;
 4922                         /*
 4923                          * EY - nr_sack:  If the received chunk is an
 4924                          * nr_sack chunk
 4925                          */
 4926                 case SCTP_NR_SELECTIVE_ACK:
 4927                         {
 4928                                 struct sctp_nr_sack_chunk *nr_sack;
 4929                                 int abort_now = 0;
 4930                                 uint32_t a_rwnd, cum_ack;
 4931                                 uint16_t num_seg, num_nr_seg, num_dup;
 4932                                 uint8_t flags;
 4933                                 int offset_seg, offset_dup;
 4934 
 4935                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
 4936                                 SCTP_STAT_INCR(sctps_recvsacks);
 4937                                 if (stcb == NULL) {
 4938                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
 4939                                         break;
 4940                                 }
 4941                                 if (stcb->asoc.nrsack_supported == 0) {
 4942                                         goto unknown_chunk;
 4943                                 }
 4944                                 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
 4945                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
 4946                                         break;
 4947                                 }
 4948                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 4949                                         /*-
 4950                                          * If we have sent a shutdown-ack, we will pay no
 4951                                          * attention to a sack sent in to us since
 4952                                          * we don't care anymore.
 4953                                          */
 4954                                         break;
 4955                                 }
 4956                                 nr_sack = (struct sctp_nr_sack_chunk *)ch;
 4957                                 flags = ch->chunk_flags;
 4958                                 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
 4959                                 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
 4960                                 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
 4961                                 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
 4962                                 a_rwnd = (uint32_t) ntohl(nr_sack->nr_sack.a_rwnd);
 4963                                 if (sizeof(struct sctp_nr_sack_chunk) +
 4964                                     (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
 4965                                     num_dup * sizeof(uint32_t) != chk_length) {
 4966                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
 4967                                         break;
 4968                                 }
 4969                                 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
 4970                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
 4971                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
 4972                                     cum_ack, num_seg, a_rwnd);
 4973                                 stcb->asoc.seen_a_sack_this_pkt = 1;
 4974                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
 4975                                     (num_seg == 0) && (num_nr_seg == 0) &&
 4976                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
 4977                                     (stcb->asoc.saw_sack_with_frags == 0) &&
 4978                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
 4979                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
 4980                                         /*
 4981                                          * We have a SIMPLE sack having no
 4982                                          * prior segments and data on sent
 4983                                          * queue to be acked. Use the faster
 4984                                          * path sack processing. We also
 4985                                          * allow window update sacks with no
 4986                                          * missing segments to go this way
 4987                                          * too.
 4988                                          */
 4989                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
 4990                                             &abort_now, ecne_seen);
 4991                                 } else {
 4992                                         if (netp && *netp)
 4993                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
 4994                                                     num_seg, num_nr_seg, num_dup, &abort_now, flags,
 4995                                                     cum_ack, a_rwnd, ecne_seen);
 4996                                 }
 4997                                 if (abort_now) {
 4998                                         /* ABORT signal from sack processing */
 4999                                         *offset = length;
 5000                                         return (NULL);
 5001                                 }
 5002                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
 5003                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
 5004                                     (stcb->asoc.stream_queue_cnt == 0)) {
 5005                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 5006                                 }
 5007                         }
 5008                         break;
 5009 
 5010                 case SCTP_HEARTBEAT_REQUEST:
 5011                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
 5012                         if ((stcb) && netp && *netp) {
 5013                                 SCTP_STAT_INCR(sctps_recvheartbeat);
 5014                                 sctp_send_heartbeat_ack(stcb, m, *offset,
 5015                                     chk_length, *netp);
 5016 
 5017                                 /* He's alive so give him credit */
 5018                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5019                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5020                                             stcb->asoc.overall_error_count,
 5021                                             0,
 5022                                             SCTP_FROM_SCTP_INPUT,
 5023                                             __LINE__);
 5024                                 }
 5025                                 stcb->asoc.overall_error_count = 0;
 5026                         }
 5027                         break;
 5028                 case SCTP_HEARTBEAT_ACK:
 5029                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
 5030                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
 5031                                 /* Its not ours */
 5032                                 *offset = length;
 5033                                 if (locked_tcb) {
 5034                                         SCTP_TCB_UNLOCK(locked_tcb);
 5035                                 }
 5036                                 return (NULL);
 5037                         }
 5038                         /* He's alive so give him credit */
 5039                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5040                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5041                                     stcb->asoc.overall_error_count,
 5042                                     0,
 5043                                     SCTP_FROM_SCTP_INPUT,
 5044                                     __LINE__);
 5045                         }
 5046                         stcb->asoc.overall_error_count = 0;
 5047                         SCTP_STAT_INCR(sctps_recvheartbeatack);
 5048                         if (netp && *netp)
 5049                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
 5050                                     stcb, *netp);
 5051                         break;
 5052                 case SCTP_ABORT_ASSOCIATION:
 5053                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
 5054                             (void *)stcb);
 5055                         if ((stcb) && netp && *netp)
 5056                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
 5057                                     stcb, *netp);
 5058                         *offset = length;
 5059                         return (NULL);
 5060                         break;
 5061                 case SCTP_SHUTDOWN:
