The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_input.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
    3  * Copyright (c) 2008-2011, by Randall Stewart. All rights reserved.
    4  * Copyright (c) 2008-2011, by Michael Tuexen. All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions are met:
    8  *
    9  * a) Redistributions of source code must retain the above copyright notice,
   10  *   this list of conditions and the following disclaimer.
   11  *
   12  * b) Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in
   14  *   the documentation and/or other materials provided with the distribution.
   15  *
   16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
   17  *    contributors may be used to endorse or promote products derived
   18  *    from this software without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
   22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
   24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   30  * THE POSSIBILITY OF SUCH DAMAGE.
   31  */
   32 
   33 /* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $   */
   34 
   35 #include <sys/cdefs.h>
   36 __FBSDID("$FreeBSD: releng/9.0/sys/netinet/sctp_input.c 224641 2011-08-03 20:21:00Z tuexen $");
   37 
   38 #include <netinet/sctp_os.h>
   39 #include <netinet/sctp_var.h>
   40 #include <netinet/sctp_sysctl.h>
   41 #include <netinet/sctp_pcb.h>
   42 #include <netinet/sctp_header.h>
   43 #include <netinet/sctputil.h>
   44 #include <netinet/sctp_output.h>
   45 #include <netinet/sctp_input.h>
   46 #include <netinet/sctp_auth.h>
   47 #include <netinet/sctp_indata.h>
   48 #include <netinet/sctp_asconf.h>
   49 #include <netinet/sctp_bsd_addr.h>
   50 #include <netinet/sctp_timer.h>
   51 #include <netinet/sctp_crc32.h>
   52 #include <netinet/udp.h>
   53 #include <sys/smp.h>
   54 
   55 
   56 
   57 static void
   58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
   59 {
   60         struct sctp_nets *net;
   61 
   62         /*
   63          * This now not only stops all cookie timers it also stops any INIT
   64          * timers as well. This will make sure that the timers are stopped
   65          * in all collision cases.
   66          */
   67         SCTP_TCB_LOCK_ASSERT(stcb);
   68         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
   69                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
   70                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
   71                             stcb->sctp_ep,
   72                             stcb,
   73                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
   74                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
   75                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
   76                             stcb->sctp_ep,
   77                             stcb,
   78                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
   79                 }
   80         }
   81 }
   82 
   83 /* INIT handler */
   84 static void
   85 sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
   86     struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
   87     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, uint16_t port)
   88 {
   89         struct sctp_init *init;
   90         struct mbuf *op_err;
   91         uint32_t init_limit;
   92 
   93         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
   94             stcb);
   95         if (stcb == NULL) {
   96                 SCTP_INP_RLOCK(inp);
   97                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
   98                         goto outnow;
   99                 }
  100         }
  101         op_err = NULL;
  102         init = &cp->init;
  103         /* First are we accepting? */
  104         if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) {
  105                 SCTPDBG(SCTP_DEBUG_INPUT2,
  106                     "sctp_handle_init: Abort, so_qlimit:%d\n",
  107                     inp->sctp_socket->so_qlimit);
  108                 /*
  109                  * FIX ME ?? What about TCP model and we have a
  110                  * match/restart case? Actually no fix is needed. the lookup
  111                  * will always find the existing assoc so stcb would not be
  112                  * NULL. It may be questionable to do this since we COULD
  113                  * just send back the INIT-ACK and hope that the app did
  114                  * accept()'s by the time the COOKIE was sent. But there is
  115                  * a price to pay for COOKIE generation and I don't want to
  116                  * pay it on the chance that the app will actually do some
  117                  * accepts(). The App just looses and should NOT be in this
  118                  * state :-)
  119                  */
  120                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
  121                     vrf_id, port);
  122                 if (stcb)
  123                         *abort_no_unlock = 1;
  124                 goto outnow;
  125         }
  126         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
  127                 /* Invalid length */
  128                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
  129                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
  130                     vrf_id, port);
  131                 if (stcb)
  132                         *abort_no_unlock = 1;
  133                 goto outnow;
  134         }
  135         /* validate parameters */
  136         if (init->initiate_tag == 0) {
  137                 /* protocol error... send abort */
  138                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
  139                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
  140                     vrf_id, port);
  141                 if (stcb)
  142                         *abort_no_unlock = 1;
  143                 goto outnow;
  144         }
  145         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
  146                 /* invalid parameter... send abort */
  147                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
  148                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
  149                     vrf_id, port);
  150                 if (stcb)
  151                         *abort_no_unlock = 1;
  152                 goto outnow;
  153         }
  154         if (init->num_inbound_streams == 0) {
  155                 /* protocol error... send abort */
  156                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
  157                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
  158                     vrf_id, port);
  159                 if (stcb)
  160                         *abort_no_unlock = 1;
  161                 goto outnow;
  162         }
  163         if (init->num_outbound_streams == 0) {
  164                 /* protocol error... send abort */
  165                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
  166                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
  167                     vrf_id, port);
  168                 if (stcb)
  169                         *abort_no_unlock = 1;
  170                 goto outnow;
  171         }
  172         init_limit = offset + ntohs(cp->ch.chunk_length);
  173         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
  174             init_limit)) {
  175                 /* auth parameter(s) error... send abort */
  176                 sctp_abort_association(inp, stcb, m, iphlen, sh, NULL, vrf_id, port);
  177                 if (stcb)
  178                         *abort_no_unlock = 1;
  179                 goto outnow;
  180         }
  181         /* send an INIT-ACK w/cookie */
  182         SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
  183         sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp, vrf_id, port,
  184             ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
  185 outnow:
  186         if (stcb == NULL) {
  187                 SCTP_INP_RUNLOCK(inp);
  188         }
  189 }
  190 
  191 /*
  192  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
  193  */
  194 
  195 int
  196 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
  197 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
  198     SCTP_UNUSED
  199 #endif
  200 )
  201 {
  202         int unsent_data = 0;
  203         unsigned int i;
  204         struct sctp_stream_queue_pending *sp;
  205         struct sctp_association *asoc;
  206 
  207         /*
  208          * This function returns the number of streams that have true unsent
  209          * data on them. Note that as it looks through it will clean up any
  210          * places that have old data that has been sent but left at top of
  211          * stream queue.
  212          */
  213         asoc = &stcb->asoc;
  214         SCTP_TCB_SEND_LOCK(stcb);
  215         if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
  216                 /* Check to see if some data queued */
  217                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
  218                         /* sa_ignore FREED_MEMORY */
  219                         sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
  220                         if (sp == NULL) {
  221                                 continue;
  222                         }
  223                         if ((sp->msg_is_complete) &&
  224                             (sp->length == 0) &&
  225                             (sp->sender_all_done)) {
  226                                 /*
  227                                  * We are doing differed cleanup. Last time
  228                                  * through when we took all the data the
  229                                  * sender_all_done was not set.
  230                                  */
  231                                 if (sp->put_last_out == 0) {
  232                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
  233                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
  234                                             sp->sender_all_done,
  235                                             sp->length,
  236                                             sp->msg_is_complete,
  237                                             sp->put_last_out);
  238                                 }
  239                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
  240                                 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
  241                                 if (sp->net) {
  242                                         sctp_free_remote_addr(sp->net);
  243                                         sp->net = NULL;
  244                                 }
  245                                 if (sp->data) {
  246                                         sctp_m_freem(sp->data);
  247                                         sp->data = NULL;
  248                                 }
  249                                 sctp_free_a_strmoq(stcb, sp, so_locked);
  250                         } else {
  251                                 unsent_data++;
  252                                 break;
  253                         }
  254                 }
  255         }
  256         SCTP_TCB_SEND_UNLOCK(stcb);
  257         return (unsent_data);
  258 }
  259 
  260 static int
  261 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb,
  262     struct sctp_nets *net)
  263 {
  264         struct sctp_init *init;
  265         struct sctp_association *asoc;
  266         struct sctp_nets *lnet;
  267         unsigned int i;
  268 
  269         init = &cp->init;
  270         asoc = &stcb->asoc;
  271         /* save off parameters */
  272         asoc->peer_vtag = ntohl(init->initiate_tag);
  273         asoc->peers_rwnd = ntohl(init->a_rwnd);
  274         /* init tsn's */
  275         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
  276 
  277         if (!TAILQ_EMPTY(&asoc->nets)) {
  278                 /* update any ssthresh's that may have a default */
  279                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
  280                         lnet->ssthresh = asoc->peers_rwnd;
  281                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
  282                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
  283                         }
  284                 }
  285         }
  286         SCTP_TCB_SEND_LOCK(stcb);
  287         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
  288                 unsigned int newcnt;
  289                 struct sctp_stream_out *outs;
  290                 struct sctp_stream_queue_pending *sp, *nsp;
  291                 struct sctp_tmit_chunk *chk, *nchk;
  292 
  293                 /* abandon the upper streams */
  294                 newcnt = ntohs(init->num_inbound_streams);
  295                 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
  296                         if (chk->rec.data.stream_number >= newcnt) {
  297                                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
  298                                 asoc->send_queue_cnt--;
  299                                 if (chk->data != NULL) {
  300                                         sctp_free_bufspace(stcb, asoc, chk, 1);
  301                                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
  302                                             SCTP_NOTIFY_DATAGRAM_UNSENT, chk, SCTP_SO_NOT_LOCKED);
  303                                         if (chk->data) {
  304                                                 sctp_m_freem(chk->data);
  305                                                 chk->data = NULL;
  306                                         }
  307                                 }
  308                                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
  309                                 /* sa_ignore FREED_MEMORY */
  310                         }
  311                 }
  312                 if (asoc->strmout) {
  313                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
  314                                 outs = &asoc->strmout[i];
  315                                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
  316                                         TAILQ_REMOVE(&outs->outqueue, sp, next);
  317                                         asoc->stream_queue_cnt--;
  318                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
  319                                             stcb, SCTP_NOTIFY_DATAGRAM_UNSENT,
  320                                             sp, SCTP_SO_NOT_LOCKED);
  321                                         if (sp->data) {
  322                                                 sctp_m_freem(sp->data);
  323                                                 sp->data = NULL;
  324                                         }
  325                                         if (sp->net) {
  326                                                 sctp_free_remote_addr(sp->net);
  327                                                 sp->net = NULL;
  328                                         }
  329                                         /* Free the chunk */
  330                                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
  331                                         /* sa_ignore FREED_MEMORY */
  332                                 }
  333                         }
  334                 }
  335                 /* cut back the count */
  336                 asoc->pre_open_streams = newcnt;
  337         }
  338         SCTP_TCB_SEND_UNLOCK(stcb);
  339         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams;
  340 
  341         /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
  342         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
  343         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
  344                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
  345         }
  346         /* This is the next one we expect */
  347         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
  348 
  349         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
  350         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
  351 
  352         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
  353         /* open the requested streams */
  354 
  355         if (asoc->strmin != NULL) {
  356                 /* Free the old ones */
  357                 struct sctp_queued_to_read *ctl, *nctl;
  358 
  359                 for (i = 0; i < asoc->streamincnt; i++) {
  360                         TAILQ_FOREACH_SAFE(ctl, &asoc->strmin[i].inqueue, next, nctl) {
  361                                 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
  362                                 sctp_free_remote_addr(ctl->whoFrom);
  363                                 ctl->whoFrom = NULL;
  364                                 sctp_m_freem(ctl->data);
  365                                 ctl->data = NULL;
  366                                 sctp_free_a_readq(stcb, ctl);
  367                         }
  368                 }
  369                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
  370         }
  371         asoc->streamincnt = ntohs(init->num_outbound_streams);
  372         if (asoc->streamincnt > MAX_SCTP_STREAMS) {
  373                 asoc->streamincnt = MAX_SCTP_STREAMS;
  374         }
  375         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
  376             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
  377         if (asoc->strmin == NULL) {
  378                 /* we didn't get memory for the streams! */
  379                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
  380                 return (-1);
  381         }
  382         for (i = 0; i < asoc->streamincnt; i++) {
  383                 asoc->strmin[i].stream_no = i;
  384                 asoc->strmin[i].last_sequence_delivered = 0xffff;
  385                 /*
  386                  * U-stream ranges will be set when the cookie is unpacked.
  387                  * Or for the INIT sender they are un set (if pr-sctp not
  388                  * supported) when the INIT-ACK arrives.
  389                  */
  390                 TAILQ_INIT(&asoc->strmin[i].inqueue);
  391                 asoc->strmin[i].delivery_started = 0;
  392         }
  393         /*
  394          * load_address_from_init will put the addresses into the
  395          * association when the COOKIE is processed or the INIT-ACK is
  396          * processed. Both types of COOKIE's existing and new call this
  397          * routine. It will remove addresses that are no longer in the
  398          * association (for the restarting case where addresses are
  399          * removed). Up front when the INIT arrives we will discard it if it
  400          * is a restart and new addresses have been added.
  401          */
  402         /* sa_ignore MEMLEAK */
  403         return (0);
  404 }
  405 
  406 /*
  407  * INIT-ACK message processing/consumption returns value < 0 on error
  408  */
  409 static int
  410 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
  411     struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
  412     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id)
  413 {
  414         struct sctp_association *asoc;
  415         struct mbuf *op_err;
  416         int retval, abort_flag;
  417         uint32_t initack_limit;
  418         int nat_friendly = 0;
  419 
  420         /* First verify that we have no illegal param's */
  421         abort_flag = 0;
  422         op_err = NULL;
  423 
  424         op_err = sctp_arethere_unrecognized_parameters(m,
  425             (offset + sizeof(struct sctp_init_chunk)),
  426             &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
  427         if (abort_flag) {
  428                 /* Send an abort and notify peer */
  429                 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_CAUSE_PROTOCOL_VIOLATION, op_err, SCTP_SO_NOT_LOCKED);
  430                 *abort_no_unlock = 1;
  431                 return (-1);
  432         }
  433         asoc = &stcb->asoc;
  434         asoc->peer_supports_nat = (uint8_t) nat_friendly;
  435         /* process the peer's parameters in the INIT-ACK */
  436         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net);
  437         if (retval < 0) {
  438                 return (retval);
  439         }
  440         initack_limit = offset + ntohs(cp->ch.chunk_length);
  441         /* load all addresses */
  442         if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen,
  443             (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh,
  444             NULL))) {
  445                 /* Huh, we should abort */
  446                 SCTPDBG(SCTP_DEBUG_INPUT1,
  447                     "Load addresses from INIT causes an abort %d\n",
  448                     retval);
  449                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
  450                     NULL, 0, net->port);
  451                 *abort_no_unlock = 1;
  452                 return (-1);
  453         }
  454         /* if the peer doesn't support asconf, flush the asconf queue */
  455         if (asoc->peer_supports_asconf == 0) {
  456                 struct sctp_asconf_addr *param, *nparam;
  457 
  458                 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
  459                         TAILQ_REMOVE(&asoc->asconf_queue, param, next);
  460                         SCTP_FREE(param, SCTP_M_ASC_ADDR);
  461                 }
  462         }
  463         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
  464             stcb->asoc.local_hmacs);
  465         if (op_err) {
  466                 sctp_queue_op_err(stcb, op_err);
  467                 /* queuing will steal away the mbuf chain to the out queue */
  468                 op_err = NULL;
  469         }
  470         /* extract the cookie and queue it to "echo" it back... */
  471         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
  472                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
  473                     stcb->asoc.overall_error_count,
  474                     0,
  475                     SCTP_FROM_SCTP_INPUT,
  476                     __LINE__);
  477         }
  478         stcb->asoc.overall_error_count = 0;
  479         net->error_count = 0;
  480 
  481         /*
  482          * Cancel the INIT timer, We do this first before queueing the
  483          * cookie. We always cancel at the primary to assue that we are
  484          * canceling the timer started by the INIT which always goes to the
  485          * primary.
  486          */
  487         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
  488             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
  489 
  490         /* calculate the RTO */
  491         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
  492             SCTP_RTT_FROM_NON_DATA);
  493 
  494         retval = sctp_send_cookie_echo(m, offset, stcb, net);
  495         if (retval < 0) {
  496                 /*
  497                  * No cookie, we probably should send a op error. But in any
  498                  * case if there is no cookie in the INIT-ACK, we can
  499                  * abandon the peer, its broke.
  500                  */
  501                 if (retval == -3) {
  502                         /* We abort with an error of missing mandatory param */
  503                         op_err =
  504                             sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);
  505                         if (op_err) {
  506                                 /*
  507                                  * Expand beyond to include the mandatory
  508                                  * param cookie
  509                                  */
  510                                 struct sctp_inv_mandatory_param *mp;
  511 
  512                                 SCTP_BUF_LEN(op_err) =
  513                                     sizeof(struct sctp_inv_mandatory_param);
  514                                 mp = mtod(op_err,
  515                                     struct sctp_inv_mandatory_param *);
  516                                 /* Subtract the reserved param */
  517                                 mp->length =
  518                                     htons(sizeof(struct sctp_inv_mandatory_param) - 2);
  519                                 mp->num_param = htonl(1);
  520                                 mp->param = htons(SCTP_STATE_COOKIE);
  521                                 mp->resv = 0;
  522                         }
  523                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
  524                             sh, op_err, 0, net->port);
  525                         *abort_no_unlock = 1;
  526                 }
  527                 return (retval);
  528         }
  529         return (0);
  530 }
  531 
  532 static void
  533 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
  534     struct sctp_tcb *stcb, struct sctp_nets *net)
  535 {
  536         struct sockaddr_storage store;
  537         struct sctp_nets *r_net, *f_net;
  538         struct timeval tv;
  539         int req_prim = 0;
  540         uint16_t old_error_counter;
  541 
  542 #ifdef INET
  543         struct sockaddr_in *sin;
  544 
  545 #endif
  546 #ifdef INET6
  547         struct sockaddr_in6 *sin6;
  548 
  549 #endif
  550 
  551         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
  552                 /* Invalid length */
  553                 return;
  554         }
  555         memset(&store, 0, sizeof(store));
  556         switch (cp->heartbeat.hb_info.addr_family) {
  557 #ifdef INET
  558         case AF_INET:
  559                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
  560                         sin = (struct sockaddr_in *)&store;
  561                         sin->sin_family = cp->heartbeat.hb_info.addr_family;
  562                         sin->sin_len = cp->heartbeat.hb_info.addr_len;
  563                         sin->sin_port = stcb->rport;
  564                         memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,
  565                             sizeof(sin->sin_addr));
  566                 } else {
  567                         return;
  568                 }
  569                 break;
  570 #endif
  571 #ifdef INET6
  572         case AF_INET6:
  573                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
  574                         sin6 = (struct sockaddr_in6 *)&store;
  575                         sin6->sin6_family = cp->heartbeat.hb_info.addr_family;
  576                         sin6->sin6_len = cp->heartbeat.hb_info.addr_len;
  577                         sin6->sin6_port = stcb->rport;
  578                         memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,
  579                             sizeof(sin6->sin6_addr));
  580                 } else {
  581                         return;
  582                 }
  583                 break;
  584 #endif
  585         default:
  586                 return;
  587         }
  588         r_net = sctp_findnet(stcb, (struct sockaddr *)&store);
  589         if (r_net == NULL) {
  590                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
  591                 return;
  592         }
  593         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
  594             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
  595             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
  596                 /*
  597                  * If the its a HB and it's random value is correct when can
  598                  * confirm the destination.
  599                  */
  600                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
  601                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
  602                         stcb->asoc.primary_destination = r_net;
  603                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
  604                         f_net = TAILQ_FIRST(&stcb->asoc.nets);
  605                         if (f_net != r_net) {
  606                                 /*
  607                                  * first one on the list is NOT the primary
  608                                  * sctp_cmpaddr() is much more efficent if
  609                                  * the primary is the first on the list,
  610                                  * make it so.
  611                                  */
  612                                 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
  613                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
  614                         }
  615                         req_prim = 1;
  616                 }
  617                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
  618                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
  619                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
  620                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
  621         }
  622         old_error_counter = r_net->error_count;
  623         r_net->error_count = 0;
  624         r_net->hb_responded = 1;
  625         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
  626         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
  627         /* Now lets do a RTO with this */
  628         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
  629             SCTP_RTT_FROM_NON_DATA);
  630         if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
  631                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
  632                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
  633                     SCTP_HEARTBEAT_SUCCESS, (void *)r_net, SCTP_SO_NOT_LOCKED);
  634         }
  635         if (r_net->dest_state & SCTP_ADDR_PF) {
  636                 r_net->dest_state &= ~SCTP_ADDR_PF;
  637                 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
  638         }
  639         if (old_error_counter > 0) {
  640                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
  641                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
  642         }
  643         if (r_net == stcb->asoc.primary_destination) {
  644                 if (stcb->asoc.alternate) {
  645                         /* release the alternate, primary is good */
  646                         sctp_free_remote_addr(stcb->asoc.alternate);
  647                         stcb->asoc.alternate = NULL;
  648                 }
  649         }
  650         /* Mobility adaptation */
  651         if (req_prim) {
  652                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
  653                     SCTP_MOBILITY_BASE) ||
  654                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  655                     SCTP_MOBILITY_FASTHANDOFF)) &&
  656                     sctp_is_mobility_feature_on(stcb->sctp_ep,
  657                     SCTP_MOBILITY_PRIM_DELETED)) {
  658 
  659                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
  660                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  661                             SCTP_MOBILITY_FASTHANDOFF)) {
  662                                 sctp_assoc_immediate_retrans(stcb,
  663                                     stcb->asoc.primary_destination);
  664                         }
  665                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
  666                             SCTP_MOBILITY_BASE)) {
  667                                 sctp_move_chunks_from_net(stcb,
  668                                     stcb->asoc.deleted_primary);
  669                         }
  670                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
  671                             stcb->asoc.deleted_primary);
  672                 }
  673         }
  674 }
  675 
  676 static int
  677 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
  678 {
  679         /*
  680          * return 0 means we want you to proceed with the abort non-zero
  681          * means no abort processing
  682          */
  683         struct sctpasochead *head;
  684 
  685         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
  686                 /* generate a new vtag and send init */
  687                 LIST_REMOVE(stcb, sctp_asocs);
  688                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
  689                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
  690                 /*
  691                  * put it in the bucket in the vtag hash of assoc's for the
  692                  * system
  693                  */
  694                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
  695                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
  696                 return (1);
  697         }
  698         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
  699                 /*
  700                  * treat like a case where the cookie expired i.e.: - dump
  701                  * current cookie. - generate a new vtag. - resend init.
  702                  */
  703                 /* generate a new vtag and send init */
  704                 LIST_REMOVE(stcb, sctp_asocs);
  705                 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
  706                 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
  707                 sctp_stop_all_cookie_timers(stcb);
  708                 sctp_toss_old_cookies(stcb, &stcb->asoc);
  709                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
  710                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
  711                 /*
  712                  * put it in the bucket in the vtag hash of assoc's for the
  713                  * system
  714                  */
  715                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
  716                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
  717                 return (1);
  718         }
  719         return (0);
  720 }
  721 
  722 static int
  723 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
  724     struct sctp_nets *net)
  725 {
  726         /*
  727          * return 0 means we want you to proceed with the abort non-zero
  728          * means no abort processing
  729          */
  730         if (stcb->asoc.peer_supports_auth == 0) {
  731                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
  732                 return (0);
  733         }
  734         sctp_asconf_send_nat_state_update(stcb, net);
  735         return (1);
  736 }
  737 
  738 
  739 static void
  740 sctp_handle_abort(struct sctp_abort_chunk *cp,
  741     struct sctp_tcb *stcb, struct sctp_nets *net)
  742 {
  743 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  744         struct socket *so;
  745 
  746 #endif
  747         uint16_t len;
  748 
  749         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
  750         if (stcb == NULL)
  751                 return;
  752 
  753         len = ntohs(cp->ch.chunk_length);
  754         if (len > sizeof(struct sctp_chunkhdr)) {
  755                 /*
  756                  * Need to check the cause codes for our two magic nat
  757                  * aborts which don't kill the assoc necessarily.
  758                  */
  759                 struct sctp_abort_chunk *cpnext;
  760                 struct sctp_missing_nat_state *natc;
  761                 uint16_t cause;
  762 
  763                 cpnext = cp;
  764                 cpnext++;
  765                 natc = (struct sctp_missing_nat_state *)cpnext;
  766                 cause = ntohs(natc->cause);
  767                 if (cause == SCTP_CAUSE_NAT_COLLIDING_STATE) {
  768                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
  769                             cp->ch.chunk_flags);
  770                         if (sctp_handle_nat_colliding_state(stcb)) {
  771                                 return;
  772                         }
  773                 } else if (cause == SCTP_CAUSE_NAT_MISSING_STATE) {
  774                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
  775                             cp->ch.chunk_flags);
  776                         if (sctp_handle_nat_missing_state(stcb, net)) {
  777                                 return;
  778                         }
  779                 }
  780         }
  781         /* stop any receive timers */
  782         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
  783         /* notify user of the abort and clean up... */
  784         sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED);
  785         /* free the tcb */
  786 #if defined(SCTP_PANIC_ON_ABORT)
  787         printf("stcb:%p state:%d rport:%d net:%p\n",
  788             stcb, stcb->asoc.state, stcb->rport, net);
  789         if (!(stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
  790                 panic("Received an ABORT");
  791         } else {
  792                 printf("No panic its in state %x closed\n", stcb->asoc.state);
  793         }
  794 #endif
  795         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
  796         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
  797             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
  798                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
  799         }
  800 #ifdef SCTP_ASOCLOG_OF_TSNS
  801         sctp_print_out_track_log(stcb);
  802 #endif
  803 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  804         so = SCTP_INP_SO(stcb->sctp_ep);
  805         atomic_add_int(&stcb->asoc.refcnt, 1);
  806         SCTP_TCB_UNLOCK(stcb);
  807         SCTP_SOCKET_LOCK(so, 1);
  808         SCTP_TCB_LOCK(stcb);
  809         atomic_subtract_int(&stcb->asoc.refcnt, 1);
  810 #endif
  811         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
  812         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
  813             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
  814 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  815         SCTP_SOCKET_UNLOCK(so, 1);
  816 #endif
  817         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
  818 }
  819 
  820 static void
  821 sctp_start_net_timers(struct sctp_tcb *stcb)
  822 {
  823         uint32_t cnt_hb_sent;
  824         struct sctp_nets *net;
  825 
  826         cnt_hb_sent = 0;
  827         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  828                 /*
  829                  * For each network start: 1) A pmtu timer. 2) A HB timer 3)
  830                  * If the dest in unconfirmed send a hb as well if under
  831                  * max_hb_burst have been sent.
