The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_input.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
    3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
    4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions are met:
    8  *
    9  * a) Redistributions of source code must retain the above copyright notice,
   10  *    this list of conditions and the following disclaimer.
   11  *
   12  * b) Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in
   14  *    the documentation and/or other materials provided with the distribution.
   15  *
   16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
   17  *    contributors may be used to endorse or promote products derived
   18  *    from this software without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
   22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
   24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   30  * THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 #include <sys/cdefs.h>
   34 __FBSDID("$FreeBSD: releng/11.1/sys/netinet/sctp_input.c 320457 2017-06-28 21:08:21Z tuexen $");
   35 
   36 #include <netinet/sctp_os.h>
   37 #include <netinet/sctp_var.h>
   38 #include <netinet/sctp_sysctl.h>
   39 #include <netinet/sctp_pcb.h>
   40 #include <netinet/sctp_header.h>
   41 #include <netinet/sctputil.h>
   42 #include <netinet/sctp_output.h>
   43 #include <netinet/sctp_input.h>
   44 #include <netinet/sctp_auth.h>
   45 #include <netinet/sctp_indata.h>
   46 #include <netinet/sctp_asconf.h>
   47 #include <netinet/sctp_bsd_addr.h>
   48 #include <netinet/sctp_timer.h>
   49 #include <netinet/sctp_crc32.h>
   50 #if defined(INET) || defined(INET6)
   51 #include <netinet/udp.h>
   52 #endif
   53 #include <sys/smp.h>
   54 
   55 
   56 
   57 static void
   58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
   59 {
   60         struct sctp_nets *net;
   61 
   62         /*
   63          * This now not only stops all cookie timers it also stops any INIT
   64          * timers as well. This will make sure that the timers are stopped
   65          * in all collision cases.
   66          */
   67         SCTP_TCB_LOCK_ASSERT(stcb);
   68         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
   69                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
   70                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
   71                             stcb->sctp_ep,
   72                             stcb,
   73                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
   74                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
   75                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
   76                             stcb->sctp_ep,
   77                             stcb,
   78                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
   79                 }
   80         }
   81 }
   82 
   83 /* INIT handler */
   84 static void
   85 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
   86     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
   87     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
   88     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_no_unlock,
   89     uint8_t mflowtype, uint32_t mflowid,
   90     uint32_t vrf_id, uint16_t port)
   91 {
   92         struct sctp_init *init;
   93         struct mbuf *op_err;
   94 
   95         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
   96             (void *)stcb);
   97         if (stcb == NULL) {
   98                 SCTP_INP_RLOCK(inp);
   99         }
  100         /* validate length */
  101         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
  102                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  103                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  104                     mflowtype, mflowid,
  105                     vrf_id, port);
  106                 if (stcb)
  107                         *abort_no_unlock = 1;
  108                 goto outnow;
  109         }
  110         /* validate parameters */
  111         init = &cp->init;
  112         if (init->initiate_tag == 0) {
  113                 /* protocol error... send abort */
  114                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  115                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  116                     mflowtype, mflowid,
  117                     vrf_id, port);
  118                 if (stcb)
  119                         *abort_no_unlock = 1;
  120                 goto outnow;
  121         }
  122         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
  123                 /* invalid parameter... send abort */
  124                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  125                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  126                     mflowtype, mflowid,
  127                     vrf_id, port);
  128                 if (stcb)
  129                         *abort_no_unlock = 1;
  130                 goto outnow;
  131         }
  132         if (init->num_inbound_streams == 0) {
  133                 /* protocol error... send abort */
  134                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  135                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  136                     mflowtype, mflowid,
  137                     vrf_id, port);
  138                 if (stcb)
  139                         *abort_no_unlock = 1;
  140                 goto outnow;
  141         }
  142         if (init->num_outbound_streams == 0) {
  143                 /* protocol error... send abort */
  144                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
  145                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  146                     mflowtype, mflowid,
  147                     vrf_id, port);
  148                 if (stcb)
  149                         *abort_no_unlock = 1;
  150                 goto outnow;
  151         }
  152         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
  153             offset + ntohs(cp->ch.chunk_length))) {
  154                 /* auth parameter(s) error... send abort */
  155                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
  156                     "Problem with AUTH parameters");
  157                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
  158                     mflowtype, mflowid,
  159                     vrf_id, port);
  160                 if (stcb)
  161                         *abort_no_unlock = 1;
  162                 goto outnow;
  163         }
  164         /* We are only accepting if we have a socket with positive
  165          * so_qlimit. */
  166         if ((stcb == NULL) &&
  167             ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
  168             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
  169             (inp->sctp_socket == NULL) ||
  170             (inp->sctp_socket->so_qlimit == 0))) {
  171                 /*
  172                  * FIX ME ?? What about TCP model and we have a
  173                  * match/restart case? Actually no fix is needed. the lookup
  174                  * will always find the existing assoc so stcb would not be
  175                  * NULL. It may be questionable to do this since we COULD
  176                  * just send back the INIT-ACK and hope that the app did
  177                  * accept()'s by the time the COOKIE was sent. But there is
  178                  * a price to pay for COOKIE generation and I don't want to
  179                  * pay it on the chance that the app will actually do some
  180                  * accepts(). The App just looses and should NOT be in this
  181                  * state :-)
  182                  */
  183                 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
  184                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
  185                             "No listener");
  186                         sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
  187                             mflowtype, mflowid, inp->fibnum,
  188                             vrf_id, port);
  189                 }
  190                 goto outnow;
  191         }
  192         if ((stcb != NULL) &&
  193             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
  194                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
  195                 sctp_send_shutdown_ack(stcb, NULL);
  196                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
  197         } else {
  198                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
  199                 sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset,
  200                     src, dst, sh, cp,
  201                     mflowtype, mflowid,
  202                     vrf_id, port,
  203                     ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
  204         }
  205 outnow:
  206         if (stcb == NULL) {
  207                 SCTP_INP_RUNLOCK(inp);
  208         }
  209 }
  210 
  211 /*
  212  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
  213  */
  214 
  215 int
  216 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
  217 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
  218     SCTP_UNUSED
  219 #endif
  220 )
  221 {
  222         int unsent_data;
  223         unsigned int i;
  224         struct sctp_stream_queue_pending *sp;
  225         struct sctp_association *asoc;
  226 
  227         /*
  228          * This function returns if any stream has true unsent data on it.
  229          * Note that as it looks through it will clean up any places that
  230          * have old data that has been sent but left at top of stream queue.
  231          */
  232         asoc = &stcb->asoc;
  233         unsent_data = 0;
  234         SCTP_TCB_SEND_LOCK(stcb);
  235         if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
  236                 /* Check to see if some data queued */
  237                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
  238                         /* sa_ignore FREED_MEMORY */
  239                         sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
  240                         if (sp == NULL) {
  241                                 continue;
  242                         }
  243                         if ((sp->msg_is_complete) &&
  244                             (sp->length == 0) &&
  245                             (sp->sender_all_done)) {
  246                                 /*
  247                                  * We are doing differed cleanup. Last time
  248                                  * through when we took all the data the
  249                                  * sender_all_done was not set.
  250                                  */
  251                                 if (sp->put_last_out == 0) {
  252                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
  253                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
  254                                             sp->sender_all_done,
  255                                             sp->length,
  256                                             sp->msg_is_complete,
  257                                             sp->put_last_out);
  258                                 }
  259                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
  260                                 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
  261                                 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp, 1);
  262                                 if (sp->net) {
  263                                         sctp_free_remote_addr(sp->net);
  264                                         sp->net = NULL;
  265                                 }
  266                                 if (sp->data) {
  267                                         sctp_m_freem(sp->data);
  268                                         sp->data = NULL;
  269                                 }
  270                                 sctp_free_a_strmoq(stcb, sp, so_locked);
  271                                 if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
  272                                         unsent_data++;
  273                                 }
  274                         } else {
  275                                 unsent_data++;
  276                         }
  277                         if (unsent_data > 0) {
  278                                 break;
  279                         }
  280                 }
  281         }
  282         SCTP_TCB_SEND_UNLOCK(stcb);
  283         return (unsent_data);
  284 }
  285 
  286 static int
  287 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
  288 {
  289         struct sctp_init *init;
  290         struct sctp_association *asoc;
  291         struct sctp_nets *lnet;
  292         unsigned int i;
  293 
  294         init = &cp->init;
  295         asoc = &stcb->asoc;
  296         /* save off parameters */
  297         asoc->peer_vtag = ntohl(init->initiate_tag);
  298         asoc->peers_rwnd = ntohl(init->a_rwnd);
  299         /* init tsn's */
  300         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
  301 
  302         if (!TAILQ_EMPTY(&asoc->nets)) {
  303                 /* update any ssthresh's that may have a default */
  304                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
  305                         lnet->ssthresh = asoc->peers_rwnd;
  306                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
  307                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
  308                         }
  309                 }
  310         }
  311         SCTP_TCB_SEND_LOCK(stcb);
  312         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
  313                 unsigned int newcnt;
  314                 struct sctp_stream_out *outs;
  315                 struct sctp_stream_queue_pending *sp, *nsp;
  316                 struct sctp_tmit_chunk *chk, *nchk;
  317 
  318                 /* abandon the upper streams */
  319                 newcnt = ntohs(init->num_inbound_streams);
  320                 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
  321                         if (chk->rec.data.sid >= newcnt) {
  322                                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
  323                                 asoc->send_queue_cnt--;
  324                                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
  325                                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
  326 #ifdef INVARIANTS
  327                                 } else {
  328                                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
  329 #endif
  330                                 }
  331                                 if (chk->data != NULL) {
  332                                         sctp_free_bufspace(stcb, asoc, chk, 1);
  333                                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
  334                                             0, chk, SCTP_SO_NOT_LOCKED);
  335                                         if (chk->data) {
  336                                                 sctp_m_freem(chk->data);
  337                                                 chk->data = NULL;
  338                                         }
  339                                 }
  340                                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
  341                                 /* sa_ignore FREED_MEMORY */
  342                         }
  343                 }
  344                 if (asoc->strmout) {
  345                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
  346                                 outs = &asoc->strmout[i];
  347                                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
  348                                         atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
  349                                         TAILQ_REMOVE(&outs->outqueue, sp, next);
  350                                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
  351                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
  352                                             stcb, 0, sp, SCTP_SO_NOT_LOCKED);
  353                                         if (sp->data) {
  354                                                 sctp_m_freem(sp->data);
  355                                                 sp->data = NULL;
  356                                         }
  357                                         if (sp->net) {
  358                                                 sctp_free_remote_addr(sp->net);
  359                                                 sp->net = NULL;
  360                                         }
  361                                         /* Free the chunk */
  362                                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
  363                                         /* sa_ignore FREED_MEMORY */
  364                                 }
  365                                 outs->state = SCTP_STREAM_CLOSED;
  366                         }
  367                 }
  368                 /* cut back the count */
  369                 asoc->pre_open_streams = newcnt;
  370         }
  371         SCTP_TCB_SEND_UNLOCK(stcb);
  372         asoc->streamoutcnt = asoc->pre_open_streams;
  373         if (asoc->strmout) {
  374                 for (i = 0; i < asoc->streamoutcnt; i++) {
  375                         asoc->strmout[i].state = SCTP_STREAM_OPEN;
  376                 }
  377         }
  378         /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
  379         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
  380         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
  381                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
  382         }
  383         /* This is the next one we expect */
  384         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
  385 
  386         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
  387         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
  388 
  389         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
  390         /* open the requested streams */
  391 
  392         if (asoc->strmin != NULL) {
  393                 /* Free the old ones */
  394                 for (i = 0; i < asoc->streamincnt; i++) {
  395                         sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
  396                         sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
  397                 }
  398                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
  399         }
  400         if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
  401                 asoc->streamincnt = ntohs(init->num_outbound_streams);
  402         } else {
  403                 asoc->streamincnt = asoc->max_inbound_streams;
  404         }
  405         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
  406             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
  407         if (asoc->strmin == NULL) {
  408                 /* we didn't get memory for the streams! */
  409                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
  410                 return (-1);
  411         }
  412         for (i = 0; i < asoc->streamincnt; i++) {
  413                 asoc->strmin[i].sid = i;
  414                 asoc->strmin[i].last_mid_delivered = 0xffffffff;
  415                 TAILQ_INIT(&asoc->strmin[i].inqueue);
  416                 TAILQ_INIT(&asoc->strmin[i].uno_inqueue);
  417                 asoc->strmin[i].pd_api_started = 0;
  418                 asoc->strmin[i].delivery_started = 0;
  419         }
  420         /*
  421          * load_address_from_init will put the addresses into the
  422          * association when the COOKIE is processed or the INIT-ACK is
  423          * processed. Both types of COOKIE's existing and new call this
  424          * routine. It will remove addresses that are no longer in the
  425          * association (for the restarting case where addresses are
  426          * removed). Up front when the INIT arrives we will discard it if it
  427          * is a restart and new addresses have been added.
  428          */
  429         /* sa_ignore MEMLEAK */
  430         return (0);
  431 }
  432 
  433 /*
  434  * INIT-ACK message processing/consumption returns value < 0 on error
  435  */
  436 static int
  437 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
  438     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
  439     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
  440     struct sctp_nets *net, int *abort_no_unlock,
  441     uint8_t mflowtype, uint32_t mflowid,
  442     uint32_t vrf_id)
  443 {
  444         struct sctp_association *asoc;
  445         struct mbuf *op_err;
  446         int retval, abort_flag;
  447         uint32_t initack_limit;
  448         int nat_friendly = 0;
  449 
  450         /* First verify that we have no illegal param's */
  451         abort_flag = 0;
  452 
  453         op_err = sctp_arethere_unrecognized_parameters(m,
  454             (offset + sizeof(struct sctp_init_chunk)),
  455             &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
  456         if (abort_flag) {
  457                 /* Send an abort and notify peer */
  458                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
  459                 *abort_no_unlock = 1;
  460                 return (-1);
  461         }
  462         asoc = &stcb->asoc;
  463         asoc->peer_supports_nat = (uint8_t)nat_friendly;
  464         /* process the peer's parameters in the INIT-ACK */
  465         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
  466         if (retval < 0) {
  467                 return (retval);
  468         }
  469         initack_limit = offset + ntohs(cp->ch.chunk_length);
  470         /* load all addresses */
  471         if ((retval = sctp_load_addresses_from_init(stcb, m,
  472             (offset + sizeof(struct sctp_init_chunk)), initack_limit,
  473             src, dst, NULL, stcb->asoc.port))) {
  474                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
  475                     "Problem with address parameters");
  476                 SCTPDBG(SCTP_DEBUG_INPUT1,
  477                     "Load addresses from INIT causes an abort %d\n",
  478                     retval);
  479                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
  480                     src, dst, sh, op_err,
  481                     mflowtype, mflowid,
  482                     vrf_id, net->port);
  483                 *abort_no_unlock = 1;
  484                 return (-1);
  485         }
  486         /* if the peer doesn't support asconf, flush the asconf queue */
  487         if (asoc->asconf_supported == 0) {
  488                 struct sctp_asconf_addr *param, *nparam;
  489 
  490                 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
  491                         TAILQ_REMOVE(&asoc->asconf_queue, param, next);
  492                         SCTP_FREE(param, SCTP_M_ASC_ADDR);
  493                 }
  494         }
  495         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
  496             stcb->asoc.local_hmacs);
  497         if (op_err) {
  498                 sctp_queue_op_err(stcb, op_err);
  499                 /* queuing will steal away the mbuf chain to the out queue */
  500                 op_err = NULL;
  501         }
  502         /* extract the cookie and queue it to "echo" it back... */
  503         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
  504                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
  505                     stcb->asoc.overall_error_count,
  506                     0,
  507                     SCTP_FROM_SCTP_INPUT,
  508                     __LINE__);
  509         }
  510         stcb->asoc.overall_error_count = 0;
  511         net->error_count = 0;
  512 
  513         /*
  514          * Cancel the INIT timer, We do this first before queueing the
  515          * cookie. We always cancel at the primary to assue that we are
  516          * canceling the timer started by the INIT which always goes to the
  517          * primary.
  518          */
  519         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
  520             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
  521 
  522         /* calculate the RTO */
  523         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
  524             SCTP_RTT_FROM_NON_DATA);
  525         retval = sctp_send_cookie_echo(m, offset, stcb, net);
  526         if (retval < 0) {
  527                 /*
  528                  * No cookie, we probably should send a op error. But in any
  529                  * case if there is no cookie in the INIT-ACK, we can
  530                  * abandon the peer, its broke.
  531                  */
  532                 if (retval == -3) {
  533                         uint16_t len;
  534 
  535                         len = (uint16_t)(sizeof(struct sctp_error_missing_param) + sizeof(uint16_t));
  536                         /* We abort with an error of missing mandatory param */
  537                         op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
  538                         if (op_err != NULL) {
  539                                 struct sctp_error_missing_param *cause;
  540 
  541                                 SCTP_BUF_LEN(op_err) = len;
  542                                 cause = mtod(op_err, struct sctp_error_missing_param *);
  543                                 /* Subtract the reserved param */
  544                                 cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM);
  545                                 cause->cause.length = htons(len);
  546                                 cause->num_missing_params = htonl(1);
  547                                 cause->type[0] = htons(SCTP_STATE_COOKIE);
  548                         }
  549                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
  550                             src, dst, sh, op_err,
  551                             mflowtype, mflowid,
  552                             vrf_id, net->port);
  553                         *abort_no_unlock = 1;
  554                 }
  555                 return (retval);
  556         }
  557         return (0);
  558 }
  559 
  560 static void
  561 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
  562     struct sctp_tcb *stcb, struct sctp_nets *net)
  563 {
  564         union sctp_sockstore store;
  565         struct sctp_nets *r_net, *f_net;
  566         struct timeval tv;
  567         int req_prim = 0;
  568         uint16_t old_error_counter;
  569 
  570         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
  571                 /* Invalid length */
  572                 return;
  573         }
  574         memset(&store, 0, sizeof(store));
  575         switch (cp->heartbeat.hb_info.addr_family) {
  576 #ifdef INET
  577         case AF_INET:
  578                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
  579                         store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
  580                         store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
  581                         store.sin.sin_port = stcb->rport;
  582                         memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
  583                             sizeof(store.sin.sin_addr));
  584                 } else {
  585                         return;
  586                 }
  587                 break;
  588 #endif
  589 #ifdef INET6
  590         case AF_INET6:
  591                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
  592                         store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
  593                         store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
  594                         store.sin6.sin6_port = stcb->rport;
  595                         memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
  596                 } else {
  597                         return;
  598                 }
  599                 break;
  600 #endif
  601         default:
  602                 return;
  603         }
  604         r_net = sctp_findnet(stcb, &store.sa);
  605         if (r_net == NULL) {
  606                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
  607                 return;
  608         }
  609         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
  610             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
  611             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
  612                 /*
  613                  * If the its a HB and it's random value is correct when can
  614                  * confirm the destination.
  615                  */
  616                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
  617                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
  618                         stcb->asoc.primary_destination = r_net;
  619                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
  620                         f_net = TAILQ_FIRST(&stcb->asoc.nets);
  621                         if (f_net != r_net) {
  622                                 /*
  623                                  * first one on the list is NOT the primary
  624                                  * sctp_cmpaddr() is much more efficient if
  625                                  * the primary is the first on the list,
  626                                  * make it so.
  627                                  */
  628                                 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
  629                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
  630                         }
  631                         req_prim = 1;
  632                 }
  633                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
  634                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
  635                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
  636                     r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
  637                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
  638         }
  639         old_error_counter = r_net->error_count;
  640         r_net->error_count = 0;
  641         r_net->hb_responded = 1;
  642         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
  643         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
  644         /* Now lets do a RTO with this */
  645         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
  646             SCTP_RTT_FROM_NON_DATA);
  647         if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
  648                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
  649                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
  650                     0, (void *)r_net, SCTP_SO_NOT_LOCKED);
  651         }
  652         if (r_net->dest_state & SCTP_ADDR_PF) {
  653                 r_net->dest_state &= ~SCTP_ADDR_PF;
  654                 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
  655         }
  656         if (old_error_counter > 0) {
  657                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
  658                     stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
  659                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
  660         }
  661         if (r_net == stcb->asoc.primary_destination) {
  662                 if (stcb->asoc.alternate) {
  663                         /* release the alternate, primary is good */
  664                         sctp_free_remote_addr(stcb->asoc.alternate);
  665                         stcb->asoc.alternate = NULL;
  666                 }
  667         }
  668         /* Mobility adaptation */
  669         if (req_prim) {
  670                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
  671                     SCTP_MOBILITY_BASE) ||
  672                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  673                     SCTP_MOBILITY_FASTHANDOFF)) &&
  674                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  675                     SCTP_MOBILITY_PRIM_DELETED)) {
  676 
  677                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
  678                             stcb->sctp_ep, stcb, NULL,
  679                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
  680                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  681                             SCTP_MOBILITY_FASTHANDOFF)) {
  682                                 sctp_assoc_immediate_retrans(stcb,
  683                                     stcb->asoc.primary_destination);
  684                         }
  685                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  686                             SCTP_MOBILITY_BASE)) {
  687                                 sctp_move_chunks_from_net(stcb,
  688                                     stcb->asoc.deleted_primary);
  689                         }
  690                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
  691                             stcb->asoc.deleted_primary);
  692                 }
  693         }
  694 }
  695 
  696 static int
  697 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
  698 {
  699         /*
  700          * return 0 means we want you to proceed with the abort non-zero
  701          * means no abort processing
  702          */
  703         struct sctpasochead *head;
  704 
  705         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
  706                 /* generate a new vtag and send init */
  707                 LIST_REMOVE(stcb, sctp_asocs);
  708                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
  709                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
  710                 /*
  711                  * put it in the bucket in the vtag hash of assoc's for the
  712                  * system
  713                  */
  714                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
  715                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
  716                 return (1);
  717         }
  718         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
  719                 /*
  720                  * treat like a case where the cookie expired i.e.: - dump
  721                  * current cookie. - generate a new vtag. - resend init.
  722                  */
  723                 /* generate a new vtag and send init */
  724                 LIST_REMOVE(stcb, sctp_asocs);
  725                 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
  726                 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
  727                 sctp_stop_all_cookie_timers(stcb);
  728                 sctp_toss_old_cookies(stcb, &stcb->asoc);
  729                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
  730                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
  731                 /*
  732                  * put it in the bucket in the vtag hash of assoc's for the
  733                  * system
  734                  */
  735                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
  736                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
  737                 return (1);
  738         }
  739         return (0);
  740 }
  741 
  742 static int
  743 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
  744     struct sctp_nets *net)
  745 {
  746         /*
  747          * return 0 means we want you to proceed with the abort non-zero
  748          * means no abort processing
  749          */
  750         if (stcb->asoc.auth_supported == 0) {
  751                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
  752                 return (0);
  753         }
  754         sctp_asconf_send_nat_state_update(stcb, net);
  755         return (1);
  756 }
  757 
  758 
  759 static void
  760 sctp_handle_abort(struct sctp_abort_chunk *abort,
  761     struct sctp_tcb *stcb, struct sctp_nets *net)
  762 {
  763 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  764         struct socket *so;
  765 #endif
  766         uint16_t len;
  767         uint16_t error;
  768 
  769         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
  770         if (stcb == NULL)
  771                 return;
  772 
  773         len = ntohs(abort->ch.chunk_length);
  774         if (len > sizeof(struct sctp_chunkhdr)) {
  775                 /*
  776                  * Need to check the cause codes for our two magic nat
  777                  * aborts which don't kill the assoc necessarily.
  778                  */
  779                 struct sctp_gen_error_cause *cause;
  780 
  781                 cause = (struct sctp_gen_error_cause *)(abort + 1);
  782                 error = ntohs(cause->code);
  783                 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
  784                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
  785                             abort->ch.chunk_flags);
  786                         if (sctp_handle_nat_colliding_state(stcb)) {
  787                                 return;
  788                         }
  789                 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
  790                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
  791                             abort->ch.chunk_flags);
  792                         if (sctp_handle_nat_missing_state(stcb, net)) {
  793                                 return;
  794                         }
  795                 }
  796         } else {
  797                 error = 0;
  798         }
  799         /* stop any receive timers */
  800         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net,
  801             SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
  802         /* notify user of the abort and clean up... */
  803         sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
  804         /* free the tcb */
  805         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
  806         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
  807             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
  808                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
  809         }
  810 #ifdef SCTP_ASOCLOG_OF_TSNS
  811         sctp_print_out_track_log(stcb);
  812 #endif
  813 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  814         so = SCTP_INP_SO(stcb->sctp_ep);
  815         atomic_add_int(&stcb->asoc.refcnt, 1);
  816         SCTP_TCB_UNLOCK(stcb);
  817         SCTP_SOCKET_LOCK(so, 1);
  818         SCTP_TCB_LOCK(stcb);
  819         atomic_subtract_int(&stcb->asoc.refcnt, 1);
  820 #endif
  821         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
  822         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
  823             SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
  824 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  825         SCTP_SOCKET_UNLOCK(so, 1);
  826 #endif
  827         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
  828 }
  829 
  830 static void
  831 sctp_start_net_timers(struct sctp_tcb *stcb)
  832 {
  833         uint32_t cnt_hb_sent;
  834         struct sctp_nets *net;
  835 
  836         cnt_hb_sent = 0;
  837         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  838                 /*
  839                  * For each network start: 1) A pmtu timer. 2) A HB timer 3)
  840                  * If the dest in unconfirmed send a hb as well if under
  841                  * max_hb_burst have been sent.
  842                  */
  843                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
  844                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
  845                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
  846                     (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
  847                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
  848                         cnt_hb_sent++;
  849                 }
  850         }
  851         if (cnt_hb_sent) {
  852                 sctp_chunk_output(stcb->sctp_ep, stcb,
  853                     SCTP_OUTPUT_FROM_COOKIE_ACK,
  854                     SCTP_SO_NOT_LOCKED);
  855         }
  856 }
  857 
  858 
  859 static void
  860 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
  861     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
  862 {
  863         struct sctp_association *asoc;
  864         int some_on_streamwheel;
  865         int old_state;
  866 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  867         struct socket *so;
  868 #endif
  869 
  870         SCTPDBG(SCTP_DEBUG_INPUT2,
  871             "sctp_handle_shutdown: handling SHUTDOWN\n");
  872         if (stcb == NULL)
  873                 return;
  874         asoc = &stcb->asoc;
  875         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
  876             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
  877                 return;
  878         }
  879         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
  880                 /* Shutdown NOT the expected size */
  881                 return;
  882         }
  883         old_state = SCTP_GET_STATE(asoc);
  884         sctp_update_acked(stcb, cp, abort_flag);
  885         if (*abort_flag) {
  886                 return;
  887         }
  888         if (asoc->control_pdapi) {
  889                 /*
  890                  * With a normal shutdown we assume the end of last record.