 5062                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
 5063                             (void *)stcb);
 5064                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
 5065                                 *offset = length;
 5066                                 if (locked_tcb) {
 5067                                         SCTP_TCB_UNLOCK(locked_tcb);
 5068                                 }
 5069                                 return (NULL);
 5070                         }
 5071                         if (netp && *netp) {
 5072                                 int abort_flag = 0;
 5073 
 5074                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
 5075                                     stcb, *netp, &abort_flag);
 5076                                 if (abort_flag) {
 5077                                         *offset = length;
 5078                                         return (NULL);
 5079                                 }
 5080                         }
 5081                         break;
 5082                 case SCTP_SHUTDOWN_ACK:
 5083                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb);
 5084                         if ((stcb) && (netp) && (*netp))
 5085                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
 5086                         *offset = length;
 5087                         return (NULL);
 5088                         break;
 5089 
 5090                 case SCTP_OPERATION_ERROR:
 5091                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
 5092                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
 5093                                 *offset = length;
 5094                                 return (NULL);
 5095                         }
 5096                         break;
 5097                 case SCTP_COOKIE_ECHO:
 5098                         SCTPDBG(SCTP_DEBUG_INPUT3,
 5099                             "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb);
 5100                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 5101                                 ;
 5102                         } else {
 5103                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5104                                         /* We are not interested anymore */
 5105                         abend:
 5106                                         if (stcb) {
 5107                                                 SCTP_TCB_UNLOCK(stcb);
 5108                                         }
 5109                                         *offset = length;
 5110                                         return (NULL);
 5111                                 }
 5112                         }
 5113                         /*
 5114                          * First are we accepting? We do this again here
 5115                          * since it is possible that a previous endpoint WAS
 5116                          * listening responded to a INIT-ACK and then
 5117                          * closed. We opened and bound.. and are now no
 5118                          * longer listening.
 5119                          */
 5120 
 5121                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
 5122                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 5123                                     (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
 5124                                         op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 5125                                         sctp_abort_association(inp, stcb, m, iphlen,
 5126                                             src, dst, sh, op_err,
 5127                                             use_mflowid, mflowid,
 5128                                             vrf_id, port);
 5129                                 }
 5130                                 *offset = length;
 5131                                 return (NULL);
 5132                         } else {
 5133                                 struct mbuf *ret_buf;
 5134                                 struct sctp_inpcb *linp;
 5135 
 5136                                 if (stcb) {
 5137                                         linp = NULL;
 5138                                 } else {
 5139                                         linp = inp;
 5140                                 }
 5141 
 5142                                 if (linp) {
 5143                                         SCTP_ASOC_CREATE_LOCK(linp);
 5144                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 5145                                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 5146                                                 SCTP_ASOC_CREATE_UNLOCK(linp);
 5147                                                 goto abend;
 5148                                         }
 5149                                 }
 5150                                 if (netp) {
 5151                                         ret_buf =
 5152                                             sctp_handle_cookie_echo(m, iphlen,
 5153                                             *offset,
 5154                                             src, dst,
 5155                                             sh,
 5156                                             (struct sctp_cookie_echo_chunk *)ch,
 5157                                             &inp, &stcb, netp,
 5158                                             auth_skipped,
 5159                                             auth_offset,
 5160                                             auth_len,
 5161                                             &locked_tcb,
 5162                                             use_mflowid,
 5163                                             mflowid,
 5164                                             vrf_id,
 5165                                             port);
 5166                                 } else {
 5167                                         ret_buf = NULL;
 5168                                 }
 5169                                 if (linp) {
 5170                                         SCTP_ASOC_CREATE_UNLOCK(linp);
 5171                                 }
 5172                                 if (ret_buf == NULL) {
 5173                                         if (locked_tcb) {
 5174                                                 SCTP_TCB_UNLOCK(locked_tcb);
 5175                                         }
 5176                                         SCTPDBG(SCTP_DEBUG_INPUT3,
 5177                                             "GAK, null buffer\n");
 5178                                         *offset = length;
 5179                                         return (NULL);
 5180                                 }
 5181                                 /* if AUTH skipped, see if it verified... */
 5182                                 if (auth_skipped) {
 5183                                         got_auth = 1;
 5184                                         auth_skipped = 0;
 5185                                 }
 5186                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 5187                                         /*
 5188                                          * Restart the timer if we have
 5189                                          * pending data
 5190                                          */
 5191                                         struct sctp_tmit_chunk *chk;
 5192 
 5193                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 5194                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
 5195                                 }
 5196                         }
 5197                         break;
 5198                 case SCTP_COOKIE_ACK:
 5199                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb);
 5200                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
 5201                                 if (locked_tcb) {
 5202                                         SCTP_TCB_UNLOCK(locked_tcb);
 5203                                 }
 5204                                 return (NULL);
 5205                         }
 5206                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5207                                 /* We are not interested anymore */
 5208                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 5209                                         ;
 5210                                 } else if (stcb) {
 5211 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5212                                         so = SCTP_INP_SO(inp);
 5213                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 5214                                         SCTP_TCB_UNLOCK(stcb);