  832                  */
  833                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
  834                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
  835                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
  836                     (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
  837                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
  838                         cnt_hb_sent++;
  839                 }
  840         }
  841         if (cnt_hb_sent) {
  842                 sctp_chunk_output(stcb->sctp_ep, stcb,
  843                     SCTP_OUTPUT_FROM_COOKIE_ACK,
  844                     SCTP_SO_NOT_LOCKED);
  845         }
  846 }
  847 
  848 
  849 static void
  850 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
  851     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
  852 {
  853         struct sctp_association *asoc;
  854         int some_on_streamwheel;
  855 
  856 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  857         struct socket *so;
  858 
  859 #endif
  860 
  861         SCTPDBG(SCTP_DEBUG_INPUT2,
  862             "sctp_handle_shutdown: handling SHUTDOWN\n");
  863         if (stcb == NULL)
  864                 return;
  865         asoc = &stcb->asoc;
  866         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
  867             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
  868                 return;
  869         }
  870         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
  871                 /* Shutdown NOT the expected size */
  872                 return;
  873         } else {
  874                 sctp_update_acked(stcb, cp, net, abort_flag);
  875                 if (*abort_flag) {
  876                         return;
  877                 }
  878         }
  879         if (asoc->control_pdapi) {
  880                 /*
  881                  * With a normal shutdown we assume the end of last record.
  882                  */
  883                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
  884                 asoc->control_pdapi->end_added = 1;
  885                 asoc->control_pdapi->pdapi_aborted = 1;
  886                 asoc->control_pdapi = NULL;
  887                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
  888 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  889                 so = SCTP_INP_SO(stcb->sctp_ep);
  890                 atomic_add_int(&stcb->asoc.refcnt, 1);
  891                 SCTP_TCB_UNLOCK(stcb);
  892                 SCTP_SOCKET_LOCK(so, 1);
  893                 SCTP_TCB_LOCK(stcb);
  894                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
  895                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
  896                         /* assoc was freed while we were unlocked */
  897                         SCTP_SOCKET_UNLOCK(so, 1);
  898                         return;
  899                 }
  900 #endif
  901                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
  902 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  903                 SCTP_SOCKET_UNLOCK(so, 1);
  904 #endif
  905         }
  906         /* goto SHUTDOWN_RECEIVED state to block new requests */
  907         if (stcb->sctp_socket) {
  908                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
  909                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
  910                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
  911                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
  912                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
  913                         /*
  914                          * notify upper layer that peer has initiated a
  915                          * shutdown
  916                          */
  917                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
  918 
  919                         /* reset time */
  920                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
  921                 }
  922         }
  923         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
  924                 /*
  925                  * stop the shutdown timer, since we WILL move to
  926                  * SHUTDOWN-ACK-SENT.
  927                  */
  928                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
  929         }
  930         /* Now is there unsent data on a stream somewhere? */
  931         some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
  932 
  933         if (!TAILQ_EMPTY(&asoc->send_queue) ||
  934             !TAILQ_EMPTY(&asoc->sent_queue) ||
  935             some_on_streamwheel) {
  936                 /* By returning we will push more data out */
  937                 return;
  938         } else {
  939                 /* no outstanding data to send, so move on... */
  940                 /* send SHUTDOWN-ACK */
  941                 sctp_send_shutdown_ack(stcb, net);
  942                 /* move to SHUTDOWN-ACK-SENT state */
  943                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
  944                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
  945                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
  946                 }
  947                 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
  948                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
  949                 sctp_stop_timers_for_shutdown(stcb);
  950                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
  951                     stcb, net);
  952         }
  953 }
  954 
  955 static void
  956 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp,
  957     struct sctp_tcb *stcb,
  958     struct sctp_nets *net)
  959 {
  960         struct sctp_association *asoc;
  961 
  962 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  963         struct socket *so;
  964 
  965         so = SCTP_INP_SO(stcb->sctp_ep);
  966 #endif
  967         SCTPDBG(SCTP_DEBUG_INPUT2,
  968             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
  969         if (stcb == NULL)
  970                 return;
  971 
  972         asoc = &stcb->asoc;
  973         /* process according to association state */
  974         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
  975             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
  976                 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
  977                 sctp_send_shutdown_complete(stcb, net, 1);
  978                 SCTP_TCB_UNLOCK(stcb);
  979                 return;
  980         }
  981         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
  982             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
  983                 /* unexpected SHUTDOWN-ACK... so ignore... */
  984                 SCTP_TCB_UNLOCK(stcb);
  985                 return;
  986         }
  987         if (asoc->control_pdapi) {
  988                 /*
  989                  * With a normal shutdown we assume the end of last record.
  990                  */
  991                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
  992                 asoc->control_pdapi->end_added = 1;
  993                 asoc->control_pdapi->pdapi_aborted = 1;
  994                 asoc->control_pdapi = NULL;
  995                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
  996 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
  997                 atomic_add_int(&stcb->asoc.refcnt, 1);
  998                 SCTP_TCB_UNLOCK(stcb);
  999                 SCTP_SOCKET_LOCK(so, 1);
 1000                 SCTP_TCB_LOCK(stcb);
 1001                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1002                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1003                         /* assoc was freed while we were unlocked */
 1004                         SCTP_SOCKET_UNLOCK(so, 1);
 1005                         return;
 1006                 }
 1007 #endif
 1008                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 1009 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1010                 SCTP_SOCKET_UNLOCK(so, 1);
 1011 #endif
 1012         }
 1013         /* are the queues empty? */
 1014         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 1015             !TAILQ_EMPTY(&asoc->sent_queue) ||
 1016             !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 1017                 sctp_report_all_outbound(stcb, 0, SCTP_SO_NOT_LOCKED);
 1018         }
 1019         /* stop the timer */
 1020         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
 1021         /* send SHUTDOWN-COMPLETE */
 1022         sctp_send_shutdown_complete(stcb, net, 0);
 1023         /* notify upper layer protocol */
 1024         if (stcb->sctp_socket) {
 1025                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 1026                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1027                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 1028                         /* Set the connected flag to disconnected */
 1029                         stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
 1030                 }
 1031         }
 1032         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 1033         /* free the TCB but first save off the ep */
 1034 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1035         atomic_add_int(&stcb->asoc.refcnt, 1);
 1036         SCTP_TCB_UNLOCK(stcb);
 1037         SCTP_SOCKET_LOCK(so, 1);
 1038         SCTP_TCB_LOCK(stcb);
 1039         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1040 #endif
 1041         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 1042             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
 1043 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1044         SCTP_SOCKET_UNLOCK(so, 1);
 1045 #endif
 1046 }
 1047 
 1048 /*
 1049  * Skip past the param header and then we will find the chunk that caused the
 1050  * problem. There are two possiblities ASCONF or FWD-TSN other than that and
 1051  * our peer must be broken.
 1052  */
 1053 static void
 1054 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
 1055     struct sctp_nets *net)
 1056 {
 1057         struct sctp_chunkhdr *chk;
 1058 
 1059         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
 1060         switch (chk->chunk_type) {
 1061         case SCTP_ASCONF_ACK:
 1062         case SCTP_ASCONF:
 1063                 sctp_asconf_cleanup(stcb, net);
 1064                 break;
 1065         case SCTP_FORWARD_CUM_TSN:
 1066                 stcb->asoc.peer_supports_prsctp = 0;
 1067                 break;
 1068         default:
 1069                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1070                     "Peer does not support chunk type %d(%x)??\n",
 1071                     chk->chunk_type, (uint32_t) chk->chunk_type);
 1072                 break;
 1073         }
 1074 }
 1075 
 1076 /*
 1077  * Skip past the param header and then we will find the param that caused the
 1078  * problem.  There are a number of param's in a ASCONF OR the prsctp param
 1079  * these will turn of specific features.
 1080  */
 1081 static void
 1082 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
 1083 {
 1084         struct sctp_paramhdr *pbad;
 1085 
 1086         pbad = phdr + 1;
 1087         switch (ntohs(pbad->param_type)) {
 1088                 /* pr-sctp draft */
 1089         case SCTP_PRSCTP_SUPPORTED:
 1090                 stcb->asoc.peer_supports_prsctp = 0;
 1091                 break;
 1092         case SCTP_SUPPORTED_CHUNK_EXT:
 1093                 break;
 1094                 /* draft-ietf-tsvwg-addip-sctp */
 1095         case SCTP_HAS_NAT_SUPPORT:
 1096                 stcb->asoc.peer_supports_nat = 0;
 1097                 break;
 1098         case SCTP_ADD_IP_ADDRESS:
 1099         case SCTP_DEL_IP_ADDRESS:
 1100         case SCTP_SET_PRIM_ADDR:
 1101                 stcb->asoc.peer_supports_asconf = 0;
 1102                 break;
 1103         case SCTP_SUCCESS_REPORT:
 1104         case SCTP_ERROR_CAUSE_IND:
 1105                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
 1106                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1107                     "Turning off ASCONF to this strange peer\n");
 1108                 stcb->asoc.peer_supports_asconf = 0;
 1109                 break;
 1110         default:
 1111                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1112                     "Peer does not support param type %d(%x)??\n",
 1113                     pbad->param_type, (uint32_t) pbad->param_type);
 1114                 break;
 1115         }
 1116 }
 1117 
 1118 static int
 1119 sctp_handle_error(struct sctp_chunkhdr *ch,
 1120     struct sctp_tcb *stcb, struct sctp_nets *net)
 1121 {
 1122         int chklen;
 1123         struct sctp_paramhdr *phdr;
 1124         uint16_t error_type;
 1125         uint16_t error_len;
 1126         struct sctp_association *asoc;
 1127         int adjust;
 1128 
 1129 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1130         struct socket *so;
 1131 
 1132 #endif
 1133 
 1134         /* parse through all of the errors and process */
 1135         asoc = &stcb->asoc;
 1136         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
 1137             sizeof(struct sctp_chunkhdr));
 1138         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
 1139         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
 1140                 /* Process an Error Cause */
 1141                 error_type = ntohs(phdr->param_type);
 1142                 error_len = ntohs(phdr->param_length);
 1143                 if ((error_len > chklen) || (error_len == 0)) {
 1144                         /* invalid param length for this param */
 1145                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
 1146                             chklen, error_len);
 1147                         return (0);
 1148                 }
 1149                 switch (error_type) {
 1150                 case SCTP_CAUSE_INVALID_STREAM:
 1151                 case SCTP_CAUSE_MISSING_PARAM:
 1152                 case SCTP_CAUSE_INVALID_PARAM:
 1153                 case SCTP_CAUSE_NO_USER_DATA:
 1154                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
 1155                             error_type);
 1156                         break;
 1157                 case SCTP_CAUSE_NAT_COLLIDING_STATE:
 1158                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
 1159                             ch->chunk_flags);
 1160                         if (sctp_handle_nat_colliding_state(stcb)) {
 1161                                 return (0);
 1162                         }
 1163                         break;
 1164                 case SCTP_CAUSE_NAT_MISSING_STATE:
 1165                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
 1166                             ch->chunk_flags);
 1167                         if (sctp_handle_nat_missing_state(stcb, net)) {
 1168                                 return (0);
 1169                         }
 1170                         break;
 1171                 case SCTP_CAUSE_STALE_COOKIE:
 1172                         /*
 1173                          * We only act if we have echoed a cookie and are
 1174                          * waiting.
 1175                          */
 1176                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 1177                                 int *p;
 1178 
 1179                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
 1180                                 /* Save the time doubled */
 1181                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
 1182                                 asoc->stale_cookie_count++;
 1183                                 if (asoc->stale_cookie_count >
 1184                                     asoc->max_init_times) {
 1185                                         sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED);
 1186                                         /* now free the asoc */
 1187 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1188                                         so = SCTP_INP_SO(stcb->sctp_ep);
 1189                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 1190                                         SCTP_TCB_UNLOCK(stcb);
 1191                                         SCTP_SOCKET_LOCK(so, 1);
 1192                                         SCTP_TCB_LOCK(stcb);
 1193                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 1194 #endif
 1195                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 1196                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
 1197 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1198                                         SCTP_SOCKET_UNLOCK(so, 1);
 1199 #endif
 1200                                         return (-1);
 1201                                 }
 1202                                 /* blast back to INIT state */
 1203                                 sctp_toss_old_cookies(stcb, &stcb->asoc);
 1204                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
 1205                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
 1206                                 sctp_stop_all_cookie_timers(stcb);
 1207                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 1208                         }
 1209                         break;
 1210                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
 1211                         /*
 1212                          * Nothing we can do here, we don't do hostname
 1213                          * addresses so if the peer does not like my IPv6
 1214                          * (or IPv4 for that matter) it does not matter. If
 1215                          * they don't support that type of address, they can
 1216                          * NOT possibly get that packet type... i.e. with no
 1217                          * IPv6 you can't recieve a IPv6 packet. so we can
 1218                          * safely ignore this one. If we ever added support
 1219                          * for HOSTNAME Addresses, then we would need to do
 1220                          * something here.
 1221                          */
 1222                         break;
 1223                 case SCTP_CAUSE_UNRECOG_CHUNK:
 1224                         sctp_process_unrecog_chunk(stcb, phdr, net);
 1225                         break;
 1226                 case SCTP_CAUSE_UNRECOG_PARAM:
 1227                         sctp_process_unrecog_param(stcb, phdr);
 1228                         break;
 1229                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
 1230                         /*
 1231                          * We ignore this since the timer will drive out a
 1232                          * new cookie anyway and there timer will drive us
 1233                          * to send a SHUTDOWN_COMPLETE. We can't send one
 1234                          * here since we don't have their tag.
 1235                          */
 1236                         break;
 1237                 case SCTP_CAUSE_DELETING_LAST_ADDR:
 1238                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
 1239                 case SCTP_CAUSE_DELETING_SRC_ADDR:
 1240                         /*
 1241                          * We should NOT get these here, but in a
 1242                          * ASCONF-ACK.
 1243                          */
 1244                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
 1245                             error_type);
 1246                         break;
 1247                 case SCTP_CAUSE_OUT_OF_RESC:
 1248                         /*
 1249                          * And what, pray tell do we do with the fact that
 1250                          * the peer is out of resources? Not really sure we
 1251                          * could do anything but abort. I suspect this
 1252                          * should have came WITH an abort instead of in a
 1253                          * OP-ERROR.
 1254                          */
 1255                         break;
 1256                 default:
 1257                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
 1258                             error_type);
 1259                         break;
 1260                 }
 1261                 adjust = SCTP_SIZE32(error_len);
 1262                 chklen -= adjust;
 1263                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
 1264         }
 1265         return (0);
 1266 }
 1267 
 1268 static int
 1269 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
 1270     struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 1271     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id)
 1272 {
 1273         struct sctp_init_ack *init_ack;
 1274         struct mbuf *op_err;
 1275 
 1276         SCTPDBG(SCTP_DEBUG_INPUT2,
 1277             "sctp_handle_init_ack: handling INIT-ACK\n");
 1278 
 1279         if (stcb == NULL) {
 1280                 SCTPDBG(SCTP_DEBUG_INPUT2,
 1281                     "sctp_handle_init_ack: TCB is null\n");
 1282                 return (-1);
 1283         }
 1284         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
 1285                 /* Invalid length */
 1286                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 1287                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
 1288                     op_err, 0, net->port);
 1289                 *abort_no_unlock = 1;
 1290                 return (-1);
 1291         }
 1292         init_ack = &cp->init;
 1293         /* validate parameters */
 1294         if (init_ack->initiate_tag == 0) {
 1295                 /* protocol error... send an abort */
 1296                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 1297                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
 1298                     op_err, 0, net->port);
 1299                 *abort_no_unlock = 1;
 1300                 return (-1);
 1301         }
 1302         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
 1303                 /* protocol error... send an abort */
 1304                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 1305                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
 1306                     op_err, 0, net->port);
 1307                 *abort_no_unlock = 1;
 1308                 return (-1);
 1309         }
 1310         if (init_ack->num_inbound_streams == 0) {
 1311                 /* protocol error... send an abort */
 1312                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 1313                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
 1314                     op_err, 0, net->port);
 1315                 *abort_no_unlock = 1;
 1316                 return (-1);
 1317         }
 1318         if (init_ack->num_outbound_streams == 0) {
 1319                 /* protocol error... send an abort */
 1320                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 1321                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
 1322                     op_err, 0, net->port);
 1323                 *abort_no_unlock = 1;
 1324                 return (-1);
 1325         }
 1326         /* process according to association state... */
 1327         switch (stcb->asoc.state & SCTP_STATE_MASK) {
 1328         case SCTP_STATE_COOKIE_WAIT:
 1329                 /* this is the expected state for this chunk */
 1330                 /* process the INIT-ACK parameters */
 1331                 if (stcb->asoc.primary_destination->dest_state &
 1332                     SCTP_ADDR_UNCONFIRMED) {
 1333                         /*
 1334                          * The primary is where we sent the INIT, we can
 1335                          * always consider it confirmed when the INIT-ACK is
 1336                          * returned. Do this before we load addresses
 1337                          * though.
 1338                          */
 1339                         stcb->asoc.primary_destination->dest_state &=
 1340                             ~SCTP_ADDR_UNCONFIRMED;
 1341                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 1342                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
 1343                 }
 1344                 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb,
 1345                     net, abort_no_unlock, vrf_id) < 0) {
 1346                         /* error in parsing parameters */
 1347                         return (-1);
 1348                 }
 1349                 /* update our state */
 1350                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
 1351                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
 1352 
 1353                 /* reset the RTO calc */
 1354                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 1355                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 1356                             stcb->asoc.overall_error_count,
 1357                             0,
 1358                             SCTP_FROM_SCTP_INPUT,
 1359                             __LINE__);
 1360                 }
 1361                 stcb->asoc.overall_error_count = 0;
 1362                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
 1363                 /*
 1364                  * collapse the init timer back in case of a exponential
 1365                  * backoff
 1366                  */
 1367                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
 1368                     stcb, net);
 1369                 /*
 1370                  * the send at the end of the inbound data processing will
 1371                  * cause the cookie to be sent
 1372                  */
 1373                 break;
 1374         case SCTP_STATE_SHUTDOWN_SENT:
 1375                 /* incorrect state... discard */
 1376                 break;
 1377         case SCTP_STATE_COOKIE_ECHOED:
 1378                 /* incorrect state... discard */
 1379                 break;
 1380         case SCTP_STATE_OPEN:
 1381                 /* incorrect state... discard */
 1382                 break;
 1383         case SCTP_STATE_EMPTY:
 1384         case SCTP_STATE_INUSE:
 1385         default:
 1386                 /* incorrect state... discard */
 1387                 return (-1);
 1388                 break;
 1389         }
 1390         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
 1391         return (0);
 1392 }
 1393 
 1394 static struct sctp_tcb *
 1395 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 1396     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1397     struct sctp_inpcb *inp, struct sctp_nets **netp,
 1398     struct sockaddr *init_src, int *notification,
 1399     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 1400     uint32_t vrf_id, uint16_t port);
 1401 
 1402 
 1403 /*
 1404  * handle a state cookie for an existing association m: input packet mbuf
 1405  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
 1406  * "split" mbuf and the cookie signature does not exist offset: offset into
 1407  * mbuf to the cookie-echo chunk
 1408  */
 1409 static struct sctp_tcb *
 1410 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
 1411     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1412     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
 1413     struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id,
 1414     uint32_t vrf_id, int auth_skipped, uint32_t auth_offset, uint32_t auth_len, uint16_t port)
 1415 {
 1416         struct sctp_association *asoc;
 1417         struct sctp_init_chunk *init_cp, init_buf;
 1418         struct sctp_init_ack_chunk *initack_cp, initack_buf;
 1419         struct sctp_nets *net;
 1420         struct mbuf *op_err;
 1421         struct sctp_paramhdr *ph;
 1422         int chk_length;
 1423         int init_offset, initack_offset, i;
 1424         int retval;
 1425         int spec_flag = 0;
 1426         uint32_t how_indx;
 1427 
 1428         net = *netp;
 1429         /* I know that the TCB is non-NULL from the caller */
 1430         asoc = &stcb->asoc;
 1431         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
 1432                 if (asoc->cookie_how[how_indx] == 0)
 1433                         break;
 1434         }
 1435         if (how_indx < sizeof(asoc->cookie_how)) {
 1436                 asoc->cookie_how[how_indx] = 1;
 1437         }
 1438         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 1439                 /* SHUTDOWN came in after sending INIT-ACK */
 1440                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
 1441                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
 1442                     0, M_DONTWAIT, 1, MT_DATA);
 1443                 if (op_err == NULL) {
 1444                         /* FOOBAR */
 1445                         return (NULL);
 1446                 }
 1447                 /* Set the len */
 1448                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
 1449                 ph = mtod(op_err, struct sctp_paramhdr *);
 1450                 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);
 1451                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
 1452                 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
 1453                     vrf_id, net->port);
 1454                 if (how_indx < sizeof(asoc->cookie_how))
 1455                         asoc->cookie_how[how_indx] = 2;
 1456                 return (NULL);
 1457         }
 1458         /*
 1459          * find and validate the INIT chunk in the cookie (peer's info) the
 1460          * INIT should start after the cookie-echo header struct (chunk
 1461          * header, state cookie header struct)
 1462          */
 1463         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
 1464 
 1465         init_cp = (struct sctp_init_chunk *)
 1466             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
 1467             (uint8_t *) & init_buf);
 1468         if (init_cp == NULL) {
 1469                 /* could not pull a INIT chunk in cookie */
 1470                 return (NULL);
 1471         }
 1472         chk_length = ntohs(init_cp->ch.chunk_length);
 1473         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
 1474                 return (NULL);
 1475         }
 1476         /*
 1477          * find and validate the INIT-ACK chunk in the cookie (my info) the
 1478          * INIT-ACK follows the INIT chunk
 1479          */
 1480         initack_offset = init_offset + SCTP_SIZE32(chk_length);
 1481         initack_cp = (struct sctp_init_ack_chunk *)
 1482             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
 1483             (uint8_t *) & initack_buf);
 1484         if (initack_cp == NULL) {
 1485                 /* could not pull INIT-ACK chunk in cookie */
 1486                 return (NULL);
 1487         }
 1488         chk_length = ntohs(initack_cp->ch.chunk_length);
 1489         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
 1490                 return (NULL);
 1491         }
 1492         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1493             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
 1494                 /*
 1495                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
 1496                  * to get into the OPEN state
 1497                  */
 1498                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
 1499                         /*-
 1500                          * Opps, this means that we somehow generated two vtag's
 1501                          * the same. I.e. we did:
 1502                          *  Us               Peer
 1503                          *   <---INIT(tag=a)------
 1504                          *   ----INIT-ACK(tag=t)-->
 1505                          *   ----INIT(tag=t)------> *1
 1506                          *   <---INIT-ACK(tag=a)---
 1507                          *   <----CE(tag=t)------------- *2
 1508                          *
 1509                          * At point *1 we should be generating a different
 1510                          * tag t'. Which means we would throw away the CE and send
 1511                          * ours instead. Basically this is case C (throw away side).
 1512                          */
 1513                         if (how_indx < sizeof(asoc->cookie_how))
 1514                                 asoc->cookie_how[how_indx] = 17;
 1515                         return (NULL);
 1516 
 1517                 }
 1518                 switch SCTP_GET_STATE
 1519                         (asoc) {
 1520                 case SCTP_STATE_COOKIE_WAIT:
 1521                 case SCTP_STATE_COOKIE_ECHOED:
 1522                         /*
 1523                          * INIT was sent but got a COOKIE_ECHO with the
 1524                          * correct tags... just accept it...but we must
 1525                          * process the init so that we can make sure we have
 1526                          * the right seq no's.
 1527                          */
 1528                         /* First we must process the INIT !! */
 1529                         retval = sctp_process_init(init_cp, stcb, net);
 1530                         if (retval < 0) {
 1531                                 if (how_indx < sizeof(asoc->cookie_how))
 1532                                         asoc->cookie_how[how_indx] = 3;
 1533                                 return (NULL);
 1534                         }
 1535                         /* we have already processed the INIT so no problem */
 1536                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
 1537                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
 1538                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
 1539                         /* update current state */
 1540                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
 1541                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 1542                         else
 1543                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1544 
 1545                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1546                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1547                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1548                                     stcb->sctp_ep, stcb, asoc->primary_destination);
 1549                         }
 1550                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1551                         sctp_stop_all_cookie_timers(stcb);
 1552                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1553                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 1554                             (inp->sctp_socket->so_qlimit == 0)
 1555                             ) {
 1556 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1557                                 struct socket *so;
 1558 
 1559 #endif
 1560                                 /*
 1561                                  * Here is where collision would go if we
 1562                                  * did a connect() and instead got a
 1563                                  * init/init-ack/cookie done before the
 1564                                  * init-ack came back..
 1565                                  */
 1566                                 stcb->sctp_ep->sctp_flags |=
 1567                                     SCTP_PCB_FLAGS_CONNECTED;
 1568 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1569                                 so = SCTP_INP_SO(stcb->sctp_ep);
 1570                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1571                                 SCTP_TCB_UNLOCK(stcb);
 1572                                 SCTP_SOCKET_LOCK(so, 1);
 1573                                 SCTP_TCB_LOCK(stcb);
 1574                                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1575                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1576                                         SCTP_SOCKET_UNLOCK(so, 1);
 1577                                         return (NULL);
 1578                                 }
 1579 #endif
 1580                                 soisconnected(stcb->sctp_socket);
 1581 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1582                                 SCTP_SOCKET_UNLOCK(so, 1);
 1583 #endif
 1584                         }
 1585                         /* notify upper layer */
 1586                         *notification = SCTP_NOTIFY_ASSOC_UP;
 1587                         /*
 1588                          * since we did not send a HB make sure we don't
 1589                          * double things
 1590                          */
 1591                         net->hb_responded = 1;
 1592                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
 1593                             &cookie->time_entered,
 1594                             sctp_align_unsafe_makecopy,
 1595                             SCTP_RTT_FROM_NON_DATA);
 1596 
 1597                         if (stcb->asoc.sctp_autoclose_ticks &&
 1598                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
 1599                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
 1600                                     inp, stcb, NULL);
 1601                         }
 1602                         break;
 1603                 default:
 1604                         /*
 1605                          * we're in the OPEN state (or beyond), so peer must
 1606                          * have simply lost the COOKIE-ACK
 1607                          */
 1608                         break;
 1609                         }       /* end switch */
 1610                 sctp_stop_all_cookie_timers(stcb);
 1611                 /*
 1612                  * We ignore the return code here.. not sure if we should
 1613                  * somehow abort.. but we do have an existing asoc. This
 1614                  * really should not fail.