  891                  */
  892                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
  893                 if (asoc->control_pdapi->on_strm_q) {
  894                         struct sctp_stream_in *strm;
  895 
  896                         strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream];
  897                         if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) {
  898                                 /* Unordered */
  899                                 TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm);
  900                                 asoc->control_pdapi->on_strm_q = 0;
  901                         } else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) {
  902                                 /* Ordered */
  903                                 TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm);
  904                                 asoc->control_pdapi->on_strm_q = 0;
  905 #ifdef INVARIANTS
  906                         } else {
  907                                 panic("Unknown state on ctrl:%p on_strm_q:%d",
  908                                     asoc->control_pdapi,
  909                                     asoc->control_pdapi->on_strm_q);
  910 #endif
  911                         }
  912                 }
  913                 asoc->control_pdapi->end_added = 1;
  914                 asoc->control_pdapi->pdapi_aborted = 1;
  915                 asoc->control_pdapi = NULL;
  916                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
  917 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  918                 so = SCTP_INP_SO(stcb->sctp_ep);
  919                 atomic_add_int(&stcb->asoc.refcnt, 1);
  920                 SCTP_TCB_UNLOCK(stcb);
  921                 SCTP_SOCKET_LOCK(so, 1);
  922                 SCTP_TCB_LOCK(stcb);
  923                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
  924                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
  925                         /* assoc was freed while we were unlocked */
  926                         SCTP_SOCKET_UNLOCK(so, 1);
  927                         return;
  928                 }
  929 #endif
  930                 if (stcb->sctp_socket) {
  931                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
  932                 }
  933 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  934                 SCTP_SOCKET_UNLOCK(so, 1);
  935 #endif
  936         }
  937         /* goto SHUTDOWN_RECEIVED state to block new requests */
  938         if (stcb->sctp_socket) {
  939                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
  940                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
  941                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
  942                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
  943                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
  944                         /*
  945                          * notify upper layer that peer has initiated a
  946                          * shutdown
  947                          */
  948                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
  949 
  950                         /* reset time */
  951                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
  952                 }
  953         }
  954         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
  955                 /*
  956                  * stop the shutdown timer, since we WILL move to
  957                  * SHUTDOWN-ACK-SENT.
  958                  */
  959                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
  960                     net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
  961         }
  962         /* Now is there unsent data on a stream somewhere? */
  963         some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
  964 
  965         if (!TAILQ_EMPTY(&asoc->send_queue) ||
  966             !TAILQ_EMPTY(&asoc->sent_queue) ||
  967             some_on_streamwheel) {
  968                 /* By returning we will push more data out */
  969                 return;
  970         } else {
  971                 /* no outstanding data to send, so move on... */
  972                 /* send SHUTDOWN-ACK */
  973                 /* move to SHUTDOWN-ACK-SENT state */
  974                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
  975                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
  976                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
  977                 }
  978                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
  979                 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
  980                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
  981                         sctp_stop_timers_for_shutdown(stcb);
  982                         sctp_send_shutdown_ack(stcb, net);
  983                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
  984                             stcb->sctp_ep, stcb, net);
  985                 } else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {
  986                         sctp_send_shutdown_ack(stcb, net);
  987                 }
  988         }
  989 }
  990 
  991 static void
  992 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
  993     struct sctp_tcb *stcb,
  994     struct sctp_nets *net)
  995 {
  996         struct sctp_association *asoc;
  997 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  998         struct socket *so;
  999 
 1000         so = SCTP_INP_SO(stcb->sctp_ep);
 1001 #endif
 1002         SCTPDBG(SCTP_DEBUG_INPUT2,
 1003             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
 1004         if (stcb == NULL)
 1005                 return;
 1006 
 1007         asoc = &stcb->asoc;
 1008         /* process according to association state */
 1009         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
 1010             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 1011                 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
 1012                 sctp_send_shutdown_complete(stcb, net, 1);
 1013                 SCTP_TCB_UNLOCK(stcb);
 1014                 return;
 1015         }
 1016         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
 1017             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 1018                 /* unexpected SHUTDOWN-ACK... so ignore... */
 1019                 SCTP_TCB_UNLOCK(stcb);
 1020                 return;
 1021         }
 1022         if (asoc->control_pdapi) {
 1023                 /*
 1024                  * With a normal shutdown we assume the end of last record.
 1025                  */
 1026                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
 1027                 asoc->control_pdapi->end_added = 1;
 1028                 asoc->control_pdapi->pdapi_aborted = 1;
 1029                 asoc->control_pdapi = NULL;
 1030                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 1031 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1032                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1033                 SCTP_TCB_UNLOCK(stcb);
 1034                 SCTP_SOCKET_LOCK(so, 1);
 1035                 SCTP_TCB_LOCK(stcb);
 1036                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1037                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1038                         /* assoc was freed while we were unlocked */
 1039                         SCTP_SOCKET_UNLOCK(so, 1);
 1040                         return;
 1041                 }
 1042 #endif
 1043                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 1044 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1045                 SCTP_SOCKET_UNLOCK(so, 1);
 1046 #endif
 1047         }
 1048 #ifdef INVARIANTS
 1049         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 1050             !TAILQ_EMPTY(&asoc->sent_queue) ||
 1051             sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
 1052                 panic("Queues are not empty when handling SHUTDOWN-ACK");
 1053         }
 1054 #endif
 1055         /* stop the timer */
 1056         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net,
 1057             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
 1058         /* send SHUTDOWN-COMPLETE */
 1059         sctp_send_shutdown_complete(stcb, net, 0);
 1060         /* notify upper layer protocol */
 1061         if (stcb->sctp_socket) {
 1062                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1063                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 1064                         stcb->sctp_socket->so_snd.sb_cc = 0;
 1065                 }
 1066                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 1067         }
 1068         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 1069         /* free the TCB but first save off the ep */
 1070 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1071         atomic_add_int(&stcb->asoc.refcnt, 1);
 1072         SCTP_TCB_UNLOCK(stcb);
 1073         SCTP_SOCKET_LOCK(so, 1);
 1074         SCTP_TCB_LOCK(stcb);
 1075         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1076 #endif
 1077         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 1078             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
 1079 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1080         SCTP_SOCKET_UNLOCK(so, 1);
 1081 #endif
 1082 }
 1083 
 1084 /*
 1085  * Skip past the param header and then we will find the chunk that caused the
 1086  * problem. There are two possibilities ASCONF or FWD-TSN other than that and
 1087  * our peer must be broken.
 1088  */
 1089 static void
 1090 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
 1091     struct sctp_nets *net)
 1092 {
 1093         struct sctp_chunkhdr *chk;
 1094 
 1095         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
 1096         switch (chk->chunk_type) {
 1097         case SCTP_ASCONF_ACK:
 1098         case SCTP_ASCONF:
 1099                 sctp_asconf_cleanup(stcb, net);
 1100                 break;
 1101         case SCTP_IFORWARD_CUM_TSN:
 1102         case SCTP_FORWARD_CUM_TSN:
 1103                 stcb->asoc.prsctp_supported = 0;
 1104                 break;
 1105         default:
 1106                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1107                     "Peer does not support chunk type %d(%x)??\n",
 1108                     chk->chunk_type, (uint32_t)chk->chunk_type);
 1109                 break;
 1110         }
 1111 }
 1112 
 1113 /*
 1114  * Skip past the param header and then we will find the param that caused the
 1115  * problem.  There are a number of param's in a ASCONF OR the prsctp param
 1116  * these will turn of specific features.
 1117  * XXX: Is this the right thing to do?
 1118  */
 1119 static void
 1120 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
 1121 {
 1122         struct sctp_paramhdr *pbad;
 1123 
 1124         pbad = phdr + 1;
 1125         switch (ntohs(pbad->param_type)) {
 1126                 /* pr-sctp draft */
 1127         case SCTP_PRSCTP_SUPPORTED:
 1128                 stcb->asoc.prsctp_supported = 0;
 1129                 break;
 1130         case SCTP_SUPPORTED_CHUNK_EXT:
 1131                 break;
 1132                 /* draft-ietf-tsvwg-addip-sctp */
 1133         case SCTP_HAS_NAT_SUPPORT:
 1134                 stcb->asoc.peer_supports_nat = 0;
 1135                 break;
 1136         case SCTP_ADD_IP_ADDRESS:
 1137         case SCTP_DEL_IP_ADDRESS:
 1138         case SCTP_SET_PRIM_ADDR:
 1139                 stcb->asoc.asconf_supported = 0;
 1140                 break;
 1141         case SCTP_SUCCESS_REPORT:
 1142         case SCTP_ERROR_CAUSE_IND:
 1143                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
 1144                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1145                     "Turning off ASCONF to this strange peer\n");
 1146                 stcb->asoc.asconf_supported = 0;
 1147                 break;
 1148         default:
 1149                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1150                     "Peer does not support param type %d(%x)??\n",
 1151                     pbad->param_type, (uint32_t)pbad->param_type);
 1152                 break;
 1153         }
 1154 }
 1155 
 1156 static int
 1157 sctp_handle_error(struct sctp_chunkhdr *ch,
 1158     struct sctp_tcb *stcb, struct sctp_nets *net)
 1159 {
 1160         int chklen;
 1161         struct sctp_paramhdr *phdr;
 1162         uint16_t error, error_type;
 1163         uint16_t error_len;
 1164         struct sctp_association *asoc;
 1165         int adjust;
 1166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1167         struct socket *so;
 1168 #endif
 1169 
 1170         /* parse through all of the errors and process */
 1171         asoc = &stcb->asoc;
 1172         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
 1173             sizeof(struct sctp_chunkhdr));
 1174         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
 1175         error = 0;
 1176         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
 1177                 /* Process an Error Cause */
 1178                 error_type = ntohs(phdr->param_type);
 1179                 error_len = ntohs(phdr->param_length);
 1180                 if ((error_len > chklen) || (error_len == 0)) {
 1181                         /* invalid param length for this param */
 1182                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
 1183                             chklen, error_len);
 1184                         return (0);
 1185                 }
 1186                 if (error == 0) {
 1187                         /* report the first error cause */
 1188                         error = error_type;
 1189                 }
 1190                 switch (error_type) {
 1191                 case SCTP_CAUSE_INVALID_STREAM:
 1192                 case SCTP_CAUSE_MISSING_PARAM:
 1193                 case SCTP_CAUSE_INVALID_PARAM:
 1194                 case SCTP_CAUSE_NO_USER_DATA:
 1195                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
 1196                             error_type);
 1197                         break;
 1198                 case SCTP_CAUSE_NAT_COLLIDING_STATE:
 1199                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
 1200                             ch->chunk_flags);
 1201                         if (sctp_handle_nat_colliding_state(stcb)) {
 1202                                 return (0);
 1203                         }
 1204                         break;
 1205                 case SCTP_CAUSE_NAT_MISSING_STATE:
 1206                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
 1207                             ch->chunk_flags);
 1208                         if (sctp_handle_nat_missing_state(stcb, net)) {
 1209                                 return (0);
 1210                         }
 1211                         break;
 1212                 case SCTP_CAUSE_STALE_COOKIE:
 1213                         /*
 1214                          * We only act if we have echoed a cookie and are
 1215                          * waiting.
 1216                          */
 1217                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 1218                                 int *p;
 1219 
 1220                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
 1221                                 /* Save the time doubled */
 1222                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
 1223                                 asoc->stale_cookie_count++;
 1224                                 if (asoc->stale_cookie_count >
 1225                                     asoc->max_init_times) {
 1226                                         sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
 1227                                         /* now free the asoc */
 1228 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1229                                         so = SCTP_INP_SO(stcb->sctp_ep);
 1230                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 1231                                         SCTP_TCB_UNLOCK(stcb);
 1232                                         SCTP_SOCKET_LOCK(so, 1);
 1233                                         SCTP_TCB_LOCK(stcb);
 1234                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1235 #endif
 1236                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 1237                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
 1238 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1239                                         SCTP_SOCKET_UNLOCK(so, 1);
 1240 #endif
 1241                                         return (-1);
 1242                                 }
 1243                                 /* blast back to INIT state */
 1244                                 sctp_toss_old_cookies(stcb, &stcb->asoc);
 1245                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
 1246                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
 1247                                 sctp_stop_all_cookie_timers(stcb);
 1248                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 1249                         }
 1250                         break;
 1251                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
 1252                         /*
 1253                          * Nothing we can do here, we don't do hostname
 1254                          * addresses so if the peer does not like my IPv6
 1255                          * (or IPv4 for that matter) it does not matter. If
 1256                          * they don't support that type of address, they can
 1257                          * NOT possibly get that packet type... i.e. with no
 1258                          * IPv6 you can't receive a IPv6 packet. so we can
 1259                          * safely ignore this one. If we ever added support
 1260                          * for HOSTNAME Addresses, then we would need to do
 1261                          * something here.
 1262                          */
 1263                         break;
 1264                 case SCTP_CAUSE_UNRECOG_CHUNK:
 1265                         sctp_process_unrecog_chunk(stcb, phdr, net);
 1266                         break;
 1267                 case SCTP_CAUSE_UNRECOG_PARAM:
 1268                         sctp_process_unrecog_param(stcb, phdr);
 1269                         break;
 1270                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
 1271                         /*
 1272                          * We ignore this since the timer will drive out a
 1273                          * new cookie anyway and there timer will drive us
 1274                          * to send a SHUTDOWN_COMPLETE. We can't send one
 1275                          * here since we don't have their tag.
 1276                          */
 1277                         break;
 1278                 case SCTP_CAUSE_DELETING_LAST_ADDR:
 1279                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
 1280                 case SCTP_CAUSE_DELETING_SRC_ADDR:
 1281                         /*
 1282                          * We should NOT get these here, but in a
 1283                          * ASCONF-ACK.
 1284                          */
 1285                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
 1286                             error_type);
 1287                         break;
 1288                 case SCTP_CAUSE_OUT_OF_RESC:
 1289                         /*
 1290                          * And what, pray tell do we do with the fact that
 1291                          * the peer is out of resources? Not really sure we
 1292                          * could do anything but abort. I suspect this
 1293                          * should have came WITH an abort instead of in a
 1294                          * OP-ERROR.
 1295                          */
 1296                         break;
 1297                 default:
 1298                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
 1299                             error_type);
 1300                         break;
 1301                 }
 1302                 adjust = SCTP_SIZE32(error_len);
 1303                 chklen -= adjust;
 1304                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
 1305         }
 1306         sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);
 1307         return (0);
 1308 }
 1309 
 1310 static int
 1311 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
 1312     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
 1313     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 1314     struct sctp_nets *net, int *abort_no_unlock,
 1315     uint8_t mflowtype, uint32_t mflowid,
 1316     uint32_t vrf_id)
 1317 {
 1318         struct sctp_init_ack *init_ack;
 1319         struct mbuf *op_err;
 1320 
 1321         SCTPDBG(SCTP_DEBUG_INPUT2,
 1322             "sctp_handle_init_ack: handling INIT-ACK\n");
 1323 
 1324         if (stcb == NULL) {
 1325                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1326                     "sctp_handle_init_ack: TCB is null\n");
 1327                 return (-1);
 1328         }
 1329         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
 1330                 /* Invalid length */
 1331                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1332                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1333                     src, dst, sh, op_err,
 1334                     mflowtype, mflowid,
 1335                     vrf_id, net->port);
 1336                 *abort_no_unlock = 1;
 1337                 return (-1);
 1338         }
 1339         init_ack = &cp->init;
 1340         /* validate parameters */
 1341         if (init_ack->initiate_tag == 0) {
 1342                 /* protocol error... send an abort */
 1343                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1344                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1345                     src, dst, sh, op_err,
 1346                     mflowtype, mflowid,
 1347                     vrf_id, net->port);
 1348                 *abort_no_unlock = 1;
 1349                 return (-1);
 1350         }
 1351         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
 1352                 /* protocol error... send an abort */
 1353                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1354                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1355                     src, dst, sh, op_err,
 1356                     mflowtype, mflowid,
 1357                     vrf_id, net->port);
 1358                 *abort_no_unlock = 1;
 1359                 return (-1);
 1360         }
 1361         if (init_ack->num_inbound_streams == 0) {
 1362                 /* protocol error... send an abort */
 1363                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1364                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1365                     src, dst, sh, op_err,
 1366                     mflowtype, mflowid,
 1367                     vrf_id, net->port);
 1368                 *abort_no_unlock = 1;
 1369                 return (-1);
 1370         }
 1371         if (init_ack->num_outbound_streams == 0) {
 1372                 /* protocol error... send an abort */
 1373                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 1374                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 1375                     src, dst, sh, op_err,
 1376                     mflowtype, mflowid,
 1377                     vrf_id, net->port);
 1378                 *abort_no_unlock = 1;
 1379                 return (-1);
 1380         }
 1381         /* process according to association state... */
 1382         switch (stcb->asoc.state & SCTP_STATE_MASK) {
 1383         case SCTP_STATE_COOKIE_WAIT:
 1384                 /* this is the expected state for this chunk */
 1385                 /* process the INIT-ACK parameters */
 1386                 if (stcb->asoc.primary_destination->dest_state &
 1387                     SCTP_ADDR_UNCONFIRMED) {
 1388                         /*
 1389                          * The primary is where we sent the INIT, we can
 1390                          * always consider it confirmed when the INIT-ACK is
 1391                          * returned. Do this before we load addresses
 1392                          * though.
 1393                          */
 1394                         stcb->asoc.primary_destination->dest_state &=
 1395                             ~SCTP_ADDR_UNCONFIRMED;
 1396                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 1397                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
 1398                 }
 1399                 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
 1400                     net, abort_no_unlock,
 1401                     mflowtype, mflowid,
 1402                     vrf_id) < 0) {
 1403                         /* error in parsing parameters */
 1404                         return (-1);
 1405                 }
 1406                 /* update our state */
 1407                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
 1408                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
 1409 
 1410                 /* reset the RTO calc */
 1411                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 1412                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 1413                             stcb->asoc.overall_error_count,
 1414                             0,
 1415                             SCTP_FROM_SCTP_INPUT,
 1416                             __LINE__);
 1417                 }
 1418                 stcb->asoc.overall_error_count = 0;
 1419                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
 1420                 /*
 1421                  * collapse the init timer back in case of a exponential
 1422                  * backoff
 1423                  */
 1424                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
 1425                     stcb, net);
 1426                 /*
 1427                  * the send at the end of the inbound data processing will
 1428                  * cause the cookie to be sent
 1429                  */
 1430                 break;
 1431         case SCTP_STATE_SHUTDOWN_SENT:
 1432                 /* incorrect state... discard */
 1433                 break;
 1434         case SCTP_STATE_COOKIE_ECHOED:
 1435                 /* incorrect state... discard */
 1436                 break;
 1437         case SCTP_STATE_OPEN:
 1438                 /* incorrect state... discard */
 1439                 break;
 1440         case SCTP_STATE_EMPTY:
 1441         case SCTP_STATE_INUSE:
 1442         default:
 1443                 /* incorrect state... discard */
 1444                 return (-1);
 1445                 break;
 1446         }
 1447         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
 1448         return (0);
 1449 }
 1450 
 1451 static struct sctp_tcb *
 1452 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 1453     struct sockaddr *src, struct sockaddr *dst,
 1454     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1455     struct sctp_inpcb *inp, struct sctp_nets **netp,
 1456     struct sockaddr *init_src, int *notification,
 1457     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 1458     uint8_t mflowtype, uint32_t mflowid,
 1459     uint32_t vrf_id, uint16_t port);
 1460 
 1461 
 1462 /*
 1463  * handle a state cookie for an existing association m: input packet mbuf
 1464  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
 1465  * "split" mbuf and the cookie signature does not exist offset: offset into
 1466  * mbuf to the cookie-echo chunk
 1467  */
 1468 static struct sctp_tcb *
 1469 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
 1470     struct sockaddr *src, struct sockaddr *dst,
 1471     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1472     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
 1473     struct sockaddr *init_src, int *notification,
 1474     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 1475     uint8_t mflowtype, uint32_t mflowid,
 1476     uint32_t vrf_id, uint16_t port)
 1477 {
 1478         struct sctp_association *asoc;
 1479         struct sctp_init_chunk *init_cp, init_buf;
 1480         struct sctp_init_ack_chunk *initack_cp, initack_buf;
 1481         struct sctp_nets *net;
 1482         struct mbuf *op_err;
 1483         int init_offset, initack_offset, i;
 1484         int retval;
 1485         int spec_flag = 0;
 1486         uint32_t how_indx;
 1487 #if defined(SCTP_DETAILED_STR_STATS)
 1488         int j;
 1489 #endif
 1490 
 1491         net = *netp;
 1492         /* I know that the TCB is non-NULL from the caller */
 1493         asoc = &stcb->asoc;
 1494         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
 1495                 if (asoc->cookie_how[how_indx] == 0)
 1496                         break;
 1497         }
 1498         if (how_indx < sizeof(asoc->cookie_how)) {
 1499                 asoc->cookie_how[how_indx] = 1;
 1500         }
 1501         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 1502                 /* SHUTDOWN came in after sending INIT-ACK */
 1503                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
 1504                 op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
 1505                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
 1506                     mflowtype, mflowid, inp->fibnum,
 1507                     vrf_id, net->port);
 1508                 if (how_indx < sizeof(asoc->cookie_how))
 1509                         asoc->cookie_how[how_indx] = 2;
 1510                 return (NULL);
 1511         }
 1512         /*
 1513          * find and validate the INIT chunk in the cookie (peer's info) the
 1514          * INIT should start after the cookie-echo header struct (chunk
 1515          * header, state cookie header struct)
 1516          */
 1517         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
 1518 
 1519         init_cp = (struct sctp_init_chunk *)
 1520             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
 1521             (uint8_t *)&init_buf);
 1522         if (init_cp == NULL) {
 1523                 /* could not pull a INIT chunk in cookie */
 1524                 return (NULL);
 1525         }
 1526         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
 1527                 return (NULL);
 1528         }
 1529         /*
 1530          * find and validate the INIT-ACK chunk in the cookie (my info) the
 1531          * INIT-ACK follows the INIT chunk
 1532          */
 1533         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
 1534         initack_cp = (struct sctp_init_ack_chunk *)
 1535             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
 1536             (uint8_t *)&initack_buf);
 1537         if (initack_cp == NULL) {
 1538                 /* could not pull INIT-ACK chunk in cookie */
 1539                 return (NULL);
 1540         }
 1541         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
 1542                 return (NULL);
 1543         }
 1544         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1545             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
 1546                 /*
 1547                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
 1548                  * to get into the OPEN state
 1549                  */
 1550                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
 1551                         /*-
 1552                          * Opps, this means that we somehow generated two vtag's
 1553                          * the same. I.e. we did:
 1554                          *  Us               Peer
 1555                          *   <---INIT(tag=a)------
 1556                          *   ----INIT-ACK(tag=t)-->
 1557                          *   ----INIT(tag=t)------> *1
 1558                          *   <---INIT-ACK(tag=a)---
 1559                          *   <----CE(tag=t)------------- *2
 1560                          *
 1561                          * At point *1 we should be generating a different
 1562                          * tag t'. Which means we would throw away the CE and send
 1563                          * ours instead. Basically this is case C (throw away side).
 1564                          */
 1565                         if (how_indx < sizeof(asoc->cookie_how))
 1566                                 asoc->cookie_how[how_indx] = 17;
 1567                         return (NULL);
 1568 
 1569                 }
 1570                 switch (SCTP_GET_STATE(asoc)) {
 1571                 case SCTP_STATE_COOKIE_WAIT:
 1572                 case SCTP_STATE_COOKIE_ECHOED:
 1573                         /*
 1574                          * INIT was sent but got a COOKIE_ECHO with the
 1575                          * correct tags... just accept it...but we must
 1576                          * process the init so that we can make sure we have
 1577                          * the right seq no's.
 1578                          */
 1579                         /* First we must process the INIT !! */
 1580                         retval = sctp_process_init(init_cp, stcb);
 1581                         if (retval < 0) {
 1582                                 if (how_indx < sizeof(asoc->cookie_how))
 1583                                         asoc->cookie_how[how_indx] = 3;
 1584                                 return (NULL);
 1585                         }
 1586                         /* we have already processed the INIT so no problem */
 1587                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp,
 1588                             stcb, net,
 1589                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
 1590                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp,
 1591                             stcb, net,
 1592                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
 1593                         /* update current state */
 1594                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
 1595                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 1596                         else
 1597                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1598 
 1599                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1600                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1601                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1602                                     stcb->sctp_ep, stcb, asoc->primary_destination);
 1603                         }
 1604                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1605                         sctp_stop_all_cookie_timers(stcb);
 1606                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1607                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 1608                             (inp->sctp_socket->so_qlimit == 0)
 1609                             ) {
 1610 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1611                                 struct socket *so;
 1612 #endif
 1613                                 /*
 1614                                  * Here is where collision would go if we
 1615                                  * did a connect() and instead got a
 1616                                  * init/init-ack/cookie done before the
 1617                                  * init-ack came back..
 1618                                  */
 1619                                 stcb->sctp_ep->sctp_flags |=
 1620                                     SCTP_PCB_FLAGS_CONNECTED;
 1621 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1622                                 so = SCTP_INP_SO(stcb->sctp_ep);
 1623                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1624                                 SCTP_TCB_UNLOCK(stcb);
 1625                                 SCTP_SOCKET_LOCK(so, 1);
 1626                                 SCTP_TCB_LOCK(stcb);
 1627                                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1628                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1629                                         SCTP_SOCKET_UNLOCK(so, 1);
 1630                                         return (NULL);
 1631                                 }
 1632 #endif
 1633                                 soisconnected(stcb->sctp_socket);
 1634 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1635                                 SCTP_SOCKET_UNLOCK(so, 1);
 1636 #endif
 1637                         }
 1638                         /* notify upper layer */
 1639                         *notification = SCTP_NOTIFY_ASSOC_UP;
 1640                         /*
 1641                          * since we did not send a HB make sure we don't
 1642                          * double things
 1643                          */
 1644                         net->hb_responded = 1;
 1645                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
 1646                             &cookie->time_entered,
 1647                             sctp_align_unsafe_makecopy,
 1648                             SCTP_RTT_FROM_NON_DATA);
 1649 
 1650                         if (stcb->asoc.sctp_autoclose_ticks &&
 1651                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
 1652                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
 1653                                     inp, stcb, NULL);
 1654                         }
 1655                         break;
 1656                 default:
 1657                         /*
 1658                          * we're in the OPEN state (or beyond), so peer must
 1659                          * have simply lost the COOKIE-ACK
 1660                          */
 1661                         break;
 1662                 }               /* end switch */
 1663                 sctp_stop_all_cookie_timers(stcb);
 1664                 /*
 1665                  * We ignore the return code here.. not sure if we should
 1666                  * somehow abort.. but we do have an existing asoc. This
 1667                  * really should not fail.