 5215                                         SCTP_SOCKET_LOCK(so, 1);
 5216                                         SCTP_TCB_LOCK(stcb);
 5217                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5218 #endif
 5219                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
 5220 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5221                                         SCTP_SOCKET_UNLOCK(so, 1);
 5222 #endif
 5223                                         *offset = length;
 5224                                         return (NULL);
 5225                                 }
 5226                         }
 5227                         /* He's alive so give him credit */
 5228                         if ((stcb) && netp && *netp) {
 5229                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5230                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5231                                             stcb->asoc.overall_error_count,
 5232                                             0,
 5233                                             SCTP_FROM_SCTP_INPUT,
 5234                                             __LINE__);
 5235                                 }
 5236                                 stcb->asoc.overall_error_count = 0;
 5237                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
 5238                         }
 5239                         break;
 5240                 case SCTP_ECN_ECHO:
 5241                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
 5242                         /* He's alive so give him credit */
 5243                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
 5244                                 /* Its not ours */
 5245                                 if (locked_tcb) {
 5246                                         SCTP_TCB_UNLOCK(locked_tcb);
 5247                                 }
 5248                                 *offset = length;
 5249                                 return (NULL);
 5250                         }
 5251                         if (stcb) {
 5252                                 if (stcb->asoc.ecn_supported == 0) {
 5253                                         goto unknown_chunk;
 5254                                 }
 5255                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5256                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5257                                             stcb->asoc.overall_error_count,
 5258                                             0,
 5259                                             SCTP_FROM_SCTP_INPUT,
 5260                                             __LINE__);
 5261                                 }
 5262                                 stcb->asoc.overall_error_count = 0;
 5263                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
 5264                                     stcb);
 5265                                 ecne_seen = 1;
 5266                         }
 5267                         break;
 5268                 case SCTP_ECN_CWR:
 5269                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
 5270                         /* He's alive so give him credit */
 5271                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
 5272                                 /* Its not ours */
 5273                                 if (locked_tcb) {
 5274                                         SCTP_TCB_UNLOCK(locked_tcb);
 5275                                 }
 5276                                 *offset = length;
 5277                                 return (NULL);
 5278                         }
 5279                         if (stcb) {
 5280                                 if (stcb->asoc.ecn_supported == 0) {
 5281                                         goto unknown_chunk;
 5282                                 }
 5283                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5284                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5285                                             stcb->asoc.overall_error_count,
 5286                                             0,
 5287                                             SCTP_FROM_SCTP_INPUT,
 5288                                             __LINE__);
 5289                                 }
 5290                                 stcb->asoc.overall_error_count = 0;
 5291                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
 5292                         }
 5293                         break;
 5294                 case SCTP_SHUTDOWN_COMPLETE:
 5295                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb);
 5296                         /* must be first and only chunk */
 5297                         if ((num_chunks > 1) ||
 5298                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 5299                                 *offset = length;
 5300                                 if (locked_tcb) {
 5301                                         SCTP_TCB_UNLOCK(locked_tcb);
 5302                                 }
 5303                                 return (NULL);
 5304                         }
 5305                         if ((stcb) && netp && *netp) {
 5306                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
 5307                                     stcb, *netp);
 5308                         }
 5309                         *offset = length;
 5310                         return (NULL);
 5311                         break;
 5312                 case SCTP_ASCONF:
 5313                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
 5314                         /* He's alive so give him credit */
 5315                         if (stcb) {
 5316                                 if (stcb->asoc.asconf_supported == 0) {
 5317                                         goto unknown_chunk;
 5318                                 }
 5319                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5320                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5321                                             stcb->asoc.overall_error_count,
 5322                                             0,
 5323                                             SCTP_FROM_SCTP_INPUT,
 5324                                             __LINE__);
 5325                                 }
 5326                                 stcb->asoc.overall_error_count = 0;
 5327                                 sctp_handle_asconf(m, *offset, src,
 5328                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
 5329                                 asconf_cnt++;
 5330                         }
 5331                         break;
 5332                 case SCTP_ASCONF_ACK:
 5333                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
 5334                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
 5335                                 /* Its not ours */
 5336                                 if (locked_tcb) {
 5337                                         SCTP_TCB_UNLOCK(locked_tcb);
 5338                                 }
 5339                                 *offset = length;
 5340                                 return (NULL);
 5341                         }
 5342                         if ((stcb) && netp && *netp) {
 5343                                 if (stcb->asoc.asconf_supported == 0) {
 5344                                         goto unknown_chunk;
 5345                                 }
 5346                                 /* He's alive so give him credit */
 5347                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5348                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5349                                             stcb->asoc.overall_error_count,
 5350                                             0,
 5351                                             SCTP_FROM_SCTP_INPUT,
 5352                                             __LINE__);
 5353                                 }
 5354                                 stcb->asoc.overall_error_count = 0;
 5355                                 sctp_handle_asconf_ack(m, *offset,
 5356                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
 5357                                 if (abort_no_unlock)
 5358                                         return (NULL);
 5359                         }
 5360                         break;
 5361                 case SCTP_FORWARD_CUM_TSN:
 5362                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
 5363                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
 5364                                 /* Its not ours */
 5365                                 if (locked_tcb) {