 1615                  */
 1616                 if (sctp_load_addresses_from_init(stcb, m, iphlen,
 1617                     init_offset + sizeof(struct sctp_init_chunk),
 1618                     initack_offset, sh, init_src)) {
 1619                         if (how_indx < sizeof(asoc->cookie_how))
 1620                                 asoc->cookie_how[how_indx] = 4;
 1621                         return (NULL);
 1622                 }
 1623                 /* respond with a COOKIE-ACK */
 1624                 sctp_toss_old_cookies(stcb, asoc);
 1625                 sctp_send_cookie_ack(stcb);
 1626                 if (how_indx < sizeof(asoc->cookie_how))
 1627                         asoc->cookie_how[how_indx] = 5;
 1628                 return (stcb);
 1629         }
 1630         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
 1631             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
 1632             cookie->tie_tag_my_vtag == 0 &&
 1633             cookie->tie_tag_peer_vtag == 0) {
 1634                 /*
 1635                  * case C in Section 5.2.4 Table 2: XMOO silently discard
 1636                  */
 1637                 if (how_indx < sizeof(asoc->cookie_how))
 1638                         asoc->cookie_how[how_indx] = 6;
 1639                 return (NULL);
 1640         }
 1641         /*
 1642          * If nat support, and the below and stcb is established, send back
 1643          * a ABORT(colliding state) if we are established.
 1644          */
 1645         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
 1646             (asoc->peer_supports_nat) &&
 1647             ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1648             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
 1649             (asoc->peer_vtag == 0)))) {
 1650                 /*
 1651                  * Special case - Peer's support nat. We may have two init's
 1652                  * that we gave out the same tag on since one was not
 1653                  * established.. i.e. we get INIT from host-1 behind the nat
 1654                  * and we respond tag-a, we get a INIT from host-2 behind
 1655                  * the nat and we get tag-a again. Then we bring up host-1
 1656                  * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
 1657                  * Now we have colliding state. We must send an abort here
 1658                  * with colliding state indication.
 1659                  */
 1660                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
 1661                     0, M_DONTWAIT, 1, MT_DATA);
 1662                 if (op_err == NULL) {
 1663                         /* FOOBAR */
 1664                         return (NULL);
 1665                 }
 1666                 /* pre-reserve some space */
 1667 #ifdef INET6
 1668                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
 1669 #else
 1670                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
 1671 #endif
 1672                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
 1673                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
 1674                 /* Set the len */
 1675                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
 1676                 ph = mtod(op_err, struct sctp_paramhdr *);
 1677                 ph->param_type = htons(SCTP_CAUSE_NAT_COLLIDING_STATE);
 1678                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
 1679                 sctp_send_abort(m, iphlen, sh, 0, op_err, vrf_id, port);
 1680                 return (NULL);
 1681         }
 1682         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
 1683             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
 1684             (asoc->peer_vtag == 0))) {
 1685                 /*
 1686                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
 1687                  * should be ok, re-accept peer info
 1688                  */
 1689                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
 1690                         /*
 1691                          * Extension of case C. If we hit this, then the
 1692                          * random number generator returned the same vtag
 1693                          * when we first sent our INIT-ACK and when we later
 1694                          * sent our INIT. The side with the seq numbers that
 1695                          * are different will be the one that normnally
 1696                          * would have hit case C. This in effect "extends"
 1697                          * our vtags in this collision case to be 64 bits.
 1698                          * The same collision could occur aka you get both
 1699                          * vtag and seq number the same twice in a row.. but
 1700                          * is much less likely. If it did happen then we
 1701                          * would proceed through and bring up the assoc.. we
 1702                          * may end up with the wrong stream setup however..
 1703                          * which would be bad.. but there is no way to
 1704                          * tell.. until we send on a stream that does not
 1705                          * exist :-)
 1706                          */
 1707                         if (how_indx < sizeof(asoc->cookie_how))
 1708                                 asoc->cookie_how[how_indx] = 7;
 1709 
 1710                         return (NULL);
 1711                 }
 1712                 if (how_indx < sizeof(asoc->cookie_how))
 1713                         asoc->cookie_how[how_indx] = 8;
 1714                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
 1715                 sctp_stop_all_cookie_timers(stcb);
 1716                 /*
 1717                  * since we did not send a HB make sure we don't double
 1718                  * things
 1719                  */
 1720                 net->hb_responded = 1;
 1721                 if (stcb->asoc.sctp_autoclose_ticks &&
 1722                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 1723                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
 1724                             NULL);
 1725                 }
 1726                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 1727                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
 1728 
 1729                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
 1730                         /*
 1731                          * Ok the peer probably discarded our data (if we
 1732                          * echoed a cookie+data). So anything on the
 1733                          * sent_queue should be marked for retransmit, we
 1734                          * may not get something to kick us so it COULD
 1735                          * still take a timeout to move these.. but it can't
 1736                          * hurt to mark them.
 1737                          */
 1738                         struct sctp_tmit_chunk *chk;
 1739 
 1740                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 1741                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
 1742                                         chk->sent = SCTP_DATAGRAM_RESEND;
 1743                                         sctp_flight_size_decrease(chk);
 1744                                         sctp_total_flight_decrease(stcb, chk);
 1745                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 1746                                         spec_flag++;
 1747                                 }
 1748                         }
 1749 
 1750                 }
 1751                 /* process the INIT info (peer's info) */
 1752                 retval = sctp_process_init(init_cp, stcb, net);
 1753                 if (retval < 0) {
 1754                         if (how_indx < sizeof(asoc->cookie_how))
 1755                                 asoc->cookie_how[how_indx] = 9;
 1756                         return (NULL);
 1757                 }
 1758                 if (sctp_load_addresses_from_init(stcb, m, iphlen,
 1759                     init_offset + sizeof(struct sctp_init_chunk),
 1760                     initack_offset, sh, init_src)) {
 1761                         if (how_indx < sizeof(asoc->cookie_how))
 1762                                 asoc->cookie_how[how_indx] = 10;
 1763                         return (NULL);
 1764                 }
 1765                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
 1766                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
 1767                         *notification = SCTP_NOTIFY_ASSOC_UP;
 1768 
 1769                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 1770                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 1771                             (inp->sctp_socket->so_qlimit == 0)) {
 1772 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1773                                 struct socket *so;
 1774 
 1775 #endif
 1776                                 stcb->sctp_ep->sctp_flags |=
 1777                                     SCTP_PCB_FLAGS_CONNECTED;
 1778 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1779                                 so = SCTP_INP_SO(stcb->sctp_ep);
 1780                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1781                                 SCTP_TCB_UNLOCK(stcb);
 1782                                 SCTP_SOCKET_LOCK(so, 1);
 1783                                 SCTP_TCB_LOCK(stcb);
 1784                                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1785                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 1786                                         SCTP_SOCKET_UNLOCK(so, 1);
 1787                                         return (NULL);
 1788                                 }
 1789 #endif
 1790                                 soisconnected(stcb->sctp_socket);
 1791 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 1792                                 SCTP_SOCKET_UNLOCK(so, 1);
 1793 #endif
 1794                         }
 1795                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
 1796                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 1797                         else
 1798                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1799                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1800                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
 1801                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
 1802                 } else {
 1803                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
 1804                 }
 1805                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1806                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1807                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1808                             stcb->sctp_ep, stcb, asoc->primary_destination);
 1809                 }
 1810                 sctp_stop_all_cookie_timers(stcb);
 1811                 sctp_toss_old_cookies(stcb, asoc);
 1812                 sctp_send_cookie_ack(stcb);
 1813                 if (spec_flag) {
 1814                         /*
 1815                          * only if we have retrans set do we do this. What
 1816                          * this call does is get only the COOKIE-ACK out and
 1817                          * then when we return the normal call to
 1818                          * sctp_chunk_output will get the retrans out behind
 1819                          * this.
 1820                          */
 1821                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
 1822                 }
 1823                 if (how_indx < sizeof(asoc->cookie_how))
 1824                         asoc->cookie_how[how_indx] = 11;
 1825 
 1826                 return (stcb);
 1827         }
 1828         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
 1829             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
 1830             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
 1831             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
 1832             cookie->tie_tag_peer_vtag != 0) {
 1833                 struct sctpasochead *head;
 1834 
 1835                 if (asoc->peer_supports_nat) {
 1836                         /*
 1837                          * This is a gross gross hack. just call the
 1838                          * cookie_new code since we are allowing a duplicate
 1839                          * association. I hope this works...
 1840                          */
 1841                         return (sctp_process_cookie_new(m, iphlen, offset, sh, cookie, cookie_len,
 1842                             inp, netp, init_src, notification,
 1843                             auth_skipped, auth_offset, auth_len,
 1844                             vrf_id, port));
 1845                 }
 1846                 /*
 1847                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
 1848                  */
 1849                 /* temp code */
 1850                 if (how_indx < sizeof(asoc->cookie_how))
 1851                         asoc->cookie_how[how_indx] = 12;
 1852                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
 1853                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 1854 
 1855                 *sac_assoc_id = sctp_get_associd(stcb);
 1856                 /* notify upper layer */
 1857                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
 1858                 atomic_add_int(&stcb->asoc.refcnt, 1);
 1859                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
 1860                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 1861                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 1862                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 1863                 }
 1864                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
 1865                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
 1866                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
 1867                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
 1868                 }
 1869                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 1870                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1871                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 1872                             stcb->sctp_ep, stcb, asoc->primary_destination);
 1873 
 1874                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
 1875                         /* move to OPEN state, if not in SHUTDOWN_SENT */
 1876                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 1877                 }
 1878                 asoc->pre_open_streams =
 1879                     ntohs(initack_cp->init.num_outbound_streams);
 1880                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
 1881                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
 1882                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 1883 
 1884                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
 1885 
 1886                 asoc->str_reset_seq_in = asoc->init_seq_number;
 1887 
 1888                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 1889                 if (asoc->mapping_array) {
 1890                         memset(asoc->mapping_array, 0,
 1891                             asoc->mapping_array_size);
 1892                 }
 1893                 if (asoc->nr_mapping_array) {
 1894                         memset(asoc->nr_mapping_array, 0,
 1895                             asoc->mapping_array_size);
 1896                 }
 1897                 SCTP_TCB_UNLOCK(stcb);
 1898                 SCTP_INP_INFO_WLOCK();
 1899                 SCTP_INP_WLOCK(stcb->sctp_ep);
 1900                 SCTP_TCB_LOCK(stcb);
 1901                 atomic_add_int(&stcb->asoc.refcnt, -1);
 1902                 /* send up all the data */
 1903                 SCTP_TCB_SEND_LOCK(stcb);
 1904 
 1905                 sctp_report_all_outbound(stcb, 1, SCTP_SO_NOT_LOCKED);
 1906                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 1907                         stcb->asoc.strmout[i].stream_no = i;
 1908                         stcb->asoc.strmout[i].next_sequence_sent = 0;
 1909                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
 1910                 }
 1911                 /* process the INIT-ACK info (my info) */
 1912                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
 1913                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 1914 
 1915                 /* pull from vtag hash */
 1916                 LIST_REMOVE(stcb, sctp_asocs);
 1917                 /* re-insert to new vtag position */
 1918                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
 1919                     SCTP_BASE_INFO(hashasocmark))];
 1920                 /*
 1921                  * put it in the bucket in the vtag hash of assoc's for the
 1922                  * system
 1923                  */
 1924                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 1925 
 1926                 /* process the INIT info (peer's info) */
 1927                 SCTP_TCB_SEND_UNLOCK(stcb);
 1928                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
 1929                 SCTP_INP_INFO_WUNLOCK();
 1930 
 1931                 retval = sctp_process_init(init_cp, stcb, net);
 1932                 if (retval < 0) {
 1933                         if (how_indx < sizeof(asoc->cookie_how))
 1934                                 asoc->cookie_how[how_indx] = 13;
 1935 
 1936                         return (NULL);
 1937                 }
 1938                 /*
 1939                  * since we did not send a HB make sure we don't double
 1940                  * things
 1941                  */
 1942                 net->hb_responded = 1;
 1943 
 1944                 if (sctp_load_addresses_from_init(stcb, m, iphlen,
 1945                     init_offset + sizeof(struct sctp_init_chunk),
 1946                     initack_offset, sh, init_src)) {
 1947                         if (how_indx < sizeof(asoc->cookie_how))
 1948                                 asoc->cookie_how[how_indx] = 14;
 1949 
 1950                         return (NULL);
 1951                 }
 1952                 /* respond with a COOKIE-ACK */
 1953                 sctp_stop_all_cookie_timers(stcb);
 1954                 sctp_toss_old_cookies(stcb, asoc);
 1955                 sctp_send_cookie_ack(stcb);
 1956                 if (how_indx < sizeof(asoc->cookie_how))
 1957                         asoc->cookie_how[how_indx] = 15;
 1958 
 1959                 return (stcb);
 1960         }
 1961         if (how_indx < sizeof(asoc->cookie_how))
 1962                 asoc->cookie_how[how_indx] = 16;
 1963         /* all other cases... */
 1964         return (NULL);
 1965 }
 1966 
 1967 
 1968 /*
 1969  * handle a state cookie for a new association m: input packet mbuf chain--
 1970  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
 1971  * and the cookie signature does not exist offset: offset into mbuf to the
 1972  * cookie-echo chunk length: length of the cookie chunk to: where the init
 1973  * was from returns a new TCB
 1974  */
 1975 struct sctp_tcb *
 1976 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
 1977     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
 1978     struct sctp_inpcb *inp, struct sctp_nets **netp,
 1979     struct sockaddr *init_src, int *notification,
 1980     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 1981     uint32_t vrf_id, uint16_t port)
 1982 {
 1983         struct sctp_tcb *stcb;
 1984         struct sctp_init_chunk *init_cp, init_buf;
 1985         struct sctp_init_ack_chunk *initack_cp, initack_buf;
 1986         struct sockaddr_storage sa_store;
 1987         struct sockaddr *initack_src = (struct sockaddr *)&sa_store;
 1988         struct sctp_association *asoc;
 1989         int chk_length;
 1990         int init_offset, initack_offset, initack_limit;
 1991         int retval;
 1992         int error = 0;
 1993         uint32_t old_tag;
 1994         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
 1995 
 1996 #ifdef INET
 1997         struct sockaddr_in *sin;
 1998 
 1999 #endif
 2000 #ifdef INET6
 2001         struct sockaddr_in6 *sin6;
 2002 
 2003 #endif
 2004 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2005         struct socket *so;
 2006 
 2007         so = SCTP_INP_SO(inp);
 2008 #endif
 2009 
 2010         /*
 2011          * find and validate the INIT chunk in the cookie (peer's info) the
 2012          * INIT should start after the cookie-echo header struct (chunk
 2013          * header, state cookie header struct)
 2014          */
 2015         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
 2016         init_cp = (struct sctp_init_chunk *)
 2017             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
 2018             (uint8_t *) & init_buf);
 2019         if (init_cp == NULL) {
 2020                 /* could not pull a INIT chunk in cookie */
 2021                 SCTPDBG(SCTP_DEBUG_INPUT1,
 2022                     "process_cookie_new: could not pull INIT chunk hdr\n");
 2023                 return (NULL);
 2024         }
 2025         chk_length = ntohs(init_cp->ch.chunk_length);
 2026         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
 2027                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
 2028                 return (NULL);
 2029         }
 2030         initack_offset = init_offset + SCTP_SIZE32(chk_length);
 2031         /*
 2032          * find and validate the INIT-ACK chunk in the cookie (my info) the
 2033          * INIT-ACK follows the INIT chunk
 2034          */
 2035         initack_cp = (struct sctp_init_ack_chunk *)
 2036             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
 2037             (uint8_t *) & initack_buf);
 2038         if (initack_cp == NULL) {
 2039                 /* could not pull INIT-ACK chunk in cookie */
 2040                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
 2041                 return (NULL);
 2042         }
 2043         chk_length = ntohs(initack_cp->ch.chunk_length);
 2044         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
 2045                 return (NULL);
 2046         }
 2047         /*
 2048          * NOTE: We can't use the INIT_ACK's chk_length to determine the
 2049          * "initack_limit" value.  This is because the chk_length field
 2050          * includes the length of the cookie, but the cookie is omitted when
 2051          * the INIT and INIT_ACK are tacked onto the cookie...
 2052          */
 2053         initack_limit = offset + cookie_len;
 2054 
 2055         /*
 2056          * now that we know the INIT/INIT-ACK are in place, create a new TCB
 2057          * and popluate
 2058          */
 2059 
 2060         /*
 2061          * Here we do a trick, we set in NULL for the proc/thread argument.
 2062          * We do this since in effect we only use the p argument when the
 2063          * socket is unbound and we must do an implicit bind. Since we are
 2064          * getting a cookie, we cannot be unbound.
 2065          */
 2066         stcb = sctp_aloc_assoc(inp, init_src, &error,
 2067             ntohl(initack_cp->init.initiate_tag), vrf_id,
 2068             (struct thread *)NULL
 2069             );
 2070         if (stcb == NULL) {
 2071                 struct mbuf *op_err;
 2072 
 2073                 /* memory problem? */
 2074                 SCTPDBG(SCTP_DEBUG_INPUT1,
 2075                     "process_cookie_new: no room for another TCB!\n");
 2076                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
 2077 
 2078                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
 2079                     sh, op_err, vrf_id, port);
 2080                 return (NULL);
 2081         }
 2082         /* get the correct sctp_nets */
 2083         if (netp)
 2084                 *netp = sctp_findnet(stcb, init_src);
 2085 
 2086         asoc = &stcb->asoc;
 2087         /* get scope variables out of cookie */
 2088         asoc->ipv4_local_scope = cookie->ipv4_scope;
 2089         asoc->site_scope = cookie->site_scope;
 2090         asoc->local_scope = cookie->local_scope;
 2091         asoc->loopback_scope = cookie->loopback_scope;
 2092 
 2093         if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) ||
 2094             (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) {
 2095                 struct mbuf *op_err;
 2096 
 2097                 /*
 2098                  * Houston we have a problem. The EP changed while the
 2099                  * cookie was in flight. Only recourse is to abort the
 2100                  * association.
 2101                  */
 2102                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2103                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
 2104                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
 2105                     sh, op_err, vrf_id, port);
 2106 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2107                 SCTP_TCB_UNLOCK(stcb);
 2108                 SCTP_SOCKET_LOCK(so, 1);
 2109                 SCTP_TCB_LOCK(stcb);
 2110 #endif
 2111                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
 2112                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 2113 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2114                 SCTP_SOCKET_UNLOCK(so, 1);
 2115 #endif
 2116                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2117                 return (NULL);
 2118         }
 2119         /* process the INIT-ACK info (my info) */
 2120         old_tag = asoc->my_vtag;
 2121         asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
 2122         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
 2123         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
 2124         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
 2125         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
 2126         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 2127         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
 2128         asoc->str_reset_seq_in = asoc->init_seq_number;
 2129 
 2130         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 2131 
 2132         /* process the INIT info (peer's info) */
 2133         if (netp)
 2134                 retval = sctp_process_init(init_cp, stcb, *netp);
 2135         else
 2136                 retval = 0;
 2137         if (retval < 0) {
 2138                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2139 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2140                 SCTP_TCB_UNLOCK(stcb);
 2141                 SCTP_SOCKET_LOCK(so, 1);
 2142                 SCTP_TCB_LOCK(stcb);
 2143 #endif
 2144                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
 2145 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2146                 SCTP_SOCKET_UNLOCK(so, 1);
 2147 #endif
 2148                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2149                 return (NULL);
 2150         }
 2151         /* load all addresses */
 2152         if (sctp_load_addresses_from_init(stcb, m, iphlen,
 2153             init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh,
 2154             init_src)) {
 2155                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2156 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2157                 SCTP_TCB_UNLOCK(stcb);
 2158                 SCTP_SOCKET_LOCK(so, 1);
 2159                 SCTP_TCB_LOCK(stcb);
 2160 #endif
 2161                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
 2162 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2163                 SCTP_SOCKET_UNLOCK(so, 1);
 2164 #endif
 2165                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2166                 return (NULL);
 2167         }
 2168         /*
 2169          * verify any preceding AUTH chunk that was skipped
 2170          */
 2171         /* pull the local authentication parameters from the cookie/init-ack */
 2172         sctp_auth_get_cookie_params(stcb, m,
 2173             initack_offset + sizeof(struct sctp_init_ack_chunk),
 2174             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
 2175         if (auth_skipped) {
 2176                 struct sctp_auth_chunk *auth;
 2177 
 2178                 auth = (struct sctp_auth_chunk *)
 2179                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
 2180                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
 2181                         /* auth HMAC failed, dump the assoc and packet */
 2182                         SCTPDBG(SCTP_DEBUG_AUTH1,
 2183                             "COOKIE-ECHO: AUTH failed\n");
 2184                         atomic_add_int(&stcb->asoc.refcnt, 1);
 2185 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2186                         SCTP_TCB_UNLOCK(stcb);
 2187                         SCTP_SOCKET_LOCK(so, 1);
 2188                         SCTP_TCB_LOCK(stcb);
 2189 #endif
 2190                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
 2191 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2192                         SCTP_SOCKET_UNLOCK(so, 1);
 2193 #endif
 2194                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2195                         return (NULL);
 2196                 } else {
 2197                         /* remaining chunks checked... good to go */
 2198                         stcb->asoc.authenticated = 1;
 2199                 }
 2200         }
 2201         /* update current state */
 2202         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
 2203         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 2204         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 2205                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 2206                     stcb->sctp_ep, stcb, asoc->primary_destination);
 2207         }
 2208         sctp_stop_all_cookie_timers(stcb);
 2209         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
 2210         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 2211 
 2212         /*
 2213          * if we're doing ASCONFs, check to see if we have any new local
 2214          * addresses that need to get added to the peer (eg. addresses
 2215          * changed while cookie echo in flight).  This needs to be done
 2216          * after we go to the OPEN state to do the correct asconf
 2217          * processing. else, make sure we have the correct addresses in our
 2218          * lists
 2219          */
 2220 
 2221         /* warning, we re-use sin, sin6, sa_store here! */
 2222         /* pull in local_address (our "from" address) */
 2223         switch (cookie->laddr_type) {
 2224 #ifdef INET
 2225         case SCTP_IPV4_ADDRESS:
 2226                 /* source addr is IPv4 */
 2227                 sin = (struct sockaddr_in *)initack_src;
 2228                 memset(sin, 0, sizeof(*sin));
 2229                 sin->sin_family = AF_INET;
 2230                 sin->sin_len = sizeof(struct sockaddr_in);
 2231                 sin->sin_addr.s_addr = cookie->laddress[0];
 2232                 break;
 2233 #endif
 2234 #ifdef INET6
 2235         case SCTP_IPV6_ADDRESS:
 2236                 /* source addr is IPv6 */
 2237                 sin6 = (struct sockaddr_in6 *)initack_src;
 2238                 memset(sin6, 0, sizeof(*sin6));
 2239                 sin6->sin6_family = AF_INET6;
 2240                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 2241                 sin6->sin6_scope_id = cookie->scope_id;
 2242                 memcpy(&sin6->sin6_addr, cookie->laddress,
 2243                     sizeof(sin6->sin6_addr));
 2244                 break;
 2245 #endif
 2246         default:
 2247                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2248 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2249                 SCTP_TCB_UNLOCK(stcb);
 2250                 SCTP_SOCKET_LOCK(so, 1);
 2251                 SCTP_TCB_LOCK(stcb);
 2252 #endif
 2253                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
 2254 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2255                 SCTP_SOCKET_UNLOCK(so, 1);
 2256 #endif
 2257                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2258                 return (NULL);
 2259         }
 2260 
 2261         /* set up to notify upper layer */
 2262         *notification = SCTP_NOTIFY_ASSOC_UP;
 2263         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 2264             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
 2265             (inp->sctp_socket->so_qlimit == 0)) {
 2266                 /*
 2267                  * This is an endpoint that called connect() how it got a
 2268                  * cookie that is NEW is a bit of a mystery. It must be that
 2269                  * the INIT was sent, but before it got there.. a complete
 2270                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
 2271                  * should have went to the other code.. not here.. oh well..
 2272                  * a bit of protection is worth having..
 2273                  */
 2274                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
 2275 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2276                 atomic_add_int(&stcb->asoc.refcnt, 1);
 2277                 SCTP_TCB_UNLOCK(stcb);
 2278                 SCTP_SOCKET_LOCK(so, 1);
 2279                 SCTP_TCB_LOCK(stcb);
 2280                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2281                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 2282                         SCTP_SOCKET_UNLOCK(so, 1);
 2283                         return (NULL);
 2284                 }
 2285 #endif
 2286                 soisconnected(stcb->sctp_socket);
 2287 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2288                 SCTP_SOCKET_UNLOCK(so, 1);
 2289 #endif
 2290         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 2291             (inp->sctp_socket->so_qlimit)) {
 2292                 /*
 2293                  * We don't want to do anything with this one. Since it is
 2294                  * the listening guy. The timer will get started for
 2295                  * accepted connections in the caller.
