sys/netinet/sctp_input.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_input.c,v 1.27 2005/03/06 16:04:17 itojun Exp $   */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_input.h>
  44 #include <netinet/sctp_auth.h>
  45 #include <netinet/sctp_indata.h>
  46 #include <netinet/sctp_asconf.h>
  47 #include <netinet/sctp_bsd_addr.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/udp.h>
  50
  51
  52
  53 static void
  54 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
  55 {
  56         struct sctp_nets *net;
  57
  58         /*
  59          * This now not only stops all cookie timers it also stops any INIT
  60          * timers as well. This will make sure that the timers are stopped
  61          * in all collision cases.
  62          */
  63         SCTP_TCB_LOCK_ASSERT(stcb);
  64         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  65                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
  66                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
  67                             stcb->sctp_ep,
  68                             stcb,
  69                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
  70                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
  71                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
  72                             stcb->sctp_ep,
  73                             stcb,
  74                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
  75                 }
  76         }
  77 }
  78
  79 /* INIT handler */
  80 static void
  81 sctp_handle_init(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
  82     struct sctp_init_chunk *cp, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
  83     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id, uint16_t port)
  84 {
  85         struct sctp_init *init;
  86         struct mbuf *op_err;
  87         uint32_t init_limit;
  88
  89         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
  90             stcb);
  91         if (stcb == NULL) {
  92                 SCTP_INP_RLOCK(inp);
  93                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
  94                         goto outnow;
  95                 }
  96         }
  97         op_err = NULL;
  98         init = &cp->init;
  99         /* First are we accepting? */
 100         if ((inp->sctp_socket->so_qlimit == 0) && (stcb == NULL)) {
 101                 SCTPDBG(SCTP_DEBUG_INPUT2,
 102                     "sctp_handle_init: Abort, so_qlimit:%d\n",
 103                     inp->sctp_socket->so_qlimit);
 104                 /*
 105                  * FIX ME ?? What about TCP model and we have a
 106                  * match/restart case? Actually no fix is needed. the lookup
 107                  * will always find the existing assoc so stcb would not be
 108                  * NULL. It may be questionable to do this since we COULD
 109                  * just send back the INIT-ACK and hope that the app did
 110                  * accept()'s by the time the COOKIE was sent. But there is
 111                  * a price to pay for COOKIE generation and I don't want to
 112                  * pay it on the chance that the app will actually do some
 113                  * accepts(). The App just looses and should NOT be in this
 114                  * state :-)
 115                  */
 116                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
 117                     vrf_id, port);
 118                 if (stcb)
 119                         *abort_no_unlock = 1;
 120                 goto outnow;
 121         }
 122         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
 123                 /* Invalid length */
 124                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 125                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
 126                     vrf_id, port);
 127                 if (stcb)
 128                         *abort_no_unlock = 1;
 129                 goto outnow;
 130         }
 131         /* validate parameters */
 132         if (init->initiate_tag == 0) {
 133                 /* protocol error... send abort */
 134                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 135                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
 136                     vrf_id, port);
 137                 if (stcb)
 138                         *abort_no_unlock = 1;
 139                 goto outnow;
 140         }
 141         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
 142                 /* invalid parameter... send abort */
 143                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 144                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
 145                     vrf_id, port);
 146                 if (stcb)
 147                         *abort_no_unlock = 1;
 148                 goto outnow;
 149         }
 150         if (init->num_inbound_streams == 0) {
 151                 /* protocol error... send abort */
 152                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 153                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
 154                     vrf_id, port);
 155                 if (stcb)
 156                         *abort_no_unlock = 1;
 157                 goto outnow;
 158         }
 159         if (init->num_outbound_streams == 0) {
 160                 /* protocol error... send abort */
 161                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 162                 sctp_abort_association(inp, stcb, m, iphlen, sh, op_err,
 163                     vrf_id, port);
 164                 if (stcb)
 165                         *abort_no_unlock = 1;
 166                 goto outnow;
 167         }
 168         init_limit = offset + ntohs(cp->ch.chunk_length);
 169         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
 170             init_limit)) {
 171                 /* auth parameter(s) error... send abort */
 172                 sctp_abort_association(inp, stcb, m, iphlen, sh, NULL, vrf_id, port);
 173                 if (stcb)
 174                         *abort_no_unlock = 1;
 175                 goto outnow;
 176         }
 177         /* send an INIT-ACK w/cookie */
 178         SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
 179         sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, sh, cp, vrf_id, port,
 180             ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
 181 outnow:
 182         if (stcb == NULL) {
 183                 SCTP_INP_RUNLOCK(inp);
 184         }
 185 }
 186
 187 /*
 188  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
 189  */
 190
 191 int
 192 sctp_is_there_unsent_data(struct sctp_tcb *stcb)
 193 {
 194         int unsent_data = 0;
 195         struct sctp_stream_queue_pending *sp;
 196         struct sctp_stream_out *strq;
 197         struct sctp_association *asoc;
 198
 199         /*
 200          * This function returns the number of streams that have true unsent
 201          * data on them. Note that as it looks through it will clean up any
 202          * places that have old data that has been sent but left at top of
 203          * stream queue.
 204          */
 205         asoc = &stcb->asoc;
 206         SCTP_TCB_SEND_LOCK(stcb);
 207         if (!TAILQ_EMPTY(&asoc->out_wheel)) {
 208                 /* Check to see if some data queued */
 209                 TAILQ_FOREACH(strq, &asoc->out_wheel, next_spoke) {
 210         is_there_another:
 211                         /* sa_ignore FREED_MEMORY */
 212                         sp = TAILQ_FIRST(&strq->outqueue);
 213                         if (sp == NULL) {
 214                                 continue;
 215                         }
 216                         if ((sp->msg_is_complete) &&
 217                             (sp->length == 0) &&
 218                             (sp->sender_all_done)) {
 219                                 /*
 220                                  * We are doing differed cleanup. Last time
 221                                  * through when we took all the data the
 222                                  * sender_all_done was not set.