 5366                                         SCTP_TCB_UNLOCK(locked_tcb);
 5367                                 }
 5368                                 *offset = length;
 5369                                 return (NULL);
 5370                         }
 5371                         /* He's alive so give him credit */
 5372                         if (stcb) {
 5373                                 int abort_flag = 0;
 5374 
 5375                                 if (stcb->asoc.prsctp_supported == 0) {
 5376                                         goto unknown_chunk;
 5377                                 }
 5378                                 stcb->asoc.overall_error_count = 0;
 5379                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5380                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5381                                             stcb->asoc.overall_error_count,
 5382                                             0,
 5383                                             SCTP_FROM_SCTP_INPUT,
 5384                                             __LINE__);
 5385                                 }
 5386                                 *fwd_tsn_seen = 1;
 5387                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5388                                         /* We are not interested anymore */
 5389 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5390                                         so = SCTP_INP_SO(inp);
 5391                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 5392                                         SCTP_TCB_UNLOCK(stcb);
 5393                                         SCTP_SOCKET_LOCK(so, 1);
 5394                                         SCTP_TCB_LOCK(stcb);
 5395                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5396 #endif
 5397                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
 5398 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5399                                         SCTP_SOCKET_UNLOCK(so, 1);
 5400 #endif
 5401                                         *offset = length;
 5402                                         return (NULL);
 5403                                 }
 5404                                 sctp_handle_forward_tsn(stcb,
 5405                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
 5406                                 if (abort_flag) {
 5407                                         *offset = length;
 5408                                         return (NULL);
 5409                                 } else {
 5410                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5411                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5412                                                     stcb->asoc.overall_error_count,
 5413                                                     0,
 5414                                                     SCTP_FROM_SCTP_INPUT,
 5415                                                     __LINE__);
 5416                                         }
 5417                                         stcb->asoc.overall_error_count = 0;
 5418                                 }
 5419 
 5420                         }
 5421                         break;
 5422                 case SCTP_STREAM_RESET:
 5423                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
 5424                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
 5425                                 /* Its not ours */
 5426                                 if (locked_tcb) {
 5427                                         SCTP_TCB_UNLOCK(locked_tcb);
 5428                                 }
 5429                                 *offset = length;
 5430                                 return (NULL);
 5431                         }
 5432                         if (stcb->asoc.reconfig_supported == 0) {
 5433                                 goto unknown_chunk;
 5434                         }
 5435                         if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
 5436                                 /* stop processing */
 5437                                 *offset = length;
 5438                                 return (NULL);
 5439                         }
 5440                         break;
 5441                 case SCTP_PACKET_DROPPED:
 5442                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
 5443                         /* re-get it all please */
 5444                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
 5445                                 /* Its not ours */
 5446                                 if (locked_tcb) {
 5447                                         SCTP_TCB_UNLOCK(locked_tcb);
 5448                                 }
 5449                                 *offset = length;
 5450                                 return (NULL);
 5451                         }
 5452                         if (ch && (stcb) && netp && (*netp)) {
 5453                                 if (stcb->asoc.pktdrop_supported == 0) {
 5454                                         goto unknown_chunk;
 5455                                 }
 5456                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
 5457                                     stcb, *netp,
 5458                                     min(chk_length, (sizeof(chunk_buf) - 4)));
 5459 
 5460                         }
 5461                         break;
 5462                 case SCTP_AUTHENTICATION:
 5463                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
 5464                         if (stcb == NULL) {
 5465                                 /* save the first AUTH for later processing */
 5466                                 if (auth_skipped == 0) {
 5467                                         auth_offset = *offset;
 5468                                         auth_len = chk_length;
 5469                                         auth_skipped = 1;
 5470                                 }
 5471                                 /* skip this chunk (temporarily) */
 5472                                 goto next_chunk;
 5473                         }
 5474                         if (stcb->asoc.auth_supported == 0) {
 5475                                 goto unknown_chunk;
 5476                         }
 5477                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
 5478                             (chk_length > (sizeof(struct sctp_auth_chunk) +
 5479                             SCTP_AUTH_DIGEST_LEN_MAX))) {
 5480                                 /* Its not ours */
 5481                                 if (locked_tcb) {
 5482                                         SCTP_TCB_UNLOCK(locked_tcb);
 5483                                 }
 5484                                 *offset = length;
 5485                                 return (NULL);
 5486                         }
 5487                         if (got_auth == 1) {
 5488                                 /* skip this chunk... it's already auth'd */
 5489                                 goto next_chunk;
 5490                         }
 5491                         got_auth = 1;
 5492                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
 5493                             m, *offset)) {
 5494                                 /* auth HMAC failed so dump the packet */
 5495                                 *offset = length;
 5496                                 return (stcb);
 5497                         } else {
 5498                                 /* remaining chunks are HMAC checked */
 5499                                 stcb->asoc.authenticated = 1;
 5500                         }
 5501                         break;
 5502 
 5503                 default:
 5504         unknown_chunk:
 5505                         /* it's an unknown chunk! */
 5506                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
 5507                                 struct mbuf *mm;
 5508                                 struct sctp_paramhdr *phd;
 5509 
 5510                                 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
 5511                                     0, M_NOWAIT, 1, MT_DATA);
 5512                                 if (mm) {
 5513                                         phd = mtod(mm, struct sctp_paramhdr *);
 5514                                         /*
 5515                                          * We cheat and use param type since
 5516                                          * we did not bother to define a
 5517                                          * error cause struct. They are the
 5518                                          * same basic format with different
 5519                                          * names.