 2296                  */
 2297                 ;
 2298         }
 2299         /* since we did not send a HB make sure we don't double things */
 2300         if ((netp) && (*netp))
 2301                 (*netp)->hb_responded = 1;
 2302 
 2303         if (stcb->asoc.sctp_autoclose_ticks &&
 2304             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 2305                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
 2306         }
 2307         /* calculate the RTT */
 2308         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
 2309         if ((netp) && (*netp)) {
 2310                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
 2311                     &cookie->time_entered, sctp_align_unsafe_makecopy,
 2312                     SCTP_RTT_FROM_NON_DATA);
 2313         }
 2314         /* respond with a COOKIE-ACK */
 2315         sctp_send_cookie_ack(stcb);
 2316 
 2317         /*
 2318          * check the address lists for any ASCONFs that need to be sent
 2319          * AFTER the cookie-ack is sent
 2320          */
 2321         sctp_check_address_list(stcb, m,
 2322             initack_offset + sizeof(struct sctp_init_ack_chunk),
 2323             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
 2324             initack_src, cookie->local_scope, cookie->site_scope,
 2325             cookie->ipv4_scope, cookie->loopback_scope);
 2326 
 2327 
 2328         return (stcb);
 2329 }
 2330 
 2331 /*
 2332  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
 2333  * we NEED to make sure we are not already using the vtag. If so we
 2334  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
 2335         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
 2336                                                             SCTP_BASE_INFO(hashasocmark))];
 2337         LIST_FOREACH(stcb, head, sctp_asocs) {
 2338                 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
 2339                        -- SEND ABORT - TRY AGAIN --
 2340                 }
 2341         }
 2342 */
 2343 
 2344 /*
 2345  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
 2346  * existing (non-NULL) TCB
 2347  */
 2348 static struct mbuf *
 2349 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 2350     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
 2351     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
 2352     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
 2353     struct sctp_tcb **locked_tcb, uint32_t vrf_id, uint16_t port)
 2354 {
 2355         struct sctp_state_cookie *cookie;
 2356         struct sctp_tcb *l_stcb = *stcb;
 2357         struct sctp_inpcb *l_inp;
 2358         struct sockaddr *to;
 2359         sctp_assoc_t sac_restart_id;
 2360         struct sctp_pcb *ep;
 2361         struct mbuf *m_sig;
 2362         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
 2363         uint8_t *sig;
 2364         uint8_t cookie_ok = 0;
 2365         unsigned int size_of_pkt, sig_offset, cookie_offset;
 2366         unsigned int cookie_len;
 2367         struct timeval now;
 2368         struct timeval time_expires;
 2369         struct sockaddr_storage dest_store;
 2370         struct sockaddr *localep_sa = (struct sockaddr *)&dest_store;
 2371         struct ip *iph;
 2372         int notification = 0;
 2373         struct sctp_nets *netl;
 2374         int had_a_existing_tcb = 0;
 2375         int send_int_conf = 0;
 2376 
 2377 #ifdef INET
 2378         struct sockaddr_in sin;
 2379 
 2380 #endif
 2381 #ifdef INET6
 2382         struct sockaddr_in6 sin6;
 2383 
 2384 #endif
 2385 
 2386         SCTPDBG(SCTP_DEBUG_INPUT2,
 2387             "sctp_handle_cookie: handling COOKIE-ECHO\n");
 2388 
 2389         if (inp_p == NULL) {
 2390                 return (NULL);
 2391         }
 2392         /* First get the destination address setup too. */
 2393         iph = mtod(m, struct ip *);
 2394         switch (iph->ip_v) {
 2395 #ifdef INET
 2396         case IPVERSION:
 2397                 {
 2398                         /* its IPv4 */
 2399                         struct sockaddr_in *lsin;
 2400 
 2401                         lsin = (struct sockaddr_in *)(localep_sa);
 2402                         memset(lsin, 0, sizeof(*lsin));
 2403                         lsin->sin_family = AF_INET;
 2404                         lsin->sin_len = sizeof(*lsin);
 2405                         lsin->sin_port = sh->dest_port;
 2406                         lsin->sin_addr.s_addr = iph->ip_dst.s_addr;
 2407                         size_of_pkt = SCTP_GET_IPV4_LENGTH(iph);
 2408                         break;
 2409                 }
 2410 #endif
 2411 #ifdef INET6
 2412         case IPV6_VERSION >> 4:
 2413                 {
 2414                         /* its IPv6 */
 2415                         struct ip6_hdr *ip6;
 2416                         struct sockaddr_in6 *lsin6;
 2417 
 2418                         lsin6 = (struct sockaddr_in6 *)(localep_sa);
 2419                         memset(lsin6, 0, sizeof(*lsin6));
 2420                         lsin6->sin6_family = AF_INET6;
 2421                         lsin6->sin6_len = sizeof(struct sockaddr_in6);
 2422                         ip6 = mtod(m, struct ip6_hdr *);
 2423                         lsin6->sin6_port = sh->dest_port;
 2424                         lsin6->sin6_addr = ip6->ip6_dst;
 2425                         size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen;
 2426                         break;
 2427                 }
 2428 #endif
 2429         default:
 2430                 return (NULL);
 2431         }
 2432 
 2433         cookie = &cp->cookie;
 2434         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
 2435         cookie_len = ntohs(cp->ch.chunk_length);
 2436 
 2437         if ((cookie->peerport != sh->src_port) &&
 2438             (cookie->myport != sh->dest_port) &&
 2439             (cookie->my_vtag != sh->v_tag)) {
 2440                 /*
 2441                  * invalid ports or bad tag.  Note that we always leave the
 2442                  * v_tag in the header in network order and when we stored
 2443                  * it in the my_vtag slot we also left it in network order.
 2444                  * This maintains the match even though it may be in the
 2445                  * opposite byte order of the machine :->
 2446                  */
 2447                 return (NULL);
 2448         }
 2449         if (cookie_len > size_of_pkt ||
 2450             cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
 2451             sizeof(struct sctp_init_chunk) +
 2452             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
 2453                 /* cookie too long!  or too small */
 2454                 return (NULL);
 2455         }
 2456         /*
 2457          * split off the signature into its own mbuf (since it should not be
 2458          * calculated in the sctp_hmac_m() call).
 2459          */
 2460         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
 2461         if (sig_offset > size_of_pkt) {
 2462                 /* packet not correct size! */
 2463                 /* XXX this may already be accounted for earlier... */
 2464                 return (NULL);
 2465         }
 2466         m_sig = m_split(m, sig_offset, M_DONTWAIT);
 2467         if (m_sig == NULL) {
 2468                 /* out of memory or ?? */
 2469                 return (NULL);
 2470         }
 2471 #ifdef SCTP_MBUF_LOGGING
 2472         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 2473                 struct mbuf *mat;
 2474 
 2475                 mat = m_sig;
 2476                 while (mat) {
 2477                         if (SCTP_BUF_IS_EXTENDED(mat)) {
 2478                                 sctp_log_mb(mat, SCTP_MBUF_SPLIT);
 2479                         }
 2480                         mat = SCTP_BUF_NEXT(mat);
 2481                 }
 2482         }
 2483 #endif
 2484 
 2485         /*
 2486          * compute the signature/digest for the cookie
 2487          */
 2488         ep = &(*inp_p)->sctp_ep;
 2489         l_inp = *inp_p;
 2490         if (l_stcb) {
 2491                 SCTP_TCB_UNLOCK(l_stcb);
 2492         }
 2493         SCTP_INP_RLOCK(l_inp);
 2494         if (l_stcb) {
 2495                 SCTP_TCB_LOCK(l_stcb);
 2496         }
 2497         /* which cookie is it? */
 2498         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
 2499             (ep->current_secret_number != ep->last_secret_number)) {
 2500                 /* it's the old cookie */
 2501                 (void)sctp_hmac_m(SCTP_HMAC,
 2502                     (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
 2503                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2504         } else {
 2505                 /* it's the current cookie */
 2506                 (void)sctp_hmac_m(SCTP_HMAC,
 2507                     (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
 2508                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2509         }
 2510         /* get the signature */
 2511         SCTP_INP_RUNLOCK(l_inp);
 2512         sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
 2513         if (sig == NULL) {
 2514                 /* couldn't find signature */
 2515                 sctp_m_freem(m_sig);
 2516                 return (NULL);
 2517         }
 2518         /* compare the received digest with the computed digest */
 2519         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
 2520                 /* try the old cookie? */
 2521                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
 2522                     (ep->current_secret_number != ep->last_secret_number)) {
 2523                         /* compute digest with old */
 2524                         (void)sctp_hmac_m(SCTP_HMAC,
 2525                             (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
 2526                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
 2527                         /* compare */
 2528                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
 2529                                 cookie_ok = 1;
 2530                 }
 2531         } else {
 2532                 cookie_ok = 1;
 2533         }
 2534 
 2535         /*
 2536          * Now before we continue we must reconstruct our mbuf so that
 2537          * normal processing of any other chunks will work.
 2538          */
 2539         {
 2540                 struct mbuf *m_at;
 2541 
 2542                 m_at = m;
 2543                 while (SCTP_BUF_NEXT(m_at) != NULL) {
 2544                         m_at = SCTP_BUF_NEXT(m_at);
 2545                 }
 2546                 SCTP_BUF_NEXT(m_at) = m_sig;
 2547         }
 2548 
 2549         if (cookie_ok == 0) {
 2550                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
 2551                 SCTPDBG(SCTP_DEBUG_INPUT2,
 2552                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
 2553                     (uint32_t) offset, cookie_offset, sig_offset);
 2554                 return (NULL);
 2555         }
 2556         /*
 2557          * check the cookie timestamps to be sure it's not stale
 2558          */
 2559         (void)SCTP_GETTIME_TIMEVAL(&now);
 2560         /* Expire time is in Ticks, so we convert to seconds */
 2561         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
 2562         time_expires.tv_usec = cookie->time_entered.tv_usec;
 2563         /*
 2564          * TODO sctp_constants.h needs alternative time macros when _KERNEL
 2565          * is undefined.
 2566          */
 2567         if (timevalcmp(&now, &time_expires, >)) {
 2568                 /* cookie is stale! */
 2569                 struct mbuf *op_err;
 2570                 struct sctp_stale_cookie_msg *scm;
 2571                 uint32_t tim;
 2572 
 2573                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
 2574                     0, M_DONTWAIT, 1, MT_DATA);
 2575                 if (op_err == NULL) {
 2576                         /* FOOBAR */
 2577                         return (NULL);
 2578                 }
 2579                 /* Set the len */
 2580                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
 2581                 scm = mtod(op_err, struct sctp_stale_cookie_msg *);
 2582                 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
 2583                 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
 2584                     (sizeof(uint32_t))));
 2585                 /* seconds to usec */
 2586                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
 2587                 /* add in usec */
 2588                 if (tim == 0)
 2589                         tim = now.tv_usec - cookie->time_entered.tv_usec;
 2590                 scm->time_usec = htonl(tim);
 2591                 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
 2592                     vrf_id, port);
 2593                 return (NULL);
 2594         }
 2595         /*
 2596          * Now we must see with the lookup address if we have an existing
 2597          * asoc. This will only happen if we were in the COOKIE-WAIT state
 2598          * and a INIT collided with us and somewhere the peer sent the
 2599          * cookie on another address besides the single address our assoc
 2600          * had for him. In this case we will have one of the tie-tags set at
 2601          * least AND the address field in the cookie can be used to look it
 2602          * up.
 2603          */
 2604         to = NULL;
 2605         switch (cookie->addr_type) {
 2606 #ifdef INET6
 2607         case SCTP_IPV6_ADDRESS:
 2608                 memset(&sin6, 0, sizeof(sin6));
 2609                 sin6.sin6_family = AF_INET6;
 2610                 sin6.sin6_len = sizeof(sin6);
 2611                 sin6.sin6_port = sh->src_port;
 2612                 sin6.sin6_scope_id = cookie->scope_id;
 2613                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
 2614                     sizeof(sin6.sin6_addr.s6_addr));
 2615                 to = (struct sockaddr *)&sin6;
 2616                 break;
 2617 #endif
 2618 #ifdef INET
 2619         case SCTP_IPV4_ADDRESS:
 2620                 memset(&sin, 0, sizeof(sin));
 2621                 sin.sin_family = AF_INET;
 2622                 sin.sin_len = sizeof(sin);
 2623                 sin.sin_port = sh->src_port;
 2624                 sin.sin_addr.s_addr = cookie->address[0];
 2625                 to = (struct sockaddr *)&sin;
 2626                 break;
 2627 #endif
 2628         default:
 2629                 /* This should not happen */
 2630                 return (NULL);
 2631         }
 2632         if ((*stcb == NULL) && to) {
 2633                 /* Yep, lets check */
 2634                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL);
 2635                 if (*stcb == NULL) {
 2636                         /*
 2637                          * We should have only got back the same inp. If we
 2638                          * got back a different ep we have a problem. The
 2639                          * original findep got back l_inp and now
 2640                          */
 2641                         if (l_inp != *inp_p) {
 2642                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
 2643                         }
 2644                 } else {
 2645                         if (*locked_tcb == NULL) {
 2646                                 /*
 2647                                  * In this case we found the assoc only
 2648                                  * after we locked the create lock. This
 2649                                  * means we are in a colliding case and we
 2650                                  * must make sure that we unlock the tcb if
 2651                                  * its one of the cases where we throw away
 2652                                  * the incoming packets.
 2653                                  */
 2654                                 *locked_tcb = *stcb;
 2655 
 2656                                 /*
 2657                                  * We must also increment the inp ref count
 2658                                  * since the ref_count flags was set when we
 2659                                  * did not find the TCB, now we found it
 2660                                  * which reduces the refcount.. we must
 2661                                  * raise it back out to balance it all :-)
 2662                                  */
 2663                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
 2664                                 if ((*stcb)->sctp_ep != l_inp) {
 2665                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
 2666                                             (*stcb)->sctp_ep, l_inp);
 2667                                 }
 2668                         }
 2669                 }
 2670         }
 2671         if (to == NULL) {
 2672                 return (NULL);
 2673         }
 2674         cookie_len -= SCTP_SIGNATURE_SIZE;
 2675         if (*stcb == NULL) {
 2676                 /* this is the "normal" case... get a new TCB */
 2677                 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie,
 2678                     cookie_len, *inp_p, netp, to, &notification,
 2679                     auth_skipped, auth_offset, auth_len, vrf_id, port);
 2680         } else {
 2681                 /* this is abnormal... cookie-echo on existing TCB */
 2682                 had_a_existing_tcb = 1;
 2683                 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh,
 2684                     cookie, cookie_len, *inp_p, *stcb, netp, to,
 2685                     &notification, &sac_restart_id, vrf_id, auth_skipped, auth_offset, auth_len, port);
 2686         }
 2687 
 2688         if (*stcb == NULL) {
 2689                 /* still no TCB... must be bad cookie-echo */
 2690                 return (NULL);
 2691         }
 2692         if ((*netp != NULL) && (m->m_flags & M_FLOWID)) {
 2693                 (*netp)->flowid = m->m_pkthdr.flowid;
 2694 #ifdef INVARIANTS
 2695                 (*netp)->flowidset = 1;
 2696 #endif
 2697         }
 2698         /*
 2699          * Ok, we built an association so confirm the address we sent the
 2700          * INIT-ACK to.
 2701          */
 2702         netl = sctp_findnet(*stcb, to);
 2703         /*
 2704          * This code should in theory NOT run but
 2705          */
 2706         if (netl == NULL) {
 2707                 /* TSNH! Huh, why do I need to add this address here? */
 2708                 int ret;
 2709 
 2710                 ret = sctp_add_remote_addr(*stcb, to, NULL, SCTP_DONOT_SETSCOPE,
 2711                     SCTP_IN_COOKIE_PROC);
 2712                 netl = sctp_findnet(*stcb, to);
 2713         }
 2714         if (netl) {
 2715                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
 2716                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 2717                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
 2718                             netl);
 2719                         send_int_conf = 1;
 2720                 }
 2721         }
 2722         sctp_start_net_timers(*stcb);
 2723         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 2724                 if (!had_a_existing_tcb ||
 2725                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
 2726                         /*
 2727                          * If we have a NEW cookie or the connect never
 2728                          * reached the connected state during collision we
 2729                          * must do the TCP accept thing.
 2730                          */
 2731                         struct socket *so, *oso;
 2732                         struct sctp_inpcb *inp;
 2733 
 2734                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
 2735                                 /*
 2736                                  * For a restart we will keep the same
 2737                                  * socket, no need to do anything. I THINK!!
 2738                                  */
 2739                                 sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id, SCTP_SO_NOT_LOCKED);
 2740                                 if (send_int_conf) {
 2741                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2742                                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2743                                 }
 2744                                 return (m);
 2745                         }
 2746                         oso = (*inp_p)->sctp_socket;
 2747                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2748                         SCTP_TCB_UNLOCK((*stcb));
 2749                         CURVNET_SET(oso->so_vnet);
 2750                         so = sonewconn(oso, 0
 2751                             );
 2752                         CURVNET_RESTORE();
 2753                         SCTP_TCB_LOCK((*stcb));
 2754                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2755 
 2756                         if (so == NULL) {
 2757                                 struct mbuf *op_err;
 2758 
 2759 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2760                                 struct socket *pcb_so;
 2761 
 2762 #endif
 2763                                 /* Too many sockets */
 2764                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
 2765                                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
 2766                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
 2767                                     sh, op_err, vrf_id, port);
 2768 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2769                                 pcb_so = SCTP_INP_SO(*inp_p);
 2770                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2771                                 SCTP_TCB_UNLOCK((*stcb));
 2772                                 SCTP_SOCKET_LOCK(pcb_so, 1);
 2773                                 SCTP_TCB_LOCK((*stcb));
 2774                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2775 #endif
 2776                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
 2777 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2778                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
 2779 #endif
 2780                                 return (NULL);
 2781                         }
 2782                         inp = (struct sctp_inpcb *)so->so_pcb;
 2783                         SCTP_INP_INCR_REF(inp);
 2784                         /*
 2785                          * We add the unbound flag here so that if we get an
 2786                          * soabort() before we get the move_pcb done, we
 2787                          * will properly cleanup.
 2788                          */
 2789                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
 2790                             SCTP_PCB_FLAGS_CONNECTED |
 2791                             SCTP_PCB_FLAGS_IN_TCPPOOL |
 2792                             SCTP_PCB_FLAGS_UNBOUND |
 2793                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
 2794                             SCTP_PCB_FLAGS_DONT_WAKE);
 2795                         inp->sctp_features = (*inp_p)->sctp_features;
 2796                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
 2797                         inp->sctp_socket = so;
 2798                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
 2799                         inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
 2800                         inp->sctp_ecn_enable = (*inp_p)->sctp_ecn_enable;
 2801                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
 2802                         inp->sctp_context = (*inp_p)->sctp_context;
 2803                         inp->inp_starting_point_for_iterator = NULL;
 2804                         /*
 2805                          * copy in the authentication parameters from the
 2806                          * original endpoint
 2807                          */
 2808                         if (inp->sctp_ep.local_hmacs)
 2809                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
 2810                         inp->sctp_ep.local_hmacs =
 2811                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
 2812                         if (inp->sctp_ep.local_auth_chunks)
 2813                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
 2814                         inp->sctp_ep.local_auth_chunks =
 2815                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
 2816 
 2817                         /*
 2818                          * Now we must move it from one hash table to
 2819                          * another and get the tcb in the right place.
 2820                          */
 2821 
 2822                         /*
 2823                          * This is where the one-2-one socket is put into
 2824                          * the accept state waiting for the accept!
 2825                          */
 2826                         if (*stcb) {
 2827                                 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
 2828                         }
 2829                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
 2830 
 2831                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2832                         SCTP_TCB_UNLOCK((*stcb));
 2833 
 2834                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
 2835                             0);
 2836                         SCTP_TCB_LOCK((*stcb));
 2837                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2838 
 2839 
 2840                         /*
 2841                          * now we must check to see if we were aborted while
 2842                          * the move was going on and the lock/unlock
 2843                          * happened.
 2844                          */
 2845                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 2846                                 /*
 2847                                  * yep it was, we leave the assoc attached
 2848                                  * to the socket since the sctp_inpcb_free()
 2849                                  * call will send an abort for us.
 2850                                  */
 2851                                 SCTP_INP_DECR_REF(inp);
 2852                                 return (NULL);
 2853                         }
 2854                         SCTP_INP_DECR_REF(inp);
 2855                         /* Switch over to the new guy */
 2856                         *inp_p = inp;
 2857                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2858                         if (send_int_conf) {
 2859                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2860                                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2861                         }
 2862                         /*
 2863                          * Pull it from the incomplete queue and wake the
 2864                          * guy
 2865                          */
 2866 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2867                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
 2868                         SCTP_TCB_UNLOCK((*stcb));
 2869                         SCTP_SOCKET_LOCK(so, 1);
 2870 #endif
 2871                         soisconnected(so);
 2872 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2873                         SCTP_TCB_LOCK((*stcb));
 2874                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
 2875                         SCTP_SOCKET_UNLOCK(so, 1);
 2876 #endif
 2877                         return (m);
 2878                 }
 2879         }
 2880         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE) {
 2881                 if (notification) {
 2882                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2883                 }
 2884                 if (send_int_conf) {
 2885                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 2886                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
 2887                 }
 2888         }
 2889         return (m);
 2890 }
 2891 
 2892 static void
 2893 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp,
 2894     struct sctp_tcb *stcb, struct sctp_nets *net)
 2895 {
 2896         /* cp must not be used, others call this without a c-ack :-) */
 2897         struct sctp_association *asoc;
 2898 
 2899         SCTPDBG(SCTP_DEBUG_INPUT2,
 2900             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
 2901         if (stcb == NULL)
 2902                 return;
 2903 
 2904         asoc = &stcb->asoc;
 2905 
 2906         sctp_stop_all_cookie_timers(stcb);
 2907         /* process according to association state */
 2908         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 2909                 /* state change only needed when I am in right state */
 2910                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
 2911                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
 2912                 sctp_start_net_timers(stcb);
 2913                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
 2914                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
 2915                             stcb->sctp_ep, stcb, asoc->primary_destination);
 2916 
 2917                 }
 2918                 /* update RTO */
 2919                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
 2920                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
 2921                 if (asoc->overall_error_count == 0) {
 2922                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
 2923                             &asoc->time_entered, sctp_align_safe_nocopy,
 2924                             SCTP_RTT_FROM_NON_DATA);
 2925                 }
 2926                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 2927                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 2928                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 2929                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 2930 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2931                         struct socket *so;
 2932 
 2933 #endif
 2934                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
 2935 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2936                         so = SCTP_INP_SO(stcb->sctp_ep);
 2937                         atomic_add_int(&stcb->asoc.refcnt, 1);
 2938                         SCTP_TCB_UNLOCK(stcb);
 2939                         SCTP_SOCKET_LOCK(so, 1);
 2940                         SCTP_TCB_LOCK(stcb);
 2941                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 2942 #endif
 2943                         if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
 2944                                 soisconnected(stcb->sctp_socket);
 2945                         }
 2946 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 2947                         SCTP_SOCKET_UNLOCK(so, 1);
 2948 #endif
 2949                 }
 2950                 /*
 2951                  * since we did not send a HB make sure we don't double
 2952                  * things
 2953                  */
 2954                 net->hb_responded = 1;
 2955 
 2956                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 2957                         /*
 2958                          * We don't need to do the asconf thing, nor hb or
 2959                          * autoclose if the socket is closed.
 2960                          */
 2961                         goto closed_socket;
 2962                 }
 2963                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 2964                     stcb, net);
 2965 
 2966 
 2967                 if (stcb->asoc.sctp_autoclose_ticks &&
 2968                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
 2969                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
 2970                             stcb->sctp_ep, stcb, NULL);
 2971                 }
 2972                 /*
 2973                  * send ASCONF if parameters are pending and ASCONFs are
 2974                  * allowed (eg. addresses changed when init/cookie echo were
 2975                  * in flight)
 2976                  */
 2977                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
 2978                     (stcb->asoc.peer_supports_asconf) &&
 2979                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
 2980 #ifdef SCTP_TIMER_BASED_ASCONF
 2981                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
 2982                             stcb->sctp_ep, stcb,
 2983                             stcb->asoc.primary_destination);
 2984 #else
 2985                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
 2986                             SCTP_ADDR_NOT_LOCKED);
 2987 #endif
 2988                 }
 2989         }
 2990 closed_socket:
 2991         /* Toss the cookie if I can */
 2992         sctp_toss_old_cookies(stcb, asoc);
 2993         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
 2994                 /* Restart the timer if we have pending data */
 2995                 struct sctp_tmit_chunk *chk;
 2996 
 2997                 chk = TAILQ_FIRST(&asoc->sent_queue);
 2998                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
 2999         }
 3000 }
 3001 
 3002 static void
 3003 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
 3004     struct sctp_tcb *stcb)
 3005 {
 3006         struct sctp_nets *net;
 3007         struct sctp_tmit_chunk *lchk;
 3008         struct sctp_ecne_chunk bkup;
 3009         uint8_t override_bit = 0;
 3010         uint32_t tsn, window_data_tsn;
 3011         int len;
 3012         unsigned int pkt_cnt;
 3013 
 3014         len = ntohs(cp->ch.chunk_length);
 3015         if ((len != sizeof(struct sctp_ecne_chunk)) &&
 3016             (len != sizeof(struct old_sctp_ecne_chunk))) {
 3017                 return;
 3018         }
 3019         if (len == sizeof(struct old_sctp_ecne_chunk)) {
 3020                 /* Its the old format */
 3021                 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
 3022                 bkup.num_pkts_since_cwr = htonl(1);
 3023                 cp = &bkup;
 3024         }
 3025         SCTP_STAT_INCR(sctps_recvecne);
 3026         tsn = ntohl(cp->tsn);
 3027         pkt_cnt = ntohl(cp->num_pkts_since_cwr);
 3028         lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
 3029         if (lchk == NULL) {
 3030                 window_data_tsn = stcb->asoc.sending_seq - 1;
 3031         } else {
 3032                 window_data_tsn = lchk->rec.data.TSN_seq;
 3033         }
 3034 
 3035         /* Find where it was sent to if possible. */
 3036         net = NULL;
 3037         TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
 3038                 if (lchk->rec.data.TSN_seq == tsn) {
 3039                         net = lchk->whoTo;
 3040                         net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
 3041                         break;
 3042                 }
 3043                 if (SCTP_TSN_GT(lchk->rec.data.TSN_seq, tsn)) {
 3044                         break;
 3045                 }
 3046         }
 3047         if (net == NULL) {
 3048                 /*
 3049                  * What to do. A previous send of a CWR was possibly lost.
 3050                  * See how old it is, we may have it marked on the actual
 3051                  * net.
 3052                  */
 3053                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 3054                         if (tsn == net->last_cwr_tsn) {
 3055                                 /* Found him, send it off */
 3056                                 goto out;
 3057                         }
 3058                 }
 3059                 /*
 3060                  * If we reach here, we need to send a special CWR that says
 3061                  * hey, we did this a long time ago and you lost the
 3062                  * response.
 3063                  */
 3064                 net = TAILQ_FIRST(&stcb->asoc.nets);
 3065                 override_bit = SCTP_CWR_REDUCE_OVERRIDE;
 3066         }
 3067 out:
 3068         if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
 3069             ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
 3070                 /*
 3071                  * JRS - Use the congestion control given in the pluggable
 3072                  * CC module
 3073                  */
 3074                 int ocwnd;
 3075 
 3076                 ocwnd = net->cwnd;
 3077                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
 3078                 /*
 3079                  * We reduce once every RTT. So we will only lower cwnd at
 3080                  * the next sending seq i.e. the window_data_tsn
 3081                  */
 3082                 net->cwr_window_tsn = window_data_tsn;
 3083                 net->ecn_ce_pkt_cnt += pkt_cnt;
 3084                 net->lost_cnt = pkt_cnt;
 3085                 net->last_cwr_tsn = tsn;
 3086         } else {
 3087                 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
 3088                 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
 3089                     ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
 3090                         /*
 3091                          * Another loss in the same window update how many
 3092                          * marks/packets lost we have had.