 1668                  */
 1669                 if (sctp_load_addresses_from_init(stcb, m,
 1670                     init_offset + sizeof(struct sctp_init_chunk),
 1671                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
 1672                         if (how_indx < sizeof(asoc->cookie_how))
 1673                                 asoc->cookie_how[how_indx] = 4;
 1674                         return (NULL);
 1675                 }
 1676                 /* respond with a COOKIE-ACK */
 1677                 sctp_toss_old_cookies(stcb, asoc);
 1678                 sctp_send_cookie_ack(stcb);
 1679                 if (how_indx < sizeof(asoc->cookie_how))
 1680                         asoc->cookie_how[how_indx] = 5;
 1681                 return (stcb);
 1682         }
 1683         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
 1684             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
 1685             cookie->tie_tag_my_vtag == 0 &&
 1686             cookie->tie_tag_peer_vtag == 0) {
 1687                 /*
 1688                  * case C in Section 5.2.4 Table 2: XMOO silently discard
 1689                  */
 1690                 if (how_indx < sizeof(asoc->cookie_how))
 1691                         asoc->cookie_how[how_indx] = 6;
 1692                 return (NULL);
 1693         }
 1694         /*
 1695          * If nat support, and the below and stcb is established, send back
 1696          * a ABORT(colliding state) if we are established.
 1697          */
 1698         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
 1699             (asoc->peer_supports_nat) &&
 1700             ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1701             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
 1702             (asoc->peer_vtag == 0)))) {
 1703                 /*
 1704                  * Special case - Peer's support nat. We may have two init's
 1705                  * that we gave out the same tag on since one was not
 1706                  * established.. i.e. we get INIT from host-1 behind the nat
 1707                  * and we respond tag-a, we get a INIT from host-2 behind
 1708                  * the nat and we get tag-a again. Then we bring up host-1
 1709                  * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
 1710                  * Now we have colliding state. We must send an abort here
 1711                  * with colliding state indication.
 1712                  */
 1713                 op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
 1714                 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
 1715                     mflowtype, mflowid, inp->fibnum,
 1716                     vrf_id, port);
 1717                 return (NULL);
 1718         }
 1719         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1720             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
 1721             (asoc->peer_vtag == 0))) {
 1722                 /*
 1723                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
 1724                  * should be ok, re-accept peer info
 1725                  */
 1726                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
 1727                         /*
 1728                          * Extension of case C. If we hit this, then the
 1729                          * random number generator returned the same vtag
 1730                          * when we first sent our INIT-ACK and when we later
 1731                          * sent our INIT. The side with the seq numbers that
 1732                          * are different will be the one that normnally
 1733                          * would have hit case C. This in effect "extends"
 1734                          * our vtags in this collision case to be 64 bits.
 1735                          * The same collision could occur aka you get both
 1736                          * vtag and seq number the same twice in a row.. but
 1737                          * is much less likely. If it did happen then we
 1738                          * would proceed through and bring up the assoc.. we
 1739                          * may end up with the wrong stream setup however..
 1740                          * which would be bad.. but there is no way to
 1741                          * tell.. until we send on a stream that does not
 1742                          * exist :-)
 1743                          */
 1744                         if (how_indx < sizeof(asoc->cookie_how))
 1745                                 asoc->cookie_how[how_indx] = 7;
 1746 
 1747                         return (NULL);
 1748                 }
 1749                 if (how_indx < sizeof(asoc->cookie_how))
 1750                         asoc->cookie_how[how_indx] = 8;
 1751                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 1752                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
 1753                 sctp_stop_all_cookie_timers(stcb);
 1754                 /*
 1755                  * since we did not send a HB make sure we don't double
 1756                  * things
 1757                  */
 1758                 net->hb_responded = 1;
 1759                 if (stcb->asoc.sctp_autoclose_ticks &&
 1760                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 1761                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
 1762                             NULL);
 1763                 }
 1764                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 1765                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
 1766 
 1767                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
 1768                         /*
 1769                          * Ok the peer probably discarded our data (if we
 1770                          * echoed a cookie+data). So anything on the
 1771                          * sent_queue should be marked for retransmit, we
 1772                          * may not get something to kick us so it COULD
 1773                          * still take a timeout to move these.. but it can't
 1774                          * hurt to mark them.
 1775                          */
 1776                         struct sctp_tmit_chunk *chk;
 1777 
 1778                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 1779                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
 1780                                         chk->sent = SCTP_DATAGRAM_RESEND;
 1781                                         sctp_flight_size_decrease(chk);
 1782                                         sctp_total_flight_decrease(stcb, chk);
 1783                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 1784                                         spec_flag++;
 1785                                 }
 1786                         }
 1787 
 1788                 }
 1789                 /* process the INIT info (peer's info) */
 1790                 retval = sctp_process_init(init_cp, stcb);
 1791                 if (retval < 0) {
 1792                         if (how_indx < sizeof(asoc->cookie_how))
 1793                                 asoc->cookie_how[how_indx] = 9;
 1794                         return (NULL);
 1795                 }
 1796                 if (sctp_load_addresses_from_init(stcb, m,
 1797                     init_offset + sizeof(struct sctp_init_chunk),
 1798                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
 1799                         if (how_indx < sizeof(asoc->cookie_how))
 1800                                 asoc->cookie_how[how_indx] = 10;
 1801                         return (NULL);
 1802                 }
 1803                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
 1804                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
 1805                         *notification = SCTP_NOTIFY_ASSOC_UP;
 1806 
 1807                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1808                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 1809                             (inp->sctp_socket->so_qlimit == 0)) {
 1810 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1811                                 struct socket *so;
 1812 #endif
 1813                                 stcb->sctp_ep->sctp_flags |=
 1814                                     SCTP_PCB_FLAGS_CONNECTED;
 1815 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1816                                 so = SCTP_INP_SO(stcb->sctp_ep);
 1817                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1818                                 SCTP_TCB_UNLOCK(stcb);
 1819                                 SCTP_SOCKET_LOCK(so, 1);
 1820                                 SCTP_TCB_LOCK(stcb);
 1821                                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1822                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1823                                         SCTP_SOCKET_UNLOCK(so, 1);
 1824                                         return (NULL);
 1825                                 }
 1826 #endif
 1827                                 soisconnected(stcb->sctp_socket);
 1828 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1829                                 SCTP_SOCKET_UNLOCK(so, 1);
 1830 #endif
 1831                         }
 1832                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
 1833                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 1834                         else
 1835                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1836                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1837                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
 1838                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
 1839                 } else {
 1840                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1841                 }
 1842                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1843                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1844                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1845                             stcb->sctp_ep, stcb, asoc->primary_destination);
 1846                 }
 1847                 sctp_stop_all_cookie_timers(stcb);
 1848                 sctp_toss_old_cookies(stcb, asoc);
 1849                 sctp_send_cookie_ack(stcb);
 1850                 if (spec_flag) {
 1851                         /*
 1852                          * only if we have retrans set do we do this. What
 1853                          * this call does is get only the COOKIE-ACK out and
 1854                          * then when we return the normal call to
 1855                          * sctp_chunk_output will get the retrans out behind
 1856                          * this.
 1857                          */
 1858                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
 1859                 }
 1860                 if (how_indx < sizeof(asoc->cookie_how))
 1861                         asoc->cookie_how[how_indx] = 11;
 1862 
 1863                 return (stcb);
 1864         }
 1865         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
 1866             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
 1867             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
 1868             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
 1869             cookie->tie_tag_peer_vtag != 0) {
 1870                 struct sctpasochead *head;
 1871 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1872                 struct socket *so;
 1873 #endif
 1874 
 1875                 if (asoc->peer_supports_nat) {
 1876                         /*
 1877                          * This is a gross gross hack. Just call the
 1878                          * cookie_new code since we are allowing a duplicate
 1879                          * association. I hope this works...
 1880                          */
 1881                         return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
 1882                             sh, cookie, cookie_len,
 1883                             inp, netp, init_src, notification,
 1884                             auth_skipped, auth_offset, auth_len,
 1885                             mflowtype, mflowid,
 1886                             vrf_id, port));
 1887                 }
 1888                 /*
 1889                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
 1890                  */
 1891                 /* temp code */
 1892                 if (how_indx < sizeof(asoc->cookie_how))
 1893                         asoc->cookie_how[how_indx] = 12;
 1894                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
 1895                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 1896                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 1897                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
 1898 
 1899                 /* notify upper layer */
 1900                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
 1901                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1902                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
 1903                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 1904                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 1905                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1906                 }
 1907                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
 1908                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
 1909                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
 1910                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
 1911                 }
 1912                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1913                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1914                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1915                             stcb->sctp_ep, stcb, asoc->primary_destination);
 1916 
 1917                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
 1918                         /* move to OPEN state, if not in SHUTDOWN_SENT */
 1919                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1920                 }
 1921                 asoc->pre_open_streams =
 1922                     ntohs(initack_cp->init.num_outbound_streams);
 1923                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
 1924                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
 1925                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 1926 
 1927                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
 1928 
 1929                 asoc->str_reset_seq_in = asoc->init_seq_number;
 1930 
 1931                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 1932                 if (asoc->mapping_array) {
 1933                         memset(asoc->mapping_array, 0,
 1934                             asoc->mapping_array_size);
 1935                 }
 1936                 if (asoc->nr_mapping_array) {
 1937                         memset(asoc->nr_mapping_array, 0,
 1938                             asoc->mapping_array_size);
 1939                 }
 1940                 SCTP_TCB_UNLOCK(stcb);
 1941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1942                 so = SCTP_INP_SO(stcb->sctp_ep);
 1943                 SCTP_SOCKET_LOCK(so, 1);
 1944 #endif
 1945                 SCTP_INP_INFO_WLOCK();
 1946                 SCTP_INP_WLOCK(stcb->sctp_ep);
 1947                 SCTP_TCB_LOCK(stcb);
 1948                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1949                 /* send up all the data */
 1950                 SCTP_TCB_SEND_LOCK(stcb);
 1951 
 1952                 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);
 1953                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 1954                         stcb->asoc.strmout[i].chunks_on_queues = 0;
 1955 #if defined(SCTP_DETAILED_STR_STATS)
 1956                         for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
 1957                                 asoc->strmout[i].abandoned_sent[j] = 0;
 1958                                 asoc->strmout[i].abandoned_unsent[j] = 0;
 1959                         }
 1960 #else
 1961                         asoc->strmout[i].abandoned_sent[0] = 0;
 1962                         asoc->strmout[i].abandoned_unsent[0] = 0;
 1963 #endif
 1964                         stcb->asoc.strmout[i].sid = i;
 1965                         stcb->asoc.strmout[i].next_mid_ordered = 0;
 1966                         stcb->asoc.strmout[i].next_mid_unordered = 0;
 1967                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
 1968                 }
 1969                 /* process the INIT-ACK info (my info) */
 1970                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
 1971                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 1972 
 1973                 /* pull from vtag hash */
 1974                 LIST_REMOVE(stcb, sctp_asocs);
 1975                 /* re-insert to new vtag position */
 1976                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
 1977                     SCTP_BASE_INFO(hashasocmark))];
 1978                 /*
 1979                  * put it in the bucket in the vtag hash of assoc's for the
 1980                  * system
 1981                  */
 1982                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 1983 
 1984                 SCTP_TCB_SEND_UNLOCK(stcb);
 1985                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 1986                 SCTP_INP_INFO_WUNLOCK();
 1987 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1988                 SCTP_SOCKET_UNLOCK(so, 1);
 1989 #endif
 1990                 asoc->total_flight = 0;
 1991                 asoc->total_flight_count = 0;
 1992                 /* process the INIT info (peer's info) */
 1993                 retval = sctp_process_init(init_cp, stcb);
 1994                 if (retval < 0) {
 1995                         if (how_indx < sizeof(asoc->cookie_how))
 1996                                 asoc->cookie_how[how_indx] = 13;
 1997 
 1998                         return (NULL);
 1999                 }
 2000                 /*
 2001                  * since we did not send a HB make sure we don't double
 2002                  * things
 2003                  */
 2004                 net->hb_responded = 1;
 2005 
 2006                 if (sctp_load_addresses_from_init(stcb, m,
 2007                     init_offset + sizeof(struct sctp_init_chunk),
 2008                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
 2009                         if (how_indx < sizeof(asoc->cookie_how))
 2010                                 asoc->cookie_how[how_indx] = 14;
 2011 
 2012                         return (NULL);
 2013                 }
 2014                 /* respond with a COOKIE-ACK */
 2015                 sctp_stop_all_cookie_timers(stcb);
 2016                 sctp_toss_old_cookies(stcb, asoc);
 2017                 sctp_send_cookie_ack(stcb);
 2018                 if (how_indx < sizeof(asoc->cookie_how))
 2019                         asoc->cookie_how[how_indx] = 15;
 2020 
 2021                 return (stcb);
 2022         }
 2023         if (how_indx < sizeof(asoc->cookie_how))
 2024                 asoc->cookie_how[how_indx] = 16;
 2025         /* all other cases... */
 2026         return (NULL);
 2027 }
 2028 
 2029 
 2030 /*
 2031  * handle a state cookie for a new association m: input packet mbuf chain--
 2032  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
 2033  * and the cookie signature does not exist offset: offset into mbuf to the
 2034  * cookie-echo chunk length: length of the cookie chunk to: where the init
 2035  * was from returns a new TCB
 2036  */
 2037 static struct sctp_tcb *
 2038 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 2039     struct sockaddr *src, struct sockaddr *dst,
 2040     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 2041     struct sctp_inpcb *inp, struct sctp_nets **netp,
 2042     struct sockaddr *init_src, int *notification,
 2043     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 2044     uint8_t mflowtype, uint32_t mflowid,
 2045     uint32_t vrf_id, uint16_t port)
 2046 {
 2047         struct sctp_tcb *stcb;
 2048         struct sctp_init_chunk *init_cp, init_buf;
 2049         struct sctp_init_ack_chunk *initack_cp, initack_buf;
 2050         union sctp_sockstore store;
 2051         struct sctp_association *asoc;
 2052         int init_offset, initack_offset, initack_limit;
 2053         int retval;
 2054         int error = 0;
 2055         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
 2056 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2057         struct socket *so;
 2058 
 2059         so = SCTP_INP_SO(inp);
 2060 #endif
 2061 
 2062         /*
 2063          * find and validate the INIT chunk in the cookie (peer's info) the
 2064          * INIT should start after the cookie-echo header struct (chunk
 2065          * header, state cookie header struct)
 2066          */
 2067         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
 2068         init_cp = (struct sctp_init_chunk *)
 2069             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
 2070             (uint8_t *)&init_buf);
 2071         if (init_cp == NULL) {
 2072                 /* could not pull a INIT chunk in cookie */
 2073                 SCTPDBG(SCTP_DEBUG_INPUT1,
 2074                     "process_cookie_new: could not pull INIT chunk hdr\n");
 2075                 return (NULL);
 2076         }
 2077         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
 2078                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
 2079                 return (NULL);
 2080         }
 2081         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
 2082         /*
 2083          * find and validate the INIT-ACK chunk in the cookie (my info) the
 2084          * INIT-ACK follows the INIT chunk
 2085          */
 2086         initack_cp = (struct sctp_init_ack_chunk *)
 2087             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
 2088             (uint8_t *)&initack_buf);
 2089         if (initack_cp == NULL) {
 2090                 /* could not pull INIT-ACK chunk in cookie */
 2091                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
 2092                 return (NULL);
 2093         }
 2094         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
 2095                 return (NULL);
 2096         }
 2097         /*
 2098          * NOTE: We can't use the INIT_ACK's chk_length to determine the
 2099          * "initack_limit" value.  This is because the chk_length field
 2100          * includes the length of the cookie, but the cookie is omitted when
 2101          * the INIT and INIT_ACK are tacked onto the cookie...
 2102          */
 2103         initack_limit = offset + cookie_len;
 2104 
 2105         /*
 2106          * now that we know the INIT/INIT-ACK are in place, create a new TCB
 2107          * and popluate
 2108          */
 2109 
 2110         /*
 2111          * Here we do a trick, we set in NULL for the proc/thread argument.
 2112          * We do this since in effect we only use the p argument when the
 2113          * socket is unbound and we must do an implicit bind. Since we are
 2114          * getting a cookie, we cannot be unbound.
 2115          */
 2116         stcb = sctp_aloc_assoc(inp, init_src, &error,
 2117             ntohl(initack_cp->init.initiate_tag), vrf_id,
 2118             ntohs(initack_cp->init.num_outbound_streams),
 2119             port,
 2120             (struct thread *)NULL
 2121             );
 2122         if (stcb == NULL) {
 2123                 struct mbuf *op_err;
 2124 
 2125                 /* memory problem? */
 2126                 SCTPDBG(SCTP_DEBUG_INPUT1,
 2127                     "process_cookie_new: no room for another TCB!\n");
 2128                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 2129                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
 2130                     src, dst, sh, op_err,
 2131                     mflowtype, mflowid,
 2132                     vrf_id, port);
 2133                 return (NULL);
 2134         }
 2135         /* get the correct sctp_nets */
 2136         if (netp)
 2137                 *netp = sctp_findnet(stcb, init_src);
 2138 
 2139         asoc = &stcb->asoc;
 2140         /* get scope variables out of cookie */
 2141         asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
 2142         asoc->scope.site_scope = cookie->site_scope;
 2143         asoc->scope.local_scope = cookie->local_scope;
 2144         asoc->scope.loopback_scope = cookie->loopback_scope;
 2145 
 2146         if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
 2147             (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
 2148                 struct mbuf *op_err;
 2149 
 2150                 /*
 2151                  * Houston we have a problem. The EP changed while the
 2152                  * cookie was in flight. Only recourse is to abort the
 2153                  * association.
 2154                  */
 2155                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2156                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 2157                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
 2158                     src, dst, sh, op_err,
 2159                     mflowtype, mflowid,
 2160                     vrf_id, port);
 2161 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2162                 SCTP_TCB_UNLOCK(stcb);
 2163                 SCTP_SOCKET_LOCK(so, 1);
 2164                 SCTP_TCB_LOCK(stcb);
 2165 #endif
 2166                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2167                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
 2168 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2169                 SCTP_SOCKET_UNLOCK(so, 1);
 2170 #endif
 2171                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2172                 return (NULL);
 2173         }
 2174         /* process the INIT-ACK info (my info) */
 2175         asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
 2176         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 2177         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
 2178         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
 2179         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
 2180         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 2181         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
 2182         asoc->str_reset_seq_in = asoc->init_seq_number;
 2183 
 2184         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 2185 
 2186         /* process the INIT info (peer's info) */
 2187         if (netp)
 2188                 retval = sctp_process_init(init_cp, stcb);
 2189         else
 2190                 retval = 0;
 2191         if (retval < 0) {
 2192                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2193 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2194                 SCTP_TCB_UNLOCK(stcb);
 2195                 SCTP_SOCKET_LOCK(so, 1);
 2196                 SCTP_TCB_LOCK(stcb);
 2197 #endif
 2198                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2199                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
 2200 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2201                 SCTP_SOCKET_UNLOCK(so, 1);
 2202 #endif
 2203                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2204                 return (NULL);
 2205         }
 2206         /* load all addresses */
 2207         if (sctp_load_addresses_from_init(stcb, m,
 2208             init_offset + sizeof(struct sctp_init_chunk), initack_offset,
 2209             src, dst, init_src, port)) {
 2210                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2211 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2212                 SCTP_TCB_UNLOCK(stcb);
 2213                 SCTP_SOCKET_LOCK(so, 1);
 2214                 SCTP_TCB_LOCK(stcb);
 2215 #endif
 2216                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2217                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
 2218 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2219                 SCTP_SOCKET_UNLOCK(so, 1);
 2220 #endif
 2221                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2222                 return (NULL);
 2223         }
 2224         /*
 2225          * verify any preceding AUTH chunk that was skipped
 2226          */
 2227         /* pull the local authentication parameters from the cookie/init-ack */
 2228         sctp_auth_get_cookie_params(stcb, m,
 2229             initack_offset + sizeof(struct sctp_init_ack_chunk),
 2230             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
 2231         if (auth_skipped) {
 2232                 struct sctp_auth_chunk *auth;
 2233 
 2234                 auth = (struct sctp_auth_chunk *)
 2235                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
 2236                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
 2237                         /* auth HMAC failed, dump the assoc and packet */
 2238                         SCTPDBG(SCTP_DEBUG_AUTH1,
 2239                             "COOKIE-ECHO: AUTH failed\n");
 2240                         atomic_add_int(&stcb->asoc.refcnt, 1);
 2241 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2242                         SCTP_TCB_UNLOCK(stcb);
 2243                         SCTP_SOCKET_LOCK(so, 1);
 2244                         SCTP_TCB_LOCK(stcb);
 2245 #endif
 2246                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2247                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
 2248 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2249                         SCTP_SOCKET_UNLOCK(so, 1);
 2250 #endif
 2251                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2252                         return (NULL);
 2253                 } else {
 2254                         /* remaining chunks checked... good to go */
 2255                         stcb->asoc.authenticated = 1;
 2256                 }
 2257         }
 2258         /* update current state */
 2259         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
 2260         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 2261         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 2262                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 2263                     stcb->sctp_ep, stcb, asoc->primary_destination);
 2264         }
 2265         sctp_stop_all_cookie_timers(stcb);
 2266         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
 2267         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 2268 
 2269         /*
 2270          * if we're doing ASCONFs, check to see if we have any new local
 2271          * addresses that need to get added to the peer (eg. addresses
 2272          * changed while cookie echo in flight).  This needs to be done
 2273          * after we go to the OPEN state to do the correct asconf
 2274          * processing. else, make sure we have the correct addresses in our
 2275          * lists
 2276          */
 2277 
 2278         /* warning, we re-use sin, sin6, sa_store here! */
 2279         /* pull in local_address (our "from" address) */
 2280         switch (cookie->laddr_type) {
 2281 #ifdef INET
 2282         case SCTP_IPV4_ADDRESS:
 2283                 /* source addr is IPv4 */
 2284                 memset(&store.sin, 0, sizeof(struct sockaddr_in));
 2285                 store.sin.sin_family = AF_INET;
 2286                 store.sin.sin_len = sizeof(struct sockaddr_in);
 2287                 store.sin.sin_addr.s_addr = cookie->laddress[0];
 2288                 break;
 2289 #endif
 2290 #ifdef INET6
 2291         case SCTP_IPV6_ADDRESS:
 2292                 /* source addr is IPv6 */
 2293                 memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
 2294                 store.sin6.sin6_family = AF_INET6;
 2295                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
 2296                 store.sin6.sin6_scope_id = cookie->scope_id;
 2297                 memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
 2298                 break;
 2299 #endif
 2300         default:
 2301                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2302 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2303                 SCTP_TCB_UNLOCK(stcb);
 2304                 SCTP_SOCKET_LOCK(so, 1);
 2305                 SCTP_TCB_LOCK(stcb);
 2306 #endif
 2307                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2308                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
 2309 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2310                 SCTP_SOCKET_UNLOCK(so, 1);
 2311 #endif
 2312                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2313                 return (NULL);
 2314         }
 2315 
 2316         /* set up to notify upper layer */
 2317         *notification = SCTP_NOTIFY_ASSOC_UP;
 2318         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 2319             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 2320             (inp->sctp_socket->so_qlimit == 0)) {
 2321                 /*
 2322                  * This is an endpoint that called connect() how it got a
 2323                  * cookie that is NEW is a bit of a mystery. It must be that
 2324                  * the INIT was sent, but before it got there.. a complete
 2325                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
 2326                  * should have went to the other code.. not here.. oh well..
 2327                  * a bit of protection is worth having..
 2328                  */
 2329                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
 2330 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2331                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2332                 SCTP_TCB_UNLOCK(stcb);
 2333                 SCTP_SOCKET_LOCK(so, 1);
 2334                 SCTP_TCB_LOCK(stcb);
 2335                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2336                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 2337                         SCTP_SOCKET_UNLOCK(so, 1);
 2338                         return (NULL);
 2339                 }
 2340 #endif
 2341                 soisconnected(stcb->sctp_socket);
 2342 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2343                 SCTP_SOCKET_UNLOCK(so, 1);
 2344 #endif
 2345         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 2346             (inp->sctp_socket->so_qlimit)) {
 2347                 /*
 2348                  * We don't want to do anything with this one. Since it is
 2349                  * the listening guy. The timer will get started for
 2350                  * accepted connections in the caller.