 5520                                          */
 5521                                         phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
 5522                                         phd->param_length = htons(chk_length + sizeof(*phd));
 5523                                         SCTP_BUF_LEN(mm) = sizeof(*phd);
 5524                                         SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, chk_length, M_NOWAIT);
 5525                                         if (SCTP_BUF_NEXT(mm)) {
 5526                                                 if (sctp_pad_lastmbuf(SCTP_BUF_NEXT(mm), SCTP_SIZE32(chk_length) - chk_length, NULL) == NULL) {
 5527                                                         sctp_m_freem(mm);
 5528                                                 } else {
 5529 #ifdef SCTP_MBUF_LOGGING
 5530                                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 5531                                                                 struct mbuf *mat;
 5532 
 5533                                                                 for (mat = SCTP_BUF_NEXT(mm); mat; mat = SCTP_BUF_NEXT(mat)) {
 5534                                                                         if (SCTP_BUF_IS_EXTENDED(mat)) {
 5535                                                                                 sctp_log_mb(mat, SCTP_MBUF_ICOPY);
 5536                                                                         }
 5537                                                                 }
 5538                                                         }
 5539 #endif
 5540                                                         sctp_queue_op_err(stcb, mm);
 5541                                                 }
 5542                                         } else {
 5543                                                 sctp_m_freem(mm);
 5544                                         }
 5545                                 }
 5546                         }
 5547                         if ((ch->chunk_type & 0x80) == 0) {
 5548                                 /* discard this packet */
 5549                                 *offset = length;
 5550                                 return (stcb);
 5551                         }       /* else skip this bad chunk and continue... */
 5552                         break;
 5553                 }               /* switch (ch->chunk_type) */
 5554 
 5555 
 5556 next_chunk:
 5557                 /* get the next chunk */
 5558                 *offset += SCTP_SIZE32(chk_length);
 5559                 if (*offset >= length) {
 5560                         /* no more data left in the mbuf chain */
 5561                         break;
 5562                 }
 5563                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 5564                     sizeof(struct sctp_chunkhdr), chunk_buf);
 5565                 if (ch == NULL) {
 5566                         if (locked_tcb) {
 5567                                 SCTP_TCB_UNLOCK(locked_tcb);
 5568                         }
 5569                         *offset = length;
 5570                         return (NULL);
 5571                 }
 5572         }                       /* while */
 5573 
 5574         if (asconf_cnt > 0 && stcb != NULL) {
 5575                 sctp_send_asconf_ack(stcb);
 5576         }
 5577         return (stcb);
 5578 }
 5579 
 5580 
 5581 #ifdef INVARIANTS
 5582 #ifdef __GNUC__
 5583 __attribute__((noinline))
 5584 #endif
 5585         void
 5586              sctp_validate_no_locks(struct sctp_inpcb *inp)
 5587 {
 5588         struct sctp_tcb *lstcb;
 5589 
 5590         LIST_FOREACH(lstcb, &inp->sctp_asoc_list, sctp_tcblist) {
 5591                 if (mtx_owned(&lstcb->tcb_mtx)) {
 5592                         panic("Own lock on stcb at return from input");
 5593                 }
 5594         }
 5595         if (mtx_owned(&inp->inp_create_mtx)) {
 5596                 panic("Own create lock on inp");
 5597         }
 5598         if (mtx_owned(&inp->inp_mtx)) {
 5599                 panic("Own inp lock on inp");
 5600         }
 5601 }
 5602 
 5603 #endif
 5604 
 5605 /*
 5606  * common input chunk processing (v4 and v6)
 5607  */
 5608 void
 5609 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
 5610     struct sockaddr *src, struct sockaddr *dst,
 5611     struct sctphdr *sh, struct sctp_chunkhdr *ch,
 5612 #if !defined(SCTP_WITH_NO_CSUM)
 5613     uint8_t compute_crc,
 5614 #endif
 5615     uint8_t ecn_bits,
 5616     uint8_t use_mflowid, uint32_t mflowid,
 5617     uint32_t vrf_id, uint16_t port)
 5618 {
 5619         uint32_t high_tsn;
 5620         int fwd_tsn_seen = 0, data_processed = 0;
 5621         struct mbuf *m = *mm, *op_err;
 5622         char msg[SCTP_DIAG_INFO_LEN];
 5623         int un_sent;
 5624         int cnt_ctrl_ready = 0;
 5625         struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
 5626         struct sctp_tcb *stcb = NULL;
 5627         struct sctp_nets *net = NULL;
 5628 
 5629         SCTP_STAT_INCR(sctps_recvdatagrams);
 5630 #ifdef SCTP_AUDITING_ENABLED
 5631         sctp_audit_log(0xE0, 1);
 5632         sctp_auditing(0, inp, stcb, net);
 5633 #endif
 5634 #if !defined(SCTP_WITH_NO_CSUM)
 5635         if (compute_crc != 0) {
 5636                 uint32_t check, calc_check;
 5637 
 5638                 check = sh->checksum;
 5639                 sh->checksum = 0;
 5640                 calc_check = sctp_calculate_cksum(m, iphlen);
 5641                 sh->checksum = check;
 5642                 if (calc_check != check) {
 5643                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
 5644                             calc_check, check, (void *)m, length, iphlen);
 5645                         stcb = sctp_findassociation_addr(m, offset, src, dst,
 5646                             sh, ch, &inp, &net, vrf_id);