 3093                          */
 3094                         int cnt = 1;
 3095 
 3096                         if (pkt_cnt > net->lost_cnt) {
 3097                                 /* Should be the case */
 3098                                 cnt = (pkt_cnt - net->lost_cnt);
 3099                                 net->ecn_ce_pkt_cnt += cnt;
 3100                         }
 3101                         net->lost_cnt = pkt_cnt;
 3102                         net->last_cwr_tsn = tsn;
 3103                         /*
 3104                          * Most CC functions will ignore this call, since we
 3105                          * are in-window yet of the initial CE the peer saw.
 3106                          */
 3107                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
 3108                 }
 3109         }
 3110         /*
 3111          * We always send a CWR this way if our previous one was lost our
 3112          * peer will get an update, or if it is not time again to reduce we
 3113          * still get the cwr to the peer. Note we set the override when we
 3114          * could not find the TSN on the chunk or the destination network.
 3115          */
 3116         sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
 3117 }
 3118 
 3119 static void
 3120 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
 3121 {
 3122         /*
 3123          * Here we get a CWR from the peer. We must look in the outqueue and
 3124          * make sure that we have a covered ECNE in teh control chunk part.
 3125          * If so remove it.
 3126          */
 3127         struct sctp_tmit_chunk *chk;
 3128         struct sctp_ecne_chunk *ecne;
 3129         int override;
 3130         uint32_t cwr_tsn;
 3131 
 3132         cwr_tsn = ntohl(cp->tsn);
 3133 
 3134         override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
 3135         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
 3136                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
 3137                         continue;
 3138                 }
 3139                 if ((override == 0) && (chk->whoTo != net)) {
 3140                         /* Must be from the right src unless override is set */
 3141                         continue;
 3142                 }
 3143                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
 3144                 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
 3145                         /* this covers this ECNE, we can remove it */
 3146                         stcb->asoc.ecn_echo_cnt_onq--;
 3147                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
 3148                             sctp_next);
 3149                         if (chk->data) {
 3150                                 sctp_m_freem(chk->data);
 3151                                 chk->data = NULL;
 3152                         }
 3153                         stcb->asoc.ctrl_queue_cnt--;
 3154                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 3155                         if (override == 0) {
 3156                                 break;
 3157                         }
 3158                 }
 3159         }
 3160 }
 3161 
 3162 static void
 3163 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp,
 3164     struct sctp_tcb *stcb, struct sctp_nets *net)
 3165 {
 3166         struct sctp_association *asoc;
 3167 
 3168 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3169         struct socket *so;
 3170 
 3171 #endif
 3172 
 3173         SCTPDBG(SCTP_DEBUG_INPUT2,
 3174             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
 3175         if (stcb == NULL)
 3176                 return;
 3177 
 3178         asoc = &stcb->asoc;
 3179         /* process according to association state */
 3180         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
 3181                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
 3182                 SCTPDBG(SCTP_DEBUG_INPUT2,
 3183                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
 3184                 SCTP_TCB_UNLOCK(stcb);
 3185                 return;
 3186         }
 3187         /* notify upper layer protocol */
 3188         if (stcb->sctp_socket) {
 3189                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 3190                 /* are the queues empty? they should be */
 3191                 if (!TAILQ_EMPTY(&asoc->send_queue) ||
 3192                     !TAILQ_EMPTY(&asoc->sent_queue) ||
 3193                     !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 3194                         sctp_report_all_outbound(stcb, 0, SCTP_SO_NOT_LOCKED);
 3195                 }
 3196         }
 3197         /* stop the timer */
 3198         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
 3199         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 3200         /* free the TCB */
 3201         SCTPDBG(SCTP_DEBUG_INPUT2,
 3202             "sctp_handle_shutdown_complete: calls free-asoc\n");
 3203 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3204         so = SCTP_INP_SO(stcb->sctp_ep);
 3205         atomic_add_int(&stcb->asoc.refcnt, 1);
 3206         SCTP_TCB_UNLOCK(stcb);
 3207         SCTP_SOCKET_LOCK(so, 1);
 3208         SCTP_TCB_LOCK(stcb);
 3209         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 3210 #endif
 3211         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
 3212 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 3213         SCTP_SOCKET_UNLOCK(so, 1);
 3214 #endif
 3215         return;
 3216 }
 3217 
 3218 static int
 3219 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
 3220     struct sctp_nets *net, uint8_t flg)
 3221 {
 3222         switch (desc->chunk_type) {
 3223         case SCTP_DATA:
 3224                 /* find the tsn to resend (possibly */
 3225                 {
 3226                         uint32_t tsn;
 3227                         struct sctp_tmit_chunk *tp1;
 3228 
 3229                         tsn = ntohl(desc->tsn_ifany);
 3230                         TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3231                                 if (tp1->rec.data.TSN_seq == tsn) {
 3232                                         /* found it */
 3233                                         break;
 3234                                 }
 3235                                 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, tsn)) {
 3236                                         /* not found */
 3237                                         tp1 = NULL;
 3238                                         break;
 3239                                 }
 3240                         }
 3241                         if (tp1 == NULL) {
 3242                                 /*
 3243                                  * Do it the other way , aka without paying
 3244                                  * attention to queue seq order.
 3245                                  */
 3246                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
 3247                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3248                                         if (tp1->rec.data.TSN_seq == tsn) {
 3249                                                 /* found it */
 3250                                                 break;
 3251                                         }
 3252                                 }
 3253                         }
 3254                         if (tp1 == NULL) {
 3255                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
 3256                         }
 3257                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
 3258                                 uint8_t *ddp;
 3259 
 3260                                 if (((flg & SCTP_BADCRC) == 0) &&
 3261                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
 3262                                         return (0);
 3263                                 }
 3264                                 if ((stcb->asoc.peers_rwnd == 0) &&
 3265                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
 3266                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
 3267                                         return (0);
 3268                                 }
 3269                                 if (stcb->asoc.peers_rwnd == 0 &&
 3270                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
 3271                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
 3272                                         return (0);
 3273                                 }
 3274                                 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
 3275                                     sizeof(struct sctp_data_chunk));
 3276                                 {
 3277                                         unsigned int iii;
 3278 
 3279                                         for (iii = 0; iii < sizeof(desc->data_bytes);
 3280                                             iii++) {
 3281                                                 if (ddp[iii] != desc->data_bytes[iii]) {
 3282                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
 3283                                                         return (-1);
 3284                                                 }
 3285                                         }
 3286                                 }
 3287 
 3288                                 if (tp1->do_rtt) {
 3289                                         /*
 3290                                          * this guy had a RTO calculation
 3291                                          * pending on it, cancel it
 3292                                          */
 3293                                         if (tp1->whoTo->rto_needed == 0) {
 3294                                                 tp1->whoTo->rto_needed = 1;
 3295                                         }
 3296                                         tp1->do_rtt = 0;
 3297                                 }
 3298                                 SCTP_STAT_INCR(sctps_pdrpmark);
 3299                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
 3300                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3301                                 /*
 3302                                  * mark it as if we were doing a FR, since
 3303                                  * we will be getting gap ack reports behind
 3304                                  * the info from the router.
 3305                                  */
 3306                                 tp1->rec.data.doing_fast_retransmit = 1;
 3307                                 /*
 3308                                  * mark the tsn with what sequences can
 3309                                  * cause a new FR.
 3310                                  */
 3311                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
 3312                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
 3313                                 } else {
 3314                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
 3315                                 }
 3316 
 3317                                 /* restart the timer */
 3318                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 3319                                     stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
 3320                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 3321                                     stcb, tp1->whoTo);
 3322 
 3323                                 /* fix counts and things */
 3324                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
 3325                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
 3326                                             tp1->whoTo->flight_size,
 3327                                             tp1->book_size,
 3328                                             (uintptr_t) stcb,
 3329                                             tp1->rec.data.TSN_seq);
 3330                                 }
 3331                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
 3332                                         sctp_flight_size_decrease(tp1);
 3333                                         sctp_total_flight_decrease(stcb, tp1);
 3334                                 }
 3335                                 tp1->sent = SCTP_DATAGRAM_RESEND;
 3336                         } {
 3337                                 /* audit code */
 3338                                 unsigned int audit;
 3339 
 3340                                 audit = 0;
 3341                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
 3342                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
 3343                                                 audit++;
 3344                                 }
 3345                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
 3346                                     sctp_next) {
 3347                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
 3348                                                 audit++;
 3349                                 }
 3350                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
 3351                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
 3352                                             audit, stcb->asoc.sent_queue_retran_cnt);
 3353 #ifndef SCTP_AUDITING_ENABLED
 3354                                         stcb->asoc.sent_queue_retran_cnt = audit;
 3355 #endif
 3356                                 }
 3357                         }
 3358                 }
 3359                 break;
 3360         case SCTP_ASCONF:
 3361                 {
 3362                         struct sctp_tmit_chunk *asconf;
 3363 
 3364                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
 3365                             sctp_next) {
 3366                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
 3367                                         break;
 3368                                 }
 3369                         }
 3370                         if (asconf) {
 3371                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
 3372                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3373                                 asconf->sent = SCTP_DATAGRAM_RESEND;
 3374                                 asconf->snd_count--;
 3375                         }
 3376                 }
 3377                 break;
 3378         case SCTP_INITIATION:
 3379                 /* resend the INIT */
 3380                 stcb->asoc.dropped_special_cnt++;
 3381                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
 3382                         /*
 3383                          * If we can get it in, in a few attempts we do
 3384                          * this, otherwise we let the timer fire.
 3385                          */
 3386                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
 3387                             stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
 3388                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 3389                 }
 3390                 break;
 3391         case SCTP_SELECTIVE_ACK:
 3392         case SCTP_NR_SELECTIVE_ACK:
 3393                 /* resend the sack */
 3394                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
 3395                 break;
 3396         case SCTP_HEARTBEAT_REQUEST:
 3397                 /* resend a demand HB */
 3398                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
 3399                         /*
 3400                          * Only retransmit if we KNOW we wont destroy the
 3401                          * tcb
 3402                          */
 3403                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 3404                 }
 3405                 break;
 3406         case SCTP_SHUTDOWN:
 3407                 sctp_send_shutdown(stcb, net);
 3408                 break;
 3409         case SCTP_SHUTDOWN_ACK:
 3410                 sctp_send_shutdown_ack(stcb, net);
 3411                 break;
 3412         case SCTP_COOKIE_ECHO:
 3413                 {
 3414                         struct sctp_tmit_chunk *cookie;
 3415 
 3416                         cookie = NULL;
 3417                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
 3418                             sctp_next) {
 3419                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
 3420                                         break;
 3421                                 }
 3422                         }
 3423                         if (cookie) {
 3424                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
 3425                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
 3426                                 cookie->sent = SCTP_DATAGRAM_RESEND;
 3427                                 sctp_stop_all_cookie_timers(stcb);
 3428                         }
 3429                 }
 3430                 break;
 3431         case SCTP_COOKIE_ACK:
 3432                 sctp_send_cookie_ack(stcb);
 3433                 break;
 3434         case SCTP_ASCONF_ACK:
 3435                 /* resend last asconf ack */
 3436                 sctp_send_asconf_ack(stcb);
 3437                 break;
 3438         case SCTP_FORWARD_CUM_TSN:
 3439                 send_forward_tsn(stcb, &stcb->asoc);
 3440                 break;
 3441                 /* can't do anything with these */
 3442         case SCTP_PACKET_DROPPED:
 3443         case SCTP_INITIATION_ACK:       /* this should not happen */
 3444         case SCTP_HEARTBEAT_ACK:
 3445         case SCTP_ABORT_ASSOCIATION:
 3446         case SCTP_OPERATION_ERROR:
 3447         case SCTP_SHUTDOWN_COMPLETE:
 3448         case SCTP_ECN_ECHO:
 3449         case SCTP_ECN_CWR:
 3450         default:
 3451                 break;
 3452         }
 3453         return (0);
 3454 }
 3455 
 3456 void
 3457 sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
 3458 {
 3459         int i;
 3460         uint16_t temp;
 3461 
 3462         /*
 3463          * We set things to 0xffff since this is the last delivered sequence
 3464          * and we will be sending in 0 after the reset.
 3465          */
 3466 
 3467         if (number_entries) {
 3468                 for (i = 0; i < number_entries; i++) {
 3469                         temp = ntohs(list[i]);
 3470                         if (temp >= stcb->asoc.streamincnt) {
 3471                                 continue;
 3472                         }
 3473                         stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
 3474                 }
 3475         } else {
 3476                 list = NULL;
 3477                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
 3478                         stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
 3479                 }
 3480         }
 3481         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
 3482 }
 3483 
 3484 static void
 3485 sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
 3486 {
 3487         int i;
 3488 
 3489         if (number_entries == 0) {
 3490                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 3491                         stcb->asoc.strmout[i].next_sequence_sent = 0;
 3492                 }
 3493         } else if (number_entries) {
 3494                 for (i = 0; i < number_entries; i++) {
 3495                         uint16_t temp;
 3496 
 3497                         temp = ntohs(list[i]);
 3498                         if (temp >= stcb->asoc.streamoutcnt) {
 3499                                 /* no such stream */
 3500                                 continue;
 3501                         }
 3502                         stcb->asoc.strmout[temp].next_sequence_sent = 0;
 3503                 }
 3504         }
 3505         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
 3506 }
 3507 
 3508 
 3509 struct sctp_stream_reset_out_request *
 3510 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
 3511 {
 3512         struct sctp_association *asoc;
 3513         struct sctp_stream_reset_out_req *req;
 3514         struct sctp_stream_reset_out_request *r;
 3515         struct sctp_tmit_chunk *chk;
 3516         int len, clen;
 3517 
 3518         asoc = &stcb->asoc;
 3519         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
 3520                 asoc->stream_reset_outstanding = 0;
 3521                 return (NULL);
 3522         }
 3523         if (stcb->asoc.str_reset == NULL) {
 3524                 asoc->stream_reset_outstanding = 0;
 3525                 return (NULL);
 3526         }
 3527         chk = stcb->asoc.str_reset;
 3528         if (chk->data == NULL) {
 3529                 return (NULL);
 3530         }
 3531         if (bchk) {
 3532                 /* he wants a copy of the chk pointer */
 3533                 *bchk = chk;
 3534         }
 3535         clen = chk->send_size;
 3536         req = mtod(chk->data, struct sctp_stream_reset_out_req *);
 3537         r = &req->sr_req;
 3538         if (ntohl(r->request_seq) == seq) {
 3539                 /* found it */
 3540                 return (r);
 3541         }
 3542         len = SCTP_SIZE32(ntohs(r->ph.param_length));
 3543         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
 3544                 /* move to the next one, there can only be a max of two */
 3545                 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len);
 3546                 if (ntohl(r->request_seq) == seq) {
 3547                         return (r);
 3548                 }
 3549         }
 3550         /* that seq is not here */
 3551         return (NULL);
 3552 }
 3553 
 3554 static void
 3555 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
 3556 {
 3557         struct sctp_association *asoc;
 3558         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
 3559 
 3560         if (stcb->asoc.str_reset == NULL) {
 3561                 return;
 3562         }
 3563         asoc = &stcb->asoc;
 3564 
 3565         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
 3566         TAILQ_REMOVE(&asoc->control_send_queue,
 3567             chk,
 3568             sctp_next);
 3569         if (chk->data) {
 3570                 sctp_m_freem(chk->data);
 3571                 chk->data = NULL;
 3572         }
 3573         asoc->ctrl_queue_cnt--;
 3574         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 3575         /* sa_ignore NO_NULL_CHK */
 3576         stcb->asoc.str_reset = NULL;
 3577 }
 3578 
 3579 
 3580 static int
 3581 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
 3582     uint32_t seq, uint32_t action,
 3583     struct sctp_stream_reset_response *respin)
 3584 {
 3585         uint16_t type;
 3586         int lparm_len;
 3587         struct sctp_association *asoc = &stcb->asoc;
 3588         struct sctp_tmit_chunk *chk;
 3589         struct sctp_stream_reset_out_request *srparam;
 3590         int number_entries;
 3591 
 3592         if (asoc->stream_reset_outstanding == 0) {
 3593                 /* duplicate */
 3594                 return (0);
 3595         }
 3596         if (seq == stcb->asoc.str_reset_seq_out) {
 3597                 srparam = sctp_find_stream_reset(stcb, seq, &chk);
 3598                 if (srparam) {
 3599                         stcb->asoc.str_reset_seq_out++;
 3600                         type = ntohs(srparam->ph.param_type);
 3601                         lparm_len = ntohs(srparam->ph.param_length);
 3602                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
 3603                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
 3604                                 asoc->stream_reset_out_is_outstanding = 0;
 3605                                 if (asoc->stream_reset_outstanding)
 3606                                         asoc->stream_reset_outstanding--;
 3607                                 if (action == SCTP_STREAM_RESET_PERFORMED) {
 3608                                         /* do it */
 3609                                         sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams);
 3610                                 } else {
 3611                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
 3612                                 }
 3613                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
 3614                                 /* Answered my request */
 3615                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
 3616                                 if (asoc->stream_reset_outstanding)
 3617                                         asoc->stream_reset_outstanding--;
 3618                                 if (action != SCTP_STREAM_RESET_PERFORMED) {
 3619                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
 3620                                 }
 3621                         } else if (type == SCTP_STR_RESET_ADD_STREAMS) {
 3622                                 /* Ok we now may have more streams */
 3623                                 if (asoc->stream_reset_outstanding)
 3624                                         asoc->stream_reset_outstanding--;
 3625                                 if (action == SCTP_STREAM_RESET_PERFORMED) {
 3626                                         /* Put the new streams into effect */
 3627                                         stcb->asoc.streamoutcnt = stcb->asoc.strm_realoutsize;
 3628                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_ADD_OK, stcb,
 3629                                             (uint32_t) stcb->asoc.streamoutcnt, NULL, SCTP_SO_NOT_LOCKED);
 3630                                 } else {
 3631                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_ADD_FAIL, stcb,
 3632                                             (uint32_t) stcb->asoc.streamoutcnt, NULL, SCTP_SO_NOT_LOCKED);
 3633                                 }
 3634                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
 3635                                 /**
 3636                                  * a) Adopt the new in tsn.
 3637                                  * b) reset the map
 3638                                  * c) Adopt the new out-tsn
 3639                                  */
 3640                                 struct sctp_stream_reset_response_tsn *resp;
 3641                                 struct sctp_forward_tsn_chunk fwdtsn;
 3642                                 int abort_flag = 0;
 3643 
 3644                                 if (respin == NULL) {
 3645                                         /* huh ? */
 3646                                         return (0);
 3647                                 }
 3648                                 if (action == SCTP_STREAM_RESET_PERFORMED) {
 3649                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
 3650                                         asoc->stream_reset_outstanding--;
 3651                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
 3652                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 3653                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
 3654                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
 3655                                         if (abort_flag) {
 3656                                                 return (1);
 3657                                         }
 3658                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
 3659                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 3660                                                 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 3661                                         }
 3662                                         stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
 3663                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
 3664                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
 3665 
 3666                                         stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
 3667                                         memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
 3668 
 3669                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
 3670                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
 3671 
 3672                                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
 3673                                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
 3674 
 3675                                 }
 3676                         }
 3677                         /* get rid of the request and get the request flags */
 3678                         if (asoc->stream_reset_outstanding == 0) {
 3679                                 sctp_clean_up_stream_reset(stcb);
 3680                         }
 3681                 }
 3682         }
 3683         return (0);
 3684 }
 3685 
 3686 static void
 3687 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
 3688     struct sctp_tmit_chunk *chk,
 3689     struct sctp_stream_reset_in_request *req, int trunc)
 3690 {
 3691         uint32_t seq;
 3692         int len, i;
 3693         int number_entries;
 3694         uint16_t temp;
 3695 
 3696         /*
 3697          * peer wants me to send a str-reset to him for my outgoing seq's if
 3698          * seq_in is right.
 3699          */
 3700         struct sctp_association *asoc = &stcb->asoc;
 3701 
 3702         seq = ntohl(req->request_seq);
 3703         if (asoc->str_reset_seq_in == seq) {
 3704                 if (trunc) {
 3705                         /* Can't do it, since they exceeded our buffer size  */
 3706                         asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3707                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
 3708                         sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3709                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
 3710                         len = ntohs(req->ph.param_length);
 3711                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
 3712                         for (i = 0; i < number_entries; i++) {
 3713                                 temp = ntohs(req->list_of_streams[i]);
 3714                                 req->list_of_streams[i] = temp;
 3715                         }
 3716                         /* move the reset action back one */
 3717                         asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3718                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
 3719                         sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
 3720                             asoc->str_reset_seq_out,
 3721                             seq, (asoc->sending_seq - 1));
 3722                         asoc->stream_reset_out_is_outstanding = 1;
 3723                         asoc->str_reset = chk;
 3724                         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
 3725                         stcb->asoc.stream_reset_outstanding++;
 3726                 } else {
 3727                         /* Can't do it, since we have sent one out */
 3728                         asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3729                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER;
 3730                         sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3731                 }
 3732                 asoc->str_reset_seq_in++;
 3733         } else if (asoc->str_reset_seq_in - 1 == seq) {
 3734                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3735         } else if (asoc->str_reset_seq_in - 2 == seq) {
 3736                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3737         } else {
 3738                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
 3739         }
 3740 }
 3741 
 3742 static int
 3743 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
 3744     struct sctp_tmit_chunk *chk,
 3745     struct sctp_stream_reset_tsn_request *req)
 3746 {
 3747         /* reset all in and out and update the tsn */
 3748         /*
 3749          * A) reset my str-seq's on in and out. B) Select a receive next,
 3750          * and set cum-ack to it. Also process this selected number as a
 3751          * fwd-tsn as well. C) set in the response my next sending seq.
 3752          */
 3753         struct sctp_forward_tsn_chunk fwdtsn;
 3754         struct sctp_association *asoc = &stcb->asoc;
 3755         int abort_flag = 0;
 3756         uint32_t seq;
 3757 
 3758         seq = ntohl(req->request_seq);
 3759         if (asoc->str_reset_seq_in == seq) {
 3760                 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
 3761                 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
 3762                 fwdtsn.ch.chunk_flags = 0;
 3763                 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
 3764                 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
 3765                 if (abort_flag) {
 3766                         return (1);
 3767                 }
 3768                 stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
 3769                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 3770                         sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 3771                 }
 3772                 stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
 3773                 stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1;
 3774                 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
 3775                 stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
 3776                 memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
 3777                 atomic_add_int(&stcb->asoc.sending_seq, 1);
 3778                 /* save off historical data for retrans */
 3779                 stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0];
 3780                 stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq;
 3781                 stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0];
 3782                 stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn;
 3783 
 3784                 sctp_add_stream_reset_result_tsn(chk,
 3785                     ntohl(req->request_seq),
 3786                     SCTP_STREAM_RESET_PERFORMED,
 3787                     stcb->asoc.sending_seq,
 3788                     stcb->asoc.mapping_array_base_tsn);
 3789                 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
 3790                 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
 3791                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 3792                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
 3793 
 3794                 asoc->str_reset_seq_in++;
 3795         } else if (asoc->str_reset_seq_in - 1 == seq) {
 3796                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
 3797                     stcb->asoc.last_sending_seq[0],
 3798                     stcb->asoc.last_base_tsnsent[0]
 3799                     );
 3800         } else if (asoc->str_reset_seq_in - 2 == seq) {
 3801                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
 3802                     stcb->asoc.last_sending_seq[1],
 3803                     stcb->asoc.last_base_tsnsent[1]
 3804                     );
 3805         } else {
 3806                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
 3807         }
 3808         return (0);
 3809 }
 3810 
 3811 static void
 3812 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
 3813     struct sctp_tmit_chunk *chk,
 3814     struct sctp_stream_reset_out_request *req, int trunc)
 3815 {
 3816         uint32_t seq, tsn;
 3817         int number_entries, len;
 3818         struct sctp_association *asoc = &stcb->asoc;
 3819 
 3820         seq = ntohl(req->request_seq);
 3821 
 3822         /* now if its not a duplicate we process it */
 3823         if (asoc->str_reset_seq_in == seq) {
 3824                 len = ntohs(req->ph.param_length);
 3825                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
 3826                 /*
 3827                  * the sender is resetting, handle the list issue.. we must
 3828                  * a) verify if we can do the reset, if so no problem b) If
 3829                  * we can't do the reset we must copy the request. c) queue
 3830                  * it, and setup the data in processor to trigger it off
 3831                  * when needed and dequeue all the queued data.
 3832                  */
 3833                 tsn = ntohl(req->send_reset_at_tsn);
 3834 
 3835                 /* move the reset action back one */
 3836                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
 3837                 if (trunc) {
 3838                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
 3839                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
 3840                 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
 3841                         /* we can do it now */
 3842                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
 3843                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
 3844                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
 3845                 } else {
 3846                         /*
 3847                          * we must queue it up and thus wait for the TSN's
 3848                          * to arrive that are at or before tsn
 3849                          */
 3850                         struct sctp_stream_reset_list *liste;
 3851                         int siz;
 3852 
 3853                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
 3854                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
 3855                             siz, SCTP_M_STRESET);
 3856                         if (liste == NULL) {
 3857                                 /* gak out of memory */
 3858                                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
 3859                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
 3860                                 return;
 3861                         }
 3862                         liste->tsn = tsn;
 3863                         liste->number_entries = number_entries;
 3864                         memcpy(&liste->req, req,
 3865                             (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t))));
 3866                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
 3867                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
 3868                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
 3869                 }
 3870                 asoc->str_reset_seq_in++;
 3871         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 3872                 /*
 3873                  * one seq back, just echo back last action since my
 3874                  * response was lost.
 3875                  */
 3876                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3877         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 3878                 /*
 3879                  * two seq back, just echo back last action since my
 3880                  * response was lost.
 3881                  */
 3882                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3883         } else {
 3884                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
 3885         }
 3886 }
 3887 
 3888 static void
 3889 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
 3890     struct sctp_stream_reset_add_strm *str_add)
 3891 {
 3892         /*
 3893          * Peer is requesting to add more streams. If its within our
 3894          * max-streams we will allow it.