 2351                  */
 2352                 ;
 2353         }
 2354         /* since we did not send a HB make sure we don't double things */
 2355         if ((netp) && (*netp))
 2356                 (*netp)->hb_responded = 1;
 2357 
 2358         if (stcb->asoc.sctp_autoclose_ticks &&
 2359             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 2360                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
 2361         }
 2362         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
 2363         if ((netp != NULL) && (*netp != NULL)) {
 2364                 /* calculate the RTT and set the encaps port */
 2365                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
 2366                     &cookie->time_entered, sctp_align_unsafe_makecopy,
 2367                     SCTP_RTT_FROM_NON_DATA);
 2368         }
 2369         /* respond with a COOKIE-ACK */
 2370         sctp_send_cookie_ack(stcb);
 2371 
 2372         /*
 2373          * check the address lists for any ASCONFs that need to be sent
 2374          * AFTER the cookie-ack is sent
 2375          */
 2376         sctp_check_address_list(stcb, m,
 2377             initack_offset + sizeof(struct sctp_init_ack_chunk),
 2378             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
 2379             &store.sa, cookie->local_scope, cookie->site_scope,
 2380             cookie->ipv4_scope, cookie->loopback_scope);
 2381 
 2382 
 2383         return (stcb);
 2384 }
 2385 
 2386 /*
 2387  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
 2388  * we NEED to make sure we are not already using the vtag. If so we
 2389  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
 2390         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
 2391                                                             SCTP_BASE_INFO(hashasocmark))];
 2392         LIST_FOREACH(stcb, head, sctp_asocs) {
 2393                 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
 2394                        -- SEND ABORT - TRY AGAIN --
 2395                 }
 2396         }
 2397 */
 2398 
 2399 /*
 2400  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
 2401  * existing (non-NULL) TCB
 2402  */
 2403 static struct mbuf *
 2404 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 2405     struct sockaddr *src, struct sockaddr *dst,
 2406     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
 2407     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
 2408     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 2409     struct sctp_tcb **locked_tcb,
 2410     uint8_t mflowtype, uint32_t mflowid,
 2411     uint32_t vrf_id, uint16_t port)
 2412 {
 2413         struct sctp_state_cookie *cookie;
 2414         struct sctp_tcb *l_stcb = *stcb;
 2415         struct sctp_inpcb *l_inp;
 2416         struct sockaddr *to;
 2417         struct sctp_pcb *ep;
 2418         struct mbuf *m_sig;
 2419         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
 2420         uint8_t *sig;
 2421         uint8_t cookie_ok = 0;
 2422         unsigned int sig_offset, cookie_offset;
 2423         unsigned int cookie_len;
 2424         struct timeval now;
 2425         struct timeval time_expires;
 2426         int notification = 0;
 2427         struct sctp_nets *netl;
 2428         int had_a_existing_tcb = 0;
 2429         int send_int_conf = 0;
 2430 #ifdef INET
 2431         struct sockaddr_in sin;
 2432 #endif
 2433 #ifdef INET6
 2434         struct sockaddr_in6 sin6;
 2435 #endif
 2436 
 2437         SCTPDBG(SCTP_DEBUG_INPUT2,
 2438             "sctp_handle_cookie: handling COOKIE-ECHO\n");
 2439 
 2440         if (inp_p == NULL) {
 2441                 return (NULL);
 2442         }
 2443         cookie = &cp->cookie;
 2444         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
 2445         cookie_len = ntohs(cp->ch.chunk_length);
 2446 
 2447         if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
 2448             sizeof(struct sctp_init_chunk) +
 2449             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
 2450                 /* cookie too small */
 2451                 return (NULL);
 2452         }
 2453         if ((cookie->peerport != sh->src_port) ||
 2454             (cookie->myport != sh->dest_port) ||
 2455             (cookie->my_vtag != sh->v_tag)) {
 2456                 /*
 2457                  * invalid ports or bad tag.  Note that we always leave the
 2458                  * v_tag in the header in network order and when we stored
 2459                  * it in the my_vtag slot we also left it in network order.
 2460                  * This maintains the match even though it may be in the
 2461                  * opposite byte order of the machine :->
 2462                  */
 2463                 return (NULL);
 2464         }
 2465         /*
 2466          * split off the signature into its own mbuf (since it should not be
 2467          * calculated in the sctp_hmac_m() call).
 2468          */
 2469         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
 2470         m_sig = m_split(m, sig_offset, M_NOWAIT);
 2471         if (m_sig == NULL) {
 2472                 /* out of memory or ?? */
 2473                 return (NULL);
 2474         }
 2475 #ifdef SCTP_MBUF_LOGGING
 2476         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 2477                 sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT);
 2478         }
 2479 #endif
 2480 
 2481         /*
 2482          * compute the signature/digest for the cookie
 2483          */
 2484         ep = &(*inp_p)->sctp_ep;
 2485         l_inp = *inp_p;
 2486         if (l_stcb) {
 2487                 SCTP_TCB_UNLOCK(l_stcb);
 2488         }
 2489         SCTP_INP_RLOCK(l_inp);
 2490         if (l_stcb) {
 2491                 SCTP_TCB_LOCK(l_stcb);
 2492         }
 2493         /* which cookie is it? */
 2494         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
 2495             (ep->current_secret_number != ep->last_secret_number)) {
 2496                 /* it's the old cookie */
 2497                 (void)sctp_hmac_m(SCTP_HMAC,
 2498                     (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
 2499                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2500         } else {
 2501                 /* it's the current cookie */
 2502                 (void)sctp_hmac_m(SCTP_HMAC,
 2503                     (uint8_t *)ep->secret_key[(int)ep->current_secret_number],
 2504                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2505         }
 2506         /* get the signature */
 2507         SCTP_INP_RUNLOCK(l_inp);
 2508         sig = (uint8_t *)sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *)&tmp_sig);
 2509         if (sig == NULL) {
 2510                 /* couldn't find signature */
 2511                 sctp_m_freem(m_sig);
 2512                 return (NULL);
 2513         }
 2514         /* compare the received digest with the computed digest */
 2515         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
 2516                 /* try the old cookie? */
 2517                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
 2518                     (ep->current_secret_number != ep->last_secret_number)) {
 2519                         /* compute digest with old */
 2520                         (void)sctp_hmac_m(SCTP_HMAC,
 2521                             (uint8_t *)ep->secret_key[(int)ep->last_secret_number],
 2522                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2523                         /* compare */
 2524                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
 2525                                 cookie_ok = 1;
 2526                 }
 2527         } else {
 2528                 cookie_ok = 1;
 2529         }
 2530 
 2531         /*
 2532          * Now before we continue we must reconstruct our mbuf so that
 2533          * normal processing of any other chunks will work.
 2534          */
 2535         {
 2536                 struct mbuf *m_at;
 2537 
 2538                 m_at = m;
 2539                 while (SCTP_BUF_NEXT(m_at) != NULL) {
 2540                         m_at = SCTP_BUF_NEXT(m_at);
 2541                 }
 2542                 SCTP_BUF_NEXT(m_at) = m_sig;
 2543         }
 2544 
 2545         if (cookie_ok == 0) {
 2546                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
 2547                 SCTPDBG(SCTP_DEBUG_INPUT2,
 2548                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
 2549                     (uint32_t)offset, cookie_offset, sig_offset);
 2550                 return (NULL);
 2551         }
 2552         /*
 2553          * check the cookie timestamps to be sure it's not stale
 2554          */
 2555         (void)SCTP_GETTIME_TIMEVAL(&now);
 2556         /* Expire time is in Ticks, so we convert to seconds */
 2557         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
 2558         time_expires.tv_usec = cookie->time_entered.tv_usec;
 2559         /*
 2560          * TODO sctp_constants.h needs alternative time macros when _KERNEL
 2561          * is undefined.
 2562          */
 2563         if (timevalcmp(&now, &time_expires, >)) {
 2564                 /* cookie is stale! */
 2565                 struct mbuf *op_err;
 2566                 struct sctp_error_stale_cookie *cause;
 2567                 uint32_t tim;
 2568 
 2569                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie),
 2570                     0, M_NOWAIT, 1, MT_DATA);
 2571                 if (op_err == NULL) {
 2572                         /* FOOBAR */
 2573                         return (NULL);
 2574                 }
 2575                 /* Set the len */
 2576                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie);
 2577                 cause = mtod(op_err, struct sctp_error_stale_cookie *);
 2578                 cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE);
 2579                 cause->cause.length = htons((sizeof(struct sctp_paramhdr) +
 2580                     (sizeof(uint32_t))));
 2581                 /* seconds to usec */
 2582                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
 2583                 /* add in usec */
 2584                 if (tim == 0)
 2585                         tim = now.tv_usec - cookie->time_entered.tv_usec;
 2586                 cause->stale_time = htonl(tim);
 2587                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
 2588                     mflowtype, mflowid, l_inp->fibnum,
 2589                     vrf_id, port);
 2590                 return (NULL);
 2591         }
 2592         /*
 2593          * Now we must see with the lookup address if we have an existing
 2594          * asoc. This will only happen if we were in the COOKIE-WAIT state
 2595          * and a INIT collided with us and somewhere the peer sent the
 2596          * cookie on another address besides the single address our assoc
 2597          * had for him. In this case we will have one of the tie-tags set at
 2598          * least AND the address field in the cookie can be used to look it
 2599          * up.
 2600          */
 2601         to = NULL;
 2602         switch (cookie->addr_type) {
 2603 #ifdef INET6
 2604         case SCTP_IPV6_ADDRESS:
 2605                 memset(&sin6, 0, sizeof(sin6));
 2606                 sin6.sin6_family = AF_INET6;
 2607                 sin6.sin6_len = sizeof(sin6);
 2608                 sin6.sin6_port = sh->src_port;
 2609                 sin6.sin6_scope_id = cookie->scope_id;
 2610                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
 2611                     sizeof(sin6.sin6_addr.s6_addr));
 2612                 to = (struct sockaddr *)&sin6;
 2613                 break;
 2614 #endif
 2615 #ifdef INET
 2616         case SCTP_IPV4_ADDRESS:
 2617                 memset(&sin, 0, sizeof(sin));
 2618                 sin.sin_family = AF_INET;
 2619                 sin.sin_len = sizeof(sin);
 2620                 sin.sin_port = sh->src_port;
 2621                 sin.sin_addr.s_addr = cookie->address[0];
 2622                 to = (struct sockaddr *)&sin;
 2623                 break;
 2624 #endif
 2625         default:
 2626                 /* This should not happen */
 2627                 return (NULL);
 2628         }
 2629         if (*stcb == NULL) {
 2630                 /* Yep, lets check */
 2631                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
 2632                 if (*stcb == NULL) {
 2633                         /*
 2634                          * We should have only got back the same inp. If we
 2635                          * got back a different ep we have a problem. The
 2636                          * original findep got back l_inp and now
 2637                          */
 2638                         if (l_inp != *inp_p) {
 2639                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
 2640                         }
 2641                 } else {
 2642                         if (*locked_tcb == NULL) {
 2643                                 /*
 2644                                  * In this case we found the assoc only
 2645                                  * after we locked the create lock. This
 2646                                  * means we are in a colliding case and we
 2647                                  * must make sure that we unlock the tcb if
 2648                                  * its one of the cases where we throw away
 2649                                  * the incoming packets.
 2650                                  */
 2651                                 *locked_tcb = *stcb;
 2652 
 2653                                 /*
 2654                                  * We must also increment the inp ref count
 2655                                  * since the ref_count flags was set when we
 2656                                  * did not find the TCB, now we found it
 2657                                  * which reduces the refcount.. we must
 2658                                  * raise it back out to balance it all :-)
 2659                                  */
 2660                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
 2661                                 if ((*stcb)->sctp_ep != l_inp) {
 2662                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
 2663                                             (void *)(*stcb)->sctp_ep, (void *)l_inp);
 2664                                 }
 2665                         }
 2666                 }
 2667         }
 2668         cookie_len -= SCTP_SIGNATURE_SIZE;
 2669         if (*stcb == NULL) {
 2670                 /* this is the "normal" case... get a new TCB */
 2671                 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
 2672                     cookie, cookie_len, *inp_p,
 2673                     netp, to, &notification,
 2674                     auth_skipped, auth_offset, auth_len,
 2675                     mflowtype, mflowid,
 2676                     vrf_id, port);
 2677         } else {
 2678                 /* this is abnormal... cookie-echo on existing TCB */
 2679                 had_a_existing_tcb = 1;
 2680                 *stcb = sctp_process_cookie_existing(m, iphlen, offset,
 2681                     src, dst, sh,
 2682                     cookie, cookie_len, *inp_p, *stcb, netp, to,
 2683                     &notification, auth_skipped, auth_offset, auth_len,
 2684                     mflowtype, mflowid,
 2685                     vrf_id, port);
 2686         }
 2687 
 2688         if (*stcb == NULL) {
 2689                 /* still no TCB... must be bad cookie-echo */
 2690                 return (NULL);
 2691         }
 2692         if (*netp != NULL) {
 2693                 (*netp)->flowtype = mflowtype;
 2694                 (*netp)->flowid = mflowid;
 2695         }
 2696         /*
 2697          * Ok, we built an association so confirm the address we sent the
 2698          * INIT-ACK to.
 2699          */
 2700         netl = sctp_findnet(*stcb, to);
 2701         /*
 2702          * This code should in theory NOT run but
 2703          */
 2704         if (netl == NULL) {
 2705                 /* TSNH! Huh, why do I need to add this address here? */
 2706                 if (sctp_add_remote_addr(*stcb, to, NULL, port,
 2707                     SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
 2708                         return (NULL);
 2709                 }
 2710                 netl = sctp_findnet(*stcb, to);
 2711         }
 2712         if (netl) {
 2713                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
 2714                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 2715                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
 2716                             netl);
 2717                         send_int_conf = 1;
 2718                 }
 2719         }
 2720         sctp_start_net_timers(*stcb);
 2721         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 2722                 if (!had_a_existing_tcb ||
 2723                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
 2724                         /*
 2725                          * If we have a NEW cookie or the connect never
 2726                          * reached the connected state during collision we
 2727                          * must do the TCP accept thing.
 2728                          */
 2729                         struct socket *so, *oso;
 2730                         struct sctp_inpcb *inp;
 2731 
 2732                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
 2733                                 /*
 2734                                  * For a restart we will keep the same
 2735                                  * socket, no need to do anything. I THINK!!
 2736                                  */
 2737                                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2738                                 if (send_int_conf) {
 2739                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2740                                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2741                                 }
 2742                                 return (m);
 2743                         }
 2744                         oso = (*inp_p)->sctp_socket;
 2745                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2746                         SCTP_TCB_UNLOCK((*stcb));
 2747                         CURVNET_SET(oso->so_vnet);
 2748                         so = sonewconn(oso, 0
 2749                             );
 2750                         CURVNET_RESTORE();
 2751                         SCTP_TCB_LOCK((*stcb));
 2752                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2753 
 2754                         if (so == NULL) {
 2755                                 struct mbuf *op_err;
 2756 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2757                                 struct socket *pcb_so;
 2758 #endif
 2759                                 /* Too many sockets */
 2760                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
 2761                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 2762                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
 2763                                     src, dst, sh, op_err,
 2764                                     mflowtype, mflowid,
 2765                                     vrf_id, port);
 2766 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2767                                 pcb_so = SCTP_INP_SO(*inp_p);
 2768                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2769                                 SCTP_TCB_UNLOCK((*stcb));
 2770                                 SCTP_SOCKET_LOCK(pcb_so, 1);
 2771                                 SCTP_TCB_LOCK((*stcb));
 2772                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2773 #endif
 2774                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,
 2775                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
 2776 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2777                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
 2778 #endif
 2779                                 return (NULL);
 2780                         }
 2781                         inp = (struct sctp_inpcb *)so->so_pcb;
 2782                         SCTP_INP_INCR_REF(inp);
 2783                         /*
 2784                          * We add the unbound flag here so that if we get an
 2785                          * soabort() before we get the move_pcb done, we
 2786                          * will properly cleanup.
 2787                          */
 2788                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
 2789                             SCTP_PCB_FLAGS_CONNECTED |
 2790                             SCTP_PCB_FLAGS_IN_TCPPOOL |
 2791                             SCTP_PCB_FLAGS_UNBOUND |
 2792                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
 2793                             SCTP_PCB_FLAGS_DONT_WAKE);
 2794                         inp->sctp_features = (*inp_p)->sctp_features;
 2795                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
 2796                         inp->sctp_socket = so;
 2797                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
 2798                         inp->max_cwnd = (*inp_p)->max_cwnd;
 2799                         inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
 2800                         inp->ecn_supported = (*inp_p)->ecn_supported;
 2801                         inp->prsctp_supported = (*inp_p)->prsctp_supported;
 2802                         inp->auth_supported = (*inp_p)->auth_supported;
 2803                         inp->asconf_supported = (*inp_p)->asconf_supported;
 2804                         inp->reconfig_supported = (*inp_p)->reconfig_supported;
 2805                         inp->nrsack_supported = (*inp_p)->nrsack_supported;
 2806                         inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
 2807                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
 2808                         inp->sctp_context = (*inp_p)->sctp_context;
 2809                         inp->local_strreset_support = (*inp_p)->local_strreset_support;
 2810                         inp->fibnum = (*inp_p)->fibnum;
 2811                         inp->inp_starting_point_for_iterator = NULL;
 2812                         /*
 2813                          * copy in the authentication parameters from the
 2814                          * original endpoint
 2815                          */
 2816                         if (inp->sctp_ep.local_hmacs)
 2817                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
 2818                         inp->sctp_ep.local_hmacs =
 2819                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
 2820                         if (inp->sctp_ep.local_auth_chunks)
 2821                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
 2822                         inp->sctp_ep.local_auth_chunks =
 2823                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
 2824 
 2825                         /*
 2826                          * Now we must move it from one hash table to
 2827                          * another and get the tcb in the right place.
 2828                          */
 2829 
 2830                         /*
 2831                          * This is where the one-2-one socket is put into
 2832                          * the accept state waiting for the accept!
 2833                          */
 2834                         if (*stcb) {
 2835                                 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
 2836                         }
 2837                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
 2838 
 2839                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2840                         SCTP_TCB_UNLOCK((*stcb));
 2841 
 2842                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
 2843                             0);
 2844                         SCTP_TCB_LOCK((*stcb));
 2845                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2846 
 2847 
 2848                         /*
 2849                          * now we must check to see if we were aborted while
 2850                          * the move was going on and the lock/unlock
 2851                          * happened.
 2852                          */
 2853                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 2854                                 /*
 2855                                  * yep it was, we leave the assoc attached
 2856                                  * to the socket since the sctp_inpcb_free()
 2857                                  * call will send an abort for us.
 2858                                  */
 2859                                 SCTP_INP_DECR_REF(inp);
 2860                                 return (NULL);
 2861                         }
 2862                         SCTP_INP_DECR_REF(inp);
 2863                         /* Switch over to the new guy */
 2864                         *inp_p = inp;
 2865                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2866                         if (send_int_conf) {
 2867                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2868                                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2869                         }
 2870                         /*
 2871                          * Pull it from the incomplete queue and wake the
 2872                          * guy
 2873                          */
 2874 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2875                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2876                         SCTP_TCB_UNLOCK((*stcb));
 2877                         SCTP_SOCKET_LOCK(so, 1);
 2878 #endif
 2879                         soisconnected(so);
 2880 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2881                         SCTP_TCB_LOCK((*stcb));
 2882                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2883                         SCTP_SOCKET_UNLOCK(so, 1);
 2884 #endif
 2885                         return (m);
 2886                 }
 2887         }
 2888         if (notification) {
 2889                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2890         }
 2891         if (send_int_conf) {
 2892                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2893                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2894         }
 2895         return (m);
 2896 }
 2897 
 2898 static void
 2899 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
 2900     struct sctp_tcb *stcb, struct sctp_nets *net)
 2901 {
 2902         /* cp must not be used, others call this without a c-ack :-) */
 2903         struct sctp_association *asoc;
 2904 
 2905         SCTPDBG(SCTP_DEBUG_INPUT2,
 2906             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
 2907         if ((stcb == NULL) || (net == NULL)) {
 2908                 return;
 2909         }
 2910         asoc = &stcb->asoc;
 2911 
 2912         sctp_stop_all_cookie_timers(stcb);
 2913         /* process according to association state */
 2914         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 2915                 /* state change only needed when I am in right state */
 2916                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
 2917                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 2918                 sctp_start_net_timers(stcb);
 2919                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 2920                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 2921                             stcb->sctp_ep, stcb, asoc->primary_destination);
 2922 
 2923                 }
 2924                 /* update RTO */
 2925                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 2926                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 2927                 if (asoc->overall_error_count == 0) {
 2928                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
 2929                             &asoc->time_entered, sctp_align_safe_nocopy,
 2930                             SCTP_RTT_FROM_NON_DATA);
 2931                 }
 2932                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 2933                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2934                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 2935                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 2936 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2937                         struct socket *so;
 2938 
 2939 #endif
 2940                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
 2941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2942                         so = SCTP_INP_SO(stcb->sctp_ep);
 2943                         atomic_add_int(&stcb->asoc.refcnt, 1);
 2944                         SCTP_TCB_UNLOCK(stcb);
 2945                         SCTP_SOCKET_LOCK(so, 1);
 2946                         SCTP_TCB_LOCK(stcb);
 2947                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2948 #endif
 2949                         if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
 2950                                 soisconnected(stcb->sctp_socket);
 2951                         }
 2952 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2953                         SCTP_SOCKET_UNLOCK(so, 1);
 2954 #endif
 2955                 }
 2956                 /*
 2957                  * since we did not send a HB make sure we don't double
 2958                  * things
 2959                  */
 2960                 net->hb_responded = 1;
 2961 
 2962                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 2963                         /*
 2964                          * We don't need to do the asconf thing, nor hb or
 2965                          * autoclose if the socket is closed.
 2966                          */
 2967                         goto closed_socket;
 2968                 }
 2969                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 2970                     stcb, net);
 2971 
 2972 
 2973                 if (stcb->asoc.sctp_autoclose_ticks &&
 2974                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 2975                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
 2976                             stcb->sctp_ep, stcb, NULL);
 2977                 }
 2978                 /*
 2979                  * send ASCONF if parameters are pending and ASCONFs are
 2980                  * allowed (eg. addresses changed when init/cookie echo were
 2981                  * in flight)
 2982                  */
 2983                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
 2984                     (stcb->asoc.asconf_supported == 1) &&
 2985                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
 2986 #ifdef SCTP_TIMER_BASED_ASCONF
 2987                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2988                             stcb->sctp_ep, stcb,
 2989                             stcb->asoc.primary_destination);
 2990 #else
 2991                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
 2992                             SCTP_ADDR_NOT_LOCKED);
 2993 #endif
 2994                 }
 2995         }
 2996 closed_socket:
 2997         /* Toss the cookie if I can */
 2998         sctp_toss_old_cookies(stcb, asoc);
 2999         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
 3000                 /* Restart the timer if we have pending data */
 3001                 struct sctp_tmit_chunk *chk;
 3002 
 3003                 chk = TAILQ_FIRST(&asoc->sent_queue);
 3004                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
 3005         }
 3006 }
 3007 
 3008 static void
 3009 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
 3010     struct sctp_tcb *stcb)
 3011 {
 3012         struct sctp_nets *net;
 3013         struct sctp_tmit_chunk *lchk;
 3014         struct sctp_ecne_chunk bkup;
 3015         uint8_t override_bit;
 3016         uint32_t tsn, window_data_tsn;
 3017         int len;
 3018         unsigned int pkt_cnt;
 3019 
 3020         len = ntohs(cp->ch.chunk_length);
 3021         if ((len != sizeof(struct sctp_ecne_chunk)) &&
 3022             (len != sizeof(struct old_sctp_ecne_chunk))) {
 3023                 return;
 3024         }
 3025         if (len == sizeof(struct old_sctp_ecne_chunk)) {
 3026                 /* Its the old format */
 3027                 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
 3028                 bkup.num_pkts_since_cwr = htonl(1);
 3029                 cp = &bkup;
 3030         }
 3031         SCTP_STAT_INCR(sctps_recvecne);
 3032         tsn = ntohl(cp->tsn);
 3033         pkt_cnt = ntohl(cp->num_pkts_since_cwr);
 3034         lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
 3035         if (lchk == NULL) {
 3036                 window_data_tsn = stcb->asoc.sending_seq - 1;
 3037         } else {
 3038                 window_data_tsn = lchk->rec.data.tsn;
 3039         }
 3040 
 3041         /* Find where it was sent to if possible. */
 3042         net = NULL;
 3043         TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
 3044                 if (lchk->rec.data.tsn == tsn) {
 3045                         net = lchk->whoTo;
 3046                         net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
 3047                         break;
 3048                 }
 3049                 if (SCTP_TSN_GT(lchk->rec.data.tsn, tsn)) {
 3050                         break;
 3051                 }
 3052         }
 3053         if (net == NULL) {
 3054                 /*
 3055                  * What to do. A previous send of a CWR was possibly lost.
 3056                  * See how old it is, we may have it marked on the actual
 3057                  * net.
 3058                  */
 3059                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 3060                         if (tsn == net->last_cwr_tsn) {
 3061                                 /* Found him, send it off */
 3062                                 break;
 3063                         }
 3064                 }
 3065                 if (net == NULL) {
 3066                         /*
 3067                          * If we reach here, we need to send a special CWR
 3068                          * that says hey, we did this a long time ago and
 3069                          * you lost the response.
 3070                          */
 3071                         net = TAILQ_FIRST(&stcb->asoc.nets);
 3072                         if (net == NULL) {
 3073                                 /* TSNH */
 3074                                 return;
 3075                         }
 3076                         override_bit = SCTP_CWR_REDUCE_OVERRIDE;
 3077                 } else {
 3078                         override_bit = 0;
 3079                 }
 3080         } else {
 3081                 override_bit = 0;
 3082         }
 3083         if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
 3084             ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
 3085                 /*
 3086                  * JRS - Use the congestion control given in the pluggable
 3087                  * CC module
 3088                  */
 3089                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
 3090                 /*
 3091                  * We reduce once every RTT. So we will only lower cwnd at
 3092                  * the next sending seq i.e. the window_data_tsn
 3093                  */
 3094                 net->cwr_window_tsn = window_data_tsn;
 3095                 net->ecn_ce_pkt_cnt += pkt_cnt;
 3096                 net->lost_cnt = pkt_cnt;
 3097                 net->last_cwr_tsn = tsn;
 3098         } else {
 3099                 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
 3100                 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
 3101                     ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
 3102                         /*
 3103                          * Another loss in the same window update how many
 3104                          * marks/packets lost we have had.
 3105                          */
 3106                         int cnt = 1;
 3107 
 3108                         if (pkt_cnt > net->lost_cnt) {
 3109                                 /* Should be the case */
 3110                                 cnt = (pkt_cnt - net->lost_cnt);
 3111                                 net->ecn_ce_pkt_cnt += cnt;
 3112                         }
 3113                         net->lost_cnt = pkt_cnt;
 3114                         net->last_cwr_tsn = tsn;
 3115                         /*
 3116                          * Most CC functions will ignore this call, since we
 3117                          * are in-window yet of the initial CE the peer saw.
 3118                          */
 3119                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
 3120                 }
 3121         }
 3122         /*
 3123          * We always send a CWR this way if our previous one was lost our
 3124          * peer will get an update, or if it is not time again to reduce we
 3125          * still get the cwr to the peer. Note we set the override when we
 3126          * could not find the TSN on the chunk or the destination network.
 3127          */
 3128         sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
 3129 }
 3130 
 3131 static void
 3132 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
 3133 {
 3134         /*
 3135          * Here we get a CWR from the peer. We must look in the outqueue and
 3136          * make sure that we have a covered ECNE in the control chunk part.
 3137          * If so remove it.