 5647 #if defined(INET) || defined(INET6)
 5648                         if ((net != NULL) && (port != 0)) {
 5649                                 if (net->port == 0) {
 5650                                         sctp_pathmtu_adjustment(stcb, net->mtu - sizeof(struct udphdr));
 5651                                 }
 5652                                 net->port = port;
 5653                         }
 5654 #endif
 5655                         if ((net != NULL) && (use_mflowid != 0)) {
 5656                                 net->flowid = mflowid;
 5657 #ifdef INVARIANTS
 5658                                 net->flowidset = 1;
 5659 #endif
 5660                         }
 5661                         if ((inp != NULL) && (stcb != NULL)) {
 5662                                 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
 5663                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
 5664                         } else if ((inp != NULL) && (stcb == NULL)) {
 5665                                 inp_decr = inp;
 5666                         }
 5667                         SCTP_STAT_INCR(sctps_badsum);
 5668                         SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
 5669                         goto out;
 5670                 }
 5671         }
 5672 #endif
 5673         /* Destination port of 0 is illegal, based on RFC4960. */
 5674         if (sh->dest_port == 0) {
 5675                 SCTP_STAT_INCR(sctps_hdrops);
 5676                 goto out;
 5677         }
 5678         stcb = sctp_findassociation_addr(m, offset, src, dst,
 5679             sh, ch, &inp, &net, vrf_id);
 5680 #if defined(INET) || defined(INET6)
 5681         if ((net != NULL) && (port != 0)) {
 5682                 if (net->port == 0) {
 5683                         sctp_pathmtu_adjustment(stcb, net->mtu - sizeof(struct udphdr));
 5684                 }
 5685                 net->port = port;
 5686         }
 5687 #endif
 5688         if ((net != NULL) && (use_mflowid != 0)) {
 5689                 net->flowid = mflowid;
 5690 #ifdef INVARIANTS
 5691                 net->flowidset = 1;
 5692 #endif
 5693         }
 5694         if (inp == NULL) {
 5695                 SCTP_STAT_INCR(sctps_noport);
 5696                 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
 5697                         goto out;
 5698                 }
 5699                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
 5700                         sctp_send_shutdown_complete2(src, dst, sh,
 5701                             use_mflowid, mflowid,
 5702                             vrf_id, port);
 5703                         goto out;
 5704                 }
 5705                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
 5706                         goto out;
 5707                 }
 5708                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
 5709                         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
 5710                             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
 5711                             (ch->chunk_type != SCTP_INIT))) {
 5712                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5713                                     "Out of the blue");
 5714                                 sctp_send_abort(m, iphlen, src, dst,
 5715                                     sh, 0, op_err,
 5716                                     use_mflowid, mflowid,
 5717                                     vrf_id, port);
 5718                         }
 5719                 }
 5720                 goto out;
 5721         } else if (stcb == NULL) {
 5722                 inp_decr = inp;
 5723         }
 5724 #ifdef IPSEC
 5725         /*-
 5726          * I very much doubt any of the IPSEC stuff will work but I have no
 5727          * idea, so I will leave it in place.
 5728          */
 5729         if (inp != NULL) {
 5730                 switch (dst->sa_family) {
 5731 #ifdef INET
 5732                 case AF_INET:
 5733                         if (ipsec4_in_reject(m, &inp->ip_inp.inp)) {
 5734                                 IPSECSTAT_INC(ips_in_polvio);
 5735                                 SCTP_STAT_INCR(sctps_hdrops);
 5736                                 goto out;
 5737                         }
 5738                         break;
 5739 #endif
 5740 #ifdef INET6
 5741                 case AF_INET6:
 5742                         if (ipsec6_in_reject(m, &inp->ip_inp.inp)) {
 5743                                 IPSEC6STAT_INC(ips_in_polvio);
 5744                                 SCTP_STAT_INCR(sctps_hdrops);
 5745                                 goto out;
 5746                         }
 5747                         break;
 5748 #endif
 5749                 default:
 5750                         break;
 5751                 }
 5752         }
 5753 #endif
 5754         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
 5755             (void *)m, iphlen, offset, length, (void *)stcb);
 5756         if (stcb) {
 5757                 /* always clear this before beginning a packet */
 5758                 stcb->asoc.authenticated = 0;
 5759                 stcb->asoc.seen_a_sack_this_pkt = 0;
 5760                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
 5761                     (void *)stcb, stcb->asoc.state);
 5762 
 5763                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
 5764                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
 5765                         /*-
 5766                          * If we hit here, we had a ref count
 5767                          * up when the assoc was aborted and the
 5768                          * timer is clearing out the assoc, we should
 5769                          * NOT respond to any packet.. its OOTB.