 223                                  */
 224                                 if (sp->put_last_out == 0) {
 225                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
 226                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
 227                                             sp->sender_all_done,
 228                                             sp->length,
 229                                             sp->msg_is_complete,
 230                                             sp->put_last_out);
 231                                 }
 232                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
 233                                 TAILQ_REMOVE(&strq->outqueue, sp, next);
 234                                 sctp_free_remote_addr(sp->net);
 235                                 if (sp->data) {
 236                                         sctp_m_freem(sp->data);
 237                                         sp->data = NULL;
 238                                 }
 239                                 sctp_free_a_strmoq(stcb, sp);
 240                                 goto is_there_another;
 241                         } else {
 242                                 unsent_data++;
 243                                 continue;
 244                         }
 245                 }
 246         }
 247         SCTP_TCB_SEND_UNLOCK(stcb);
 248         return (unsent_data);
 249 }
 250
 251 static int
 252 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb,
 253     struct sctp_nets *net)
 254 {
 255         struct sctp_init *init;
 256         struct sctp_association *asoc;
 257         struct sctp_nets *lnet;
 258         unsigned int i;
 259
 260         init = &cp->init;
 261         asoc = &stcb->asoc;
 262         /* save off parameters */
 263         asoc->peer_vtag = ntohl(init->initiate_tag);
 264         asoc->peers_rwnd = ntohl(init->a_rwnd);
 265         if (TAILQ_FIRST(&asoc->nets)) {
 266                 /* update any ssthresh's that may have a default */
 267                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
 268                         lnet->ssthresh = asoc->peers_rwnd;
 269
 270                         if (sctp_logging_level & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
 271                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
 272                         }
 273                 }
 274         }
 275         SCTP_TCB_SEND_LOCK(stcb);
 276         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
 277                 unsigned int newcnt;
 278                 struct sctp_stream_out *outs;
 279                 struct sctp_stream_queue_pending *sp;
 280
 281                 /* cut back on number of streams */
 282                 newcnt = ntohs(init->num_inbound_streams);
 283                 /* This if is probably not needed but I am cautious */
 284                 if (asoc->strmout) {
 285                         /* First make sure no data chunks are trapped */
 286                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
 287                                 outs = &asoc->strmout[i];
 288                                 sp = TAILQ_FIRST(&outs->outqueue);
 289                                 while (sp) {
 290                                         TAILQ_REMOVE(&outs->outqueue, sp,
 291                                             next);
 292                                         asoc->stream_queue_cnt--;
 293                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
 294                                             stcb, SCTP_NOTIFY_DATAGRAM_UNSENT,
 295                                             sp, SCTP_SO_NOT_LOCKED);
 296                                         if (sp->data) {
 297                                                 sctp_m_freem(sp->data);
 298                                                 sp->data = NULL;
 299                                         }
 300                                         sctp_free_remote_addr(sp->net);
 301                                         sp->net = NULL;
 302                                         /* Free the chunk */
 303                                         SCTP_PRINTF("sp:%p tcb:%p weird free case\n",
 304                                             sp, stcb);
 305
 306                                         sctp_free_a_strmoq(stcb, sp);
 307                                         /* sa_ignore FREED_MEMORY */
 308                                         sp = TAILQ_FIRST(&outs->outqueue);
 309                                 }
 310                         }
 311                 }
 312                 /* cut back the count and abandon the upper streams */
 313                 asoc->pre_open_streams = newcnt;
 314         }
 315         SCTP_TCB_SEND_UNLOCK(stcb);
 316         asoc->streamoutcnt = asoc->pre_open_streams;
 317         /* init tsn's */
 318         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
 319         if (sctp_logging_level & SCTP_MAP_LOGGING_ENABLE) {
 320                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 321         }
 322         /* This is the next one we expect */
 323         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
 324
 325         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
 326         asoc->cumulative_tsn = asoc->asconf_seq_in;
 327         asoc->last_echo_tsn = asoc->asconf_seq_in;
 328         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 329         /* open the requested streams */
 330
 331         if (asoc->strmin != NULL) {
 332                 /* Free the old ones */
 333                 struct sctp_queued_to_read *ctl;
 334
 335                 for (i = 0; i < asoc->streamincnt; i++) {
 336                         ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
 337                         while (ctl) {
 338                                 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
 339                                 sctp_free_remote_addr(ctl->whoFrom);
 340                                 ctl->whoFrom = NULL;
 341                                 sctp_m_freem(ctl->data);
 342                                 ctl->data = NULL;
 343                                 sctp_free_a_readq(stcb, ctl);
 344                                 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
 345                         }
 346                 }
 347                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
 348         }
 349         asoc->streamincnt = ntohs(init->num_outbound_streams);
 350         if (asoc->streamincnt > MAX_SCTP_STREAMS) {
 351                 asoc->streamincnt = MAX_SCTP_STREAMS;
 352         }
 353         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
 354             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
 355         if (asoc->strmin == NULL) {
 356                 /* we didn't get memory for the streams! */
 357                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
 358                 return (-1);
 359         }
 360         for (i = 0; i < asoc->streamincnt; i++) {
 361                 asoc->strmin[i].stream_no = i;
 362                 asoc->strmin[i].last_sequence_delivered = 0xffff;
 363                 /*
 364                  * U-stream ranges will be set when the cookie is unpacked.
 365                  * Or for the INIT sender they are un set (if pr-sctp not
 366                  * supported) when the INIT-ACK arrives.
 367                  */
 368                 TAILQ_INIT(&asoc->strmin[i].inqueue);
 369                 asoc->strmin[i].delivery_started = 0;
 370         }
 371         /*
 372          * load_address_from_init will put the addresses into the
 373          * association when the COOKIE is processed or the INIT-ACK is
 374          * processed. Both types of COOKIE's existing and new call this
 375          * routine. It will remove addresses that are no longer in the
 376          * association (for the restarting case where addresses are
 377          * removed). Up front when the INIT arrives we will discard it if it
 378          * is a restart and new addresses have been added.
 379          */
 380         /* sa_ignore MEMLEAK */
 381         return (0);
 382 }
 383
 384 /*
 385  * INIT-ACK message processing/consumption returns value < 0 on error
 386  */
 387 static int
 388 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
 389     struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 390     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id)
 391 {
 392         struct sctp_association *asoc;
 393         struct mbuf *op_err;
 394         int retval, abort_flag;
 395         uint32_t initack_limit;
 396
 397         /* First verify that we have no illegal param's */
 398         abort_flag = 0;
 399         op_err = NULL;
 400
 401         op_err = sctp_arethere_unrecognized_parameters(m,
 402             (offset + sizeof(struct sctp_init_chunk)),
 403             &abort_flag, (struct sctp_chunkhdr *)cp);
 404         if (abort_flag) {
 405                 /* Send an abort and notify peer */
 406                 sctp_abort_an_association(stcb->sctp_ep, stcb, SCTP_CAUSE_PROTOCOL_VIOLATION, op_err, SCTP_SO_NOT_LOCKED);
 407                 *abort_no_unlock = 1;
 408                 return (-1);
 409         }
 410         asoc = &stcb->asoc;
 411         /* process the peer's parameters in the INIT-ACK */
 412         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb, net);
 413         if (retval < 0) {
 414                 return (retval);
 415         }
 416         initack_limit = offset + ntohs(cp->ch.chunk_length);
 417         /* load all addresses */
 418         if ((retval = sctp_load_addresses_from_init(stcb, m, iphlen,
 419             (offset + sizeof(struct sctp_init_chunk)), initack_limit, sh,
 420             NULL))) {
 421                 /* Huh, we should abort */
 422                 SCTPDBG(SCTP_DEBUG_INPUT1,
 423                     "Load addresses from INIT causes an abort %d\n",
 424                     retval);
 425                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
 426                     NULL, 0, net->port);
 427                 *abort_no_unlock = 1;
 428                 return (-1);
 429         }
 430         /* if the peer doesn't support asconf, flush the asconf queue */
 431         if (asoc->peer_supports_asconf == 0) {
 432                 struct sctp_asconf_addr *aparam;
 433
 434                 while (!TAILQ_EMPTY(&asoc->asconf_queue)) {
 435                         /* sa_ignore FREED_MEMORY */
 436                         aparam = TAILQ_FIRST(&asoc->asconf_queue);
 437                         TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
 438                         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
 439                 }
 440         }
 441         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
 442             stcb->asoc.local_hmacs);
 443         if (op_err) {
 444                 sctp_queue_op_err(stcb, op_err);
 445                 /* queuing will steal away the mbuf chain to the out queue */
 446                 op_err = NULL;
 447         }
 448         /* extract the cookie and queue it to "echo" it back... */
 449         if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
 450                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 451                     stcb->asoc.overall_error_count,
 452                     0,
 453                     SCTP_FROM_SCTP_INPUT,
 454                     __LINE__);
 455         }
 456         stcb->asoc.overall_error_count = 0;
 457         net->error_count = 0;
 458
 459         /*
 460          * Cancel the INIT timer, We do this first before queueing the
 461          * cookie. We always cancel at the primary to assue that we are
 462          * canceling the timer started by the INIT which always goes to the
 463          * primary.