 3895          */
 3896         uint16_t num_stream, i;
 3897         uint32_t seq;
 3898         struct sctp_association *asoc = &stcb->asoc;
 3899         struct sctp_queued_to_read *ctl, *nctl;
 3900 
 3901         /* Get the number. */
 3902         seq = ntohl(str_add->request_seq);
 3903         num_stream = ntohs(str_add->number_of_streams);
 3904         /* Now what would be the new total? */
 3905         if (asoc->str_reset_seq_in == seq) {
 3906                 num_stream += stcb->asoc.streamincnt;
 3907                 if (num_stream > stcb->asoc.max_inbound_streams) {
 3908                         /* We must reject it they ask for to many */
 3909         denied:
 3910                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
 3911                         stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 3912                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
 3913                 } else {
 3914                         /* Ok, we can do that :-) */
 3915                         struct sctp_stream_in *oldstrm;
 3916 
 3917                         /* save off the old */
 3918                         oldstrm = stcb->asoc.strmin;
 3919                         SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
 3920                             (num_stream * sizeof(struct sctp_stream_in)),
 3921                             SCTP_M_STRMI);
 3922                         if (stcb->asoc.strmin == NULL) {
 3923                                 stcb->asoc.strmin = oldstrm;
 3924                                 goto denied;
 3925                         }
 3926                         /* copy off the old data */
 3927                         for (i = 0; i < stcb->asoc.streamincnt; i++) {
 3928                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
 3929                                 stcb->asoc.strmin[i].stream_no = i;
 3930                                 stcb->asoc.strmin[i].last_sequence_delivered = oldstrm[i].last_sequence_delivered;
 3931                                 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
 3932                                 /* now anything on those queues? */
 3933                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next, nctl) {
 3934                                         TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next);
 3935                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next);
 3936                                 }
 3937                         }
 3938                         /* Init the new streams */
 3939                         for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
 3940                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
 3941                                 stcb->asoc.strmin[i].stream_no = i;
 3942                                 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
 3943                                 stcb->asoc.strmin[i].delivery_started = 0;
 3944                         }
 3945                         SCTP_FREE(oldstrm, SCTP_M_STRMI);
 3946                         /* update the size */
 3947                         stcb->asoc.streamincnt = num_stream;
 3948                         /* Send the ack */
 3949                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
 3950                         stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
 3951                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
 3952                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_INSTREAM_ADD_OK, stcb,
 3953                             (uint32_t) stcb->asoc.streamincnt, NULL, SCTP_SO_NOT_LOCKED);
 3954                 }
 3955         } else if ((asoc->str_reset_seq_in - 1) == seq) {
 3956                 /*
 3957                  * one seq back, just echo back last action since my
 3958                  * response was lost.
 3959                  */
 3960                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
 3961         } else if ((asoc->str_reset_seq_in - 2) == seq) {
 3962                 /*
 3963                  * two seq back, just echo back last action since my
 3964                  * response was lost.
 3965                  */
 3966                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
 3967         } else {
 3968                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
 3969 
 3970         }
 3971 }
 3972 
 3973 #ifdef __GNUC__
 3974 __attribute__((noinline))
 3975 #endif
 3976         static int
 3977             sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
 3978         struct sctp_stream_reset_out_req *sr_req)
 3979 {
 3980         int chk_length, param_len, ptype;
 3981         struct sctp_paramhdr pstore;
 3982         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
 3983 
 3984         uint32_t seq;
 3985         int num_req = 0;
 3986         int trunc = 0;
 3987         struct sctp_tmit_chunk *chk;
 3988         struct sctp_chunkhdr *ch;
 3989         struct sctp_paramhdr *ph;
 3990         int ret_code = 0;
 3991         int num_param = 0;
 3992 
 3993         /* now it may be a reset or a reset-response */
 3994         chk_length = ntohs(sr_req->ch.chunk_length);
 3995 
 3996         /* setup for adding the response */
 3997         sctp_alloc_a_chunk(stcb, chk);
 3998         if (chk == NULL) {
 3999                 return (ret_code);
 4000         }
 4001         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
 4002         chk->rec.chunk_id.can_take_data = 0;
 4003         chk->asoc = &stcb->asoc;
 4004         chk->no_fr_allowed = 0;
 4005         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
 4006         chk->book_size_scale = 0;
 4007         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
 4008         if (chk->data == NULL) {
 4009 strres_nochunk:
 4010                 if (chk->data) {
 4011                         sctp_m_freem(chk->data);
 4012                         chk->data = NULL;
 4013                 }
 4014                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 4015                 return (ret_code);
 4016         }
 4017         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
 4018 
 4019         /* setup chunk parameters */
 4020         chk->sent = SCTP_DATAGRAM_UNSENT;
 4021         chk->snd_count = 0;
 4022         chk->whoTo = NULL;
 4023 
 4024         ch = mtod(chk->data, struct sctp_chunkhdr *);
 4025         ch->chunk_type = SCTP_STREAM_RESET;
 4026         ch->chunk_flags = 0;
 4027         ch->chunk_length = htons(chk->send_size);
 4028         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
 4029         offset += sizeof(struct sctp_chunkhdr);
 4030         while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) {
 4031                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *) & pstore);
 4032                 if (ph == NULL)
 4033                         break;
 4034                 param_len = ntohs(ph->param_length);
 4035                 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) {
 4036                         /* bad param */
 4037                         break;
 4038                 }
 4039                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, (int)sizeof(cstore)),
 4040                     (uint8_t *) & cstore);
 4041                 ptype = ntohs(ph->param_type);
 4042                 num_param++;
 4043                 if (param_len > (int)sizeof(cstore)) {
 4044                         trunc = 1;
 4045                 } else {
 4046                         trunc = 0;
 4047                 }
 4048 
 4049                 if (num_param > SCTP_MAX_RESET_PARAMS) {
 4050                         /* hit the max of parameters already sorry.. */
 4051                         break;
 4052                 }
 4053                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
 4054                         struct sctp_stream_reset_out_request *req_out;
 4055 
 4056                         req_out = (struct sctp_stream_reset_out_request *)ph;
 4057                         num_req++;
 4058                         if (stcb->asoc.stream_reset_outstanding) {
 4059                                 seq = ntohl(req_out->response_seq);
 4060                                 if (seq == stcb->asoc.str_reset_seq_out) {
 4061                                         /* implicit ack */
 4062                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL);
 4063                                 }
 4064                         }
 4065                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
 4066                 } else if (ptype == SCTP_STR_RESET_ADD_STREAMS) {
 4067                         struct sctp_stream_reset_add_strm *str_add;
 4068 
 4069                         str_add = (struct sctp_stream_reset_add_strm *)ph;
 4070                         num_req++;
 4071                         sctp_handle_str_reset_add_strm(stcb, chk, str_add);
 4072                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
 4073                         struct sctp_stream_reset_in_request *req_in;
 4074 
 4075                         num_req++;
 4076 
 4077                         req_in = (struct sctp_stream_reset_in_request *)ph;
 4078 
 4079                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
 4080                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
 4081                         struct sctp_stream_reset_tsn_request *req_tsn;
 4082 
 4083                         num_req++;
 4084                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
 4085 
 4086                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
 4087                                 ret_code = 1;
 4088                                 goto strres_nochunk;
 4089                         }
 4090                         /* no more */
 4091                         break;
 4092                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
 4093                         struct sctp_stream_reset_response *resp;
 4094                         uint32_t result;
 4095 
 4096                         resp = (struct sctp_stream_reset_response *)ph;
 4097                         seq = ntohl(resp->response_seq);
 4098                         result = ntohl(resp->result);
 4099                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
 4100                                 ret_code = 1;
 4101                                 goto strres_nochunk;
 4102                         }
 4103                 } else {
 4104                         break;
 4105                 }
 4106                 offset += SCTP_SIZE32(param_len);
 4107                 chk_length -= SCTP_SIZE32(param_len);
 4108         }
 4109         if (num_req == 0) {
 4110                 /* we have no response free the stuff */
 4111                 goto strres_nochunk;
 4112         }
 4113         /* ok we have a chunk to link in */
 4114         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
 4115             chk,
 4116             sctp_next);
 4117         stcb->asoc.ctrl_queue_cnt++;
 4118         return (ret_code);
 4119 }
 4120 
 4121 /*
 4122  * Handle a router or endpoints report of a packet loss, there are two ways
 4123  * to handle this, either we get the whole packet and must disect it
 4124  * ourselves (possibly with truncation and or corruption) or it is a summary
 4125  * from a middle box that did the disectting for us.
 4126  */
 4127 static void
 4128 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
 4129     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
 4130 {
 4131         uint32_t bottle_bw, on_queue;
 4132         uint16_t trunc_len;
 4133         unsigned int chlen;
 4134         unsigned int at;
 4135         struct sctp_chunk_desc desc;
 4136         struct sctp_chunkhdr *ch;
 4137 
 4138         chlen = ntohs(cp->ch.chunk_length);
 4139         chlen -= sizeof(struct sctp_pktdrop_chunk);
 4140         /* XXX possible chlen underflow */
 4141         if (chlen == 0) {
 4142                 ch = NULL;
 4143                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
 4144                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
 4145         } else {
 4146                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
 4147                 chlen -= sizeof(struct sctphdr);
 4148                 /* XXX possible chlen underflow */
 4149                 memset(&desc, 0, sizeof(desc));
 4150         }
 4151         trunc_len = (uint16_t) ntohs(cp->trunc_len);
 4152         if (trunc_len > limit) {
 4153                 trunc_len = limit;
 4154         }
 4155         /* now the chunks themselves */
 4156         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
 4157                 desc.chunk_type = ch->chunk_type;
 4158                 /* get amount we need to move */
 4159                 at = ntohs(ch->chunk_length);
 4160                 if (at < sizeof(struct sctp_chunkhdr)) {
 4161                         /* corrupt chunk, maybe at the end? */
 4162                         SCTP_STAT_INCR(sctps_pdrpcrupt);
 4163                         break;
 4164                 }
 4165                 if (trunc_len == 0) {
 4166                         /* we are supposed to have all of it */
 4167                         if (at > chlen) {
 4168                                 /* corrupt skip it */
 4169                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
 4170                                 break;
 4171                         }
 4172                 } else {
 4173                         /* is there enough of it left ? */
 4174                         if (desc.chunk_type == SCTP_DATA) {
 4175                                 if (chlen < (sizeof(struct sctp_data_chunk) +
 4176                                     sizeof(desc.data_bytes))) {
 4177                                         break;
 4178                                 }
 4179                         } else {
 4180                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
 4181                                         break;
 4182                                 }
 4183                         }
 4184                 }
 4185                 if (desc.chunk_type == SCTP_DATA) {
 4186                         /* can we get out the tsn? */
 4187                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
 4188                                 SCTP_STAT_INCR(sctps_pdrpmbda);
 4189 
 4190                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
 4191                                 /* yep */
 4192                                 struct sctp_data_chunk *dcp;
 4193                                 uint8_t *ddp;
 4194                                 unsigned int iii;
 4195 
 4196                                 dcp = (struct sctp_data_chunk *)ch;
 4197                                 ddp = (uint8_t *) (dcp + 1);
 4198                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
 4199                                         desc.data_bytes[iii] = ddp[iii];
 4200                                 }
 4201                                 desc.tsn_ifany = dcp->dp.tsn;
 4202                         } else {
 4203                                 /* nope we are done. */
 4204                                 SCTP_STAT_INCR(sctps_pdrpnedat);
 4205                                 break;
 4206                         }
 4207                 } else {
 4208                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
 4209                                 SCTP_STAT_INCR(sctps_pdrpmbct);
 4210                 }
 4211 
 4212                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
 4213                         SCTP_STAT_INCR(sctps_pdrppdbrk);
 4214                         break;
 4215                 }
 4216                 if (SCTP_SIZE32(at) > chlen) {
 4217                         break;
 4218                 }
 4219                 chlen -= SCTP_SIZE32(at);
 4220                 if (chlen < sizeof(struct sctp_chunkhdr)) {
 4221                         /* done, none left */
 4222                         break;
 4223                 }
 4224                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
 4225         }
 4226         /* Now update any rwnd --- possibly */
 4227         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
 4228                 /* From a peer, we get a rwnd report */
 4229                 uint32_t a_rwnd;
 4230 
 4231                 SCTP_STAT_INCR(sctps_pdrpfehos);
 4232 
 4233                 bottle_bw = ntohl(cp->bottle_bw);
 4234                 on_queue = ntohl(cp->current_onq);
 4235                 if (bottle_bw && on_queue) {
 4236                         /* a rwnd report is in here */
 4237                         if (bottle_bw > on_queue)
 4238                                 a_rwnd = bottle_bw - on_queue;
 4239                         else
 4240                                 a_rwnd = 0;
 4241 
 4242                         if (a_rwnd == 0)
 4243                                 stcb->asoc.peers_rwnd = 0;
 4244                         else {
 4245                                 if (a_rwnd > stcb->asoc.total_flight) {
 4246                                         stcb->asoc.peers_rwnd =
 4247                                             a_rwnd - stcb->asoc.total_flight;
 4248                                 } else {
 4249                                         stcb->asoc.peers_rwnd = 0;
 4250                                 }
 4251                                 if (stcb->asoc.peers_rwnd <
 4252                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
 4253                                         /* SWS sender side engages */
 4254                                         stcb->asoc.peers_rwnd = 0;
 4255                                 }
 4256                         }
 4257                 }
 4258         } else {
 4259                 SCTP_STAT_INCR(sctps_pdrpfmbox);
 4260         }
 4261 
 4262         /* now middle boxes in sat networks get a cwnd bump */
 4263         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
 4264             (stcb->asoc.sat_t3_loss_recovery == 0) &&
 4265             (stcb->asoc.sat_network)) {
 4266                 /*
 4267                  * This is debateable but for sat networks it makes sense
 4268                  * Note if a T3 timer has went off, we will prohibit any
 4269                  * changes to cwnd until we exit the t3 loss recovery.
 4270                  */
 4271                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
 4272                     net, cp, &bottle_bw, &on_queue);
 4273         }
 4274 }
 4275 
 4276 /*
 4277  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
 4278  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
 4279  * offset: offset into the mbuf chain to first chunkhdr - length: is the
 4280  * length of the complete packet outputs: - length: modified to remaining
 4281  * length after control processing - netp: modified to new sctp_nets after
 4282  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
 4283  * bad packet,...) otherwise return the tcb for this packet
 4284  */
 4285 #ifdef __GNUC__
 4286 __attribute__((noinline))
 4287 #endif
 4288         static struct sctp_tcb *
 4289                  sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
 4290              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
 4291              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
 4292              uint32_t vrf_id, uint16_t port)
 4293 {
 4294         struct sctp_association *asoc;
 4295         uint32_t vtag_in;
 4296         int num_chunks = 0;     /* number of control chunks processed */
 4297         uint32_t chk_length;
 4298         int ret;
 4299         int abort_no_unlock = 0;
 4300         int ecne_seen = 0;
 4301 
 4302         /*
 4303          * How big should this be, and should it be alloc'd? Lets try the
 4304          * d-mtu-ceiling for now (2k) and that should hopefully work ...
 4305          * until we get into jumbo grams and such..
 4306          */
 4307         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
 4308         struct sctp_tcb *locked_tcb = stcb;
 4309         int got_auth = 0;
 4310         uint32_t auth_offset = 0, auth_len = 0;
 4311         int auth_skipped = 0;
 4312         int asconf_cnt = 0;
 4313 
 4314 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4315         struct socket *so;
 4316 
 4317 #endif
 4318 
 4319         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
 4320             iphlen, *offset, length, stcb);
 4321 
 4322         /* validate chunk header length... */
 4323         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
 4324                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
 4325                     ntohs(ch->chunk_length));
 4326                 if (locked_tcb) {
 4327                         SCTP_TCB_UNLOCK(locked_tcb);
 4328                 }
 4329                 return (NULL);
 4330         }
 4331         /*
 4332          * validate the verification tag
 4333          */
 4334         vtag_in = ntohl(sh->v_tag);
 4335 
 4336         if (locked_tcb) {
 4337                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
 4338         }
 4339         if (ch->chunk_type == SCTP_INITIATION) {
 4340                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
 4341                     ntohs(ch->chunk_length), vtag_in);
 4342                 if (vtag_in != 0) {
 4343                         /* protocol error- silently discard... */
 4344                         SCTP_STAT_INCR(sctps_badvtag);
 4345                         if (locked_tcb) {
 4346                                 SCTP_TCB_UNLOCK(locked_tcb);
 4347                         }
 4348                         return (NULL);
 4349                 }
 4350         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
 4351                 /*
 4352                  * If there is no stcb, skip the AUTH chunk and process
 4353                  * later after a stcb is found (to validate the lookup was
 4354                  * valid.
 4355                  */
 4356                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
 4357                     (stcb == NULL) &&
 4358                     !SCTP_BASE_SYSCTL(sctp_auth_disable)) {
 4359                         /* save this chunk for later processing */
 4360                         auth_skipped = 1;
 4361                         auth_offset = *offset;
 4362                         auth_len = ntohs(ch->chunk_length);
 4363 
 4364                         /* (temporarily) move past this chunk */
 4365                         *offset += SCTP_SIZE32(auth_len);
 4366                         if (*offset >= length) {
 4367                                 /* no more data left in the mbuf chain */
 4368                                 *offset = length;
 4369                                 if (locked_tcb) {
 4370                                         SCTP_TCB_UNLOCK(locked_tcb);
 4371                                 }
 4372                                 return (NULL);
 4373                         }
 4374                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4375                             sizeof(struct sctp_chunkhdr), chunk_buf);
 4376                 }
 4377                 if (ch == NULL) {
 4378                         /* Help */
 4379                         *offset = length;
 4380                         if (locked_tcb) {
 4381                                 SCTP_TCB_UNLOCK(locked_tcb);
 4382                         }
 4383                         return (NULL);
 4384                 }
 4385                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
 4386                         goto process_control_chunks;
 4387                 }
 4388                 /*
 4389                  * first check if it's an ASCONF with an unknown src addr we
 4390                  * need to look inside to find the association
 4391                  */
 4392                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
 4393                         struct sctp_chunkhdr *asconf_ch = ch;
 4394                         uint32_t asconf_offset = 0, asconf_len = 0;
 4395 
 4396                         /* inp's refcount may be reduced */
 4397                         SCTP_INP_INCR_REF(inp);
 4398 
 4399                         asconf_offset = *offset;
 4400                         do {
 4401                                 asconf_len = ntohs(asconf_ch->chunk_length);
 4402                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
 4403                                         break;
 4404                                 stcb = sctp_findassociation_ep_asconf(m, iphlen,
 4405                                     *offset, sh, &inp, netp, vrf_id);
 4406                                 if (stcb != NULL)
 4407                                         break;
 4408                                 asconf_offset += SCTP_SIZE32(asconf_len);
 4409                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
 4410                                     sizeof(struct sctp_chunkhdr), chunk_buf);
 4411                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
 4412                         if (stcb == NULL) {
 4413                                 /*
 4414                                  * reduce inp's refcount if not reduced in
 4415                                  * sctp_findassociation_ep_asconf().
 4416                                  */
 4417                                 SCTP_INP_DECR_REF(inp);
 4418                         } else {
 4419                                 locked_tcb = stcb;
 4420                         }
 4421 
 4422                         /* now go back and verify any auth chunk to be sure */
 4423                         if (auth_skipped && (stcb != NULL)) {
 4424                                 struct sctp_auth_chunk *auth;
 4425 
 4426                                 auth = (struct sctp_auth_chunk *)
 4427                                     sctp_m_getptr(m, auth_offset,
 4428                                     auth_len, chunk_buf);
 4429                                 got_auth = 1;
 4430                                 auth_skipped = 0;
 4431                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
 4432                                     auth_offset)) {
 4433                                         /* auth HMAC failed so dump it */
 4434                                         *offset = length;
 4435                                         if (locked_tcb) {
 4436                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4437                                         }
 4438                                         return (NULL);
 4439                                 } else {
 4440                                         /* remaining chunks are HMAC checked */
 4441                                         stcb->asoc.authenticated = 1;
 4442                                 }
 4443                         }
 4444                 }
 4445                 if (stcb == NULL) {
 4446                         /* no association, so it's out of the blue... */
 4447                         sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL,
 4448                             vrf_id, port);
 4449                         *offset = length;
 4450                         if (locked_tcb) {
 4451                                 SCTP_TCB_UNLOCK(locked_tcb);
 4452                         }
 4453                         return (NULL);
 4454                 }
 4455                 asoc = &stcb->asoc;
 4456                 /* ABORT and SHUTDOWN can use either v_tag... */
 4457                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
 4458                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
 4459                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
 4460                         if ((vtag_in == asoc->my_vtag) ||
 4461                             ((ch->chunk_flags & SCTP_HAD_NO_TCB) &&
 4462                             (vtag_in == asoc->peer_vtag))) {
 4463                                 /* this is valid */
 4464                         } else {
 4465                                 /* drop this packet... */
 4466                                 SCTP_STAT_INCR(sctps_badvtag);
 4467                                 if (locked_tcb) {
 4468                                         SCTP_TCB_UNLOCK(locked_tcb);
 4469                                 }
 4470                                 return (NULL);
 4471                         }
 4472                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
 4473                         if (vtag_in != asoc->my_vtag) {
 4474                                 /*
 4475                                  * this could be a stale SHUTDOWN-ACK or the
 4476                                  * peer never got the SHUTDOWN-COMPLETE and
 4477                                  * is still hung; we have started a new asoc
 4478                                  * but it won't complete until the shutdown
 4479                                  * is completed
 4480                                  */
 4481                                 if (locked_tcb) {
 4482                                         SCTP_TCB_UNLOCK(locked_tcb);
 4483                                 }
 4484                                 sctp_handle_ootb(m, iphlen, *offset, sh, inp,
 4485                                     NULL, vrf_id, port);
 4486                                 return (NULL);
 4487                         }
 4488                 } else {
 4489                         /* for all other chunks, vtag must match */
 4490                         if (vtag_in != asoc->my_vtag) {
 4491                                 /* invalid vtag... */
 4492                                 SCTPDBG(SCTP_DEBUG_INPUT3,
 4493                                     "invalid vtag: %xh, expect %xh\n",
 4494                                     vtag_in, asoc->my_vtag);
 4495                                 SCTP_STAT_INCR(sctps_badvtag);
 4496                                 if (locked_tcb) {
 4497                                         SCTP_TCB_UNLOCK(locked_tcb);
 4498                                 }
 4499                                 *offset = length;
 4500                                 return (NULL);
 4501                         }
 4502                 }
 4503         }                       /* end if !SCTP_COOKIE_ECHO */
 4504         /*
 4505          * process all control chunks...
 4506          */
 4507         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
 4508         /* EY */
 4509             (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
 4510             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
 4511             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 4512                 /* implied cookie-ack.. we must have lost the ack */
 4513                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 4514                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 4515                             stcb->asoc.overall_error_count,
 4516                             0,
 4517                             SCTP_FROM_SCTP_INPUT,
 4518                             __LINE__);
 4519                 }
 4520                 stcb->asoc.overall_error_count = 0;
 4521                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
 4522                     *netp);
 4523         }
 4524 process_control_chunks:
 4525         while (IS_SCTP_CONTROL(ch)) {
 4526                 /* validate chunk length */
 4527                 chk_length = ntohs(ch->chunk_length);
 4528                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
 4529                     ch->chunk_type, chk_length);
 4530                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
 4531                 if (chk_length < sizeof(*ch) ||
 4532                     (*offset + (int)chk_length) > length) {
 4533                         *offset = length;
 4534                         if (locked_tcb) {
 4535                                 SCTP_TCB_UNLOCK(locked_tcb);
 4536                         }
 4537                         return (NULL);
 4538                 }
 4539                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
 4540                 /*
 4541                  * INIT-ACK only gets the init ack "header" portion only
 4542                  * because we don't have to process the peer's COOKIE. All
 4543                  * others get a complete chunk.
 4544                  */
 4545                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
 4546                     (ch->chunk_type == SCTP_INITIATION)) {
 4547                         /* get an init-ack chunk */
 4548                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4549                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
 4550                         if (ch == NULL) {
 4551                                 *offset = length;
 4552                                 if (locked_tcb) {
 4553                                         SCTP_TCB_UNLOCK(locked_tcb);
 4554                                 }
 4555                                 return (NULL);
 4556                         }
 4557                 } else {
 4558                         /* For cookies and all other chunks. */
 4559                         if (chk_length > sizeof(chunk_buf)) {
 4560                                 /*
 4561                                  * use just the size of the chunk buffer so
 4562                                  * the front part of our chunks fit in
 4563                                  * contiguous space up to the chunk buffer
 4564                                  * size (508 bytes). For chunks that need to
 4565                                  * get more than that they must use the
 4566                                  * sctp_m_getptr() function or other means
 4567                                  * (e.g. know how to parse mbuf chains).
 4568                                  * Cookies do this already.