 3138          */
 3139         struct sctp_tmit_chunk *chk;
 3140         struct sctp_ecne_chunk *ecne;
 3141         int override;
 3142         uint32_t cwr_tsn;
 3143 
 3144         cwr_tsn = ntohl(cp->tsn);
 3145         override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
 3146         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
 3147                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
 3148                         continue;
 3149                 }
 3150                 if ((override == 0) && (chk->whoTo != net)) {
 3151                         /* Must be from the right src unless override is set */
 3152                         continue;
 3153                 }
 3154                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
 3155                 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
 3156                         /* this covers this ECNE, we can remove it */
 3157                         stcb->asoc.ecn_echo_cnt_onq--;
 3158                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
 3159                             sctp_next);
 3160                         sctp_m_freem(chk->data);
 3161                         chk->data = NULL;
 3162                         stcb->asoc.ctrl_queue_cnt--;
 3163                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 3164                         if (override == 0) {
 3165                                 break;
 3166                         }
 3167                 }
 3168         }
 3169 }
 3170 
 3171 static void
 3172 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
 3173     struct sctp_tcb *stcb, struct sctp_nets *net)
 3174 {
 3175         struct sctp_association *asoc;
 3176 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3177         struct socket *so;
 3178 #endif
 3179 
 3180         SCTPDBG(SCTP_DEBUG_INPUT2,
 3181             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
 3182         if (stcb == NULL)
 3183                 return;
 3184 
 3185         asoc = &stcb->asoc;
 3186         /* process according to association state */
 3187         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
 3188                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
 3189                 SCTPDBG(SCTP_DEBUG_INPUT2,
 3190                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
 3191                 SCTP_TCB_UNLOCK(stcb);
 3192                 return;
 3193         }
 3194         /* notify upper layer protocol */
 3195         if (stcb->sctp_socket) {
 3196                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 3197         }
 3198 #ifdef INVARIANTS
 3199         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 3200             !TAILQ_EMPTY(&asoc->sent_queue) ||
 3201             sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
 3202                 panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
 3203         }
 3204 #endif
 3205         /* stop the timer */
 3206         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net,
 3207             SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
 3208         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 3209         /* free the TCB */
 3210         SCTPDBG(SCTP_DEBUG_INPUT2,
 3211             "sctp_handle_shutdown_complete: calls free-asoc\n");
 3212 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3213         so = SCTP_INP_SO(stcb->sctp_ep);
 3214         atomic_add_int(&stcb->asoc.refcnt, 1);
 3215         SCTP_TCB_UNLOCK(stcb);
 3216         SCTP_SOCKET_LOCK(so, 1);
 3217         SCTP_TCB_LOCK(stcb);
 3218         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 3219 #endif
 3220         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 3221             SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
 3222 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3223         SCTP_SOCKET_UNLOCK(so, 1);
 3224 #endif
 3225         return;
 3226 }
 3227 
 3228 static int
 3229 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
 3230     struct sctp_nets *net, uint8_t flg)
 3231 {
 3232         switch (desc->chunk_type) {
 3233         case SCTP_DATA:
 3234                 /* find the tsn to resend (possibly */
 3235                 {
 3236                         uint32_t tsn;
 3237                         struct sctp_tmit_chunk *tp1;
 3238 
 3239                         tsn = ntohl(desc->tsn_ifany);
 3240                         TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3241                                 if (tp1->rec.data.tsn == tsn) {
 3242                                         /* found it */
 3243                                         break;
 3244                                 }
 3245                                 if (SCTP_TSN_GT(tp1->rec.data.tsn, tsn)) {
 3246                                         /* not found */
 3247                                         tp1 = NULL;
 3248                                         break;
 3249                                 }
 3250                         }
 3251                         if (tp1 == NULL) {
 3252                                 /*
 3253                                  * Do it the other way , aka without paying
 3254                                  * attention to queue seq order.
 3255                                  */
 3256                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
 3257                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3258                                         if (tp1->rec.data.tsn == tsn) {
 3259                                                 /* found it */
 3260                                                 break;
 3261                                         }
 3262                                 }
 3263                         }
 3264                         if (tp1 == NULL) {
 3265                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
 3266                         }
 3267                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
 3268                                 uint8_t *ddp;
 3269 
 3270                                 if (((flg & SCTP_BADCRC) == 0) &&
 3271                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
 3272                                         return (0);
 3273                                 }
 3274                                 if ((stcb->asoc.peers_rwnd == 0) &&
 3275                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
 3276                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
 3277                                         return (0);
 3278                                 }
 3279                                 if (stcb->asoc.peers_rwnd == 0 &&
 3280                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
 3281                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
 3282                                         return (0);
 3283                                 }
 3284                                 ddp = (uint8_t *)(mtod(tp1->data, caddr_t)+
 3285                                     sizeof(struct sctp_data_chunk));
 3286                                 {
 3287                                         unsigned int iii;
 3288 
 3289                                         for (iii = 0; iii < sizeof(desc->data_bytes);
 3290                                             iii++) {
 3291                                                 if (ddp[iii] != desc->data_bytes[iii]) {
 3292                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
 3293                                                         return (-1);
 3294                                                 }
 3295                                         }
 3296                                 }
 3297 
 3298                                 if (tp1->do_rtt) {
 3299                                         /*
 3300                                          * this guy had a RTO calculation
 3301                                          * pending on it, cancel it
 3302                                          */
 3303                                         if (tp1->whoTo->rto_needed == 0) {
 3304                                                 tp1->whoTo->rto_needed = 1;
 3305                                         }
 3306                                         tp1->do_rtt = 0;
 3307                                 }
 3308                                 SCTP_STAT_INCR(sctps_pdrpmark);
 3309                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
 3310                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3311                                 /*
 3312                                  * mark it as if we were doing a FR, since
 3313                                  * we will be getting gap ack reports behind
 3314                                  * the info from the router.
 3315                                  */
 3316                                 tp1->rec.data.doing_fast_retransmit = 1;
 3317                                 /*
 3318                                  * mark the tsn with what sequences can
 3319                                  * cause a new FR.
 3320                                  */
 3321                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
 3322                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
 3323                                 } else {
 3324                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.tsn;
 3325                                 }
 3326 
 3327                                 /* restart the timer */
 3328                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 3329                                     stcb, tp1->whoTo,
 3330                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
 3331                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 3332                                     stcb, tp1->whoTo);
 3333 
 3334                                 /* fix counts and things */
 3335                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
 3336                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
 3337                                             tp1->whoTo->flight_size,
 3338                                             tp1->book_size,
 3339                                             (uint32_t)(uintptr_t)stcb,
 3340                                             tp1->rec.data.tsn);
 3341                                 }
 3342                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
 3343                                         sctp_flight_size_decrease(tp1);
 3344                                         sctp_total_flight_decrease(stcb, tp1);
 3345                                 }
 3346                                 tp1->sent = SCTP_DATAGRAM_RESEND;
 3347                         } {
 3348                                 /* audit code */
 3349                                 unsigned int audit;
 3350 
 3351                                 audit = 0;
 3352                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3353                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
 3354                                                 audit++;
 3355                                 }
 3356                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
 3357                                     sctp_next) {
 3358                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
 3359                                                 audit++;
 3360                                 }
 3361                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
 3362                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
 3363                                             audit, stcb->asoc.sent_queue_retran_cnt);
 3364 #ifndef SCTP_AUDITING_ENABLED
 3365                                         stcb->asoc.sent_queue_retran_cnt = audit;
 3366 #endif
 3367                                 }
 3368                         }
 3369                 }
 3370                 break;
 3371         case SCTP_ASCONF:
 3372                 {
 3373                         struct sctp_tmit_chunk *asconf;
 3374 
 3375                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
 3376                             sctp_next) {
 3377                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
 3378                                         break;
 3379                                 }
 3380                         }
 3381                         if (asconf) {
 3382                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
 3383                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3384                                 asconf->sent = SCTP_DATAGRAM_RESEND;
 3385                                 asconf->snd_count--;
 3386                         }
 3387                 }
 3388                 break;
 3389         case SCTP_INITIATION:
 3390                 /* resend the INIT */
 3391                 stcb->asoc.dropped_special_cnt++;
 3392                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
 3393                         /*
 3394                          * If we can get it in, in a few attempts we do
 3395                          * this, otherwise we let the timer fire.
 3396                          */
 3397                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
 3398                             stcb, net,
 3399                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
 3400                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 3401                 }
 3402                 break;
 3403         case SCTP_SELECTIVE_ACK:
 3404         case SCTP_NR_SELECTIVE_ACK:
 3405                 /* resend the sack */
 3406                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
 3407                 break;
 3408         case SCTP_HEARTBEAT_REQUEST:
 3409                 /* resend a demand HB */
 3410                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
 3411                         /*
 3412                          * Only retransmit if we KNOW we wont destroy the
 3413                          * tcb
 3414                          */
 3415                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 3416                 }
 3417                 break;
 3418         case SCTP_SHUTDOWN:
 3419                 sctp_send_shutdown(stcb, net);
 3420                 break;
 3421         case SCTP_SHUTDOWN_ACK:
 3422                 sctp_send_shutdown_ack(stcb, net);
 3423                 break;
 3424         case SCTP_COOKIE_ECHO:
 3425                 {
 3426                         struct sctp_tmit_chunk *cookie;
 3427 
 3428                         cookie = NULL;
 3429                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
 3430                             sctp_next) {
 3431                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
 3432                                         break;
 3433                                 }
 3434                         }
 3435                         if (cookie) {
 3436                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
 3437                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3438                                 cookie->sent = SCTP_DATAGRAM_RESEND;
 3439                                 sctp_stop_all_cookie_timers(stcb);
 3440                         }
 3441                 }
 3442                 break;
 3443         case SCTP_COOKIE_ACK:
 3444                 sctp_send_cookie_ack(stcb);
 3445                 break;
 3446         case SCTP_ASCONF_ACK:
 3447                 /* resend last asconf ack */
 3448                 sctp_send_asconf_ack(stcb);
 3449                 break;
 3450         case SCTP_IFORWARD_CUM_TSN:
 3451         case SCTP_FORWARD_CUM_TSN:
 3452                 send_forward_tsn(stcb, &stcb->asoc);
 3453                 break;
 3454                 /* can't do anything with these */
 3455         case SCTP_PACKET_DROPPED:
 3456         case SCTP_INITIATION_ACK:       /* this should not happen */
 3457         case SCTP_HEARTBEAT_ACK:
 3458         case SCTP_ABORT_ASSOCIATION:
 3459         case SCTP_OPERATION_ERROR:
 3460         case SCTP_SHUTDOWN_COMPLETE:
 3461         case SCTP_ECN_ECHO:
 3462         case SCTP_ECN_CWR:
 3463         default:
 3464                 break;
 3465         }
 3466         return (0);
 3467 }
 3468 
 3469 void
 3470 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
 3471 {
 3472         uint32_t i;
 3473         uint16_t temp;
 3474 
 3475         /*
 3476          * We set things to 0xffffffff since this is the last delivered
 3477          * sequence and we will be sending in 0 after the reset.
 3478          */
 3479 
 3480         if (number_entries) {
 3481                 for (i = 0; i < number_entries; i++) {
 3482                         temp = ntohs(list[i]);
 3483                         if (temp >= stcb->asoc.streamincnt) {
 3484                                 continue;
 3485                         }
 3486                         stcb->asoc.strmin[temp].last_mid_delivered = 0xffffffff;
 3487                 }
 3488         } else {
 3489                 list = NULL;
 3490                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
 3491                         stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
 3492                 }
 3493         }
 3494         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
 3495 }
 3496 
 3497 static void
 3498 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
 3499 {
 3500         uint32_t i;
 3501         uint16_t temp;
 3502 
 3503         if (number_entries > 0) {
 3504                 for (i = 0; i < number_entries; i++) {
 3505                         temp = ntohs(list[i]);
 3506                         if (temp >= stcb->asoc.streamoutcnt) {
 3507                                 /* no such stream */
 3508                                 continue;
 3509                         }
 3510                         stcb->asoc.strmout[temp].next_mid_ordered = 0;
 3511                         stcb->asoc.strmout[temp].next_mid_unordered = 0;
 3512                 }
 3513         } else {
 3514                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 3515                         stcb->asoc.strmout[i].next_mid_ordered = 0;
 3516                         stcb->asoc.strmout[i].next_mid_unordered = 0;
 3517                 }
 3518         }
 3519         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
 3520 }
 3521 
 3522 static void
 3523 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t *list)
 3524 {
 3525         uint32_t i;
 3526         uint16_t temp;
 3527 
 3528         if (number_entries > 0) {
 3529                 for (i = 0; i < number_entries; i++) {
 3530                         temp = ntohs(list[i]);
 3531                         if (temp >= stcb->asoc.streamoutcnt) {
 3532                                 /* no such stream */
 3533                                 continue;
 3534                         }
 3535                         stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN;
 3536                 }
 3537         } else {
 3538                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 3539                         stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN;
 3540                 }
 3541         }
 3542 }
 3543 
 3544 
 3545 struct sctp_stream_reset_request *
 3546 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
 3547 {
 3548         struct sctp_association *asoc;
 3549         struct sctp_chunkhdr *ch;
 3550         struct sctp_stream_reset_request *r;
 3551         struct sctp_tmit_chunk *chk;
 3552         int len, clen;
 3553 
 3554         asoc = &stcb->asoc;
 3555         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
 3556                 asoc->stream_reset_outstanding = 0;
 3557                 return (NULL);
 3558         }
 3559         if (stcb->asoc.str_reset == NULL) {
 3560                 asoc->stream_reset_outstanding = 0;
 3561                 return (NULL);
 3562         }
 3563         chk = stcb->asoc.str_reset;
 3564         if (chk->data == NULL) {
 3565                 return (NULL);
 3566         }
 3567         if (bchk) {
 3568                 /* he wants a copy of the chk pointer */
 3569                 *bchk = chk;
 3570         }
 3571         clen = chk->send_size;
 3572         ch = mtod(chk->data, struct sctp_chunkhdr *);
 3573         r = (struct sctp_stream_reset_request *)(ch + 1);
 3574         if (ntohl(r->request_seq) == seq) {
 3575                 /* found it */
 3576                 return (r);
 3577         }
 3578         len = SCTP_SIZE32(ntohs(r->ph.param_length));
 3579         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
 3580                 /* move to the next one, there can only be a max of two */
 3581                 r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
 3582                 if (ntohl(r->request_seq) == seq) {
 3583                         return (r);
 3584                 }
 3585         }
 3586         /* that seq is not here */
 3587         return (NULL);
 3588 }
 3589 
 3590 static void
 3591 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
 3592 {
 3593         struct sctp_association *asoc;
 3594         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
 3595 
 3596         if (stcb->asoc.str_reset == NULL) {
 3597                 return;
 3598         }
 3599         asoc = &stcb->asoc;
 3600 
 3601         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb,
 3602             chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
 3603         TAILQ_REMOVE(&asoc->control_send_queue,
 3604             chk,
 3605             sctp_next);
 3606         if (chk->data) {
 3607                 sctp_m_freem(chk->data);
 3608                 chk->data = NULL;
 3609         }
 3610         asoc->ctrl_queue_cnt--;
 3611         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 3612         /* sa_ignore NO_NULL_CHK */
 3613         stcb->asoc.str_reset = NULL;
 3614 }
 3615 
 3616 
 3617 static int
 3618 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
 3619     uint32_t seq, uint32_t action,
 3620     struct sctp_stream_reset_response *respin)
 3621 {
 3622         uint16_t type;
 3623         int lparam_len;
 3624         struct sctp_association *asoc = &stcb->asoc;
 3625         struct sctp_tmit_chunk *chk;
 3626         struct sctp_stream_reset_request *req_param;
 3627         struct sctp_stream_reset_out_request *req_out_param;
 3628         struct sctp_stream_reset_in_request *req_in_param;
 3629         uint32_t number_entries;
 3630 
 3631         if (asoc->stream_reset_outstanding == 0) {
 3632                 /* duplicate */
 3633                 return (0);
 3634         }
 3635         if (seq == stcb->asoc.str_reset_seq_out) {
 3636                 req_param = sctp_find_stream_reset(stcb, seq, &chk);
 3637                 if (req_param != NULL) {
 3638                         stcb->asoc.str_reset_seq_out++;
 3639                         type = ntohs(req_param->ph.param_type);
 3640                         lparam_len = ntohs(req_param->ph.param_length);
 3641                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
 3642                                 int no_clear = 0;
 3643 
 3644                                 req_out_param = (struct sctp_stream_reset_out_request *)req_param;
 3645                                 number_entries = (lparam_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
 3646                                 asoc->stream_reset_out_is_outstanding = 0;
 3647                                 if (asoc->stream_reset_outstanding)
 3648                                         asoc->stream_reset_outstanding--;
 3649                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3650                                         /* do it */
 3651                                         sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
 3652                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3653                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3654                                 } else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {
 3655                                         /*
 3656                                          * Set it up so we don't stop
 3657                                          * retransmitting
 3658                                          */
 3659                                         asoc->stream_reset_outstanding++;
 3660                                         stcb->asoc.str_reset_seq_out--;
 3661                                         asoc->stream_reset_out_is_outstanding = 1;
 3662                                         no_clear = 1;
 3663                                 } else {
 3664                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3665                                 }
 3666                                 if (no_clear == 0) {
 3667                                         sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams);
 3668                                 }
 3669                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
 3670                                 req_in_param = (struct sctp_stream_reset_in_request *)req_param;
 3671                                 number_entries = (lparam_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
 3672                                 if (asoc->stream_reset_outstanding)
 3673                                         asoc->stream_reset_outstanding--;
 3674                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3675                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
 3676                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3677                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3678                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
 3679                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
 3680                                 }
 3681                         } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
 3682                                 /* Ok we now may have more streams */
 3683                                 int num_stream;
 3684 
 3685                                 num_stream = stcb->asoc.strm_pending_add_size;
 3686                                 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
 3687                                         /* TSNH */
 3688                                         num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
 3689                                 }
 3690                                 stcb->asoc.strm_pending_add_size = 0;
 3691                                 if (asoc->stream_reset_outstanding)
 3692                                         asoc->stream_reset_outstanding--;
 3693                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3694                                         /* Put the new streams into effect */
 3695                                         int i;
 3696 
 3697                                         for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) {
 3698                                                 asoc->strmout[i].state = SCTP_STREAM_OPEN;
 3699                                         }
 3700                                         asoc->streamoutcnt += num_stream;
 3701                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
 3702                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3703                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3704                                             SCTP_STREAM_CHANGE_DENIED);
 3705                                 } else {
 3706                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3707                                             SCTP_STREAM_CHANGE_FAILED);
 3708                                 }
 3709                         } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
 3710                                 if (asoc->stream_reset_outstanding)
 3711                                         asoc->stream_reset_outstanding--;
 3712                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3713                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3714                                             SCTP_STREAM_CHANGE_DENIED);
 3715                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3716                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
 3717                                             SCTP_STREAM_CHANGE_FAILED);
 3718                                 }
 3719                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
 3720                                 /**
 3721                                  * a) Adopt the new in tsn.
 3722                                  * b) reset the map
 3723                                  * c) Adopt the new out-tsn
 3724                                  */
 3725                                 struct sctp_stream_reset_response_tsn *resp;
 3726                                 struct sctp_forward_tsn_chunk fwdtsn;
 3727                                 int abort_flag = 0;
 3728 
 3729                                 if (respin == NULL) {
 3730                                         /* huh ? */
 3731                                         return (0);
 3732                                 }
 3733                                 if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
 3734                                         return (0);
 3735                                 }
 3736                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
 3737                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
 3738                                         asoc->stream_reset_outstanding--;
 3739                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
 3740                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 3741                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
 3742                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
 3743                                         if (abort_flag) {
 3744                                                 return (1);
 3745                                         }
 3746                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
 3747                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 3748                                                 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 3749                                         }
 3750                                         stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
 3751                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
 3752                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
 3753 
 3754                                         stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
 3755                                         memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
 3756 
 3757                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
 3758                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
 3759 
 3760                                         sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL);
 3761                                         sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL);
 3762                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
 3763                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
 3764                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
 3765                                             SCTP_ASSOC_RESET_DENIED);
 3766                                 } else {
 3767                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
 3768                                             SCTP_ASSOC_RESET_FAILED);
 3769                                 }
 3770                         }
 3771                         /* get rid of the request and get the request flags */
 3772                         if (asoc->stream_reset_outstanding == 0) {
 3773                                 sctp_clean_up_stream_reset(stcb);
 3774                         }
 3775                 }
 3776         }
 3777         if (asoc->stream_reset_outstanding == 0) {
 3778                 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
 3779         }
 3780         return (0);
 3781 }
 3782 
 3783 static void
 3784 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
 3785     struct sctp_tmit_chunk *chk,
 3786     struct sctp_stream_reset_in_request *req, int trunc)
 3787 {
 3788         uint32_t seq;
 3789         int len, i;
 3790         int number_entries;
 3791         uint16_t temp;
 3792 
 3793         /*
 3794          * peer wants me to send a str-reset to him for my outgoing seq's if
 3795          * seq_in is right.
 3796          */
 3797         struct sctp_association *asoc = &stcb->asoc;
 3798 
 3799         seq = ntohl(req->request_seq);
 3800         if (asoc->str_reset_seq_in == seq) {
 3801                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3802                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
 3803                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3804                 } else if (trunc) {
 3805                         /* Can't do it, since they exceeded our buffer size  */
 3806                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3807                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
 3808                         len = ntohs(req->ph.param_length);
 3809                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
 3810                         if (number_entries) {
 3811                                 for (i = 0; i < number_entries; i++) {
 3812                                         temp = ntohs(req->list_of_streams[i]);
 3813                                         if (temp >= stcb->asoc.streamoutcnt) {
 3814                                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3815                                                 goto bad_boy;
 3816                                         }
 3817                                         req->list_of_streams[i] = temp;
 3818                                 }
 3819                                 for (i = 0; i < number_entries; i++) {
 3820                                         if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {
 3821                                                 stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING;
 3822                                         }
 3823                                 }
 3824                         } else {
 3825                                 /* Its all */
 3826                                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 3827                                         if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)
 3828                                                 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING;
 3829                                 }
 3830                         }
 3831                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3832                 } else {
 3833                         /* Can't do it, since we have sent one out */
 3834                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
 3835                 }
 3836 bad_boy:
 3837                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3838                 asoc->str_reset_seq_in++;
 3839         } else if (asoc->str_reset_seq_in - 1 == seq) {
 3840                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3841         } else if (asoc->str_reset_seq_in - 2 == seq) {
 3842                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3843         } else {
 3844                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3845         }
 3846         sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
 3847 }
 3848 
 3849 static int
 3850 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
 3851     struct sctp_tmit_chunk *chk,
 3852     struct sctp_stream_reset_tsn_request *req)
 3853 {
 3854         /* reset all in and out and update the tsn */
 3855         /*
 3856          * A) reset my str-seq's on in and out. B) Select a receive next,
 3857          * and set cum-ack to it. Also process this selected number as a
 3858          * fwd-tsn as well. C) set in the response my next sending seq.
 3859          */
 3860         struct sctp_forward_tsn_chunk fwdtsn;
 3861         struct sctp_association *asoc = &stcb->asoc;
 3862         int abort_flag = 0;
 3863         uint32_t seq;
 3864 
 3865         seq = ntohl(req->request_seq);
 3866         if (asoc->str_reset_seq_in == seq) {
 3867                 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
 3868                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
 3869                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3870                 } else {
 3871                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
 3872                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 3873                         fwdtsn.ch.chunk_flags = 0;
 3874                         fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
 3875                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
 3876                         if (abort_flag) {
 3877                                 return (1);
 3878                         }
 3879                         asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
 3880                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 3881                                 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 3882                         }
 3883                         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
 3884                         asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
 3885                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
 3886                         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
 3887                         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
 3888                         atomic_add_int(&asoc->sending_seq, 1);
 3889                         /* save off historical data for retrans */
 3890                         asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
 3891                         asoc->last_sending_seq[0] = asoc->sending_seq;
 3892                         asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
 3893                         asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
 3894                         sctp_reset_out_streams(stcb, 0, (uint16_t *)NULL);
 3895                         sctp_reset_in_stream(stcb, 0, (uint16_t *)NULL);
 3896                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3897                         sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
 3898                 }
 3899                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
 3900                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
 3901                 asoc->str_reset_seq_in++;
 3902         } else if (asoc->str_reset_seq_in - 1 == seq) {
 3903                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
 3904                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
 3905         } else if (asoc->str_reset_seq_in - 2 == seq) {
 3906                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
 3907                     asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
 3908         } else {
 3909                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3910         }
 3911         return (0);
 3912 }
 3913 
 3914 static void
 3915 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
 3916     struct sctp_tmit_chunk *chk,
 3917     struct sctp_stream_reset_out_request *req, int trunc)
 3918 {
 3919         uint32_t seq, tsn;
 3920         int number_entries, len;
 3921         struct sctp_association *asoc = &stcb->asoc;
 3922 
 3923         seq = ntohl(req->request_seq);
 3924 
 3925         /* now if its not a duplicate we process it */
 3926         if (asoc->str_reset_seq_in == seq) {
 3927                 len = ntohs(req->ph.param_length);
 3928                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
 3929                 /*
 3930                  * the sender is resetting, handle the list issue.. we must
 3931                  * a) verify if we can do the reset, if so no problem b) If
 3932                  * we can't do the reset we must copy the request. c) queue
 3933                  * it, and setup the data in processor to trigger it off
 3934                  * when needed and dequeue all the queued data.
 3935                  */
 3936                 tsn = ntohl(req->send_reset_at_tsn);
 3937 
 3938                 /* move the reset action back one */
 3939                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3940                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
 3941                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3942                 } else if (trunc) {
 3943                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3944                 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
 3945                         /* we can do it now */
 3946                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
 3947                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 3948                 } else {
 3949                         /*
 3950                          * we must queue it up and thus wait for the TSN's
 3951                          * to arrive that are at or before tsn
 3952                          */
 3953                         struct sctp_stream_reset_list *liste;
 3954                         int siz;
 3955 
 3956                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
 3957                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
 3958                             siz, SCTP_M_STRESET);
 3959                         if (liste == NULL) {
 3960                                 /* gak out of memory */
 3961                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 3962                                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3963                                 return;
 3964                         }
 3965                         liste->seq = seq;
 3966                         liste->tsn = tsn;
 3967                         liste->number_entries = number_entries;
 3968                         memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
 3969                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
 3970                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;
 3971                 }
 3972                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3973                 asoc->str_reset_seq_in++;
 3974         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 3975                 /*
 3976                  * one seq back, just echo back last action since my
 3977                  * response was lost.
 3978                  */
 3979                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3980         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 3981                 /*
 3982                  * two seq back, just echo back last action since my
 3983                  * response was lost.