 464          */
 465         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
 466             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
 467
 468         /* calculate the RTO */
 469         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy);
 470
 471         retval = sctp_send_cookie_echo(m, offset, stcb, net);
 472         if (retval < 0) {
 473                 /*
 474                  * No cookie, we probably should send a op error. But in any
 475                  * case if there is no cookie in the INIT-ACK, we can
 476                  * abandon the peer, its broke.
 477                  */
 478                 if (retval == -3) {
 479                         /* We abort with an error of missing mandatory param */
 480                         op_err =
 481                             sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);
 482                         if (op_err) {
 483                                 /*
 484                                  * Expand beyond to include the mandatory
 485                                  * param cookie
 486                                  */
 487                                 struct sctp_inv_mandatory_param *mp;
 488
 489                                 SCTP_BUF_LEN(op_err) =
 490                                     sizeof(struct sctp_inv_mandatory_param);
 491                                 mp = mtod(op_err,
 492                                     struct sctp_inv_mandatory_param *);
 493                                 /* Subtract the reserved param */
 494                                 mp->length =
 495                                     htons(sizeof(struct sctp_inv_mandatory_param) - 2);
 496                                 mp->num_param = htonl(1);
 497                                 mp->param = htons(SCTP_STATE_COOKIE);
 498                                 mp->resv = 0;
 499                         }
 500                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 501                             sh, op_err, 0, net->port);
 502                         *abort_no_unlock = 1;
 503                 }
 504                 return (retval);
 505         }
 506         return (0);
 507 }
 508
 509 static void
 510 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
 511     struct sctp_tcb *stcb, struct sctp_nets *net)
 512 {
 513         struct sockaddr_storage store;
 514         struct sockaddr_in *sin;
 515         struct sockaddr_in6 *sin6;
 516         struct sctp_nets *r_net;
 517         struct timeval tv;
 518         int req_prim = 0;
 519
 520         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
 521                 /* Invalid length */
 522                 return;
 523         }
 524         sin = (struct sockaddr_in *)&store;
 525         sin6 = (struct sockaddr_in6 *)&store;
 526
 527         memset(&store, 0, sizeof(store));
 528         if (cp->heartbeat.hb_info.addr_family == AF_INET &&
 529             cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
 530                 sin->sin_family = cp->heartbeat.hb_info.addr_family;
 531                 sin->sin_len = cp->heartbeat.hb_info.addr_len;
 532                 sin->sin_port = stcb->rport;
 533                 memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,
 534                     sizeof(sin->sin_addr));
 535         } else if (cp->heartbeat.hb_info.addr_family == AF_INET6 &&
 536             cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
 537                 sin6->sin6_family = cp->heartbeat.hb_info.addr_family;
 538                 sin6->sin6_len = cp->heartbeat.hb_info.addr_len;
 539                 sin6->sin6_port = stcb->rport;
 540                 memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,
 541                     sizeof(sin6->sin6_addr));
 542         } else {
 543                 return;
 544         }
 545         r_net = sctp_findnet(stcb, (struct sockaddr *)sin);
 546         if (r_net == NULL) {
 547                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
 548                 return;
 549         }
 550         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
 551             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
 552             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
 553                 /*
 554                  * If the its a HB and it's random value is correct when can
 555                  * confirm the destination.
 556                  */
 557                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 558                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
 559                         stcb->asoc.primary_destination = r_net;
 560                         r_net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
 561                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
 562                         r_net = TAILQ_FIRST(&stcb->asoc.nets);
 563                         if (r_net != stcb->asoc.primary_destination) {
 564                                 /*
 565                                  * first one on the list is NOT the primary
 566                                  * sctp_cmpaddr() is much more efficent if
 567                                  * the primary is the first on the list,
 568                                  * make it so.
 569                                  */
 570                                 TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
 571                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
 572                         }
 573                         req_prim = 1;
 574                 }
 575                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 576                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 577         }
 578         r_net->error_count = 0;
 579         r_net->hb_responded = 1;
 580         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
 581         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
 582         if (r_net->dest_state & SCTP_ADDR_NOT_REACHABLE) {
 583                 r_net->dest_state &= ~SCTP_ADDR_NOT_REACHABLE;
 584                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
 585                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
 586                     SCTP_HEARTBEAT_SUCCESS, (void *)r_net, SCTP_SO_NOT_LOCKED);
 587                 /* now was it the primary? if so restore */
 588                 if (r_net->dest_state & SCTP_ADDR_WAS_PRIMARY) {
 589                         (void)sctp_set_primary_addr(stcb, (struct sockaddr *)NULL, r_net);
 590                 }
 591         }
 592         /*
 593          * JRS 5/14/07 - If CMT PF is on and the destination is in PF state,
 594          * set the destination to active state and set the cwnd to one or
 595          * two MTU's based on whether PF1 or PF2 is being used. If a T3
 596          * timer is running, for the destination, stop the timer because a
 597          * PF-heartbeat was received.
 598          */
 599         if (sctp_cmt_on_off && sctp_cmt_pf && (net->dest_state & SCTP_ADDR_PF) ==
 600             SCTP_ADDR_PF) {
 601                 if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
 602                         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
 603                             stcb, net,
 604                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
 605                 }
 606                 net->dest_state &= ~SCTP_ADDR_PF;
 607                 net->cwnd = net->mtu * sctp_cmt_pf;
 608                 SCTPDBG(SCTP_DEBUG_INPUT1, "Destination %p moved from PF to reachable with cwnd %d.\n",
 609                     net, net->cwnd);
 610         }
 611         /* Now lets do a RTO with this */
 612         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy);
 613         /* Mobility adaptation */
 614         if (req_prim) {
 615                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 616                     SCTP_MOBILITY_BASE) ||
 617                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 618                     SCTP_MOBILITY_FASTHANDOFF)) &&
 619                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 620                     SCTP_MOBILITY_PRIM_DELETED)) {
 621
 622                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 623                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 624                             SCTP_MOBILITY_FASTHANDOFF)) {
 625                                 sctp_assoc_immediate_retrans(stcb,
 626                                     stcb->asoc.primary_destination);
 627                         }
 628                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 629                             SCTP_MOBILITY_BASE)) {
 630                                 sctp_move_chunks_from_deleted_prim(stcb,
 631                                     stcb->asoc.primary_destination);
 632                         }
 633                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 634                             stcb->asoc.deleted_primary);
 635                 }
 636         }
 637 }
 638
 639 static void
 640 sctp_handle_abort(struct sctp_abort_chunk *cp,
 641     struct sctp_tcb *stcb, struct sctp_nets *net)
 642 {
 643 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 644         struct socket *so;
 645
 646 #endif
 647
 648         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
 649         if (stcb == NULL)
 650                 return;
 651
 652         /* stop any receive timers */
 653         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
 654         /* notify user of the abort and clean up... */
 655         sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED);
 656         /* free the tcb */
 657 #if defined(SCTP_PANIC_ON_ABORT)
 658         printf("stcb:%p state:%d rport:%d net:%p\n",
 659             stcb, stcb->asoc.state, stcb->rport, net);
 660         if (!(stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
 661                 panic("Received an ABORT");
 662         } else {
 663                 printf("No panic its in state %x closed\n", stcb->asoc.state);
 664         }
 665 #endif
 666         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
 667         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 668             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 669                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 670         }
 671 #ifdef SCTP_ASOCLOG_OF_TSNS
 672         sctp_print_out_track_log(stcb);
 673 #endif
 674 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 675         so = SCTP_INP_SO(stcb->sctp_ep);
 676         atomic_add_int(&stcb->asoc.refcnt, 1);
 677         SCTP_TCB_UNLOCK(stcb);
 678         SCTP_SOCKET_LOCK(so, 1);
 679         SCTP_TCB_LOCK(stcb);
 680         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 681 #endif
 682         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
 683         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 684             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
 685 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 686         SCTP_SOCKET_UNLOCK(so, 1);
 687 #endif
 688         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
 689 }
 690
 691 static void
 692 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
 693     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
 694 {
 695         struct sctp_association *asoc;
 696         int some_on_streamwheel;
 697
 698 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 699         struct socket *so;
 700
 701 #endif
 702
 703         SCTPDBG(SCTP_DEBUG_INPUT2,
 704             "sctp_handle_shutdown: handling SHUTDOWN\n");
 705         if (stcb == NULL)
 706                 return;
 707         asoc = &stcb->asoc;
 708         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
 709             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 710                 return;
 711         }
 712         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
 713                 /* Shutdown NOT the expected size */
 714                 return;
 715         } else {
 716                 sctp_update_acked(stcb, cp, net, abort_flag);
 717         }
 718         if (asoc->control_pdapi) {
 719                 /*
 720                  * With a normal shutdown we assume the end of last record.