 4569                                  */
 4570                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4571                                     (sizeof(chunk_buf) - 4),
 4572                                     chunk_buf);
 4573                                 if (ch == NULL) {
 4574                                         *offset = length;
 4575                                         if (locked_tcb) {
 4576                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4577                                         }
 4578                                         return (NULL);
 4579                                 }
 4580                         } else {
 4581                                 /* We can fit it all */
 4582                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 4583                                     chk_length, chunk_buf);
 4584                                 if (ch == NULL) {
 4585                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
 4586                                         *offset = length;
 4587                                         if (locked_tcb) {
 4588                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4589                                         }
 4590                                         return (NULL);
 4591                                 }
 4592                         }
 4593                 }
 4594                 num_chunks++;
 4595                 /* Save off the last place we got a control from */
 4596                 if (stcb != NULL) {
 4597                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
 4598                                 /*
 4599                                  * allow last_control to be NULL if
 4600                                  * ASCONF... ASCONF processing will find the
 4601                                  * right net later
 4602                                  */
 4603                                 if ((netp != NULL) && (*netp != NULL))
 4604                                         stcb->asoc.last_control_chunk_from = *netp;
 4605                         }
 4606                 }
 4607 #ifdef SCTP_AUDITING_ENABLED
 4608                 sctp_audit_log(0xB0, ch->chunk_type);
 4609 #endif
 4610 
 4611                 /* check to see if this chunk required auth, but isn't */
 4612                 if ((stcb != NULL) &&
 4613                     !SCTP_BASE_SYSCTL(sctp_auth_disable) &&
 4614                     sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
 4615                     !stcb->asoc.authenticated) {
 4616                         /* "silently" ignore */
 4617                         SCTP_STAT_INCR(sctps_recvauthmissing);
 4618                         goto next_chunk;
 4619                 }
 4620                 switch (ch->chunk_type) {
 4621                 case SCTP_INITIATION:
 4622                         /* must be first and only chunk */
 4623                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
 4624                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 4625                                 /* We are not interested anymore? */
 4626                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 4627                                         /*
 4628                                          * collision case where we are
 4629                                          * sending to them too
 4630                                          */
 4631                                         ;
 4632                                 } else {
 4633                                         if (locked_tcb) {
 4634                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4635                                         }
 4636                                         *offset = length;
 4637                                         return (NULL);
 4638                                 }
 4639                         }
 4640                         if ((chk_length > SCTP_LARGEST_INIT_ACCEPTED) ||
 4641                             (num_chunks > 1) ||
 4642                             (SCTP_BASE_SYSCTL(sctp_strict_init) && (length - *offset > (int)SCTP_SIZE32(chk_length)))) {
 4643                                 *offset = length;
 4644                                 if (locked_tcb) {
 4645                                         SCTP_TCB_UNLOCK(locked_tcb);
 4646                                 }
 4647                                 return (NULL);
 4648                         }
 4649                         if ((stcb != NULL) &&
 4650                             (SCTP_GET_STATE(&stcb->asoc) ==
 4651                             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 4652                                 sctp_send_shutdown_ack(stcb, NULL);
 4653                                 *offset = length;
 4654                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 4655                                 if (locked_tcb) {
 4656                                         SCTP_TCB_UNLOCK(locked_tcb);
 4657                                 }
 4658                                 return (NULL);
 4659                         }
 4660                         if (netp) {
 4661                                 sctp_handle_init(m, iphlen, *offset, sh,
 4662                                     (struct sctp_init_chunk *)ch, inp,
 4663                                     stcb, *netp, &abort_no_unlock, vrf_id, port);
 4664                         }
 4665                         if (abort_no_unlock)
 4666                                 return (NULL);
 4667 
 4668                         *offset = length;
 4669                         if (locked_tcb) {
 4670                                 SCTP_TCB_UNLOCK(locked_tcb);
 4671                         }
 4672                         return (NULL);
 4673                         break;
 4674                 case SCTP_PAD_CHUNK:
 4675                         break;
 4676                 case SCTP_INITIATION_ACK:
 4677                         /* must be first and only chunk */
 4678                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
 4679                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 4680                                 /* We are not interested anymore */
 4681                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 4682                                         ;
 4683                                 } else {
 4684                                         if (locked_tcb != stcb) {
 4685                                                 /* Very unlikely */
 4686                                                 SCTP_TCB_UNLOCK(locked_tcb);
 4687                                         }
 4688                                         *offset = length;
 4689                                         if (stcb) {
 4690 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4691                                                 so = SCTP_INP_SO(inp);
 4692                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 4693                                                 SCTP_TCB_UNLOCK(stcb);
 4694                                                 SCTP_SOCKET_LOCK(so, 1);
 4695                                                 SCTP_TCB_LOCK(stcb);
 4696                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 4697 #endif
 4698                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
 4699 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 4700                                                 SCTP_SOCKET_UNLOCK(so, 1);
 4701 #endif
 4702                                         }
 4703                                         return (NULL);
 4704                                 }
 4705                         }
 4706                         if ((num_chunks > 1) ||
 4707                             (SCTP_BASE_SYSCTL(sctp_strict_init) && (length - *offset > (int)SCTP_SIZE32(chk_length)))) {
 4708                                 *offset = length;
 4709                                 if (locked_tcb) {
 4710                                         SCTP_TCB_UNLOCK(locked_tcb);
 4711                                 }
 4712                                 return (NULL);
 4713                         }
 4714                         if ((netp) && (*netp)) {
 4715                                 ret = sctp_handle_init_ack(m, iphlen, *offset, sh,
 4716                                     (struct sctp_init_ack_chunk *)ch, stcb, *netp, &abort_no_unlock, vrf_id);
 4717                         } else {
 4718                                 ret = -1;
 4719                         }
 4720                         /*
 4721                          * Special case, I must call the output routine to
 4722                          * get the cookie echoed
 4723                          */
 4724                         if (abort_no_unlock)
 4725                                 return (NULL);
 4726 
 4727                         if ((stcb) && ret == 0)
 4728                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 4729                         *offset = length;
 4730                         if (locked_tcb) {
 4731                                 SCTP_TCB_UNLOCK(locked_tcb);
 4732                         }
 4733                         return (NULL);
 4734                         break;
 4735                 case SCTP_SELECTIVE_ACK:
 4736                         {
 4737                                 struct sctp_sack_chunk *sack;
 4738                                 int abort_now = 0;
 4739                                 uint32_t a_rwnd, cum_ack;
 4740                                 uint16_t num_seg, num_dup;
 4741                                 uint8_t flags;
 4742                                 int offset_seg, offset_dup;
 4743 
 4744                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
 4745                                 SCTP_STAT_INCR(sctps_recvsacks);
 4746                                 if (stcb == NULL) {
 4747                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
 4748                                         break;
 4749                                 }
 4750                                 if (chk_length < sizeof(struct sctp_sack_chunk)) {
 4751                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
 4752                                         break;
 4753                                 }
 4754                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 4755                                         /*-
 4756                                          * If we have sent a shutdown-ack, we will pay no
 4757                                          * attention to a sack sent in to us since
 4758                                          * we don't care anymore.
 4759                                          */
 4760                                         break;
 4761                                 }
 4762                                 sack = (struct sctp_sack_chunk *)ch;
 4763                                 flags = ch->chunk_flags;
 4764                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
 4765                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
 4766                                 num_dup = ntohs(sack->sack.num_dup_tsns);
 4767                                 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
 4768                                 if (sizeof(struct sctp_sack_chunk) +
 4769                                     num_seg * sizeof(struct sctp_gap_ack_block) +
 4770                                     num_dup * sizeof(uint32_t) != chk_length) {
 4771                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
 4772                                         break;
 4773                                 }
 4774                                 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
 4775                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
 4776                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
 4777                                     cum_ack, num_seg, a_rwnd);
 4778                                 stcb->asoc.seen_a_sack_this_pkt = 1;
 4779                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
 4780                                     (num_seg == 0) &&
 4781                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
 4782                                     (stcb->asoc.saw_sack_with_frags == 0) &&
 4783                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
 4784                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
 4785                                     ) {
 4786                                         /*
 4787                                          * We have a SIMPLE sack having no
 4788                                          * prior segments and data on sent
 4789                                          * queue to be acked.. Use the
 4790                                          * faster path sack processing. We
 4791                                          * also allow window update sacks
 4792                                          * with no missing segments to go
 4793                                          * this way too.
 4794                                          */
 4795                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
 4796                                 } else {
 4797                                         if (netp && *netp)
 4798                                                 sctp_handle_sack(m, offset_seg, offset_dup,
 4799                                                     stcb, *netp,
 4800                                                     num_seg, 0, num_dup, &abort_now, flags,
 4801                                                     cum_ack, a_rwnd, ecne_seen);
 4802                                 }
 4803                                 if (abort_now) {
 4804                                         /* ABORT signal from sack processing */
 4805                                         *offset = length;
 4806                                         return (NULL);
 4807                                 }
 4808                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
 4809                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
 4810                                     (stcb->asoc.stream_queue_cnt == 0)) {
 4811                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 4812                                 }
 4813                         }
 4814                         break;
 4815                         /*
 4816                          * EY - nr_sack:  If the received chunk is an
 4817                          * nr_sack chunk
 4818                          */
 4819                 case SCTP_NR_SELECTIVE_ACK:
 4820                         {
 4821                                 struct sctp_nr_sack_chunk *nr_sack;
 4822                                 int abort_now = 0;
 4823                                 uint32_t a_rwnd, cum_ack;
 4824                                 uint16_t num_seg, num_nr_seg, num_dup;
 4825                                 uint8_t flags;
 4826                                 int offset_seg, offset_dup;
 4827 
 4828                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
 4829                                 SCTP_STAT_INCR(sctps_recvsacks);
 4830                                 if (stcb == NULL) {
 4831                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
 4832                                         break;
 4833                                 }
 4834                                 if ((stcb->asoc.sctp_nr_sack_on_off == 0) ||
 4835                                     (stcb->asoc.peer_supports_nr_sack == 0)) {
 4836                                         goto unknown_chunk;
 4837                                 }
 4838                                 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
 4839                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
 4840                                         break;
 4841                                 }
 4842                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 4843                                         /*-
 4844                                          * If we have sent a shutdown-ack, we will pay no
 4845                                          * attention to a sack sent in to us since
 4846                                          * we don't care anymore.
 4847                                          */
 4848                                         break;
 4849                                 }
 4850                                 nr_sack = (struct sctp_nr_sack_chunk *)ch;
 4851                                 flags = ch->chunk_flags;
 4852                                 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
 4853                                 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
 4854                                 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
 4855                                 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
 4856                                 a_rwnd = (uint32_t) ntohl(nr_sack->nr_sack.a_rwnd);
 4857                                 if (sizeof(struct sctp_nr_sack_chunk) +
 4858                                     (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
 4859                                     num_dup * sizeof(uint32_t) != chk_length) {
 4860                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
 4861                                         break;
 4862                                 }
 4863                                 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
 4864                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
 4865                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
 4866                                     cum_ack, num_seg, a_rwnd);
 4867                                 stcb->asoc.seen_a_sack_this_pkt = 1;
 4868                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
 4869                                     (num_seg == 0) && (num_nr_seg == 0) &&
 4870                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
 4871                                     (stcb->asoc.saw_sack_with_frags == 0) &&
 4872                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
 4873                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
 4874                                         /*
 4875                                          * We have a SIMPLE sack having no
 4876                                          * prior segments and data on sent
 4877                                          * queue to be acked. Use the faster
 4878                                          * path sack processing. We also
 4879                                          * allow window update sacks with no
 4880                                          * missing segments to go this way
 4881                                          * too.
 4882                                          */
 4883                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
 4884                                             &abort_now, ecne_seen);
 4885                                 } else {
 4886                                         if (netp && *netp)
 4887                                                 sctp_handle_sack(m, offset_seg, offset_dup,
 4888                                                     stcb, *netp,
 4889                                                     num_seg, num_nr_seg, num_dup, &abort_now, flags,
 4890                                                     cum_ack, a_rwnd, ecne_seen);
 4891                                 }
 4892                                 if (abort_now) {
 4893                                         /* ABORT signal from sack processing */
 4894                                         *offset = length;
 4895                                         return (NULL);
 4896                                 }
 4897                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
 4898                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
 4899                                     (stcb->asoc.stream_queue_cnt == 0)) {
 4900                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 4901                                 }
 4902                         }
 4903                         break;
 4904 
 4905                 case SCTP_HEARTBEAT_REQUEST:
 4906                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
 4907                         if ((stcb) && netp && *netp) {
 4908                                 SCTP_STAT_INCR(sctps_recvheartbeat);
 4909                                 sctp_send_heartbeat_ack(stcb, m, *offset,
 4910                                     chk_length, *netp);
 4911 
 4912                                 /* He's alive so give him credit */
 4913                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 4914                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 4915                                             stcb->asoc.overall_error_count,
 4916                                             0,
 4917                                             SCTP_FROM_SCTP_INPUT,
 4918                                             __LINE__);
 4919                                 }
 4920                                 stcb->asoc.overall_error_count = 0;
 4921                         }
 4922                         break;
 4923                 case SCTP_HEARTBEAT_ACK:
 4924                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
 4925                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
 4926                                 /* Its not ours */
 4927                                 *offset = length;
 4928                                 if (locked_tcb) {
 4929                                         SCTP_TCB_UNLOCK(locked_tcb);
 4930                                 }
 4931                                 return (NULL);
 4932                         }
 4933                         /* He's alive so give him credit */
 4934                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 4935                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 4936                                     stcb->asoc.overall_error_count,
 4937                                     0,
 4938                                     SCTP_FROM_SCTP_INPUT,
 4939                                     __LINE__);
 4940                         }
 4941                         stcb->asoc.overall_error_count = 0;
 4942                         SCTP_STAT_INCR(sctps_recvheartbeatack);
 4943                         if (netp && *netp)
 4944                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
 4945                                     stcb, *netp);
 4946                         break;
 4947                 case SCTP_ABORT_ASSOCIATION:
 4948                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
 4949                             stcb);
 4950                         if ((stcb) && netp && *netp)
 4951                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
 4952                                     stcb, *netp);
 4953                         *offset = length;
 4954                         return (NULL);
 4955                         break;
 4956                 case SCTP_SHUTDOWN:
 4957                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
 4958                             stcb);
 4959                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
 4960                                 *offset = length;
 4961                                 if (locked_tcb) {
 4962                                         SCTP_TCB_UNLOCK(locked_tcb);
 4963                                 }
 4964                                 return (NULL);
 4965                         }
 4966                         if (netp && *netp) {
 4967                                 int abort_flag = 0;
 4968 
 4969                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
 4970                                     stcb, *netp, &abort_flag);
 4971                                 if (abort_flag) {
 4972                                         *offset = length;
 4973                                         return (NULL);
 4974                                 }
 4975                         }
 4976                         break;
 4977                 case SCTP_SHUTDOWN_ACK:
 4978                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", stcb);
 4979                         if ((stcb) && (netp) && (*netp))
 4980                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
 4981                         *offset = length;
 4982                         return (NULL);
 4983                         break;
 4984 
 4985                 case SCTP_OPERATION_ERROR:
 4986                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
 4987                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
 4988 
 4989                                 *offset = length;
 4990                                 return (NULL);
 4991                         }
 4992                         break;
 4993                 case SCTP_COOKIE_ECHO:
 4994                         SCTPDBG(SCTP_DEBUG_INPUT3,
 4995                             "SCTP_COOKIE-ECHO, stcb %p\n", stcb);
 4996                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 4997                                 ;
 4998                         } else {
 4999                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5000                                         /* We are not interested anymore */
 5001                         abend:
 5002                                         if (stcb) {
 5003                                                 SCTP_TCB_UNLOCK(stcb);
 5004                                         }
 5005                                         *offset = length;
 5006                                         return (NULL);
 5007                                 }
 5008                         }
 5009                         /*
 5010                          * First are we accepting? We do this again here
 5011                          * since it is possible that a previous endpoint WAS
 5012                          * listening responded to a INIT-ACK and then
 5013                          * closed. We opened and bound.. and are now no
 5014                          * longer listening.
 5015                          */
 5016 
 5017                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
 5018                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 5019                                     (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
 5020                                         struct mbuf *oper;
 5021                                         struct sctp_paramhdr *phdr;
 5022 
 5023                                         oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
 5024                                             0, M_DONTWAIT, 1, MT_DATA);
 5025                                         if (oper) {
 5026                                                 SCTP_BUF_LEN(oper) =
 5027                                                     sizeof(struct sctp_paramhdr);
 5028                                                 phdr = mtod(oper,
 5029                                                     struct sctp_paramhdr *);
 5030                                                 phdr->param_type =
 5031                                                     htons(SCTP_CAUSE_OUT_OF_RESC);
 5032                                                 phdr->param_length =
 5033                                                     htons(sizeof(struct sctp_paramhdr));
 5034                                         }
 5035                                         sctp_abort_association(inp, stcb, m,
 5036                                             iphlen, sh, oper, vrf_id, port);
 5037                                 }
 5038                                 *offset = length;
 5039                                 return (NULL);
 5040                         } else {
 5041                                 struct mbuf *ret_buf;
 5042                                 struct sctp_inpcb *linp;
 5043 
 5044                                 if (stcb) {
 5045                                         linp = NULL;
 5046                                 } else {
 5047                                         linp = inp;
 5048                                 }
 5049 
 5050                                 if (linp) {
 5051                                         SCTP_ASOC_CREATE_LOCK(linp);
 5052                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 5053                                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 5054                                                 SCTP_ASOC_CREATE_UNLOCK(linp);
 5055                                                 goto abend;
 5056                                         }
 5057                                 }
 5058                                 if (netp) {
 5059                                         ret_buf =
 5060                                             sctp_handle_cookie_echo(m, iphlen,
 5061                                             *offset, sh,
 5062                                             (struct sctp_cookie_echo_chunk *)ch,
 5063                                             &inp, &stcb, netp,
 5064                                             auth_skipped,
 5065                                             auth_offset,
 5066                                             auth_len,
 5067                                             &locked_tcb,
 5068                                             vrf_id,
 5069                                             port);
 5070                                 } else {
 5071                                         ret_buf = NULL;
 5072                                 }
 5073                                 if (linp) {
 5074                                         SCTP_ASOC_CREATE_UNLOCK(linp);
 5075                                 }
 5076                                 if (ret_buf == NULL) {
 5077                                         if (locked_tcb) {
 5078                                                 SCTP_TCB_UNLOCK(locked_tcb);
 5079                                         }
 5080                                         SCTPDBG(SCTP_DEBUG_INPUT3,
 5081                                             "GAK, null buffer\n");
 5082                                         auth_skipped = 0;
 5083                                         *offset = length;
 5084                                         return (NULL);
 5085                                 }
 5086                                 /* if AUTH skipped, see if it verified... */
 5087                                 if (auth_skipped) {
 5088                                         got_auth = 1;
 5089                                         auth_skipped = 0;
 5090                                 }
 5091                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 5092                                         /*
 5093                                          * Restart the timer if we have
 5094                                          * pending data
 5095                                          */
 5096                                         struct sctp_tmit_chunk *chk;
 5097 
 5098                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
 5099                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
 5100                                 }
 5101                         }
 5102                         break;
 5103                 case SCTP_COOKIE_ACK:
 5104                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", stcb);
 5105                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
 5106                                 if (locked_tcb) {
 5107                                         SCTP_TCB_UNLOCK(locked_tcb);
 5108                                 }
 5109                                 return (NULL);
 5110                         }
 5111                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5112                                 /* We are not interested anymore */
 5113                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
 5114                                         ;
 5115                                 } else if (stcb) {
 5116 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5117                                         so = SCTP_INP_SO(inp);
 5118                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 5119                                         SCTP_TCB_UNLOCK(stcb);
 5120                                         SCTP_SOCKET_LOCK(so, 1);
 5121                                         SCTP_TCB_LOCK(stcb);
 5122                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5123 #endif
 5124                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
 5125 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5126                                         SCTP_SOCKET_UNLOCK(so, 1);
 5127 #endif
 5128                                         *offset = length;
 5129                                         return (NULL);
 5130                                 }
 5131                         }
 5132                         /* He's alive so give him credit */
 5133                         if ((stcb) && netp && *netp) {
 5134                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5135                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5136                                             stcb->asoc.overall_error_count,
 5137                                             0,
 5138                                             SCTP_FROM_SCTP_INPUT,
 5139                                             __LINE__);
 5140                                 }
 5141                                 stcb->asoc.overall_error_count = 0;
 5142                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
 5143                         }
 5144                         break;
 5145                 case SCTP_ECN_ECHO:
 5146                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
 5147                         /* He's alive so give him credit */
 5148                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
 5149                                 /* Its not ours */
 5150                                 if (locked_tcb) {
 5151                                         SCTP_TCB_UNLOCK(locked_tcb);
 5152                                 }
 5153                                 *offset = length;
 5154                                 return (NULL);
 5155                         }
 5156                         if (stcb) {
 5157                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5158                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5159                                             stcb->asoc.overall_error_count,
 5160                                             0,
 5161                                             SCTP_FROM_SCTP_INPUT,
 5162                                             __LINE__);
 5163                                 }
 5164                                 stcb->asoc.overall_error_count = 0;
 5165                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
 5166                                     stcb);
 5167                                 ecne_seen = 1;
 5168                         }
 5169                         break;
 5170                 case SCTP_ECN_CWR:
 5171                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
 5172                         /* He's alive so give him credit */
 5173                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
 5174                                 /* Its not ours */
 5175                                 if (locked_tcb) {
 5176                                         SCTP_TCB_UNLOCK(locked_tcb);
 5177                                 }
 5178                                 *offset = length;
 5179                                 return (NULL);
 5180                         }
 5181                         if (stcb) {
 5182                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5183                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5184                                             stcb->asoc.overall_error_count,
 5185                                             0,
 5186                                             SCTP_FROM_SCTP_INPUT,
 5187                                             __LINE__);
 5188                                 }
 5189                                 stcb->asoc.overall_error_count = 0;
 5190                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
 5191                         }
 5192                         break;
 5193                 case SCTP_SHUTDOWN_COMPLETE:
 5194                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", stcb);
 5195                         /* must be first and only chunk */
 5196                         if ((num_chunks > 1) ||
 5197                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
 5198                                 *offset = length;
 5199                                 if (locked_tcb) {
 5200                                         SCTP_TCB_UNLOCK(locked_tcb);
 5201                                 }
 5202                                 return (NULL);
 5203                         }
 5204                         if ((stcb) && netp && *netp) {
 5205                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
 5206                                     stcb, *netp);
 5207                         }
 5208                         *offset = length;
 5209                         return (NULL);
 5210                         break;
 5211                 case SCTP_ASCONF:
 5212                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
 5213                         /* He's alive so give him credit */
 5214                         if (stcb) {
 5215                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5216                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5217                                             stcb->asoc.overall_error_count,
 5218                                             0,
 5219                                             SCTP_FROM_SCTP_INPUT,
 5220                                             __LINE__);
 5221                                 }
 5222                                 stcb->asoc.overall_error_count = 0;
 5223                                 sctp_handle_asconf(m, *offset,
 5224                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
 5225                                 asconf_cnt++;
 5226                         }
 5227                         break;
 5228                 case SCTP_ASCONF_ACK:
 5229                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
 5230                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
 5231                                 /* Its not ours */
 5232                                 if (locked_tcb) {
 5233                                         SCTP_TCB_UNLOCK(locked_tcb);
 5234                                 }
 5235                                 *offset = length;
 5236                                 return (NULL);
 5237                         }
 5238                         if ((stcb) && netp && *netp) {
 5239                                 /* He's alive so give him credit */
 5240                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5241                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5242                                             stcb->asoc.overall_error_count,
 5243                                             0,
 5244                                             SCTP_FROM_SCTP_INPUT,
 5245                                             __LINE__);
 5246                                 }
 5247                                 stcb->asoc.overall_error_count = 0;
 5248                                 sctp_handle_asconf_ack(m, *offset,
 5249                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
 5250                                 if (abort_no_unlock)
 5251                                         return (NULL);
 5252                         }
 5253                         break;
 5254                 case SCTP_FORWARD_CUM_TSN:
 5255                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
 5256                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
 5257                                 /* Its not ours */
 5258                                 if (locked_tcb) {
 5259                                         SCTP_TCB_UNLOCK(locked_tcb);
 5260                                 }
 5261                                 *offset = length;
 5262                                 return (NULL);
 5263                         }
 5264                         /* He's alive so give him credit */
 5265                         if (stcb) {
 5266                                 int abort_flag = 0;
 5267 
 5268                                 stcb->asoc.overall_error_count = 0;
 5269                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5270                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5271                                             stcb->asoc.overall_error_count,
 5272                                             0,
 5273                                             SCTP_FROM_SCTP_INPUT,
 5274                                             __LINE__);
 5275                                 }
 5276                                 *fwd_tsn_seen = 1;
 5277                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5278                                         /* We are not interested anymore */
 5279 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5280                                         so = SCTP_INP_SO(inp);
 5281                                         atomic_add_int(&stcb->asoc.refcnt, 1);
 5282                                         SCTP_TCB_UNLOCK(stcb);
 5283                                         SCTP_SOCKET_LOCK(so, 1);
 5284                                         SCTP_TCB_LOCK(stcb);
 5285                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5286 #endif
 5287                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
 5288 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5289                                         SCTP_SOCKET_UNLOCK(so, 1);
 5290 #endif
 5291                                         *offset = length;
 5292                                         return (NULL);
 5293                                 }
 5294                                 sctp_handle_forward_tsn(stcb,
 5295                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
 5296                                 if (abort_flag) {
 5297                                         *offset = length;
 5298                                         return (NULL);
 5299                                 } else {
 5300                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5301                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5302                                                     stcb->asoc.overall_error_count,
 5303                                                     0,
 5304                                                     SCTP_FROM_SCTP_INPUT,
 5305                                                     __LINE__);
 5306                                         }
 5307                                         stcb->asoc.overall_error_count = 0;
 5308                                 }
 5309 
 5310                         }
 5311                         break;
 5312                 case SCTP_STREAM_RESET:
 5313                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
 5314                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
 5315                                 /* Its not ours */
 5316                                 if (locked_tcb) {
 5317                                         SCTP_TCB_UNLOCK(locked_tcb);
 5318                                 }
 5319                                 *offset = length;
 5320                                 return (NULL);
 5321                         }
 5322                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 5323                                 /* We are not interested anymore */
 5324 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5325                                 so = SCTP_INP_SO(inp);
 5326                                 atomic_add_int(&stcb->asoc.refcnt, 1);
 5327                                 SCTP_TCB_UNLOCK(stcb);
 5328                                 SCTP_SOCKET_LOCK(so, 1);
 5329                                 SCTP_TCB_LOCK(stcb);
 5330                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 5331 #endif
 5332                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
 5333 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 5334                                 SCTP_SOCKET_UNLOCK(so, 1);
 5335 #endif
 5336                                 *offset = length;
 5337                                 return (NULL);
 5338                         }
 5339                         if (stcb->asoc.peer_supports_strreset == 0) {
 5340                                 /*
 5341                                  * hmm, peer should have announced this, but
 5342                                  * we will turn it on since he is sending us
 5343                                  * a stream reset.