 3984                  */
 3985                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3986         } else {
 3987                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 3988         }
 3989 }
 3990 
 3991 static void
 3992 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
 3993     struct sctp_stream_reset_add_strm *str_add)
 3994 {
 3995         /*
 3996          * Peer is requesting to add more streams. If its within our
 3997          * max-streams we will allow it.
 3998          */
 3999         uint32_t num_stream, i;
 4000         uint32_t seq;
 4001         struct sctp_association *asoc = &stcb->asoc;
 4002         struct sctp_queued_to_read *ctl, *nctl;
 4003 
 4004         /* Get the number. */
 4005         seq = ntohl(str_add->request_seq);
 4006         num_stream = ntohs(str_add->number_of_streams);
 4007         /* Now what would be the new total? */
 4008         if (asoc->str_reset_seq_in == seq) {
 4009                 num_stream += stcb->asoc.streamincnt;
 4010                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 4011                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
 4012                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4013                 } else if ((num_stream > stcb->asoc.max_inbound_streams) ||
 4014                     (num_stream > 0xffff)) {
 4015                         /* We must reject it they ask for to many */
 4016         denied:
 4017                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4018                 } else {
 4019                         /* Ok, we can do that :-) */
 4020                         struct sctp_stream_in *oldstrm;
 4021 
 4022                         /* save off the old */
 4023                         oldstrm = stcb->asoc.strmin;
 4024                         SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
 4025                             (num_stream * sizeof(struct sctp_stream_in)),
 4026                             SCTP_M_STRMI);
 4027                         if (stcb->asoc.strmin == NULL) {
 4028                                 stcb->asoc.strmin = oldstrm;
 4029                                 goto denied;
 4030                         }
 4031                         /* copy off the old data */
 4032                         for (i = 0; i < stcb->asoc.streamincnt; i++) {
 4033                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
 4034                                 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
 4035                                 stcb->asoc.strmin[i].sid = i;
 4036                                 stcb->asoc.strmin[i].last_mid_delivered = oldstrm[i].last_mid_delivered;
 4037                                 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
 4038                                 stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started;
 4039                                 /* now anything on those queues? */
 4040                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) {
 4041                                         TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm);
 4042                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm);
 4043                                 }
 4044                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) {
 4045                                         TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm);
 4046                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm);
 4047                                 }
 4048                         }
 4049                         /* Init the new streams */
 4050                         for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
 4051                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
 4052                                 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
 4053                                 stcb->asoc.strmin[i].sid = i;
 4054                                 stcb->asoc.strmin[i].last_mid_delivered = 0xffffffff;
 4055                                 stcb->asoc.strmin[i].pd_api_started = 0;
 4056                                 stcb->asoc.strmin[i].delivery_started = 0;
 4057                         }
 4058                         SCTP_FREE(oldstrm, SCTP_M_STRMI);
 4059                         /* update the size */
 4060                         stcb->asoc.streamincnt = num_stream;
 4061                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 4062                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
 4063                 }
 4064                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 4065                 asoc->str_reset_seq_in++;
 4066         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 4067                 /*
 4068                  * one seq back, just echo back last action since my
 4069                  * response was lost.
 4070                  */
 4071                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 4072         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 4073                 /*
 4074                  * two seq back, just echo back last action since my
 4075                  * response was lost.
 4076                  */
 4077                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 4078         } else {
 4079                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 4080 
 4081         }
 4082 }
 4083 
 4084 static void
 4085 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
 4086     struct sctp_stream_reset_add_strm *str_add)
 4087 {
 4088         /*
 4089          * Peer is requesting to add more streams. If its within our
 4090          * max-streams we will allow it.
 4091          */
 4092         uint16_t num_stream;
 4093         uint32_t seq;
 4094         struct sctp_association *asoc = &stcb->asoc;
 4095 
 4096         /* Get the number. */
 4097         seq = ntohl(str_add->request_seq);
 4098         num_stream = ntohs(str_add->number_of_streams);
 4099         /* Now what would be the new total? */
 4100         if (asoc->str_reset_seq_in == seq) {
 4101                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 4102                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
 4103                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4104                 } else if (stcb->asoc.stream_reset_outstanding) {
 4105                         /* We must reject it we have something pending */
 4106                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
 4107                 } else {
 4108                         /* Ok, we can do that :-) */
 4109                         int mychk;
 4110 
 4111                         mychk = stcb->asoc.streamoutcnt;
 4112                         mychk += num_stream;
 4113                         if (mychk < 0x10000) {
 4114                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
 4115                                 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) {
 4116                                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4117                                 }
 4118                         } else {
 4119                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
 4120                         }
 4121                 }
 4122                 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
 4123                 asoc->str_reset_seq_in++;
 4124         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 4125                 /*
 4126                  * one seq back, just echo back last action since my
 4127                  * response was lost.
 4128                  */
 4129                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 4130         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 4131                 /*
 4132                  * two seq back, just echo back last action since my
 4133                  * response was lost.
 4134                  */
 4135                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 4136         } else {
 4137                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
 4138         }
 4139 }
 4140 
 4141 #ifdef __GNUC__
 4142 __attribute__((noinline))
 4143 #endif
 4144 static int
 4145 sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 4146     struct sctp_chunkhdr *ch_req)
 4147 {
 4148         uint16_t remaining_length, param_len, ptype;
 4149         struct sctp_paramhdr pstore;
 4150         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
 4151         uint32_t seq = 0;
 4152         int num_req = 0;
 4153         int trunc = 0;
 4154         struct sctp_tmit_chunk *chk;
 4155         struct sctp_chunkhdr *ch;
 4156         struct sctp_paramhdr *ph;
 4157         int ret_code = 0;
 4158         int num_param = 0;
 4159 
 4160         /* now it may be a reset or a reset-response */
 4161         remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
 4162 
 4163         /* setup for adding the response */
 4164         sctp_alloc_a_chunk(stcb, chk);
 4165         if (chk == NULL) {
 4166                 return (ret_code);
 4167         }
 4168         chk->copy_by_ref = 0;
 4169         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
 4170         chk->rec.chunk_id.can_take_data = 0;
 4171         chk->flags = 0;
 4172         chk->asoc = &stcb->asoc;
 4173         chk->no_fr_allowed = 0;
 4174         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
 4175         chk->book_size_scale = 0;
 4176         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
 4177         if (chk->data == NULL) {
 4178 strres_nochunk:
 4179                 if (chk->data) {
 4180                         sctp_m_freem(chk->data);
 4181                         chk->data = NULL;
 4182                 }
 4183                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 4184                 return (ret_code);
 4185         }
 4186         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
 4187 
 4188         /* setup chunk parameters */
 4189         chk->sent = SCTP_DATAGRAM_UNSENT;
 4190         chk->snd_count = 0;
 4191         chk->whoTo = NULL;
 4192 
 4193         ch = mtod(chk->data, struct sctp_chunkhdr *);
 4194         ch->chunk_type = SCTP_STREAM_RESET;
 4195         ch->chunk_flags = 0;
 4196         ch->chunk_length = htons(chk->send_size);
 4197         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
 4198         offset += sizeof(struct sctp_chunkhdr);
 4199         while (remaining_length >= sizeof(struct sctp_paramhdr)) {
 4200                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *)&pstore);
 4201                 if (ph == NULL) {
 4202                         /* TSNH */
 4203                         break;
 4204                 }
 4205                 param_len = ntohs(ph->param_length);
 4206                 if ((param_len > remaining_length) ||
 4207                     (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
 4208                         /* bad parameter length */
 4209                         break;
 4210                 }
 4211                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
 4212                     (uint8_t *)&cstore);
 4213                 if (ph == NULL) {
 4214                         /* TSNH */
 4215                         break;
 4216                 }
 4217                 ptype = ntohs(ph->param_type);
 4218                 num_param++;
 4219                 if (param_len > sizeof(cstore)) {
 4220                         trunc = 1;
 4221                 } else {
 4222                         trunc = 0;
 4223                 }
 4224                 if (num_param > SCTP_MAX_RESET_PARAMS) {
 4225                         /* hit the max of parameters already sorry.. */
 4226                         break;
 4227                 }
 4228                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
 4229                         struct sctp_stream_reset_out_request *req_out;
 4230 
 4231                         if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
 4232                                 break;
 4233                         }
 4234                         req_out = (struct sctp_stream_reset_out_request *)ph;
 4235                         num_req++;
 4236                         if (stcb->asoc.stream_reset_outstanding) {
 4237                                 seq = ntohl(req_out->response_seq);
 4238                                 if (seq == stcb->asoc.str_reset_seq_out) {
 4239                                         /* implicit ack */
 4240                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
 4241                                 }
 4242                         }
 4243                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
 4244                 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
 4245                         struct sctp_stream_reset_add_strm *str_add;
 4246 
 4247                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
 4248                                 break;
 4249                         }
 4250                         str_add = (struct sctp_stream_reset_add_strm *)ph;
 4251                         num_req++;
 4252                         sctp_handle_str_reset_add_strm(stcb, chk, str_add);
 4253                 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
 4254                         struct sctp_stream_reset_add_strm *str_add;
 4255 
 4256                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
 4257                                 break;
 4258                         }
 4259                         str_add = (struct sctp_stream_reset_add_strm *)ph;
 4260                         num_req++;
 4261                         sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
 4262                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
 4263                         struct sctp_stream_reset_in_request *req_in;
 4264 
 4265                         num_req++;
 4266                         req_in = (struct sctp_stream_reset_in_request *)ph;
 4267                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
 4268                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
 4269                         struct sctp_stream_reset_tsn_request *req_tsn;
 4270 
 4271                         num_req++;
 4272                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
 4273                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
 4274                                 ret_code = 1;
 4275                                 goto strres_nochunk;
 4276                         }
 4277                         /* no more */
 4278                         break;
 4279                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
 4280                         struct sctp_stream_reset_response *resp;
 4281                         uint32_t result;
 4282 
 4283                         if (param_len < sizeof(struct sctp_stream_reset_response)) {
 4284                                 break;
 4285                         }
 4286                         resp = (struct sctp_stream_reset_response *)ph;
 4287                         seq = ntohl(resp->response_seq);
 4288                         result = ntohl(resp->result);
 4289                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
 4290                                 ret_code = 1;
 4291                                 goto strres_nochunk;
 4292                         }
 4293                 } else {
 4294                         break;
 4295                 }
 4296                 offset += SCTP_SIZE32(param_len);
 4297                 if (remaining_length >= SCTP_SIZE32(param_len)) {
 4298                         remaining_length -= SCTP_SIZE32(param_len);
 4299                 } else {
 4300                         remaining_length = 0;
 4301                 }
 4302         }
 4303         if (num_req == 0) {
 4304                 /* we have no response free the stuff */
 4305                 goto strres_nochunk;
 4306         }
 4307         /* ok we have a chunk to link in */
 4308         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
 4309             chk,
 4310             sctp_next);
 4311         stcb->asoc.ctrl_queue_cnt++;
 4312         return (ret_code);
 4313 }
 4314 
 4315 /*
 4316  * Handle a router or endpoints report of a packet loss, there are two ways
 4317  * to handle this, either we get the whole packet and must disect it
 4318  * ourselves (possibly with truncation and or corruption) or it is a summary
 4319  * from a middle box that did the disectting for us.
 4320  */
 4321 static void
 4322 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
 4323     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
 4324 {
 4325         uint32_t bottle_bw, on_queue;
 4326         uint16_t trunc_len;
 4327         unsigned int chlen;
 4328         unsigned int at;
 4329         struct sctp_chunk_desc desc;
 4330         struct sctp_chunkhdr *ch;
 4331 
 4332         chlen = ntohs(cp->ch.chunk_length);
 4333         chlen -= sizeof(struct sctp_pktdrop_chunk);
 4334         /* XXX possible chlen underflow */
 4335         if (chlen == 0) {
 4336                 ch = NULL;
 4337                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
 4338                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
 4339         } else {
 4340                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
 4341                 chlen -= sizeof(struct sctphdr);
 4342                 /* XXX possible chlen underflow */
 4343                 memset(&desc, 0, sizeof(desc));
 4344         }
 4345         trunc_len = (uint16_t)ntohs(cp->trunc_len);
 4346         if (trunc_len > limit) {
 4347                 trunc_len = limit;
 4348         }
 4349         /* now the chunks themselves */
 4350         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
 4351                 desc.chunk_type = ch->chunk_type;
 4352                 /* get amount we need to move */
 4353                 at = ntohs(ch->chunk_length);
 4354                 if (at < sizeof(struct sctp_chunkhdr)) {
 4355                         /* corrupt chunk, maybe at the end? */
 4356                         SCTP_STAT_INCR(sctps_pdrpcrupt);
 4357                         break;
 4358                 }
 4359                 if (trunc_len == 0) {
 4360                         /* we are supposed to have all of it */
 4361                         if (at > chlen) {
 4362                                 /* corrupt skip it */
 4363                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
 4364                                 break;
 4365                         }
 4366                 } else {
 4367                         /* is there enough of it left ? */
 4368                         if (desc.chunk_type == SCTP_DATA) {
 4369                                 if (chlen < (sizeof(struct sctp_data_chunk) +
 4370                                     sizeof(desc.data_bytes))) {
 4371                                         break;
 4372                                 }
 4373                         } else {
 4374                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
 4375                                         break;
 4376                                 }
 4377                         }
 4378                 }
 4379                 if (desc.chunk_type == SCTP_DATA) {
 4380                         /* can we get out the tsn? */
 4381                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
 4382                                 SCTP_STAT_INCR(sctps_pdrpmbda);
 4383 
 4384                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
 4385                                 /* yep */
 4386                                 struct sctp_data_chunk *dcp;
 4387                                 uint8_t *ddp;
 4388                                 unsigned int iii;
 4389 
 4390                                 dcp = (struct sctp_data_chunk *)ch;
 4391                                 ddp = (uint8_t *)(dcp + 1);
 4392                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
 4393                                         desc.data_bytes[iii] = ddp[iii];
 4394                                 }
 4395                                 desc.tsn_ifany = dcp->dp.tsn;
 4396                         } else {
 4397                                 /* nope we are done. */
 4398                                 SCTP_STAT_INCR(sctps_pdrpnedat);
 4399                                 break;
 4400                         }
 4401                 } else {
 4402                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
 4403                                 SCTP_STAT_INCR(sctps_pdrpmbct);
 4404                 }
 4405 
 4406                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
 4407                         SCTP_STAT_INCR(sctps_pdrppdbrk);
 4408                         break;
 4409                 }
 4410                 if (SCTP_SIZE32(at) > chlen) {
 4411                         break;
 4412                 }
 4413                 chlen -= SCTP_SIZE32(at);
 4414                 if (chlen < sizeof(struct sctp_chunkhdr)) {
 4415                         /* done, none left */
 4416                         break;
 4417                 }
 4418                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
 4419         }
 4420         /* Now update any rwnd --- possibly */
 4421         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
 4422                 /* From a peer, we get a rwnd report */
 4423                 uint32_t a_rwnd;
 4424 
 4425                 SCTP_STAT_INCR(sctps_pdrpfehos);
 4426 
 4427                 bottle_bw = ntohl(cp->bottle_bw);
 4428                 on_queue = ntohl(cp->current_onq);
 4429                 if (bottle_bw && on_queue) {
 4430                         /* a rwnd report is in here */
 4431                         if (bottle_bw > on_queue)
 4432                                 a_rwnd = bottle_bw - on_queue;
 4433                         else
 4434                                 a_rwnd = 0;
 4435 
 4436                         if (a_rwnd == 0)
 4437                                 stcb->asoc.peers_rwnd = 0;
 4438                         else {
 4439                                 if (a_rwnd > stcb->asoc.total_flight) {
 4440                                         stcb->asoc.peers_rwnd =
 4441                                             a_rwnd - stcb->asoc.total_flight;
 4442                                 } else {
 4443                                         stcb->asoc.peers_rwnd = 0;
 4444                                 }
 4445                                 if (stcb->asoc.peers_rwnd <
 4446                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
 4447                                         /* SWS sender side engages */
 4448                                         stcb->asoc.peers_rwnd = 0;
 4449                                 }
 4450                         }
 4451                 }
 4452         } else {
 4453                 SCTP_STAT_INCR(sctps_pdrpfmbox);
 4454         }
 4455 
 4456         /* now middle boxes in sat networks get a cwnd bump */
 4457         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
 4458             (stcb->asoc.sat_t3_loss_recovery == 0) &&
 4459             (stcb->asoc.sat_network)) {
 4460                 /*
 4461                  * This is debatable but for sat networks it makes sense
 4462                  * Note if a T3 timer has went off, we will prohibit any
 4463                  * changes to cwnd until we exit the t3 loss recovery.
 4464                  */
 4465                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
 4466                     net, cp, &bottle_bw, &on_queue);
 4467         }
 4468 }
 4469 
 4470 /*
 4471  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
 4472  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
 4473  * offset: offset into the mbuf chain to first chunkhdr - length: is the
 4474  * length of the complete packet outputs: - length: modified to remaining
 4475  * length after control processing - netp: modified to new sctp_nets after
 4476  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
 4477  * bad packet,...) otherwise return the tcb for this packet
 4478  */
 4479 #ifdef __GNUC__
 4480 __attribute__((noinline))
 4481 #endif
 4482 static struct sctp_tcb *
 4483 sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
 4484     struct sockaddr *src, struct sockaddr *dst,
 4485     struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
 4486     struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
 4487     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
 4488     uint32_t vrf_id, uint16_t port)
 4489 {
 4490         struct sctp_association *asoc;
 4491         struct mbuf *op_err;
 4492         char msg[SCTP_DIAG_INFO_LEN];
 4493         uint32_t vtag_in;
 4494         int num_chunks = 0;     /* number of control chunks processed */
 4495         uint32_t chk_length;
 4496         int ret;
 4497         int abort_no_unlock = 0;
 4498         int ecne_seen = 0;
 4499 
 4500         /*
 4501          * How big should this be, and should it be alloc'd? Lets try the
 4502          * d-mtu-ceiling for now (2k) and that should hopefully work ...
 4503          * until we get into jumbo grams and such..
 4504          */
 4505         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
 4506         struct sctp_tcb *locked_tcb = stcb;
 4507         int got_auth = 0;
 4508         uint32_t auth_offset = 0, auth_len = 0;
 4509         int auth_skipped = 0;
 4510         int asconf_cnt = 0;
 4511 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4512         struct socket *so;
 4513 #endif
 4514 
 4515         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
 4516             iphlen, *offset, length, (void *)stcb);
 4517 
 4518         /* validate chunk header length... */
 4519         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
 4520                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
 4521                     ntohs(ch->chunk_length));
 4522                 if (locked_tcb) {
 4523                         SCTP_TCB_UNLOCK(locked_tcb);
 4524                 }
 4525                 return (NULL);
 4526         }
 4527         /*
 4528          * validate the verification tag
 4529          */
 4530         vtag_in = ntohl(sh->v_tag);
 4531 
 4532         if (locked_tcb) {
 4533                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
 4534         }
 4535         if (ch->chunk_type == SCTP_INITIATION) {
 4536                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
 4537                     ntohs(ch->chunk_length), vtag_in);
 4538                 if (vtag_in != 0) {
 4539                         /* protocol error- silently discard... */
 4540                         SCTP_STAT_INCR(sctps_badvtag);
 4541                         if (locked_tcb) {
 4542                                 SCTP_TCB_UNLOCK(locked_tcb);
 4543                         }
 4544                         return (NULL);
 4545                 }
 4546         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
 4547                 /*
 4548                  * If there is no stcb, skip the AUTH chunk and process
 4549                  * later after a stcb is found (to validate the lookup was
 4550                  * valid.
 4551                  */
 4552                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
 4553                     (stcb == NULL) &&
 4554                     (inp->auth_supported == 1)) {
 4555                         /* save this chunk for later processing */
 4556                         auth_skipped = 1;
 4557                         auth_offset = *offset;
 4558                         auth_len = ntohs(ch->chunk_length);
 4559 
 4560                         /* (temporarily) move past this chunk */
 4561                         *offset += SCTP_SIZE32(auth_len);
 4562                         if (*offset >= length) {
 4563                                 /* no more data left in the mbuf chain */
 4564                                 *offset = length;
 4565                                 if (locked_tcb) {
 4566                                         SCTP_TCB_UNLOCK(locked_tcb);
 4567                                 }
 4568                                 return (NULL);
 4569                         }
 4570                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4571                             sizeof(struct sctp_chunkhdr), chunk_buf);
 4572                 }
 4573                 if (ch == NULL) {
 4574                         /* Help */
 4575                         *offset = length;
 4576                         if (locked_tcb) {
 4577                                 SCTP_TCB_UNLOCK(locked_tcb);
 4578                         }
 4579                         return (NULL);
 4580                 }
 4581                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
 4582                         goto process_control_chunks;
 4583                 }
 4584                 /*
 4585                  * first check if it's an ASCONF with an unknown src addr we
 4586                  * need to look inside to find the association
 4587                  */
 4588                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
 4589                         struct sctp_chunkhdr *asconf_ch = ch;
 4590                         uint32_t asconf_offset = 0, asconf_len = 0;
 4591 
 4592                         /* inp's refcount may be reduced */
 4593                         SCTP_INP_INCR_REF(inp);
 4594 
 4595                         asconf_offset = *offset;
 4596                         do {
 4597                                 asconf_len = ntohs(asconf_ch->chunk_length);
 4598                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
 4599                                         break;
 4600                                 stcb = sctp_findassociation_ep_asconf(m,
 4601                                     *offset,
 4602                                     dst,
 4603                                     sh, &inp, netp, vrf_id);
 4604                                 if (stcb != NULL)
 4605                                         break;
 4606                                 asconf_offset += SCTP_SIZE32(asconf_len);
 4607                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
 4608                                     sizeof(struct sctp_chunkhdr), chunk_buf);
 4609                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
 4610                         if (stcb == NULL) {
 4611                                 /*
 4612                                  * reduce inp's refcount if not reduced in
 4613                                  * sctp_findassociation_ep_asconf().
 4614                                  */
 4615                                 SCTP_INP_DECR_REF(inp);
 4616                         } else {
 4617                                 locked_tcb = stcb;
 4618                         }
 4619 
 4620                         /* now go back and verify any auth chunk to be sure */
 4621                         if (auth_skipped && (stcb != NULL)) {
 4622                                 struct sctp_auth_chunk *auth;
 4623 
 4624                                 auth = (struct sctp_auth_chunk *)
 4625                                     sctp_m_getptr(m, auth_offset,
 4626                                     auth_len, chunk_buf);
 4627                                 got_auth = 1;
 4628                                 auth_skipped = 0;
 4629                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
 4630                                     auth_offset)) {
 4631                                         /* auth HMAC failed so dump it */
 4632                                         *offset = length;
 4633                                         if (locked_tcb) {
 4634                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4635                                         }
 4636                                         return (NULL);
 4637                                 } else {
 4638                                         /* remaining chunks are HMAC checked */
 4639                                         stcb->asoc.authenticated = 1;
 4640                                 }
 4641                         }
 4642                 }
 4643                 if (stcb == NULL) {
 4644                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
 4645                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 4646                             msg);
 4647                         /* no association, so it's out of the blue... */
 4648                         sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
 4649                             mflowtype, mflowid, inp->fibnum,
 4650                             vrf_id, port);
 4651                         *offset = length;
 4652                         if (locked_tcb) {
 4653                                 SCTP_TCB_UNLOCK(locked_tcb);
 4654                         }
 4655                         return (NULL);
 4656                 }
 4657                 asoc = &stcb->asoc;
 4658                 /* ABORT and SHUTDOWN can use either v_tag... */
 4659                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
 4660                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
 4661                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
 4662                         /* Take the T-bit always into account. */
 4663                         if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
 4664                             (vtag_in == asoc->my_vtag)) ||
 4665                             (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
 4666                             (vtag_in == asoc->peer_vtag))) {
 4667                                 /* this is valid */
 4668                         } else {
 4669                                 /* drop this packet... */
 4670                                 SCTP_STAT_INCR(sctps_badvtag);
 4671                                 if (locked_tcb) {
 4672                                         SCTP_TCB_UNLOCK(locked_tcb);
 4673                                 }
 4674                                 return (NULL);
 4675                         }
 4676                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
 4677                         if (vtag_in != asoc->my_vtag) {
 4678                                 /*
 4679                                  * this could be a stale SHUTDOWN-ACK or the
 4680                                  * peer never got the SHUTDOWN-COMPLETE and
 4681                                  * is still hung; we have started a new asoc
 4682                                  * but it won't complete until the shutdown
 4683                                  * is completed
 4684                                  */
 4685                                 if (locked_tcb) {
 4686                                         SCTP_TCB_UNLOCK(locked_tcb);
 4687                                 }
 4688                                 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
 4689                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 4690                                     msg);
 4691                                 sctp_handle_ootb(m, iphlen, *offset, src, dst,
 4692                                     sh, inp, op_err,
 4693                                     mflowtype, mflowid, fibnum,
 4694                                     vrf_id, port);
 4695                                 return (NULL);
 4696                         }
 4697                 } else {
 4698                         /* for all other chunks, vtag must match */
 4699                         if (vtag_in != asoc->my_vtag) {
 4700                                 /* invalid vtag... */
 4701                                 SCTPDBG(SCTP_DEBUG_INPUT3,
 4702                                     "invalid vtag: %xh, expect %xh\n",
 4703                                     vtag_in, asoc->my_vtag);
 4704                                 SCTP_STAT_INCR(sctps_badvtag);
 4705                                 if (locked_tcb) {
 4706                                         SCTP_TCB_UNLOCK(locked_tcb);
 4707                                 }
 4708                                 *offset = length;
 4709                                 return (NULL);
 4710                         }
 4711                 }
 4712         }                       /* end if !SCTP_COOKIE_ECHO */
 4713         /*
 4714          * process all control chunks...
 4715          */
 4716         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
 4717             (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
 4718             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
 4719             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 4720                 /* implied cookie-ack.. we must have lost the ack */
 4721                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 4722                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 4723                             stcb->asoc.overall_error_count,
 4724                             0,
 4725                             SCTP_FROM_SCTP_INPUT,
 4726                             __LINE__);
 4727                 }
 4728                 stcb->asoc.overall_error_count = 0;
 4729                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
 4730                     *netp);
 4731         }
 4732 process_control_chunks:
 4733         while (IS_SCTP_CONTROL(ch)) {
 4734                 /* validate chunk length */
 4735                 chk_length = ntohs(ch->chunk_length);
 4736                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
 4737                     ch->chunk_type, chk_length);
 4738                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
 4739                 if (chk_length < sizeof(*ch) ||
 4740                     (*offset + (int)chk_length) > length) {
 4741                         *offset = length;
 4742                         if (locked_tcb) {
 4743                                 SCTP_TCB_UNLOCK(locked_tcb);
 4744                         }
 4745                         return (NULL);
 4746                 }
 4747                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
 4748                 /*
 4749                  * INIT-ACK only gets the init ack "header" portion only
 4750                  * because we don't have to process the peer's COOKIE. All
 4751                  * others get a complete chunk.