 721                  */
 722                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
 723                 asoc->control_pdapi->end_added = 1;
 724                 asoc->control_pdapi->pdapi_aborted = 1;
 725                 asoc->control_pdapi = NULL;
 726                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 727 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 728                 so = SCTP_INP_SO(stcb->sctp_ep);
 729                 atomic_add_int(&stcb->asoc.refcnt, 1);
 730                 SCTP_TCB_UNLOCK(stcb);
 731                 SCTP_SOCKET_LOCK(so, 1);
 732                 SCTP_TCB_LOCK(stcb);
 733                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 734                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 735                         /* assoc was freed while we were unlocked */
 736                         SCTP_SOCKET_UNLOCK(so, 1);
 737                         return;
 738                 }
 739 #endif
 740                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 741 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 742                 SCTP_SOCKET_UNLOCK(so, 1);
 743 #endif
 744         }
 745         /* goto SHUTDOWN_RECEIVED state to block new requests */
 746         if (stcb->sctp_socket) {
 747                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 748                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
 749                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 750                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
 751                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 752                         /*
 753                          * notify upper layer that peer has initiated a
 754                          * shutdown
 755                          */
 756                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 757
 758                         /* reset time */
 759                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 760                 }
 761         }
 762         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
 763                 /*
 764                  * stop the shutdown timer, since we WILL move to
 765                  * SHUTDOWN-ACK-SENT.
 766                  */
 767                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
 768         }
 769         /* Now is there unsent data on a stream somewhere? */
 770         some_on_streamwheel = sctp_is_there_unsent_data(stcb);
 771
 772         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 773             !TAILQ_EMPTY(&asoc->sent_queue) ||
 774             some_on_streamwheel) {
 775                 /* By returning we will push more data out */
 776                 return;
 777         } else {
 778                 /* no outstanding data to send, so move on... */
 779                 /* send SHUTDOWN-ACK */
 780                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
 781                 /* move to SHUTDOWN-ACK-SENT state */
 782                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
 783                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 784                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 785                 }
 786                 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
 787                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 788                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net,
 789                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
 790                 /* start SHUTDOWN timer */
 791                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
 792                     stcb, net);
 793         }
 794 }
 795
 796 static void
 797 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp,
 798     struct sctp_tcb *stcb, struct sctp_nets *net)
 799 {
 800         struct sctp_association *asoc;
 801
 802 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 803         struct socket *so;
 804
 805         so = SCTP_INP_SO(stcb->sctp_ep);
 806 #endif
 807         SCTPDBG(SCTP_DEBUG_INPUT2,
 808             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
 809         if (stcb == NULL)
 810                 return;
 811
 812         asoc = &stcb->asoc;
 813         /* process according to association state */
 814         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
 815             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 816                 /* unexpected SHUTDOWN-ACK... so ignore... */
 817                 SCTP_TCB_UNLOCK(stcb);
 818                 return;
 819         }
 820         if (asoc->control_pdapi) {
 821                 /*
 822                  * With a normal shutdown we assume the end of last record.
 823                  */
 824                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
 825                 asoc->control_pdapi->end_added = 1;
 826                 asoc->control_pdapi->pdapi_aborted = 1;
 827                 asoc->control_pdapi = NULL;
 828                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 829 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 830                 atomic_add_int(&stcb->asoc.refcnt, 1);
 831                 SCTP_TCB_UNLOCK(stcb);
 832                 SCTP_SOCKET_LOCK(so, 1);
 833                 SCTP_TCB_LOCK(stcb);
 834                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 835                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 836                         /* assoc was freed while we were unlocked */
 837                         SCTP_SOCKET_UNLOCK(so, 1);
 838                         return;
 839                 }
 840 #endif
 841                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 842 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 843                 SCTP_SOCKET_UNLOCK(so, 1);
 844 #endif
 845         }
 846         /* are the queues empty? */
 847         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 848             !TAILQ_EMPTY(&asoc->sent_queue) ||
 849             !TAILQ_EMPTY(&asoc->out_wheel)) {
 850                 sctp_report_all_outbound(stcb, 0, SCTP_SO_NOT_LOCKED);
 851         }
 852         /* stop the timer */
 853         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
 854         /* send SHUTDOWN-COMPLETE */
 855         sctp_send_shutdown_complete(stcb, net);
 856         /* notify upper layer protocol */
 857         if (stcb->sctp_socket) {
 858                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 859                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
 860                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
 861                         /* Set the connected flag to disconnected */
 862                         stcb->sctp_ep->sctp_socket->so_snd.sb_cc = 0;
 863                 }
 864         }
 865         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
 866         /* free the TCB but first save off the ep */
 867 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 868         atomic_add_int(&stcb->asoc.refcnt, 1);
 869         SCTP_TCB_UNLOCK(stcb);
 870         SCTP_SOCKET_LOCK(so, 1);
 871         SCTP_TCB_LOCK(stcb);
 872         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 873 #endif
 874         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 875             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
 876 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 877         SCTP_SOCKET_UNLOCK(so, 1);
 878 #endif
 879 }
 880
 881 /*
 882  * Skip past the param header and then we will find the chunk that caused the
 883  * problem. There are two possiblities ASCONF or FWD-TSN other than that and
 884  * our peer must be broken.
 885  */
 886 static void
 887 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
 888     struct sctp_nets *net)
 889 {
 890         struct sctp_chunkhdr *chk;
 891
 892         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
 893         switch (chk->chunk_type) {
 894         case SCTP_ASCONF_ACK:
 895         case SCTP_ASCONF:
 896                 sctp_asconf_cleanup(stcb, net);
 897                 break;
 898         case SCTP_FORWARD_CUM_TSN:
 899                 stcb->asoc.peer_supports_prsctp = 0;
 900                 break;
 901         default:
 902                 SCTPDBG(SCTP_DEBUG_INPUT2,
 903                     "Peer does not support chunk type %d(%x)??\n",
 904                     chk->chunk_type, (uint32_t) chk->chunk_type);
 905                 break;
 906         }
 907 }
 908
 909 /*
 910  * Skip past the param header and then we will find the param that caused the
 911  * problem.  There are a number of param's in a ASCONF OR the prsctp param
 912  * these will turn of specific features.