 5770                          */
 5771                         SCTP_TCB_UNLOCK(stcb);
 5772                         stcb = NULL;
 5773                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__);
 5774                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5775                             msg);
 5776                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
 5777                             use_mflowid, mflowid,
 5778                             vrf_id, port);
 5779                         goto out;
 5780                 }
 5781         }
 5782         if (IS_SCTP_CONTROL(ch)) {
 5783                 /* process the control portion of the SCTP packet */
 5784                 /* sa_ignore NO_NULL_CHK */
 5785                 stcb = sctp_process_control(m, iphlen, &offset, length,
 5786                     src, dst, sh, ch,
 5787                     inp, stcb, &net, &fwd_tsn_seen,
 5788                     use_mflowid, mflowid,
 5789                     vrf_id, port);
 5790                 if (stcb) {
 5791                         /*
 5792                          * This covers us if the cookie-echo was there and
 5793                          * it changes our INP.
 5794                          */
 5795                         inp = stcb->sctp_ep;
 5796 #if defined(INET) || defined(INET6)
 5797                         if ((net) && (port)) {
 5798                                 if (net->port == 0) {
 5799                                         sctp_pathmtu_adjustment(stcb, net->mtu - sizeof(struct udphdr));
 5800                                 }
 5801                                 net->port = port;
 5802                         }
 5803 #endif
 5804                 }
 5805         } else {
 5806                 /*
 5807                  * no control chunks, so pre-process DATA chunks (these
 5808                  * checks are taken care of by control processing)
 5809                  */
 5810 
 5811                 /*
 5812                  * if DATA only packet, and auth is required, then punt...
 5813                  * can't have authenticated without any AUTH (control)
 5814                  * chunks
 5815                  */
 5816                 if ((stcb != NULL) &&
 5817                     (stcb->asoc.auth_supported == 1) &&
 5818                     sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
 5819                         /* "silently" ignore */
 5820                         SCTP_STAT_INCR(sctps_recvauthmissing);
 5821                         goto out;
 5822                 }
 5823                 if (stcb == NULL) {
 5824                         /* out of the blue DATA chunk */
 5825                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__);
 5826                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5827                             msg);
 5828                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
 5829                             use_mflowid, mflowid,
 5830                             vrf_id, port);
 5831                         goto out;
 5832                 }
 5833                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
 5834                         /* v_tag mismatch! */
 5835                         SCTP_STAT_INCR(sctps_badvtag);
 5836                         goto out;
 5837                 }
 5838         }
 5839 
 5840         if (stcb == NULL) {
 5841                 /*
 5842                  * no valid TCB for this packet, or we found it's a bad
 5843                  * packet while processing control, or we're done with this
 5844                  * packet (done or skip rest of data), so we drop it...
 5845                  */
 5846                 goto out;
 5847         }
 5848         /*
 5849          * DATA chunk processing
 5850          */
 5851         /* plow through the data chunks while length > offset */
 5852 
 5853         /*
 5854          * Rest should be DATA only.  Check authentication state if AUTH for
 5855          * DATA is required.
 5856          */
 5857         if ((length > offset) &&
 5858             (stcb != NULL) &&
 5859             (stcb->asoc.auth_supported == 1) &&
 5860             sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
 5861             !stcb->asoc.authenticated) {
 5862                 /* "silently" ignore */
 5863                 SCTP_STAT_INCR(sctps_recvauthmissing);
 5864                 SCTPDBG(SCTP_DEBUG_AUTH1,
 5865                     "Data chunk requires AUTH, skipped\n");
 5866                 goto trigger_send;
 5867         }
 5868         if (length > offset) {
 5869                 int retval;
 5870 
 5871                 /*
 5872                  * First check to make sure our state is correct. We would
 5873                  * not get here unless we really did have a tag, so we don't
 5874                  * abort if this happens, just dump the chunk silently.
 5875                  */
 5876                 switch (SCTP_GET_STATE(&stcb->asoc)) {
 5877                 case SCTP_STATE_COOKIE_ECHOED:
 5878                         /*
 5879                          * we consider data with valid tags in this state
 5880                          * shows us the cookie-ack was lost. Imply it was
 5881                          * there.
 5882                          */
 5883                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5884                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5885                                     stcb->asoc.overall_error_count,
 5886                                     0,
 5887                                     SCTP_FROM_SCTP_INPUT,
 5888                                     __LINE__);
 5889                         }
 5890                         stcb->asoc.overall_error_count = 0;
 5891                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
 5892                         break;
 5893                 case SCTP_STATE_COOKIE_WAIT:
 5894                         /*
 5895                          * We consider OOTB any data sent during asoc setup.
 5896                          */
 5897                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s\n", __FILE__, __LINE__, __FUNCTION__);
 5898                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5899                             msg);
 5900                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
 5901                             use_mflowid, mflowid,
 5902                             vrf_id, port);
 5903                         goto out;
 5904                         /* sa_ignore NOTREACHED */
 5905                         break;
 5906                 case SCTP_STATE_EMPTY:  /* should not happen */
 5907                 case SCTP_STATE_INUSE:  /* should not happen */
 5908                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
 5909                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 5910                 default:
 5911                         goto out;
 5912                         /* sa_ignore NOTREACHED */
 5913                         break;
 5914                 case SCTP_STATE_OPEN:
 5915                 case SCTP_STATE_SHUTDOWN_SENT:
 5916                         break;
 5917                 }
 5918                 /* plow through the data chunks while length > offset */
 5919                 retval = sctp_process_data(mm, iphlen, &offset, length,
 5920                     src, dst, sh,
 5921                     inp, stcb, net, &high_tsn,
 5922                     use_mflowid, mflowid,
 5923                     vrf_id, port);
 5924                 if (retval == 2) {
 5925                         /*
 5926                          * The association aborted, NO UNLOCK needed since
 5927                          * the association is destroyed.