 4752                  */
 4753                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
 4754                     (ch->chunk_type == SCTP_INITIATION)) {
 4755                         /* get an init-ack chunk */
 4756                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4757                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
 4758                         if (ch == NULL) {
 4759                                 *offset = length;
 4760                                 if (locked_tcb) {
 4761                                         SCTP_TCB_UNLOCK(locked_tcb);
 4762                                 }
 4763                                 return (NULL);
 4764                         }
 4765                 } else {
 4766                         /* For cookies and all other chunks. */
 4767                         if (chk_length > sizeof(chunk_buf)) {
 4768                                 /*
 4769                                  * use just the size of the chunk buffer so
 4770                                  * the front part of our chunks fit in
 4771                                  * contiguous space up to the chunk buffer
 4772                                  * size (508 bytes). For chunks that need to
 4773                                  * get more than that they must use the
 4774                                  * sctp_m_getptr() function or other means
 4775                                  * (e.g. know how to parse mbuf chains).
 4776                                  * Cookies do this already.
 4777                                  */
 4778                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4779                                     (sizeof(chunk_buf) - 4),
 4780                                     chunk_buf);
 4781                                 if (ch == NULL) {
 4782                                         *offset = length;
 4783                                         if (locked_tcb) {
 4784                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4785                                         }
 4786                                         return (NULL);
 4787                                 }
 4788                         } else {
 4789                                 /* We can fit it all */
 4790                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4791                                     chk_length, chunk_buf);
 4792                                 if (ch == NULL) {
 4793                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
 4794                                         *offset = length;
 4795                                         if (locked_tcb) {
 4796                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4797                                         }
 4798                                         return (NULL);
 4799                                 }
 4800                         }
 4801                 }
 4802                 num_chunks++;
 4803                 /* Save off the last place we got a control from */
 4804                 if (stcb != NULL) {
 4805                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
 4806                                 /*
 4807                                  * allow last_control to be NULL if
 4808                                  * ASCONF... ASCONF processing will find the
 4809                                  * right net later
 4810                                  */
 4811                                 if ((netp != NULL) && (*netp != NULL))
 4812                                         stcb->asoc.last_control_chunk_from = *netp;
 4813                         }
 4814                 }
 4815 #ifdef SCTP_AUDITING_ENABLED
 4816                 sctp_audit_log(0xB0, ch->chunk_type);
 4817 #endif
 4818 
 4819                 /* check to see if this chunk required auth, but isn't */
 4820                 if ((stcb != NULL) &&
 4821                     (stcb->asoc.auth_supported == 1) &&
 4822                     sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
 4823                     !stcb->asoc.authenticated) {
 4824                         /* "silently" ignore */
 4825                         SCTP_STAT_INCR(sctps_recvauthmissing);
 4826                         goto next_chunk;
 4827                 }
 4828                 switch (ch->chunk_type) {
 4829                 case SCTP_INITIATION:
 4830                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
 4831                         /* The INIT chunk must be the only chunk. */
 4832                         if ((num_chunks > 1) ||
 4833                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 4834                                 /* RFC 4960 requires that no ABORT is sent */
 4835                                 *offset = length;
 4836                                 if (locked_tcb) {
 4837                                         SCTP_TCB_UNLOCK(locked_tcb);
 4838                                 }
 4839                                 return (NULL);
 4840                         }
 4841                         /* Honor our resource limit. */
 4842                         if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
 4843                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 4844                                 sctp_abort_association(inp, stcb, m, iphlen,
 4845                                     src, dst, sh, op_err,
 4846                                     mflowtype, mflowid,
 4847                                     vrf_id, port);
 4848                                 *offset = length;
 4849                                 return (NULL);
 4850                         }
 4851                         sctp_handle_init(m, iphlen, *offset, src, dst, sh,
 4852                             (struct sctp_init_chunk *)ch, inp,
 4853                             stcb, *netp, &abort_no_unlock,
 4854                             mflowtype, mflowid,
 4855                             vrf_id, port);
 4856                         *offset = length;
 4857                         if ((!abort_no_unlock) && (locked_tcb)) {
 4858                                 SCTP_TCB_UNLOCK(locked_tcb);
 4859                         }
 4860                         return (NULL);
 4861                         break;
 4862                 case SCTP_PAD_CHUNK:
 4863                         break;
 4864                 case SCTP_INITIATION_ACK:
 4865                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
 4866                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 4867                                 /* We are not interested anymore */
 4868                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 4869                                         ;
 4870                                 } else {
 4871                                         if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
 4872                                                 /* Very unlikely */
 4873                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4874                                         }
 4875                                         *offset = length;
 4876                                         if (stcb) {
 4877 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4878                                                 so = SCTP_INP_SO(inp);
 4879                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 4880                                                 SCTP_TCB_UNLOCK(stcb);
 4881                                                 SCTP_SOCKET_LOCK(so, 1);
 4882                                                 SCTP_TCB_LOCK(stcb);
 4883                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 4884 #endif
 4885                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 4886                                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
 4887 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4888                                                 SCTP_SOCKET_UNLOCK(so, 1);
 4889 #endif
 4890                                         }
 4891                                         return (NULL);
 4892                                 }
 4893                         }
 4894                         /* The INIT-ACK chunk must be the only chunk. */
 4895                         if ((num_chunks > 1) ||
 4896                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 4897                                 *offset = length;
 4898                                 if (locked_tcb) {
 4899                                         SCTP_TCB_UNLOCK(locked_tcb);
 4900                                 }
 4901                                 return (NULL);
 4902                         }
 4903                         if ((netp) && (*netp)) {
 4904                                 ret = sctp_handle_init_ack(m, iphlen, *offset,
 4905                                     src, dst, sh,
 4906                                     (struct sctp_init_ack_chunk *)ch,
 4907                                     stcb, *netp,
 4908                                     &abort_no_unlock,
 4909                                     mflowtype, mflowid,
 4910                                     vrf_id);
 4911                         } else {
 4912                                 ret = -1;
 4913                         }
 4914                         *offset = length;
 4915                         if (abort_no_unlock) {
 4916                                 return (NULL);
 4917                         }
 4918                         /*
 4919                          * Special case, I must call the output routine to
 4920                          * get the cookie echoed
 4921                          */
 4922                         if ((stcb != NULL) && (ret == 0)) {
 4923                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 4924                         }
 4925                         if (locked_tcb) {
 4926                                 SCTP_TCB_UNLOCK(locked_tcb);
 4927                         }
 4928                         return (NULL);
 4929                         break;
 4930                 case SCTP_SELECTIVE_ACK:
 4931                         {
 4932                                 struct sctp_sack_chunk *sack;
 4933                                 int abort_now = 0;
 4934                                 uint32_t a_rwnd, cum_ack;
 4935                                 uint16_t num_seg, num_dup;
 4936                                 uint8_t flags;
 4937                                 int offset_seg, offset_dup;
 4938 
 4939                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
 4940                                 SCTP_STAT_INCR(sctps_recvsacks);
 4941                                 if (stcb == NULL) {
 4942                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
 4943                                         break;
 4944                                 }
 4945                                 if (chk_length < sizeof(struct sctp_sack_chunk)) {
 4946                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
 4947                                         break;
 4948                                 }
 4949                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 4950                                         /*-
 4951                                          * If we have sent a shutdown-ack, we will pay no
 4952                                          * attention to a sack sent in to us since
 4953                                          * we don't care anymore.
 4954                                          */
 4955                                         break;
 4956                                 }
 4957                                 sack = (struct sctp_sack_chunk *)ch;
 4958                                 flags = ch->chunk_flags;
 4959                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
 4960                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
 4961                                 num_dup = ntohs(sack->sack.num_dup_tsns);
 4962                                 a_rwnd = (uint32_t)ntohl(sack->sack.a_rwnd);
 4963                                 if (sizeof(struct sctp_sack_chunk) +
 4964                                     num_seg * sizeof(struct sctp_gap_ack_block) +
 4965                                     num_dup * sizeof(uint32_t) != chk_length) {
 4966                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
 4967                                         break;
 4968                                 }
 4969                                 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
 4970                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
 4971                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
 4972                                     cum_ack, num_seg, a_rwnd);
 4973                                 stcb->asoc.seen_a_sack_this_pkt = 1;
 4974                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
 4975                                     (num_seg == 0) &&
 4976                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
 4977                                     (stcb->asoc.saw_sack_with_frags == 0) &&
 4978                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
 4979                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
 4980                                     ) {
 4981                                         /*
 4982                                          * We have a SIMPLE sack having no
 4983                                          * prior segments and data on sent
 4984                                          * queue to be acked.. Use the
 4985                                          * faster path sack processing. We
 4986                                          * also allow window update sacks
 4987                                          * with no missing segments to go
 4988                                          * this way too.
 4989                                          */
 4990                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
 4991                                 } else {
 4992                                         if (netp && *netp)
 4993                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
 4994                                                     num_seg, 0, num_dup, &abort_now, flags,
 4995                                                     cum_ack, a_rwnd, ecne_seen);
 4996                                 }
 4997                                 if (abort_now) {
 4998                                         /* ABORT signal from sack processing */
 4999                                         *offset = length;
 5000                                         return (NULL);
 5001                                 }
 5002                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
 5003                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
 5004                                     (stcb->asoc.stream_queue_cnt == 0)) {
 5005                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 5006                                 }
 5007                         }
 5008                         break;
 5009                         /*
 5010                          * EY - nr_sack:  If the received chunk is an
 5011                          * nr_sack chunk
 5012                          */
 5013                 case SCTP_NR_SELECTIVE_ACK:
 5014                         {
 5015                                 struct sctp_nr_sack_chunk *nr_sack;
 5016                                 int abort_now = 0;
 5017                                 uint32_t a_rwnd, cum_ack;
 5018                                 uint16_t num_seg, num_nr_seg, num_dup;
 5019                                 uint8_t flags;
 5020                                 int offset_seg, offset_dup;
 5021 
 5022                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
 5023                                 SCTP_STAT_INCR(sctps_recvsacks);
 5024                                 if (stcb == NULL) {
 5025                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
 5026                                         break;
 5027                                 }
 5028                                 if (stcb->asoc.nrsack_supported == 0) {
 5029                                         goto unknown_chunk;
 5030                                 }
 5031                                 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
 5032                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
 5033                                         break;
 5034                                 }
 5035                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 5036                                         /*-
 5037                                          * If we have sent a shutdown-ack, we will pay no
 5038                                          * attention to a sack sent in to us since
 5039                                          * we don't care anymore.
 5040                                          */
 5041                                         break;
 5042                                 }
 5043                                 nr_sack = (struct sctp_nr_sack_chunk *)ch;
 5044                                 flags = ch->chunk_flags;
 5045                                 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
 5046                                 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
 5047                                 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
 5048                                 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
 5049                                 a_rwnd = (uint32_t)ntohl(nr_sack->nr_sack.a_rwnd);
 5050                                 if (sizeof(struct sctp_nr_sack_chunk) +
 5051                                     (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
 5052                                     num_dup * sizeof(uint32_t) != chk_length) {
 5053                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
 5054                                         break;
 5055                                 }
 5056                                 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
 5057                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
 5058                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
 5059                                     cum_ack, num_seg, a_rwnd);
 5060                                 stcb->asoc.seen_a_sack_this_pkt = 1;
 5061                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
 5062                                     (num_seg == 0) && (num_nr_seg == 0) &&
 5063                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
 5064                                     (stcb->asoc.saw_sack_with_frags == 0) &&
 5065                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
 5066                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
 5067                                         /*
 5068                                          * We have a SIMPLE sack having no
 5069                                          * prior segments and data on sent
 5070                                          * queue to be acked. Use the faster
 5071                                          * path sack processing. We also
 5072                                          * allow window update sacks with no
 5073                                          * missing segments to go this way
 5074                                          * too.
 5075                                          */
 5076                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
 5077                                             &abort_now, ecne_seen);
 5078                                 } else {
 5079                                         if (netp && *netp)
 5080                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
 5081                                                     num_seg, num_nr_seg, num_dup, &abort_now, flags,
 5082                                                     cum_ack, a_rwnd, ecne_seen);
 5083                                 }
 5084                                 if (abort_now) {
 5085                                         /* ABORT signal from sack processing */
 5086                                         *offset = length;
 5087                                         return (NULL);
 5088                                 }
 5089                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
 5090                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
 5091                                     (stcb->asoc.stream_queue_cnt == 0)) {
 5092                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 5093                                 }
 5094                         }
 5095                         break;
 5096 
 5097                 case SCTP_HEARTBEAT_REQUEST:
 5098                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
 5099                         if ((stcb) && netp && *netp) {
 5100                                 SCTP_STAT_INCR(sctps_recvheartbeat);
 5101                                 sctp_send_heartbeat_ack(stcb, m, *offset,
 5102                                     chk_length, *netp);
 5103 
 5104                                 /* He's alive so give him credit */
 5105                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5106                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5107                                             stcb->asoc.overall_error_count,
 5108                                             0,
 5109                                             SCTP_FROM_SCTP_INPUT,
 5110                                             __LINE__);
 5111                                 }
 5112                                 stcb->asoc.overall_error_count = 0;
 5113                         }
 5114                         break;
 5115                 case SCTP_HEARTBEAT_ACK:
 5116                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
 5117                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
 5118                                 /* Its not ours */
 5119                                 *offset = length;
 5120                                 if (locked_tcb) {
 5121                                         SCTP_TCB_UNLOCK(locked_tcb);
 5122                                 }
 5123                                 return (NULL);
 5124                         }
 5125                         /* He's alive so give him credit */
 5126                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5127                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5128                                     stcb->asoc.overall_error_count,
 5129                                     0,
 5130                                     SCTP_FROM_SCTP_INPUT,
 5131                                     __LINE__);
 5132                         }
 5133                         stcb->asoc.overall_error_count = 0;
 5134                         SCTP_STAT_INCR(sctps_recvheartbeatack);
 5135                         if (netp && *netp)
 5136                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
 5137                                     stcb, *netp);
 5138                         break;
 5139                 case SCTP_ABORT_ASSOCIATION:
 5140                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
 5141                             (void *)stcb);
 5142                         if ((stcb) && netp && *netp)
 5143                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
 5144                                     stcb, *netp);
 5145                         *offset = length;
 5146                         return (NULL);
 5147                         break;
 5148                 case SCTP_SHUTDOWN:
 5149                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
 5150                             (void *)stcb);
 5151                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
 5152                                 *offset = length;
 5153                                 if (locked_tcb) {
 5154                                         SCTP_TCB_UNLOCK(locked_tcb);
 5155                                 }
 5156                                 return (NULL);
 5157                         }
 5158                         if (netp && *netp) {
 5159                                 int abort_flag = 0;
 5160 
 5161                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
 5162                                     stcb, *netp, &abort_flag);
 5163                                 if (abort_flag) {
 5164                                         *offset = length;
 5165                                         return (NULL);
 5166                                 }
 5167                         }
 5168                         break;
 5169                 case SCTP_SHUTDOWN_ACK:
 5170                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb);
 5171                         if ((stcb) && (netp) && (*netp))
 5172                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
 5173                         *offset = length;
 5174                         return (NULL);
 5175                         break;
 5176 
 5177                 case SCTP_OPERATION_ERROR:
 5178                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
 5179                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
 5180                                 *offset = length;
 5181                                 return (NULL);
 5182                         }
 5183                         break;
 5184                 case SCTP_COOKIE_ECHO:
 5185                         SCTPDBG(SCTP_DEBUG_INPUT3,
 5186                             "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb);
 5187                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 5188                                 ;
 5189                         } else {
 5190                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5191                                         /* We are not interested anymore */
 5192                         abend:
 5193                                         if (stcb) {
 5194                                                 SCTP_TCB_UNLOCK(stcb);
 5195                                         }
 5196                                         *offset = length;
 5197                                         return (NULL);
 5198                                 }
 5199                         }
 5200                         /*
 5201                          * First are we accepting? We do this again here
 5202                          * since it is possible that a previous endpoint WAS
 5203                          * listening responded to a INIT-ACK and then
 5204                          * closed. We opened and bound.. and are now no
 5205                          * longer listening.
 5206                          */
 5207 
 5208                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
 5209                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 5210                                     (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
 5211                                         op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
 5212                                         sctp_abort_association(inp, stcb, m, iphlen,
 5213                                             src, dst, sh, op_err,
 5214                                             mflowtype, mflowid,
 5215                                             vrf_id, port);
 5216                                 }
 5217                                 *offset = length;
 5218                                 return (NULL);
 5219                         } else {
 5220                                 struct mbuf *ret_buf;
 5221                                 struct sctp_inpcb *linp;
 5222 
 5223                                 if (stcb) {
 5224                                         linp = NULL;
 5225                                 } else {
 5226                                         linp = inp;
 5227                                 }
 5228 
 5229                                 if (linp) {
 5230                                         SCTP_ASOC_CREATE_LOCK(linp);
 5231                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 5232                                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 5233                                                 SCTP_ASOC_CREATE_UNLOCK(linp);
 5234                                                 goto abend;
 5235                                         }
 5236                                 }
 5237                                 if (netp) {
 5238                                         ret_buf =
 5239                                             sctp_handle_cookie_echo(m, iphlen,
 5240                                             *offset,
 5241                                             src, dst,
 5242                                             sh,
 5243                                             (struct sctp_cookie_echo_chunk *)ch,
 5244                                             &inp, &stcb, netp,
 5245                                             auth_skipped,
 5246                                             auth_offset,
 5247                                             auth_len,
 5248                                             &locked_tcb,
 5249                                             mflowtype,
 5250                                             mflowid,
 5251                                             vrf_id,
 5252                                             port);
 5253                                 } else {
 5254                                         ret_buf = NULL;
 5255                                 }
 5256                                 if (linp) {
 5257                                         SCTP_ASOC_CREATE_UNLOCK(linp);
 5258                                 }
 5259                                 if (ret_buf == NULL) {
 5260                                         if (locked_tcb) {
 5261                                                 SCTP_TCB_UNLOCK(locked_tcb);
 5262                                         }
 5263                                         SCTPDBG(SCTP_DEBUG_INPUT3,
 5264                                             "GAK, null buffer\n");
 5265                                         *offset = length;
 5266                                         return (NULL);
 5267                                 }
 5268                                 /* if AUTH skipped, see if it verified... */
 5269                                 if (auth_skipped) {
 5270                                         got_auth = 1;
 5271                                         auth_skipped = 0;
 5272                                 }
 5273                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 5274                                         /*
 5275                                          * Restart the timer if we have
 5276                                          * pending data
 5277                                          */
 5278                                         struct sctp_tmit_chunk *chk;
 5279 
 5280                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 5281                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
 5282                                 }
 5283                         }
 5284                         break;
 5285                 case SCTP_COOKIE_ACK:
 5286                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb);
 5287                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
 5288                                 if (locked_tcb) {
 5289                                         SCTP_TCB_UNLOCK(locked_tcb);
 5290                                 }
 5291                                 return (NULL);
 5292                         }
 5293                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5294                                 /* We are not interested anymore */
 5295                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 5296                                         ;
 5297                                 } else if (stcb) {
 5298 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5299                                         so = SCTP_INP_SO(inp);
 5300                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 5301                                         SCTP_TCB_UNLOCK(stcb);
 5302                                         SCTP_SOCKET_LOCK(so, 1);
 5303                                         SCTP_TCB_LOCK(stcb);
 5304                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5305 #endif
 5306                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 5307                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
 5308 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5309                                         SCTP_SOCKET_UNLOCK(so, 1);
 5310 #endif
 5311                                         *offset = length;
 5312                                         return (NULL);
 5313                                 }
 5314                         }
 5315                         /* He's alive so give him credit */
 5316                         if ((stcb) && netp && *netp) {
 5317                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5318                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5319                                             stcb->asoc.overall_error_count,
 5320                                             0,
 5321                                             SCTP_FROM_SCTP_INPUT,
 5322                                             __LINE__);
 5323                                 }
 5324                                 stcb->asoc.overall_error_count = 0;
 5325                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
 5326                         }
 5327                         break;
 5328                 case SCTP_ECN_ECHO:
 5329                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
 5330                         /* He's alive so give him credit */
 5331                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
 5332                                 /* Its not ours */
 5333                                 if (locked_tcb) {
 5334                                         SCTP_TCB_UNLOCK(locked_tcb);
 5335                                 }
 5336                                 *offset = length;
 5337                                 return (NULL);
 5338                         }
 5339                         if (stcb) {
 5340                                 if (stcb->asoc.ecn_supported == 0) {
 5341                                         goto unknown_chunk;
 5342                                 }
 5343                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5344                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5345                                             stcb->asoc.overall_error_count,
 5346                                             0,
 5347                                             SCTP_FROM_SCTP_INPUT,
 5348                                             __LINE__);
 5349                                 }
 5350                                 stcb->asoc.overall_error_count = 0;
 5351                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
 5352                                     stcb);
 5353                                 ecne_seen = 1;
 5354                         }
 5355                         break;
 5356                 case SCTP_ECN_CWR:
 5357                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
 5358                         /* He's alive so give him credit */
 5359                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
 5360                                 /* Its not ours */
 5361                                 if (locked_tcb) {
 5362                                         SCTP_TCB_UNLOCK(locked_tcb);
 5363                                 }
 5364                                 *offset = length;
 5365                                 return (NULL);
 5366                         }
 5367                         if (stcb) {
 5368                                 if (stcb->asoc.ecn_supported == 0) {
 5369                                         goto unknown_chunk;
 5370                                 }
 5371                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5372                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5373                                             stcb->asoc.overall_error_count,
 5374                                             0,
 5375                                             SCTP_FROM_SCTP_INPUT,
 5376                                             __LINE__);
 5377                                 }
 5378                                 stcb->asoc.overall_error_count = 0;
 5379                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
 5380                         }
 5381                         break;
 5382                 case SCTP_SHUTDOWN_COMPLETE:
 5383                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb);
 5384                         /* must be first and only chunk */
 5385                         if ((num_chunks > 1) ||
 5386                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 5387                                 *offset = length;
 5388                                 if (locked_tcb) {
 5389                                         SCTP_TCB_UNLOCK(locked_tcb);
 5390                                 }
 5391                                 return (NULL);
 5392                         }
 5393                         if ((stcb) && netp && *netp) {
 5394                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
 5395                                     stcb, *netp);
 5396                         }
 5397                         *offset = length;
 5398                         return (NULL);
 5399                         break;
 5400                 case SCTP_ASCONF:
 5401                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
 5402                         /* He's alive so give him credit */
 5403                         if (stcb) {
 5404                                 if (stcb->asoc.asconf_supported == 0) {
 5405                                         goto unknown_chunk;
 5406                                 }
 5407                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5408                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5409                                             stcb->asoc.overall_error_count,
 5410                                             0,
 5411                                             SCTP_FROM_SCTP_INPUT,
 5412                                             __LINE__);
 5413                                 }
 5414                                 stcb->asoc.overall_error_count = 0;
 5415                                 sctp_handle_asconf(m, *offset, src,
 5416                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
 5417                                 asconf_cnt++;
 5418                         }
 5419                         break;
 5420                 case SCTP_ASCONF_ACK:
 5421                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
 5422                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
 5423                                 /* Its not ours */
 5424                                 if (locked_tcb) {
 5425                                         SCTP_TCB_UNLOCK(locked_tcb);
 5426                                 }
 5427                                 *offset = length;
 5428                                 return (NULL);
 5429                         }
 5430                         if ((stcb) && netp && *netp) {
 5431                                 if (stcb->asoc.asconf_supported == 0) {
 5432                                         goto unknown_chunk;
 5433                                 }
 5434                                 /* He's alive so give him credit */
 5435                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5436                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5437                                             stcb->asoc.overall_error_count,
 5438                                             0,
 5439                                             SCTP_FROM_SCTP_INPUT,
 5440                                             __LINE__);
 5441                                 }
 5442                                 stcb->asoc.overall_error_count = 0;
 5443                                 sctp_handle_asconf_ack(m, *offset,
 5444                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
 5445                                 if (abort_no_unlock)
 5446                                         return (NULL);
 5447                         }
 5448                         break;
 5449                 case SCTP_FORWARD_CUM_TSN:
 5450                 case SCTP_IFORWARD_CUM_TSN:
 5451                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
 5452                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
 5453                                 /* Its not ours */
 5454                                 if (locked_tcb) {
 5455                                         SCTP_TCB_UNLOCK(locked_tcb);
 5456                                 }
 5457                                 *offset = length;
 5458                                 return (NULL);
 5459                         }
 5460                         /* He's alive so give him credit */
 5461                         if (stcb) {
 5462                                 int abort_flag = 0;
 5463 
 5464                                 if (stcb->asoc.prsctp_supported == 0) {
 5465                                         goto unknown_chunk;
 5466                                 }
 5467                                 stcb->asoc.overall_error_count = 0;
 5468                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5469                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5470                                             stcb->asoc.overall_error_count,
 5471                                             0,
 5472                                             SCTP_FROM_SCTP_INPUT,
 5473                                             __LINE__);
 5474                                 }
 5475                                 *fwd_tsn_seen = 1;
 5476                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5477                                         /* We are not interested anymore */
 5478 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5479                                         so = SCTP_INP_SO(inp);
 5480                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 5481                                         SCTP_TCB_UNLOCK(stcb);
 5482                                         SCTP_SOCKET_LOCK(so, 1);
 5483                                         SCTP_TCB_LOCK(stcb);
 5484                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5485 #endif
 5486                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 5487                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_31);
 5488 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5489                                         SCTP_SOCKET_UNLOCK(so, 1);
 5490 #endif
 5491                                         *offset = length;
 5492                                         return (NULL);
 5493                                 }
 5494                                 /*
 5495                                  * For sending a SACK this looks like DATA
 5496                                  * chunks.