 913  */
 914 static void
 915 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
 916 {
 917         struct sctp_paramhdr *pbad;
 918
 919         pbad = phdr + 1;
 920         switch (ntohs(pbad->param_type)) {
 921                 /* pr-sctp draft */
 922         case SCTP_PRSCTP_SUPPORTED:
 923                 stcb->asoc.peer_supports_prsctp = 0;
 924                 break;
 925         case SCTP_SUPPORTED_CHUNK_EXT:
 926                 break;
 927                 /* draft-ietf-tsvwg-addip-sctp */
 928         case SCTP_ECN_NONCE_SUPPORTED:
 929                 stcb->asoc.peer_supports_ecn_nonce = 0;
 930                 stcb->asoc.ecn_nonce_allowed = 0;
 931                 stcb->asoc.ecn_allowed = 0;
 932                 break;
 933         case SCTP_ADD_IP_ADDRESS:
 934         case SCTP_DEL_IP_ADDRESS:
 935         case SCTP_SET_PRIM_ADDR:
 936                 stcb->asoc.peer_supports_asconf = 0;
 937                 break;
 938         case SCTP_SUCCESS_REPORT:
 939         case SCTP_ERROR_CAUSE_IND:
 940                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
 941                 SCTPDBG(SCTP_DEBUG_INPUT2,
 942                     "Turning off ASCONF to this strange peer\n");
 943                 stcb->asoc.peer_supports_asconf = 0;
 944                 break;
 945         default:
 946                 SCTPDBG(SCTP_DEBUG_INPUT2,
 947                     "Peer does not support param type %d(%x)??\n",
 948                     pbad->param_type, (uint32_t) pbad->param_type);
 949                 break;
 950         }
 951 }
 952
 953 static int
 954 sctp_handle_error(struct sctp_chunkhdr *ch,
 955     struct sctp_tcb *stcb, struct sctp_nets *net)
 956 {
 957         int chklen;
 958         struct sctp_paramhdr *phdr;
 959         uint16_t error_type;
 960         uint16_t error_len;
 961         struct sctp_association *asoc;
 962         int adjust;
 963
 964 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 965         struct socket *so;
 966
 967 #endif
 968
 969         /* parse through all of the errors and process */
 970         asoc = &stcb->asoc;
 971         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
 972             sizeof(struct sctp_chunkhdr));
 973         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
 974         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
 975                 /* Process an Error Cause */
 976                 error_type = ntohs(phdr->param_type);
 977                 error_len = ntohs(phdr->param_length);
 978                 if ((error_len > chklen) || (error_len == 0)) {
 979                         /* invalid param length for this param */
 980                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
 981                             chklen, error_len);
 982                         return (0);
 983                 }
 984                 switch (error_type) {
 985                 case SCTP_CAUSE_INVALID_STREAM:
 986                 case SCTP_CAUSE_MISSING_PARAM:
 987                 case SCTP_CAUSE_INVALID_PARAM:
 988                 case SCTP_CAUSE_NO_USER_DATA:
 989                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
 990                             error_type);
 991                         break;
 992                 case SCTP_CAUSE_STALE_COOKIE:
 993                         /*
 994                          * We only act if we have echoed a cookie and are
 995                          * waiting.
 996                          */
 997                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
 998                                 int *p;
 999
1000                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
1001                                 /* Save the time doubled */
1002                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
1003                                 asoc->stale_cookie_count++;
1004                                 if (asoc->stale_cookie_count >
1005                                     asoc->max_init_times) {
1006                                         sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED);
1007                                         /* now free the asoc */
1008 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1009                                         so = SCTP_INP_SO(stcb->sctp_ep);
1010                                         atomic_add_int(&stcb->asoc.refcnt, 1);
1011                                         SCTP_TCB_UNLOCK(stcb);
1012                                         SCTP_SOCKET_LOCK(so, 1);
1013                                         SCTP_TCB_LOCK(stcb);
1014                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1015 #endif
1016                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1017                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1018 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1019                                         SCTP_SOCKET_UNLOCK(so, 1);
1020 #endif
1021                                         return (-1);
1022                                 }
1023                                 /* blast back to INIT state */
1024                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
1025                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
1026
1027                                 sctp_stop_all_cookie_timers(stcb);
1028                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1029                         }
1030                         break;
1031                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1032                         /*
1033                          * Nothing we can do here, we don't do hostname
1034                          * addresses so if the peer does not like my IPv6
1035                          * (or IPv4 for that matter) it does not matter. If
1036                          * they don't support that type of address, they can
1037                          * NOT possibly get that packet type... i.e. with no
1038                          * IPv6 you can't recieve a IPv6 packet. so we can
1039                          * safely ignore this one. If we ever added support
1040                          * for HOSTNAME Addresses, then we would need to do
1041                          * something here.
1042                          */
1043                         break;
1044                 case SCTP_CAUSE_UNRECOG_CHUNK:
1045                         sctp_process_unrecog_chunk(stcb, phdr, net);
1046                         break;
1047                 case SCTP_CAUSE_UNRECOG_PARAM:
1048                         sctp_process_unrecog_param(stcb, phdr);
1049                         break;
1050                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1051                         /*
1052                          * We ignore this since the timer will drive out a
1053                          * new cookie anyway and there timer will drive us
1054                          * to send a SHUTDOWN_COMPLETE. We can't send one
1055                          * here since we don't have their tag.
1056                          */
1057                         break;
1058                 case SCTP_CAUSE_DELETING_LAST_ADDR:
1059                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
1060                 case SCTP_CAUSE_DELETING_SRC_ADDR:
1061                         /*
1062                          * We should NOT get these here, but in a
1063                          * ASCONF-ACK.
1064                          */
1065                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
1066                             error_type);
1067                         break;
1068                 case SCTP_CAUSE_OUT_OF_RESC:
1069                         /*
1070                          * And what, pray tell do we do with the fact that
1071                          * the peer is out of resources? Not really sure we
1072                          * could do anything but abort. I suspect this
1073                          * should have came WITH an abort instead of in a
1074                          * OP-ERROR.
1075                          */
1076                         break;
1077                 default:
1078                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
1079                             error_type);
1080                         break;
1081                 }
1082                 adjust = SCTP_SIZE32(error_len);
1083                 chklen -= adjust;
1084                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
1085         }
1086         return (0);
1087 }
1088
1089 static int
1090 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1091     struct sctphdr *sh, struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1092     struct sctp_nets *net, int *abort_no_unlock, uint32_t vrf_id)
1093 {
1094         struct sctp_init_ack *init_ack;
1095         struct mbuf *op_err;
1096
1097         SCTPDBG(SCTP_DEBUG_INPUT2,
1098             "sctp_handle_init_ack: handling INIT-ACK\n");
1099
1100         if (stcb == NULL) {
1101                 SCTPDBG(SCTP_DEBUG_INPUT2,
1102                     "sctp_handle_init_ack: TCB is null\n");
1103                 return (-1);
1104         }
1105         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
1106                 /* Invalid length */
1107                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1108                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
1109                     op_err, 0, net->port);
1110                 *abort_no_unlock = 1;
1111                 return (-1);
1112         }
1113         init_ack = &cp->init;
1114         /* validate parameters */
1115         if (init_ack->initiate_tag == 0) {
1116                 /* protocol error... send an abort */
1117                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1118                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
1119                     op_err, 0, net->port);
1120                 *abort_no_unlock = 1;
1121                 return (-1);
1122         }
1123         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
1124                 /* protocol error... send an abort */
1125                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1126                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
1127                     op_err, 0, net->port);
1128                 *abort_no_unlock = 1;
1129                 return (-1);
1130         }
1131         if (init_ack->num_inbound_streams == 0) {
1132                 /* protocol error... send an abort */
1133                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1134                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
1135                     op_err, 0, net->port);
1136                 *abort_no_unlock = 1;
1137                 return (-1);
1138         }
1139         if (init_ack->num_outbound_streams == 0) {
1140                 /* protocol error... send an abort */
1141                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1142                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen, sh,
1143                     op_err, 0, net->port);
1144                 *abort_no_unlock = 1;
1145                 return (-1);
1146         }
1147         /* process according to association state... */
1148         switch (stcb->asoc.state & SCTP_STATE_MASK) {
1149         case SCTP_STATE_COOKIE_WAIT:
1150                 /* this is the expected state for this chunk */
1151                 /* process the INIT-ACK parameters */
1152                 if (stcb->asoc.primary_destination->dest_state &
1153                     SCTP_ADDR_UNCONFIRMED) {
1154                         /*
1155                          * The primary is where we sent the INIT, we can
1156                          * always consider it confirmed when the INIT-ACK is
1157                          * returned. Do this before we load addresses
1158                          * though.