 5344                                  */
 5345                                 stcb->asoc.peer_supports_strreset = 1;
 5346                         }
 5347                         if (sctp_handle_stream_reset(stcb, m, *offset, (struct sctp_stream_reset_out_req *)ch)) {
 5348                                 /* stop processing */
 5349                                 *offset = length;
 5350                                 return (NULL);
 5351                         }
 5352                         break;
 5353                 case SCTP_PACKET_DROPPED:
 5354                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
 5355                         /* re-get it all please */
 5356                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
 5357                                 /* Its not ours */
 5358                                 if (locked_tcb) {
 5359                                         SCTP_TCB_UNLOCK(locked_tcb);
 5360                                 }
 5361                                 *offset = length;
 5362                                 return (NULL);
 5363                         }
 5364                         if (ch && (stcb) && netp && (*netp)) {
 5365                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
 5366                                     stcb, *netp,
 5367                                     min(chk_length, (sizeof(chunk_buf) - 4)));
 5368 
 5369                         }
 5370                         break;
 5371 
 5372                 case SCTP_AUTHENTICATION:
 5373                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
 5374                         if (SCTP_BASE_SYSCTL(sctp_auth_disable))
 5375                                 goto unknown_chunk;
 5376 
 5377                         if (stcb == NULL) {
 5378                                 /* save the first AUTH for later processing */
 5379                                 if (auth_skipped == 0) {
 5380                                         auth_offset = *offset;
 5381                                         auth_len = chk_length;
 5382                                         auth_skipped = 1;
 5383                                 }
 5384                                 /* skip this chunk (temporarily) */
 5385                                 goto next_chunk;
 5386                         }
 5387                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
 5388                             (chk_length > (sizeof(struct sctp_auth_chunk) +
 5389                             SCTP_AUTH_DIGEST_LEN_MAX))) {
 5390                                 /* Its not ours */
 5391                                 if (locked_tcb) {
 5392                                         SCTP_TCB_UNLOCK(locked_tcb);
 5393                                 }
 5394                                 *offset = length;
 5395                                 return (NULL);
 5396                         }
 5397                         if (got_auth == 1) {
 5398                                 /* skip this chunk... it's already auth'd */
 5399                                 goto next_chunk;
 5400                         }
 5401                         got_auth = 1;
 5402                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
 5403                             m, *offset)) {
 5404                                 /* auth HMAC failed so dump the packet */
 5405                                 *offset = length;
 5406                                 return (stcb);
 5407                         } else {
 5408                                 /* remaining chunks are HMAC checked */
 5409                                 stcb->asoc.authenticated = 1;
 5410                         }
 5411                         break;
 5412 
 5413                 default:
 5414         unknown_chunk:
 5415                         /* it's an unknown chunk! */
 5416                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
 5417                                 struct mbuf *mm;
 5418                                 struct sctp_paramhdr *phd;
 5419 
 5420                                 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
 5421                                     0, M_DONTWAIT, 1, MT_DATA);
 5422                                 if (mm) {
 5423                                         phd = mtod(mm, struct sctp_paramhdr *);
 5424                                         /*
 5425                                          * We cheat and use param type since
 5426                                          * we did not bother to define a
 5427                                          * error cause struct. They are the
 5428                                          * same basic format with different
 5429                                          * names.
 5430                                          */
 5431                                         phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
 5432                                         phd->param_length = htons(chk_length + sizeof(*phd));
 5433                                         SCTP_BUF_LEN(mm) = sizeof(*phd);
 5434                                         SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length),
 5435                                             M_DONTWAIT);
 5436                                         if (SCTP_BUF_NEXT(mm)) {
 5437 #ifdef SCTP_MBUF_LOGGING
 5438                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 5439                                                         struct mbuf *mat;
 5440 
 5441                                                         mat = SCTP_BUF_NEXT(mm);
 5442                                                         while (mat) {
 5443                                                                 if (SCTP_BUF_IS_EXTENDED(mat)) {
 5444                                                                         sctp_log_mb(mat, SCTP_MBUF_ICOPY);
 5445                                                                 }
 5446                                                                 mat = SCTP_BUF_NEXT(mat);
 5447                                                         }
 5448                                                 }
 5449 #endif
 5450                                                 sctp_queue_op_err(stcb, mm);
 5451                                         } else {
 5452                                                 sctp_m_freem(mm);
 5453                                         }
 5454                                 }
 5455                         }
 5456                         if ((ch->chunk_type & 0x80) == 0) {
 5457                                 /* discard this packet */
 5458                                 *offset = length;
 5459                                 return (stcb);
 5460                         }       /* else skip this bad chunk and continue... */
 5461                         break;
 5462                 }               /* switch (ch->chunk_type) */
 5463 
 5464 
 5465 next_chunk:
 5466                 /* get the next chunk */
 5467                 *offset += SCTP_SIZE32(chk_length);
 5468                 if (*offset >= length) {
 5469                         /* no more data left in the mbuf chain */
 5470                         break;
 5471                 }
 5472                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
 5473                     sizeof(struct sctp_chunkhdr), chunk_buf);
 5474                 if (ch == NULL) {
 5475                         if (locked_tcb) {
 5476                                 SCTP_TCB_UNLOCK(locked_tcb);
 5477                         }
 5478                         *offset = length;
 5479                         return (NULL);
 5480                 }
 5481         }                       /* while */
 5482 
 5483         if (asconf_cnt > 0 && stcb != NULL) {
 5484                 sctp_send_asconf_ack(stcb);
 5485         }
 5486         return (stcb);
 5487 }
 5488 
 5489 
 5490 #ifdef INVARIANTS
 5491 #ifdef __GNUC__
 5492 __attribute__((noinline))
 5493 #endif
 5494         void
 5495              sctp_validate_no_locks(struct sctp_inpcb *inp)
 5496 {
 5497         struct sctp_tcb *lstcb;
 5498 
 5499         LIST_FOREACH(lstcb, &inp->sctp_asoc_list, sctp_tcblist) {
 5500                 if (mtx_owned(&lstcb->tcb_mtx)) {
 5501                         panic("Own lock on stcb at return from input");
 5502                 }
 5503         }
 5504         if (mtx_owned(&inp->inp_create_mtx)) {
 5505                 panic("Own create lock on inp");
 5506         }
 5507         if (mtx_owned(&inp->inp_mtx)) {
 5508                 panic("Own inp lock on inp");
 5509         }
 5510 }
 5511 
 5512 #endif
 5513 
 5514 /*
 5515  * common input chunk processing (v4 and v6)
 5516  */
 5517 void
 5518 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset,
 5519     int length, struct sctphdr *sh, struct sctp_chunkhdr *ch,
 5520     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
 5521     uint8_t ecn_bits, uint32_t vrf_id, uint16_t port)
 5522 {
 5523         /*
 5524          * Control chunk processing
 5525          */
 5526         uint32_t high_tsn;
 5527         int fwd_tsn_seen = 0, data_processed = 0;
 5528         struct mbuf *m = *mm;
 5529         int abort_flag = 0;
 5530         int un_sent;
 5531         int cnt_ctrl_ready = 0;
 5532 
 5533         SCTP_STAT_INCR(sctps_recvdatagrams);
 5534 #ifdef SCTP_AUDITING_ENABLED
 5535         sctp_audit_log(0xE0, 1);
 5536         sctp_auditing(0, inp, stcb, net);
 5537 #endif
 5538 
 5539         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
 5540             m, iphlen, offset, length, stcb);
 5541         if (stcb) {
 5542                 /* always clear this before beginning a packet */
 5543                 stcb->asoc.authenticated = 0;
 5544                 stcb->asoc.seen_a_sack_this_pkt = 0;
 5545                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
 5546                     stcb, stcb->asoc.state);
 5547 
 5548                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
 5549                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
 5550                         /*-
 5551                          * If we hit here, we had a ref count
 5552                          * up when the assoc was aborted and the
 5553                          * timer is clearing out the assoc, we should
 5554                          * NOT respond to any packet.. its OOTB.
 5555                          */
 5556                         SCTP_TCB_UNLOCK(stcb);
 5557                         sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
 5558                             vrf_id, port);
 5559                         goto out_now;
 5560                 }
 5561         }
 5562         if (IS_SCTP_CONTROL(ch)) {
 5563                 /* process the control portion of the SCTP packet */
 5564                 /* sa_ignore NO_NULL_CHK */
 5565                 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch,
 5566                     inp, stcb, &net, &fwd_tsn_seen, vrf_id, port);
 5567                 if (stcb) {
 5568                         /*
 5569                          * This covers us if the cookie-echo was there and
 5570                          * it changes our INP.
 5571                          */
 5572                         inp = stcb->sctp_ep;
 5573                         if ((net) && (port)) {
 5574                                 if (net->port == 0) {
 5575                                         sctp_pathmtu_adjustment(inp, stcb, net, net->mtu - sizeof(struct udphdr));
 5576                                 }
 5577                                 net->port = port;
 5578                         }
 5579                 }
 5580         } else {
 5581                 /*
 5582                  * no control chunks, so pre-process DATA chunks (these
 5583                  * checks are taken care of by control processing)
 5584                  */
 5585 
 5586                 /*
 5587                  * if DATA only packet, and auth is required, then punt...
 5588                  * can't have authenticated without any AUTH (control)
 5589                  * chunks
 5590                  */
 5591                 if ((stcb != NULL) &&
 5592                     !SCTP_BASE_SYSCTL(sctp_auth_disable) &&
 5593                     sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
 5594                         /* "silently" ignore */
 5595                         SCTP_STAT_INCR(sctps_recvauthmissing);
 5596                         SCTP_TCB_UNLOCK(stcb);
 5597                         goto out_now;
 5598                 }
 5599                 if (stcb == NULL) {
 5600                         /* out of the blue DATA chunk */
 5601                         sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
 5602                             vrf_id, port);
 5603                         goto out_now;
 5604                 }
 5605                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
 5606                         /* v_tag mismatch! */
 5607                         SCTP_STAT_INCR(sctps_badvtag);
 5608                         SCTP_TCB_UNLOCK(stcb);
 5609                         goto out_now;
 5610                 }
 5611         }
 5612 
 5613         if (stcb == NULL) {
 5614                 /*
 5615                  * no valid TCB for this packet, or we found it's a bad
 5616                  * packet while processing control, or we're done with this
 5617                  * packet (done or skip rest of data), so we drop it...
 5618                  */
 5619                 goto out_now;
 5620         }
 5621         /*
 5622          * DATA chunk processing
 5623          */
 5624         /* plow through the data chunks while length > offset */
 5625 
 5626         /*
 5627          * Rest should be DATA only.  Check authentication state if AUTH for
 5628          * DATA is required.
 5629          */
 5630         if ((length > offset) &&
 5631             (stcb != NULL) &&
 5632             !SCTP_BASE_SYSCTL(sctp_auth_disable) &&
 5633             sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
 5634             !stcb->asoc.authenticated) {
 5635                 /* "silently" ignore */
 5636                 SCTP_STAT_INCR(sctps_recvauthmissing);
 5637                 SCTPDBG(SCTP_DEBUG_AUTH1,
 5638                     "Data chunk requires AUTH, skipped\n");
 5639                 goto trigger_send;
 5640         }
 5641         if (length > offset) {
 5642                 int retval;
 5643 
 5644                 /*
 5645                  * First check to make sure our state is correct. We would
 5646                  * not get here unless we really did have a tag, so we don't
 5647                  * abort if this happens, just dump the chunk silently.
 5648                  */
 5649                 switch (SCTP_GET_STATE(&stcb->asoc)) {
 5650                 case SCTP_STATE_COOKIE_ECHOED:
 5651                         /*
 5652                          * we consider data with valid tags in this state
 5653                          * shows us the cookie-ack was lost. Imply it was
 5654                          * there.
 5655                          */
 5656                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 5657                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 5658                                     stcb->asoc.overall_error_count,
 5659                                     0,
 5660                                     SCTP_FROM_SCTP_INPUT,
 5661                                     __LINE__);
 5662                         }
 5663                         stcb->asoc.overall_error_count = 0;
 5664                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
 5665                         break;
 5666                 case SCTP_STATE_COOKIE_WAIT:
 5667                         /*
 5668                          * We consider OOTB any data sent during asoc setup.
 5669                          */
 5670                         sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
 5671                             vrf_id, port);
 5672                         SCTP_TCB_UNLOCK(stcb);
 5673                         goto out_now;
 5674                         /* sa_ignore NOTREACHED */
 5675                         break;
 5676                 case SCTP_STATE_EMPTY:  /* should not happen */
 5677                 case SCTP_STATE_INUSE:  /* should not happen */
 5678                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
 5679                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 5680                 default:
 5681                         SCTP_TCB_UNLOCK(stcb);
 5682                         goto out_now;
 5683                         /* sa_ignore NOTREACHED */
 5684                         break;
 5685                 case SCTP_STATE_OPEN:
 5686                 case SCTP_STATE_SHUTDOWN_SENT:
 5687                         break;
 5688                 }
 5689                 /* plow through the data chunks while length > offset */
 5690                 retval = sctp_process_data(mm, iphlen, &offset, length, sh,
 5691                     inp, stcb, net, &high_tsn);
 5692                 if (retval == 2) {
 5693                         /*
 5694                          * The association aborted, NO UNLOCK needed since
 5695                          * the association is destroyed.
 5696                          */
 5697                         goto out_now;
 5698                 }
 5699                 data_processed = 1;
 5700                 /*
 5701                  * Anything important needs to have been m_copy'ed in
 5702                  * process_data
 5703                  */
 5704         }
 5705         /* take care of ecn */
 5706         if ((stcb->asoc.ecn_allowed == 1) &&
 5707             ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
 5708                 /* Yep, we need to add a ECNE */
 5709                 sctp_send_ecn_echo(stcb, net, high_tsn);
 5710         }
 5711         if ((data_processed == 0) && (fwd_tsn_seen)) {
 5712                 int was_a_gap;
 5713                 uint32_t highest_tsn;
 5714 
 5715                 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
 5716                         highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
 5717                 } else {
 5718                         highest_tsn = stcb->asoc.highest_tsn_inside_map;
 5719                 }
 5720                 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
 5721                 stcb->asoc.send_sack = 1;
 5722                 sctp_sack_check(stcb, was_a_gap, &abort_flag);
 5723                 if (abort_flag) {
 5724                         /* Again, we aborted so NO UNLOCK needed */
 5725                         goto out_now;
 5726                 }
 5727         } else if (fwd_tsn_seen) {
 5728                 stcb->asoc.send_sack = 1;
 5729         }
 5730         /* trigger send of any chunks in queue... */
 5731 trigger_send:
 5732 #ifdef SCTP_AUDITING_ENABLED
 5733         sctp_audit_log(0xE0, 2);
 5734         sctp_auditing(1, inp, stcb, net);
 5735 #endif
 5736         SCTPDBG(SCTP_DEBUG_INPUT1,
 5737             "Check for chunk output prw:%d tqe:%d tf=%d\n",
 5738             stcb->asoc.peers_rwnd,
 5739             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
 5740             stcb->asoc.total_flight);
 5741         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
 5742         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
 5743                 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
 5744         }
 5745         if (cnt_ctrl_ready ||
 5746             ((un_sent) &&
 5747             (stcb->asoc.peers_rwnd > 0 ||
 5748             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
 5749                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
 5750                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 5751                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
 5752         }
 5753 #ifdef SCTP_AUDITING_ENABLED
 5754         sctp_audit_log(0xE0, 3);
 5755         sctp_auditing(2, inp, stcb, net);
 5756 #endif
 5757         SCTP_TCB_UNLOCK(stcb);
 5758 out_now:
 5759 #ifdef INVARIANTS
 5760         sctp_validate_no_locks(inp);
 5761 #endif
 5762         return;
 5763 }
 5764 
 5765 #if 0
 5766 static void
 5767 sctp_print_mbuf_chain(struct mbuf *m)
 5768 {
 5769         for (; m; m = SCTP_BUF_NEXT(m)) {
 5770                 printf("%p: m_len = %ld\n", m, SCTP_BUF_LEN(m));
 5771                 if (SCTP_BUF_IS_EXTENDED(m))
 5772                         printf("%p: extend_size = %d\n", m, SCTP_BUF_EXTEND_SIZE(m));
 5773         }
 5774 }
 5775 
 5776 #endif
 5777 
 5778 #ifdef INET
 5779 void
 5780 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
 5781 {
 5782 #ifdef SCTP_MBUF_LOGGING
 5783         struct mbuf *mat;
 5784 
 5785 #endif
 5786         struct mbuf *m;
 5787         int iphlen;
 5788         uint32_t vrf_id = 0;
 5789         uint8_t ecn_bits;
 5790         struct ip *ip;
 5791         struct sctphdr *sh;
 5792         struct sctp_inpcb *inp = NULL;
 5793         struct sctp_nets *net;
 5794         struct sctp_tcb *stcb = NULL;
 5795         struct sctp_chunkhdr *ch;
 5796         int refcount_up = 0;
 5797         int length, mlen, offset;
 5798 
 5799 #if !defined(SCTP_WITH_NO_CSUM)
 5800         uint32_t check, calc_check;
 5801 
 5802 #endif
 5803 
 5804         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
 5805                 SCTP_RELEASE_PKT(i_pak);
 5806                 return;
 5807         }
 5808         mlen = SCTP_HEADER_LEN(i_pak);
 5809         iphlen = off;
 5810         m = SCTP_HEADER_TO_CHAIN(i_pak);
 5811 
 5812         net = NULL;
 5813         SCTP_STAT_INCR(sctps_recvpackets);
 5814         SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
 5815 
 5816 
 5817 #ifdef SCTP_MBUF_LOGGING
 5818         /* Log in any input mbufs */
 5819         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
 5820                 mat = m;
 5821                 while (mat) {
 5822                         if (SCTP_BUF_IS_EXTENDED(mat)) {
 5823                                 sctp_log_mb(mat, SCTP_MBUF_INPUT);
 5824                         }
 5825                         mat = SCTP_BUF_NEXT(mat);
 5826                 }
 5827         }
 5828 #endif
 5829 #ifdef  SCTP_PACKET_LOGGING
 5830         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING)
 5831                 sctp_packet_log(m, mlen);
 5832 #endif
 5833         /*
 5834          * Must take out the iphlen, since mlen expects this (only effect lb
 5835          * case)
 5836          */
 5837         mlen -= iphlen;
 5838 
 5839         /*
 5840          * Get IP, SCTP, and first chunk header together in first mbuf.
 5841          */
 5842         ip = mtod(m, struct ip *);
 5843         offset = iphlen + sizeof(*sh) + sizeof(*ch);
 5844         if (SCTP_BUF_LEN(m) < offset) {
 5845                 if ((m = m_pullup(m, offset)) == 0) {
 5846                         SCTP_STAT_INCR(sctps_hdrops);
 5847                         return;
 5848                 }
 5849                 ip = mtod(m, struct ip *);
 5850         }
 5851         /* validate mbuf chain length with IP payload length */
 5852         if (mlen < (SCTP_GET_IPV4_LENGTH(ip) - iphlen)) {
 5853                 SCTP_STAT_INCR(sctps_hdrops);
 5854                 goto bad;
 5855         }
 5856         sh = (struct sctphdr *)((caddr_t)ip + iphlen);
 5857         ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh));
 5858         SCTPDBG(SCTP_DEBUG_INPUT1,
 5859             "sctp_input() length:%d iphlen:%d\n", mlen, iphlen);
 5860 
 5861         /* SCTP does not allow broadcasts or multicasts */
 5862         if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
 5863                 goto bad;
 5864         }
 5865         if (SCTP_IS_IT_BROADCAST(ip->ip_dst, m)) {
 5866                 /*
 5867                  * We only look at broadcast if its a front state, All
 5868                  * others we will not have a tcb for anyway.
 5869                  */
 5870                 goto bad;
 5871         }
 5872         /* validate SCTP checksum */
 5873         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
 5874             "sctp_input(): Packet of length %d received on %s with csum_flags 0x%x.\n",
 5875             m->m_pkthdr.len,
 5876             if_name(m->m_pkthdr.rcvif),
 5877             m->m_pkthdr.csum_flags);
 5878 #if defined(SCTP_WITH_NO_CSUM)
 5879         SCTP_STAT_INCR(sctps_recvnocrc);
 5880 #else
 5881         if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
 5882                 SCTP_STAT_INCR(sctps_recvhwcrc);
 5883                 goto sctp_skip_csum_4;
 5884         }
 5885         check = sh->checksum;   /* save incoming checksum */
 5886         sh->checksum = 0;       /* prepare for calc */
 5887         calc_check = sctp_calculate_cksum(m, iphlen);
 5888         sh->checksum = check;
 5889         SCTP_STAT_INCR(sctps_recvswcrc);
 5890         if (calc_check != check) {
 5891                 SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
 5892                     calc_check, check, m, mlen, iphlen);
 5893 
 5894                 stcb = sctp_findassociation_addr(m, iphlen,
 5895                     offset - sizeof(*ch),
 5896                     sh, ch, &inp, &net,
 5897                     vrf_id);
 5898                 if ((net) && (port)) {
 5899                         if (net->port == 0) {
 5900                                 sctp_pathmtu_adjustment(inp, stcb, net, net->mtu - sizeof(struct udphdr));
 5901                         }
 5902                         net->port = port;
 5903                 }
 5904                 if ((net != NULL) && (m->m_flags & M_FLOWID)) {
 5905                         net->flowid = m->m_pkthdr.flowid;
 5906 #ifdef INVARIANTS
 5907                         net->flowidset = 1;
 5908 #endif
 5909                 }
 5910                 if ((inp) && (stcb)) {
 5911                         sctp_send_packet_dropped(stcb, net, m, iphlen, 1);
 5912                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
 5913                 } else if ((inp != NULL) && (stcb == NULL)) {
 5914                         refcount_up = 1;
 5915                 }
 5916                 SCTP_STAT_INCR(sctps_badsum);
 5917                 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
 5918                 goto bad;
 5919         }
 5920 sctp_skip_csum_4:
 5921 #endif
 5922         /* destination port of 0 is illegal, based on RFC2960. */
 5923         if (sh->dest_port == 0) {
 5924                 SCTP_STAT_INCR(sctps_hdrops);
 5925                 goto bad;
 5926         }
 5927         /*
 5928          * Locate pcb and tcb for datagram sctp_findassociation_addr() wants
 5929          * IP/SCTP/first chunk header...
 5930          */
 5931         stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
 5932             sh, ch, &inp, &net, vrf_id);
 5933         if ((net) && (port)) {
 5934                 if (net->port == 0) {
 5935                         sctp_pathmtu_adjustment(inp, stcb, net, net->mtu - sizeof(struct udphdr));
 5936                 }
 5937                 net->port = port;
 5938         }
 5939         if ((net != NULL) && (m->m_flags & M_FLOWID)) {
 5940                 net->flowid = m->m_pkthdr.flowid;
 5941 #ifdef INVARIANTS
 5942                 net->flowidset = 1;
 5943 #endif
 5944         }
 5945         /* inp's ref-count increased && stcb locked */
 5946         if (inp == NULL) {
 5947                 struct sctp_init_chunk *init_chk, chunk_buf;
 5948 
 5949                 SCTP_STAT_INCR(sctps_noport);
 5950 #ifdef ICMP_BANDLIM
 5951                 /*
 5952                  * we use the bandwidth limiting to protect against sending
 5953                  * too many ABORTS all at once. In this case these count the
 5954                  * same as an ICMP message.
 5955                  */
 5956                 if (badport_bandlim(0) < 0)
 5957                         goto bad;
 5958 #endif                          /* ICMP_BANDLIM */
 5959                 SCTPDBG(SCTP_DEBUG_INPUT1,
 5960                     "Sending a ABORT from packet entry!\n");
 5961                 if (ch->chunk_type == SCTP_INITIATION) {
 5962                         /*
 5963                          * we do a trick here to get the INIT tag, dig in
 5964                          * and get the tag from the INIT and put it in the
 5965                          * common header.
 5966                          */
 5967                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
 5968                             iphlen + sizeof(*sh), sizeof(*init_chk),
 5969                             (uint8_t *) & chunk_buf);
 5970                         if (init_chk != NULL)
 5971                                 sh->v_tag = init_chk->init.initiate_tag;
 5972                 }
 5973                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
 5974                         sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id, port);
 5975                         goto bad;
 5976                 }
 5977                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
 5978                         goto bad;
 5979                 }
 5980                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION)
 5981                         sctp_send_abort(m, iphlen, sh, 0, NULL, vrf_id, port);
 5982                 goto bad;
 5983         } else if (stcb == NULL) {
 5984                 refcount_up = 1;
 5985         }
 5986 #ifdef IPSEC
 5987         /*
 5988          * I very much doubt any of the IPSEC stuff will work but I have no
 5989          * idea, so I will leave it in place.
 5990          */
 5991         if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) {
 5992                 MODULE_GLOBAL(ipsec4stat).in_polvio++;
 5993                 SCTP_STAT_INCR(sctps_hdrops);
 5994                 goto bad;
 5995         }
 5996 #endif                          /* IPSEC */
 5997 
 5998         /*
 5999          * common chunk processing
 6000          */
 6001         length = ip->ip_len + iphlen;
 6002         offset -= sizeof(struct sctp_chunkhdr);
 6003 
 6004         ecn_bits = ip->ip_tos;
 6005 
 6006         /* sa_ignore NO_NULL_CHK */
 6007         sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
 6008             inp, stcb, net, ecn_bits, vrf_id, port);
 6009         /* inp's ref-count reduced && stcb unlocked */
 6010         if (m) {
 6011                 sctp_m_freem(m);
 6012         }
 6013         if ((inp) && (refcount_up)) {
 6014                 /* reduce ref-count */
 6015                 SCTP_INP_DECR_REF(inp);
 6016         }
 6017         return;
 6018 bad:
 6019         if (stcb) {
 6020                 SCTP_TCB_UNLOCK(stcb);
 6021         }
 6022         if ((inp) && (refcount_up)) {
 6023                 /* reduce ref-count */
 6024                 SCTP_INP_DECR_REF(inp);
 6025         }
 6026         if (m) {
 6027                 sctp_m_freem(m);
 6028         }
 6029         return;
 6030 }
 6031 
 6032 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
 6033 extern int *sctp_cpuarry;
 6034 
 6035 #endif
 6036 
 6037 void
 6038 sctp_input(struct mbuf *m, int off)
 6039 {
 6040 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
 6041         struct ip *ip;
 6042         struct sctphdr *sh;
 6043         int offset;
 6044         int cpu_to_use;
 6045         uint32_t flowid, tag;
 6046 
 6047         if (mp_ncpus > 1) {
 6048                 if (m->m_flags & M_FLOWID) {
 6049                         flowid = m->m_pkthdr.flowid;
 6050                 } else {
 6051                         /*
 6052                          * No flow id built by lower layers fix it so we
 6053                          * create one.
 6054                          */
 6055                         ip = mtod(m, struct ip *);
 6056                         offset = off + sizeof(*sh);
 6057                         if (SCTP_BUF_LEN(m) < offset) {
 6058                                 if ((m = m_pullup(m, offset)) == 0) {
 6059                                         SCTP_STAT_INCR(sctps_hdrops);
 6060                                         return;
 6061                                 }
 6062                                 ip = mtod(m, struct ip *);
 6063                         }
 6064                         sh = (struct sctphdr *)((caddr_t)ip + off);
 6065                         tag = htonl(sh->v_tag);
 6066                         flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
 6067                         m->m_pkthdr.flowid = flowid;
 6068                         m->m_flags |= M_FLOWID;
 6069                 }
 6070                 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
 6071                 sctp_queue_to_mcore(m, off, cpu_to_use);
 6072                 return;
 6073         }
 6074 #endif
 6075         sctp_input_with_port(m, off, 0);
 6076 }
 6077 
 6078 #endif

Cache object: 1bc2d2f7283e0d965c6a804ca9944e3f


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.