 5497                                  */
 5498                                 stcb->asoc.last_data_chunk_from = stcb->asoc.last_control_chunk_from;
 5499                                 sctp_handle_forward_tsn(stcb,
 5500                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
 5501                                 if (abort_flag) {
 5502                                         *offset = length;
 5503                                         return (NULL);
 5504                                 } else {
 5505                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5506                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5507                                                     stcb->asoc.overall_error_count,
 5508                                                     0,
 5509                                                     SCTP_FROM_SCTP_INPUT,
 5510                                                     __LINE__);
 5511                                         }
 5512                                         stcb->asoc.overall_error_count = 0;
 5513                                 }
 5514 
 5515                         }
 5516                         break;
 5517                 case SCTP_STREAM_RESET:
 5518                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
 5519                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
 5520                                 /* Its not ours */
 5521                                 if (locked_tcb) {
 5522                                         SCTP_TCB_UNLOCK(locked_tcb);
 5523                                 }
 5524                                 *offset = length;
 5525                                 return (NULL);
 5526                         }
 5527                         if (stcb->asoc.reconfig_supported == 0) {
 5528                                 goto unknown_chunk;
 5529                         }
 5530                         if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
 5531                                 /* stop processing */
 5532                                 *offset = length;
 5533                                 return (NULL);
 5534                         }
 5535                         break;
 5536                 case SCTP_PACKET_DROPPED:
 5537                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
 5538                         /* re-get it all please */
 5539                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
 5540                                 /* Its not ours */
 5541                                 if (locked_tcb) {
 5542                                         SCTP_TCB_UNLOCK(locked_tcb);
 5543                                 }
 5544                                 *offset = length;
 5545                                 return (NULL);
 5546                         }
 5547                         if (ch && (stcb) && netp && (*netp)) {
 5548                                 if (stcb->asoc.pktdrop_supported == 0) {
 5549                                         goto unknown_chunk;
 5550                                 }
 5551                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
 5552                                     stcb, *netp,
 5553                                     min(chk_length, (sizeof(chunk_buf) - 4)));
 5554 
 5555                         }
 5556                         break;
 5557                 case SCTP_AUTHENTICATION:
 5558                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
 5559                         if (stcb == NULL) {
 5560                                 /* save the first AUTH for later processing */
 5561                                 if (auth_skipped == 0) {
 5562                                         auth_offset = *offset;
 5563                                         auth_len = chk_length;
 5564                                         auth_skipped = 1;
 5565                                 }
 5566                                 /* skip this chunk (temporarily) */
 5567                                 goto next_chunk;
 5568                         }
 5569                         if (stcb->asoc.auth_supported == 0) {
 5570                                 goto unknown_chunk;
 5571                         }
 5572                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
 5573                             (chk_length > (sizeof(struct sctp_auth_chunk) +
 5574                             SCTP_AUTH_DIGEST_LEN_MAX))) {
 5575                                 /* Its not ours */
 5576                                 if (locked_tcb) {
 5577                                         SCTP_TCB_UNLOCK(locked_tcb);
 5578                                 }
 5579                                 *offset = length;
 5580                                 return (NULL);
 5581                         }
 5582                         if (got_auth == 1) {
 5583                                 /* skip this chunk... it's already auth'd */
 5584                                 goto next_chunk;
 5585                         }
 5586                         got_auth = 1;
 5587                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
 5588                             m, *offset)) {
 5589                                 /* auth HMAC failed so dump the packet */
 5590                                 *offset = length;
 5591                                 return (stcb);
 5592                         } else {
 5593                                 /* remaining chunks are HMAC checked */
 5594                                 stcb->asoc.authenticated = 1;
 5595                         }
 5596                         break;
 5597 
 5598                 default:
 5599         unknown_chunk:
 5600                         /* it's an unknown chunk! */
 5601                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
 5602                                 struct sctp_gen_error_cause *cause;
 5603                                 int len;
 5604 
 5605                                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
 5606                                     0, M_NOWAIT, 1, MT_DATA);
 5607                                 if (op_err != NULL) {
 5608                                         len = min(SCTP_SIZE32(chk_length), (uint32_t)(length - *offset));
 5609                                         cause = mtod(op_err, struct sctp_gen_error_cause *);
 5610                                         cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
 5611                                         cause->length = htons((uint16_t)(len + sizeof(struct sctp_gen_error_cause)));
 5612                                         SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
 5613                                         SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT);
 5614                                         if (SCTP_BUF_NEXT(op_err) != NULL) {
 5615 #ifdef SCTP_MBUF_LOGGING
 5616                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 5617                                                         sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY);
 5618                                                 }
 5619 #endif
 5620                                                 sctp_queue_op_err(stcb, op_err);
 5621                                         } else {
 5622                                                 sctp_m_freem(op_err);
 5623                                         }
 5624                                 }
 5625                         }
 5626                         if ((ch->chunk_type & 0x80) == 0) {
 5627                                 /* discard this packet */
 5628                                 *offset = length;
 5629                                 return (stcb);
 5630                         }       /* else skip this bad chunk and continue... */
 5631                         break;
 5632                 }               /* switch (ch->chunk_type) */
 5633 
 5634 
 5635 next_chunk:
 5636                 /* get the next chunk */
 5637                 *offset += SCTP_SIZE32(chk_length);
 5638                 if (*offset >= length) {
 5639                         /* no more data left in the mbuf chain */
 5640                         break;
 5641                 }
 5642                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 5643                     sizeof(struct sctp_chunkhdr), chunk_buf);
 5644                 if (ch == NULL) {
 5645                         if (locked_tcb) {
 5646                                 SCTP_TCB_UNLOCK(locked_tcb);
 5647                         }
 5648                         *offset = length;
 5649                         return (NULL);
 5650                 }
 5651         }                       /* while */
 5652 
 5653         if (asconf_cnt > 0 && stcb != NULL) {
 5654                 sctp_send_asconf_ack(stcb);
 5655         }
 5656         return (stcb);
 5657 }
 5658 
 5659 
 5660 /*
 5661  * common input chunk processing (v4 and v6)
 5662  */
 5663 void
 5664 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
 5665     struct sockaddr *src, struct sockaddr *dst,
 5666     struct sctphdr *sh, struct sctp_chunkhdr *ch,
 5667 #if !defined(SCTP_WITH_NO_CSUM)
 5668     uint8_t compute_crc,
 5669 #endif
 5670     uint8_t ecn_bits,
 5671     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
 5672     uint32_t vrf_id, uint16_t port)
 5673 {
 5674         uint32_t high_tsn;
 5675         int fwd_tsn_seen = 0, data_processed = 0;
 5676         struct mbuf *m = *mm, *op_err;
 5677         char msg[SCTP_DIAG_INFO_LEN];
 5678         int un_sent;
 5679         int cnt_ctrl_ready = 0;
 5680         struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
 5681         struct sctp_tcb *stcb = NULL;
 5682         struct sctp_nets *net = NULL;
 5683 
 5684         SCTP_STAT_INCR(sctps_recvdatagrams);
 5685 #ifdef SCTP_AUDITING_ENABLED
 5686         sctp_audit_log(0xE0, 1);
 5687         sctp_auditing(0, inp, stcb, net);
 5688 #endif
 5689 #if !defined(SCTP_WITH_NO_CSUM)
 5690         if (compute_crc != 0) {
 5691                 uint32_t check, calc_check;
 5692 
 5693                 check = sh->checksum;
 5694                 sh->checksum = 0;
 5695                 calc_check = sctp_calculate_cksum(m, iphlen);
 5696                 sh->checksum = check;
 5697                 if (calc_check != check) {
 5698                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
 5699                             calc_check, check, (void *)m, length, iphlen);
 5700                         stcb = sctp_findassociation_addr(m, offset, src, dst,
 5701                             sh, ch, &inp, &net, vrf_id);
 5702 #if defined(INET) || defined(INET6)
 5703                         if ((ch->chunk_type != SCTP_INITIATION) &&
 5704                             (net != NULL) && (net->port != port)) {
 5705                                 if (net->port == 0) {
 5706                                         /* UDP encapsulation turned on. */
 5707                                         net->mtu -= sizeof(struct udphdr);
 5708                                         if (stcb->asoc.smallest_mtu > net->mtu) {
 5709                                                 sctp_pathmtu_adjustment(stcb, net->mtu);
 5710                                         }
 5711                                 } else if (port == 0) {
 5712                                         /* UDP encapsulation turned off. */
 5713                                         net->mtu += sizeof(struct udphdr);
 5714                                         /* XXX Update smallest_mtu */
 5715                                 }
 5716                                 net->port = port;
 5717                         }
 5718 #endif
 5719                         if (net != NULL) {
 5720                                 net->flowtype = mflowtype;
 5721                                 net->flowid = mflowid;
 5722                         }
 5723                         if ((inp != NULL) && (stcb != NULL)) {
 5724                                 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
 5725                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
 5726                         } else if ((inp != NULL) && (stcb == NULL)) {
 5727                                 inp_decr = inp;
 5728                         }
 5729                         SCTP_STAT_INCR(sctps_badsum);
 5730                         SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
 5731                         goto out;
 5732                 }
 5733         }
 5734 #endif
 5735         /* Destination port of 0 is illegal, based on RFC4960. */
 5736         if (sh->dest_port == 0) {
 5737                 SCTP_STAT_INCR(sctps_hdrops);
 5738                 goto out;
 5739         }
 5740         stcb = sctp_findassociation_addr(m, offset, src, dst,
 5741             sh, ch, &inp, &net, vrf_id);
 5742 #if defined(INET) || defined(INET6)
 5743         if ((ch->chunk_type != SCTP_INITIATION) &&
 5744             (net != NULL) && (net->port != port)) {
 5745                 if (net->port == 0) {
 5746                         /* UDP encapsulation turned on. */
 5747                         net->mtu -= sizeof(struct udphdr);
 5748                         if (stcb->asoc.smallest_mtu > net->mtu) {
 5749                                 sctp_pathmtu_adjustment(stcb, net->mtu);
 5750                         }
 5751                 } else if (port == 0) {
 5752                         /* UDP encapsulation turned off. */
 5753                         net->mtu += sizeof(struct udphdr);
 5754                         /* XXX Update smallest_mtu */
 5755                 }
 5756                 net->port = port;
 5757         }
 5758 #endif
 5759         if (net != NULL) {
 5760                 net->flowtype = mflowtype;
 5761                 net->flowid = mflowid;
 5762         }
 5763         if (inp == NULL) {
 5764                 SCTP_STAT_INCR(sctps_noport);
 5765                 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
 5766                         goto out;
 5767                 }
 5768                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
 5769                         sctp_send_shutdown_complete2(src, dst, sh,
 5770                             mflowtype, mflowid, fibnum,
 5771                             vrf_id, port);
 5772                         goto out;
 5773                 }
 5774                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
 5775                         goto out;
 5776                 }
 5777                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
 5778                         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
 5779                             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
 5780                             (ch->chunk_type != SCTP_INIT))) {
 5781                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5782                                     "Out of the blue");
 5783                                 sctp_send_abort(m, iphlen, src, dst,
 5784                                     sh, 0, op_err,
 5785                                     mflowtype, mflowid, fibnum,
 5786                                     vrf_id, port);
 5787                         }
 5788                 }
 5789                 goto out;
 5790         } else if (stcb == NULL) {
 5791                 inp_decr = inp;
 5792         }
 5793         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
 5794             (void *)m, iphlen, offset, length, (void *)stcb);
 5795         if (stcb) {
 5796                 /* always clear this before beginning a packet */
 5797                 stcb->asoc.authenticated = 0;
 5798                 stcb->asoc.seen_a_sack_this_pkt = 0;
 5799                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
 5800                     (void *)stcb, stcb->asoc.state);
 5801 
 5802                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
 5803                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
 5804                         /*-
 5805                          * If we hit here, we had a ref count
 5806                          * up when the assoc was aborted and the
 5807                          * timer is clearing out the assoc, we should
 5808                          * NOT respond to any packet.. its OOTB.
 5809                          */
 5810                         SCTP_TCB_UNLOCK(stcb);
 5811                         stcb = NULL;
 5812                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
 5813                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5814                             msg);
 5815                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
 5816                             mflowtype, mflowid, inp->fibnum,
 5817                             vrf_id, port);
 5818                         goto out;
 5819                 }
 5820         }
 5821         if (IS_SCTP_CONTROL(ch)) {
 5822                 /* process the control portion of the SCTP packet */
 5823                 /* sa_ignore NO_NULL_CHK */
 5824                 stcb = sctp_process_control(m, iphlen, &offset, length,
 5825                     src, dst, sh, ch,
 5826                     inp, stcb, &net, &fwd_tsn_seen,
 5827                     mflowtype, mflowid, fibnum,
 5828                     vrf_id, port);
 5829                 if (stcb) {
 5830                         /*
 5831                          * This covers us if the cookie-echo was there and
 5832                          * it changes our INP.
 5833                          */
 5834                         inp = stcb->sctp_ep;
 5835 #if defined(INET) || defined(INET6)
 5836                         if ((ch->chunk_type != SCTP_INITIATION) &&
 5837                             (net != NULL) && (net->port != port)) {
 5838                                 if (net->port == 0) {
 5839                                         /* UDP encapsulation turned on. */
 5840                                         net->mtu -= sizeof(struct udphdr);
 5841                                         if (stcb->asoc.smallest_mtu > net->mtu) {
 5842                                                 sctp_pathmtu_adjustment(stcb, net->mtu);
 5843                                         }
 5844                                 } else if (port == 0) {
 5845                                         /* UDP encapsulation turned off. */
 5846                                         net->mtu += sizeof(struct udphdr);
 5847                                         /* XXX Update smallest_mtu */
 5848                                 }
 5849                                 net->port = port;
 5850                         }
 5851 #endif
 5852                 }
 5853         } else {
 5854                 /*
 5855                  * no control chunks, so pre-process DATA chunks (these
 5856                  * checks are taken care of by control processing)
 5857                  */
 5858 
 5859                 /*
 5860                  * if DATA only packet, and auth is required, then punt...
 5861                  * can't have authenticated without any AUTH (control)
 5862                  * chunks
 5863                  */
 5864                 if ((stcb != NULL) &&
 5865                     (stcb->asoc.auth_supported == 1) &&
 5866                     sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
 5867                         /* "silently" ignore */
 5868                         SCTP_STAT_INCR(sctps_recvauthmissing);
 5869                         goto out;
 5870                 }
 5871                 if (stcb == NULL) {
 5872                         /* out of the blue DATA chunk */
 5873                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
 5874                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5875                             msg);
 5876                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
 5877                             mflowtype, mflowid, fibnum,
 5878                             vrf_id, port);
 5879                         goto out;
 5880                 }
 5881                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
 5882                         /* v_tag mismatch! */
 5883                         SCTP_STAT_INCR(sctps_badvtag);
 5884                         goto out;
 5885                 }
 5886         }
 5887 
 5888         if (stcb == NULL) {
 5889                 /*
 5890                  * no valid TCB for this packet, or we found it's a bad
 5891                  * packet while processing control, or we're done with this
 5892                  * packet (done or skip rest of data), so we drop it...
 5893                  */
 5894                 goto out;
 5895         }
 5896         /*
 5897          * DATA chunk processing
 5898          */
 5899         /* plow through the data chunks while length > offset */
 5900 
 5901         /*
 5902          * Rest should be DATA only.  Check authentication state if AUTH for
 5903          * DATA is required.
 5904          */
 5905         if ((length > offset) &&
 5906             (stcb != NULL) &&
 5907             (stcb->asoc.auth_supported == 1) &&
 5908             sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
 5909             !stcb->asoc.authenticated) {
 5910                 /* "silently" ignore */
 5911                 SCTP_STAT_INCR(sctps_recvauthmissing);
 5912                 SCTPDBG(SCTP_DEBUG_AUTH1,
 5913                     "Data chunk requires AUTH, skipped\n");
 5914                 goto trigger_send;
 5915         }
 5916         if (length > offset) {
 5917                 int retval;
 5918 
 5919                 /*
 5920                  * First check to make sure our state is correct. We would
 5921                  * not get here unless we really did have a tag, so we don't
 5922                  * abort if this happens, just dump the chunk silently.
 5923                  */
 5924                 switch (SCTP_GET_STATE(&stcb->asoc)) {
 5925                 case SCTP_STATE_COOKIE_ECHOED:
 5926                         /*
 5927                          * we consider data with valid tags in this state
 5928                          * shows us the cookie-ack was lost. Imply it was
 5929                          * there.
 5930                          */
 5931                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5932                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5933                                     stcb->asoc.overall_error_count,
 5934                                     0,
 5935                                     SCTP_FROM_SCTP_INPUT,
 5936                                     __LINE__);
 5937                         }
 5938                         stcb->asoc.overall_error_count = 0;
 5939                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
 5940                         break;
 5941                 case SCTP_STATE_COOKIE_WAIT:
 5942                         /*
 5943                          * We consider OOTB any data sent during asoc setup.
 5944                          */
 5945                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
 5946                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 5947                             msg);
 5948                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
 5949                             mflowtype, mflowid, inp->fibnum,
 5950                             vrf_id, port);
 5951                         goto out;
 5952                         /* sa_ignore NOTREACHED */
 5953                         break;
 5954                 case SCTP_STATE_EMPTY:  /* should not happen */
 5955                 case SCTP_STATE_INUSE:  /* should not happen */
 5956                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
 5957                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 5958                 default:
 5959                         goto out;
 5960                         /* sa_ignore NOTREACHED */
 5961                         break;
 5962                 case SCTP_STATE_OPEN:
 5963                 case SCTP_STATE_SHUTDOWN_SENT:
 5964                         break;
 5965                 }
 5966                 /* plow through the data chunks while length > offset */
 5967                 retval = sctp_process_data(mm, iphlen, &offset, length,
 5968                     inp, stcb, net, &high_tsn);
 5969                 if (retval == 2) {
 5970                         /*
 5971                          * The association aborted, NO UNLOCK needed since
 5972                          * the association is destroyed.
 5973                          */
 5974                         stcb = NULL;
 5975                         goto out;
 5976                 }
 5977                 data_processed = 1;
 5978                 /*
 5979                  * Anything important needs to have been m_copy'ed in
 5980                  * process_data
 5981                  */
 5982         }
 5983         /* take care of ecn */
 5984         if ((data_processed == 1) &&
 5985             (stcb->asoc.ecn_supported == 1) &&
 5986             ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
 5987                 /* Yep, we need to add a ECNE */
 5988                 sctp_send_ecn_echo(stcb, net, high_tsn);
 5989         }
 5990         if ((data_processed == 0) && (fwd_tsn_seen)) {
 5991                 int was_a_gap;
 5992                 uint32_t highest_tsn;
 5993 
 5994                 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
 5995                         highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
 5996                 } else {
 5997                         highest_tsn = stcb->asoc.highest_tsn_inside_map;
 5998                 }
 5999                 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
 6000                 stcb->asoc.send_sack = 1;
 6001                 sctp_sack_check(stcb, was_a_gap);
 6002         } else if (fwd_tsn_seen) {
 6003                 stcb->asoc.send_sack = 1;
 6004         }
 6005         /* trigger send of any chunks in queue... */
 6006 trigger_send:
 6007 #ifdef SCTP_AUDITING_ENABLED
 6008         sctp_audit_log(0xE0, 2);
 6009         sctp_auditing(1, inp, stcb, net);
 6010 #endif
 6011         SCTPDBG(SCTP_DEBUG_INPUT1,
 6012             "Check for chunk output prw:%d tqe:%d tf=%d\n",
 6013             stcb->asoc.peers_rwnd,
 6014             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
 6015             stcb->asoc.total_flight);
 6016         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
 6017         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
 6018                 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
 6019         }
 6020         if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||
 6021             cnt_ctrl_ready ||
 6022             stcb->asoc.trigger_reset ||
 6023             ((un_sent) &&
 6024             (stcb->asoc.peers_rwnd > 0 ||
 6025             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
 6026                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
 6027                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 6028                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
 6029         }
 6030 #ifdef SCTP_AUDITING_ENABLED
 6031         sctp_audit_log(0xE0, 3);
 6032         sctp_auditing(2, inp, stcb, net);
 6033 #endif
 6034 out:
 6035         if (stcb != NULL) {
 6036                 SCTP_TCB_UNLOCK(stcb);
 6037         }
 6038         if (inp_decr != NULL) {
 6039                 /* reduce ref-count */
 6040                 SCTP_INP_WLOCK(inp_decr);
 6041                 SCTP_INP_DECR_REF(inp_decr);
 6042                 SCTP_INP_WUNLOCK(inp_decr);
 6043         }
 6044         return;
 6045 }
 6046 
 6047 #ifdef INET
 6048 void
 6049 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
 6050 {
 6051         struct mbuf *m;
 6052         int iphlen;
 6053         uint32_t vrf_id = 0;
 6054         uint8_t ecn_bits;
 6055         struct sockaddr_in src, dst;
 6056         struct ip *ip;
 6057         struct sctphdr *sh;
 6058         struct sctp_chunkhdr *ch;
 6059         int length, offset;
 6060 #if !defined(SCTP_WITH_NO_CSUM)
 6061         uint8_t compute_crc;
 6062 #endif
 6063         uint32_t mflowid;
 6064         uint8_t mflowtype;
 6065         uint16_t fibnum;
 6066 
 6067         iphlen = off;
 6068         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
 6069                 SCTP_RELEASE_PKT(i_pak);
 6070                 return;
 6071         }
 6072         m = SCTP_HEADER_TO_CHAIN(i_pak);
 6073 #ifdef SCTP_MBUF_LOGGING
 6074         /* Log in any input mbufs */
 6075         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 6076                 sctp_log_mbc(m, SCTP_MBUF_INPUT);
 6077         }
 6078 #endif
 6079 #ifdef SCTP_PACKET_LOGGING
 6080         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
 6081                 sctp_packet_log(m);
 6082         }
 6083 #endif
 6084         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
 6085             "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n",
 6086             m->m_pkthdr.len,
 6087             if_name(m->m_pkthdr.rcvif),
 6088             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
 6089         mflowid = m->m_pkthdr.flowid;
 6090         mflowtype = M_HASHTYPE_GET(m);
 6091         fibnum = M_GETFIB(m);
 6092         SCTP_STAT_INCR(sctps_recvpackets);
 6093         SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
 6094         /* Get IP, SCTP, and first chunk header together in the first mbuf. */
 6095         offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
 6096         if (SCTP_BUF_LEN(m) < offset) {
 6097                 if ((m = m_pullup(m, offset)) == NULL) {
 6098                         SCTP_STAT_INCR(sctps_hdrops);
 6099                         return;
 6100                 }
 6101         }
 6102         ip = mtod(m, struct ip *);
 6103         sh = (struct sctphdr *)((caddr_t)ip + iphlen);
 6104         ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
 6105         offset -= sizeof(struct sctp_chunkhdr);
 6106         memset(&src, 0, sizeof(struct sockaddr_in));
 6107         src.sin_family = AF_INET;
 6108         src.sin_len = sizeof(struct sockaddr_in);
 6109         src.sin_port = sh->src_port;
 6110         src.sin_addr = ip->ip_src;
 6111         memset(&dst, 0, sizeof(struct sockaddr_in));
 6112         dst.sin_family = AF_INET;
 6113         dst.sin_len = sizeof(struct sockaddr_in);
 6114         dst.sin_port = sh->dest_port;
 6115         dst.sin_addr = ip->ip_dst;
 6116         length = ntohs(ip->ip_len);
 6117         /* Validate mbuf chain length with IP payload length. */
 6118         if (SCTP_HEADER_LEN(m) != length) {
 6119                 SCTPDBG(SCTP_DEBUG_INPUT1,
 6120                     "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
 6121                 SCTP_STAT_INCR(sctps_hdrops);
 6122                 goto out;
 6123         }
 6124         /* SCTP does not allow broadcasts or multicasts */
 6125         if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
 6126                 goto out;
 6127         }
 6128         if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
 6129                 goto out;
 6130         }
 6131         ecn_bits = ip->ip_tos;
 6132 #if defined(SCTP_WITH_NO_CSUM)
 6133         SCTP_STAT_INCR(sctps_recvnocrc);
 6134 #else
 6135         if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
 6136                 SCTP_STAT_INCR(sctps_recvhwcrc);
 6137                 compute_crc = 0;
 6138         } else {
 6139                 SCTP_STAT_INCR(sctps_recvswcrc);
 6140                 compute_crc = 1;
 6141         }
 6142 #endif
 6143         sctp_common_input_processing(&m, iphlen, offset, length,
 6144             (struct sockaddr *)&src,
 6145             (struct sockaddr *)&dst,
 6146             sh, ch,
 6147 #if !defined(SCTP_WITH_NO_CSUM)
 6148             compute_crc,
 6149 #endif
 6150             ecn_bits,
 6151             mflowtype, mflowid, fibnum,
 6152             vrf_id, port);
 6153 out:
 6154         if (m) {
 6155                 sctp_m_freem(m);
 6156         }
 6157         return;
 6158 }
 6159 
 6160 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
 6161 extern int *sctp_cpuarry;
 6162 #endif
 6163 
 6164 int
 6165 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED)
 6166 {
 6167         struct mbuf *m;
 6168         int off;
 6169 
 6170         m = *mp;
 6171         off = *offp;
 6172 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
 6173         if (mp_ncpus > 1) {
 6174                 struct ip *ip;
 6175                 struct sctphdr *sh;
 6176                 int offset;
 6177                 int cpu_to_use;
 6178                 uint32_t flowid, tag;
 6179 
 6180                 if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {
 6181                         flowid = m->m_pkthdr.flowid;
 6182                 } else {
 6183                         /*
 6184                          * No flow id built by lower layers fix it so we
 6185                          * create one.
 6186                          */
 6187                         offset = off + sizeof(struct sctphdr);
 6188                         if (SCTP_BUF_LEN(m) < offset) {
 6189                                 if ((m = m_pullup(m, offset)) == NULL) {
 6190                                         SCTP_STAT_INCR(sctps_hdrops);
 6191                                         return (IPPROTO_DONE);
 6192                                 }
 6193                         }
 6194                         ip = mtod(m, struct ip *);
 6195                         sh = (struct sctphdr *)((caddr_t)ip + off);
 6196                         tag = htonl(sh->v_tag);
 6197                         flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
 6198                         m->m_pkthdr.flowid = flowid;
 6199                         M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH);
 6200                 }
 6201                 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
 6202                 sctp_queue_to_mcore(m, off, cpu_to_use);
 6203                 return (IPPROTO_DONE);
 6204         }
 6205 #endif
 6206         sctp_input_with_port(m, off, 0);
 6207         return (IPPROTO_DONE);
 6208 }
 6209 #endif

Cache object: 4285a615e5d9695e29cc5f5d526edb0a


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.