1159                          */
1160                         stcb->asoc.primary_destination->dest_state &=
1161                             ~SCTP_ADDR_UNCONFIRMED;
1162                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1163                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1164                 }
1165                 if (sctp_process_init_ack(m, iphlen, offset, sh, cp, stcb,
1166                     net, abort_no_unlock, vrf_id) < 0) {
1167                         /* error in parsing parameters */
1168                         return (-1);
1169                 }
1170                 /* update our state */
1171                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1172                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
1173
1174                 /* reset the RTO calc */
1175                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
1176                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1177                             stcb->asoc.overall_error_count,
1178                             0,
1179                             SCTP_FROM_SCTP_INPUT,
1180                             __LINE__);
1181                 }
1182                 stcb->asoc.overall_error_count = 0;
1183                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1184                 /*
1185                  * collapse the init timer back in case of a exponential
1186                  * backoff
1187                  */
1188                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1189                     stcb, net);
1190                 /*
1191                  * the send at the end of the inbound data processing will
1192                  * cause the cookie to be sent
1193                  */
1194                 break;
1195         case SCTP_STATE_SHUTDOWN_SENT:
1196                 /* incorrect state... discard */
1197                 break;
1198         case SCTP_STATE_COOKIE_ECHOED:
1199                 /* incorrect state... discard */
1200                 break;
1201         case SCTP_STATE_OPEN:
1202                 /* incorrect state... discard */
1203                 break;
1204         case SCTP_STATE_EMPTY:
1205         case SCTP_STATE_INUSE:
1206         default:
1207                 /* incorrect state... discard */
1208                 return (-1);
1209                 break;
1210         }
1211         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1212         return (0);
1213 }
1214
1215
1216 /*
1217  * handle a state cookie for an existing association m: input packet mbuf
1218  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1219  * "split" mbuf and the cookie signature does not exist offset: offset into
1220  * mbuf to the cookie-echo chunk
1221  */
1222 static struct sctp_tcb *
1223 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1224     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1225     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
1226     struct sockaddr *init_src, int *notification, sctp_assoc_t * sac_assoc_id,
1227     uint32_t vrf_id)
1228 {
1229         struct sctp_association *asoc;
1230         struct sctp_init_chunk *init_cp, init_buf;
1231         struct sctp_init_ack_chunk *initack_cp, initack_buf;
1232         int chk_length;
1233         int init_offset, initack_offset, i;
1234         int retval;
1235         int spec_flag = 0;
1236         uint32_t how_indx;
1237
1238         /* I know that the TCB is non-NULL from the caller */
1239         asoc = &stcb->asoc;
1240         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1241                 if (asoc->cookie_how[how_indx] == 0)
1242                         break;
1243         }
1244         if (how_indx < sizeof(asoc->cookie_how)) {
1245                 asoc->cookie_how[how_indx] = 1;
1246         }
1247         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1248                 /* SHUTDOWN came in after sending INIT-ACK */
1249                 struct mbuf *op_err;
1250                 struct sctp_paramhdr *ph;
1251
1252                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1253                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
1254                     0, M_DONTWAIT, 1, MT_DATA);
1255                 if (op_err == NULL) {
1256                         /* FOOBAR */
1257                         return (NULL);
1258                 }
1259                 /* pre-reserve some space */
1260 #ifdef INET6
1261                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1262 #else
1263                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
1264 #endif
1265                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1266                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1267                 /* Set the len */
1268                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
1269                 ph = mtod(op_err, struct sctp_paramhdr *);
1270                 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);
1271                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
1272                 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
1273                     vrf_id, net->port);
1274                 if (how_indx < sizeof(asoc->cookie_how))
1275                         asoc->cookie_how[how_indx] = 2;
1276                 return (NULL);
1277         }
1278         /*
1279          * find and validate the INIT chunk in the cookie (peer's info) the
1280          * INIT should start after the cookie-echo header struct (chunk
1281          * header, state cookie header struct)
1282          */
1283         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1284
1285         init_cp = (struct sctp_init_chunk *)
1286             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1287             (uint8_t *) & init_buf);
1288         if (init_cp == NULL) {
1289                 /* could not pull a INIT chunk in cookie */
1290                 return (NULL);
1291         }
1292         chk_length = ntohs(init_cp->ch.chunk_length);
1293         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1294                 return (NULL);
1295         }
1296         /*
1297          * find and validate the INIT-ACK chunk in the cookie (my info) the
1298          * INIT-ACK follows the INIT chunk
1299          */
1300         initack_offset = init_offset + SCTP_SIZE32(chk_length);
1301         initack_cp = (struct sctp_init_ack_chunk *)
1302             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1303             (uint8_t *) & initack_buf);
1304         if (initack_cp == NULL) {
1305                 /* could not pull INIT-ACK chunk in cookie */
1306                 return (NULL);
1307         }
1308         chk_length = ntohs(initack_cp->ch.chunk_length);
1309         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1310                 return (NULL);
1311         }
1312         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1313             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1314                 /*
1315                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
1316                  * to get into the OPEN state
1317                  */
1318                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1319                         /*-
1320                          * Opps, this means that we somehow generated two vtag's
1321                          * the same. I.e. we did:
1322                          *  Us               Peer
1323                          *   <---INIT(tag=a)------
1324                          *   ----INIT-ACK(tag=t)-->
1325                          *   ----INIT(tag=t)------> *1
1326                          *   <---INIT-ACK(tag=a)---
1327                          *   <----CE(tag=t)------------- *2
1328                          *
1329                          * At point *1 we should be generating a different
1330                          * tag t'. Which means we would throw away the CE and send
1331                          * ours instead. Basically this is case C (throw away side).
1332                          */
1333                         if (how_indx < sizeof(asoc->cookie_how))
1334                                 asoc->cookie_how[how_indx] = 17;
1335                         return (NULL);
1336
1337                 }
1338                 switch SCTP_GET_STATE
1339                         (asoc) {
1340                 case SCTP_STATE_COOKIE_WAIT:
1341                 case SCTP_STATE_COOKIE_ECHOED:
1342                         /*
1343                          * INIT was sent but got a COOKIE_ECHO with the
1344                          * correct tags... just accept it...but we must
1345                          * process the init so that we can make sure we have
1346                          * the right seq no's.
1347                          */
1348                         /* First we must process the INIT !! */
1349                         retval = sctp_process_init(init_cp, stcb, net);
1350                         if (retval < 0) {
1351                                 if (how_indx < sizeof(asoc->cookie_how))
1352                                         asoc->cookie_how[how_indx] = 3;
1353                                 return (NULL);
1354                         }
1355                         /* we have already processed the INIT so no problem */
1356                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
1357                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1358                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1359                         /* update current state */
1360                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1361                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1362                         else
1363                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1364
1365                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1366                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1367                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1368                                     stcb->sctp_ep, stcb, asoc->primary_destination);
1369                         }
1370                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1371                         sctp_stop_all_cookie_timers(stcb);
1372                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1373                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1374                             (inp->sctp_socket->so_qlimit == 0)
1375                             ) {
1376 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1377                                 struct socket *so;
1378
1379 #endif
1380                                 /*
1381                                  * Here is where collision would go if we
1382                                  * did a connect() and instead got a
1383                                  * init/init-ack/cookie done before the
1384                                  * init-ack came back..