 5928                          */
 5929                         stcb = NULL;
 5930                         goto out;
 5931                 }
 5932                 data_processed = 1;
 5933                 /*
 5934                  * Anything important needs to have been m_copy'ed in
 5935                  * process_data
 5936                  */
 5937         }
 5938         /* take care of ecn */
 5939         if ((data_processed == 1) &&
 5940             (stcb->asoc.ecn_supported == 1) &&
 5941             ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
 5942                 /* Yep, we need to add a ECNE */
 5943                 sctp_send_ecn_echo(stcb, net, high_tsn);
 5944         }
 5945         if ((data_processed == 0) && (fwd_tsn_seen)) {
 5946                 int was_a_gap;
 5947                 uint32_t highest_tsn;
 5948 
 5949                 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
 5950                         highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
 5951                 } else {
 5952                         highest_tsn = stcb->asoc.highest_tsn_inside_map;
 5953                 }
 5954                 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
 5955                 stcb->asoc.send_sack = 1;
 5956                 sctp_sack_check(stcb, was_a_gap);
 5957         } else if (fwd_tsn_seen) {
 5958                 stcb->asoc.send_sack = 1;
 5959         }
 5960         /* trigger send of any chunks in queue... */
 5961 trigger_send:
 5962 #ifdef SCTP_AUDITING_ENABLED
 5963         sctp_audit_log(0xE0, 2);
 5964         sctp_auditing(1, inp, stcb, net);
 5965 #endif
 5966         SCTPDBG(SCTP_DEBUG_INPUT1,
 5967             "Check for chunk output prw:%d tqe:%d tf=%d\n",
 5968             stcb->asoc.peers_rwnd,
 5969             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
 5970             stcb->asoc.total_flight);
 5971         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
 5972         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
 5973                 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
 5974         }
 5975         if (cnt_ctrl_ready ||
 5976             ((un_sent) &&
 5977             (stcb->asoc.peers_rwnd > 0 ||
 5978             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
 5979                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
 5980                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 5981                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
 5982         }
 5983 #ifdef SCTP_AUDITING_ENABLED
 5984         sctp_audit_log(0xE0, 3);
 5985         sctp_auditing(2, inp, stcb, net);
 5986 #endif
 5987 out:
 5988         if (stcb != NULL) {
 5989                 SCTP_TCB_UNLOCK(stcb);
 5990         }
 5991         if (inp_decr != NULL) {
 5992                 /* reduce ref-count */
 5993                 SCTP_INP_WLOCK(inp_decr);
 5994                 SCTP_INP_DECR_REF(inp_decr);
 5995                 SCTP_INP_WUNLOCK(inp_decr);
 5996         }
 5997 #ifdef INVARIANTS
 5998         if (inp != NULL) {
 5999                 sctp_validate_no_locks(inp);
 6000         }
 6001 #endif
 6002         return;
 6003 }
 6004 
 6005 #if 0
 6006 static void
 6007 sctp_print_mbuf_chain(struct mbuf *m)
 6008 {
 6009         for (; m; m = SCTP_BUF_NEXT(m)) {
 6010                 SCTP_PRINTF("%p: m_len = %ld\n", (void *)m, SCTP_BUF_LEN(m));
 6011                 if (SCTP_BUF_IS_EXTENDED(m))
 6012                         SCTP_PRINTF("%p: extend_size = %d\n", (void *)m, SCTP_BUF_EXTEND_SIZE(m));
 6013         }
 6014 }
 6015 
 6016 #endif
 6017 
 6018 #ifdef INET
 6019 void
 6020 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
 6021 {
 6022         struct mbuf *m;
 6023         int iphlen;
 6024         uint32_t vrf_id = 0;
 6025         uint8_t ecn_bits;
 6026         struct sockaddr_in src, dst;
 6027         struct ip *ip;
 6028         struct sctphdr *sh;
 6029         struct sctp_chunkhdr *ch;
 6030         int length, offset;
 6031 
 6032 #if !defined(SCTP_WITH_NO_CSUM)
 6033         uint8_t compute_crc;
 6034 
 6035 #endif
 6036         uint32_t mflowid;
 6037         uint8_t use_mflowid;
 6038 
 6039         iphlen = off;
 6040         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
 6041                 SCTP_RELEASE_PKT(i_pak);
 6042                 return;
 6043         }
 6044         m = SCTP_HEADER_TO_CHAIN(i_pak);
 6045 #ifdef SCTP_MBUF_LOGGING
 6046         /* Log in any input mbufs */
 6047         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 6048                 struct mbuf *mat;
 6049 
 6050                 for (mat = m; mat; mat = SCTP_BUF_NEXT(