1385                                  */
1386                                 stcb->sctp_ep->sctp_flags |=
1387                                     SCTP_PCB_FLAGS_CONNECTED;
1388 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1389                                 so = SCTP_INP_SO(stcb->sctp_ep);
1390                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1391                                 SCTP_TCB_UNLOCK(stcb);
1392                                 SCTP_SOCKET_LOCK(so, 1);
1393                                 SCTP_TCB_LOCK(stcb);
1394                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1395                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1396                                         SCTP_SOCKET_UNLOCK(so, 1);
1397                                         return (NULL);
1398                                 }
1399 #endif
1400                                 soisconnected(stcb->sctp_socket);
1401 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1402                                 SCTP_SOCKET_UNLOCK(so, 1);
1403 #endif
1404                         }
1405                         /* notify upper layer */
1406                         *notification = SCTP_NOTIFY_ASSOC_UP;
1407                         /*
1408                          * since we did not send a HB make sure we don't
1409                          * double things
1410                          */
1411                         net->hb_responded = 1;
1412                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
1413                             &cookie->time_entered, sctp_align_unsafe_makecopy);
1414
1415                         if (stcb->asoc.sctp_autoclose_ticks &&
1416                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1417                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1418                                     inp, stcb, NULL);
1419                         }
1420                         break;
1421                 default:
1422                         /*
1423                          * we're in the OPEN state (or beyond), so peer must
1424                          * have simply lost the COOKIE-ACK
1425                          */
1426                         break;
1427                         }       /* end switch */
1428                 sctp_stop_all_cookie_timers(stcb);
1429                 /*
1430                  * We ignore the return code here.. not sure if we should
1431                  * somehow abort.. but we do have an existing asoc. This
1432                  * really should not fail.
1433                  */
1434                 if (sctp_load_addresses_from_init(stcb, m, iphlen,
1435                     init_offset + sizeof(struct sctp_init_chunk),
1436                     initack_offset, sh, init_src)) {
1437                         if (how_indx < sizeof(asoc->cookie_how))
1438                                 asoc->cookie_how[how_indx] = 4;
1439                         return (NULL);
1440                 }
1441                 /* respond with a COOKIE-ACK */
1442                 sctp_toss_old_cookies(stcb, asoc);
1443                 sctp_send_cookie_ack(stcb);
1444                 if (how_indx < sizeof(asoc->cookie_how))
1445                         asoc->cookie_how[how_indx] = 5;
1446                 return (stcb);
1447         }
1448         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1449             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1450             cookie->tie_tag_my_vtag == 0 &&
1451             cookie->tie_tag_peer_vtag == 0) {
1452                 /*
1453                  * case C in Section 5.2.4 Table 2: XMOO silently discard
1454                  */
1455                 if (how_indx < sizeof(asoc->cookie_how))
1456                         asoc->cookie_how[how_indx] = 6;
1457                 return (NULL);
1458         }
1459         if (ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag &&
1460             (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag ||
1461             init_cp->init.initiate_tag == 0)) {
1462                 /*
1463                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1464                  * should be ok, re-accept peer info
1465                  */
1466                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1467                         /*
1468                          * Extension of case C. If we hit this, then the
1469                          * random number generator returned the same vtag
1470                          * when we first sent our INIT-ACK and when we later
1471                          * sent our INIT. The side with the seq numbers that
1472                          * are different will be the one that normnally
1473                          * would have hit case C. This in effect "extends"
1474                          * our vtags in this collision case to be 64 bits.
1475                          * The same collision could occur aka you get both
1476                          * vtag and seq number the same twice in a row.. but
1477                          * is much less likely. If it did happen then we
1478                          * would proceed through and bring up the assoc.. we
1479                          * may end up with the wrong stream setup however..
1480                          * which would be bad.. but there is no way to
1481                          * tell.. until we send on a stream that does not
1482                          * exist :-)
1483                          */
1484                         if (how_indx < sizeof(asoc->cookie_how))
1485                                 asoc->cookie_how[how_indx] = 7;
1486
1487                         return (NULL);
1488                 }
1489                 if (how_indx < sizeof(asoc->cookie_how))
1490                         asoc->cookie_how[how_indx] = 8;
1491                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1492                 sctp_stop_all_cookie_timers(stcb);
1493                 /*
1494                  * since we did not send a HB make sure we don't double
1495                  * things
1496                  */
1497                 net->hb_responded = 1;
1498                 if (stcb->asoc.sctp_autoclose_ticks &&
1499                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1500                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1501                             NULL);
1502                 }
1503                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1504                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1505
1506                 /* Note last_cwr_tsn? where is this used? */
1507                 asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1508                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1509                         /*
1510                          * Ok the peer probably discarded our data (if we
1511                          * echoed a cookie+data). So anything on the
1512                          * sent_queue should be marked for retransmit, we
1513                          * may not get something to kick us so it COULD
1514                          * still take a timeout to move these.. but it can't
1515                          * hurt to mark them.
1516                          */
1517                         struct sctp_tmit_chunk *chk;
1518
1519                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1520                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
1521                                         chk->sent = SCTP_DATAGRAM_RESEND;
1522                                         sctp_flight_size_decrease(chk);
1523                                         sctp_total_flight_decrease(stcb, chk);
1524                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1525                                         spec_flag++;
1526                                 }
1527                         }
1528
1529                 }
1530                 /* process the INIT info (peer's info) */
1531                 retval = sctp_process_init(init_cp, stcb, net);
1532                 if (retval < 0) {
1533                         if (how_indx < sizeof(asoc->cookie_how))
1534                                 asoc->cookie_how[how_indx] = 9;
1535                         return (NULL);
1536                 }
1537                 if (sctp_load_addresses_from_init(stcb, m, iphlen,
1538                     init_offset + sizeof(struct sctp_init_chunk),
1539                     initack_offset, sh, init_src)) {
1540                         if (how_indx < sizeof(asoc->cookie_how))
1541                                 asoc->cookie_how[how_indx] = 10;
1542                         return (NULL);
1543                 }
1544                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1545                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1546                         *notification = SCTP_NOTIFY_ASSOC_UP;
1547
1548                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1549                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1550                             (inp->sctp_socket->so_qlimit == 0)) {
1551 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1552                                 struct socket *so;
1553
1554 #endif
1555                                 stcb->sctp_ep->sctp_flags |=
1556                                     SCTP_PCB_FLAGS_CONNECTED;
1557 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1558                                 so = SCTP_INP_SO(stcb->sctp_ep);
1559                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1560                                 SCTP_TCB_UNLOCK(stcb);
1561                                 SCTP_SOCKET_LOCK(so, 1);
1562                                 SCTP_TCB_LOCK(stcb);
1563                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1564                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1565                                         SCTP_SOCKET_UNLOCK(so, 1);
1566                                         return (NULL);
1567                                 }
1568 #endif
1569                                 soisconnected(stcb->sctp_socket);
1570 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1571                                 SCTP_SOCKET_UNLOCK(so, 1);
1572 #endif
1573                         }
1574                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1575                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1576                         else
1577                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1578                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1579                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1580                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1581                 } else {
1582                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1583                 }
1584                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1585                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1586                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1587                             stcb->sctp_ep, stcb, asoc->primary_destination);
1588                 }
1589                 sctp_stop_all_cookie_timers(stcb);
1590                 sctp_toss_old_cookies(stcb, asoc);
1591                 sctp_send_cookie_ack(stcb);
1592                 if (spec_flag) {
1593                         /*
1594                          * only if we have retrans set do we do this. What
1595                          * this call does is get only the COOKIE-ACK out and
1596                          * then when we return the normal call to
1597                          * sctp_chunk_output will get the retrans out behind
1598                          * this.
1599                          */
1600                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1601                 }
1602                 if (how_indx < sizeof(asoc->cookie_how))
1603                         asoc->cookie_how[how_indx] = 11;
1604
1605                 return (stcb);
1606         }
1607         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1608             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1609             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1610             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1611             cookie->tie_tag_peer_vtag != 0) {
1612                 struct sctpasochead *head;
1613
1614                 /*
1615                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1616                  */
1617                 /* temp code */
1618                 if (how_indx < sizeof(asoc->cookie_how))
1619                         asoc->cookie_how[how_indx] = 12;
1620                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1621                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1622
1623                 *sac_assoc_id = sctp_get_associd(stcb);
1624                 /* notify upper layer */
1625                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
1626                 atomic_add_int(&stcb->asoc.refcnt, 1);
1627                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1628                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1629                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1630                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1631                 }
1632                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1633                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1634                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1635                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1636                 }
1637                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1638                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1639                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1640                             stcb->sctp_ep, stcb, asoc->primary_destination);
1641
1642                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1643                         /* move to OPEN state, if not in SHUTDOWN_SENT */
1644                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1645                 }
1646                 asoc->pre_open_streams =
1647                     ntohs(initack_cp->init.num_outbound_streams);
1648                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1649                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1650                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1651
1652                 asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1653                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1654
1655                 asoc->str_reset_seq_in = asoc->init_seq_number;
1656
1657                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1658                 if (asoc->mapping_array) {
1659                         memset(asoc->mapping_array, 0,
1660                             asoc->mapping_array_size);
1661                 }
1662                 SCTP_TCB_UNLOCK(stcb);
1663                 SCTP_INP_INFO_WLOCK();
1664                 SCTP_INP_WLOCK(stcb->sctp_ep);
1665                 SCTP_TCB_LOCK(stcb);
1666                 atomic_add_int(&stcb->asoc.refcnt, -1);
1667                 /* send up all the data */
1668                 SCTP_TCB_SEND_LOCK(stcb);
1669
1670                 sctp_report_all_outbound(stcb, 1, SCTP_SO_NOT_LOCKED);
1671                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1672                         stcb->asoc.strmout[i].stream_no = i;
1673                         stcb->asoc.strmout[i].next_sequence_sent = 0;
1674                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
1675                 }
1676                 /* process the INIT-ACK info (my info) */
1677                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1678                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1679
1680                 /* pull from vtag hash */
1681                 LIST_REMOVE(stcb, sctp_asocs);
1682                 /* re-insert to new vtag position */
1683                 head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1684                     sctppcbinfo.hashasocmark)];
1685                 /*
1686                  * put it in the bucket in the vtag hash of assoc's for the
1687                  * system
1688                  */
1689                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1690
1691                 /* Is this the first restart? */
1692                 if (stcb->asoc.in_restart_hash == 0) {
1693                         /* Ok add it to assoc_id vtag hash */
1694                         head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
1695                             sctppcbinfo.hashrestartmark)];
1696                         LIST_INSERT_HEAD(head, stcb, sctp_tcbrestarhash);
1697                         stcb->asoc.in_restart_hash = 1;
1698                 }
1699                 /* process the INIT info (peer's info) */
1700                 SCTP_TCB_SEND_UNLOCK(stcb);
1701                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
1702                 SCTP_INP_INFO_WUNLOCK();
1703
1704                 retval = sctp_process_init(init_cp, stcb, net);
1705                 if (retval < 0) {
1706                         if (how_indx < sizeof(asoc->cookie_how))
1707                                 asoc->cookie_how[how_indx] = 13;
1708
1709                         return (NULL);
1710                 }
1711                 /*
1712                  * since we did not send a HB make sure we don't double
1713                  * things
1714                  */
1715                 net->hb_responded = 1;
1716
1717                 if (sctp_load_addresses_from_init(stcb, m, iphlen,
1718                     init_offset + sizeof(struct sctp_init_chunk),
1719                     initack_offset, sh, init_src)) {
1720                         if (how_indx < sizeof(asoc->cookie_how))
1721                                 asoc->cookie_how[how_indx] = 14;
1722
1723                         return (NULL);
1724                 }
1725                 /* respond with a COOKIE-ACK */
1726                 sctp_stop_all_cookie_timers(stcb);
1727                 sctp_toss_old_cookies(stcb, asoc);
1728                 sctp_send_cookie_ack(stcb);
1729                 if (how_indx < sizeof(asoc->cookie_how))
1730                         asoc->cookie_how[how_indx] = 15;
1731
1732                 return (stcb);
1733         }
1734         if (how_indx < sizeof(asoc->cookie_how))
1735                 asoc->cookie_how[how_indx] = 16;
1736         /* all other cases... */
1737         return (NULL);
1738 }
1739
1740
1741 /*
1742  * handle a state cookie for a new association m: input packet mbuf chain--
1743  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
1744  * and the cookie signature does not exist offset: offset into mbuf to the
1745  * cookie-echo chunk length: length of the cookie chunk to: where the init
1746  * was from returns a new TCB
1747  */
1748 static struct sctp_tcb *
1749 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1750     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1751     struct sctp_inpcb *inp, struct sctp_nets **netp,
1752     struct sockaddr *init_src, int *notification,
1753     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1754     uint32_t vrf_id, uint16_t port)
1755 {
1756         struct sctp_tcb *stcb;
1757         struct sctp_init_chunk *init_cp, init_buf;
1758         struct sctp_init_ack_chunk *initack_cp, initack_buf;
1759         struct sockaddr_storage sa_store;
1760         struct sockaddr *initack_src = (struct sockaddr *)&sa_store;
1761         struct sockaddr_in *sin;
1762         struct sockaddr_in6 *sin6;
1763         struct sctp_association *asoc;
1764         int chk_length;
1765         int init_offset, initack_offset, initack_limit;
1766         int retval;
1767         int error = 0;
1768         uint32_t old_tag;
1769         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
1770
1771 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1772         struct socket *so;
1773
1774         so = SCTP_INP_SO(inp);
1775 #endif
1776
1777         /*
1778          * find and validate the INIT chunk in the cookie (peer's info) the
1779          * INIT should start after the cookie-echo header struct (chunk
1780          * header, state cookie header struct)
1781          */
1782         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
1783         init_cp = (struct sctp_init_chunk *)
1784             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1785             (uint8_t *) & init_buf);
1786         if (init_cp == NULL) {
1787                 /* could not pull a INIT chunk in cookie */
1788                 SCTPDBG(SCTP_DEBUG_INPUT1,
1789                     "process_cookie_new: could not pull INIT chunk hdr\n");
1790                 return (NULL);
1791         }
1792         chk_length = ntohs(init_cp->ch.chunk_length);
1793         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1794                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
1795                 return (NULL);
1796         }
1797         initack_offset = init_offset + SCTP_SIZE32(chk_length);
1798         /*
1799          * find and validate the INIT-ACK chunk in the cookie (my info) the
1800          * INIT-ACK follows the INIT chunk
1801          */
1802         initack_cp = (struct sctp_init_ack_chunk *)
1803             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1804             (uint8_t *) & initack_buf);
1805         if (initack_cp == NULL) {
1806                 /* could not pull INIT-ACK chunk in cookie */
1807                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
1808                 return (NULL);
1809         }
1810         chk_length = ntohs(initack_cp->ch.chunk_length);
1811         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1812                 return (NULL);
1813         }
1814         /*
1815          * NOTE: We can't use the INIT_ACK's chk_length to determine the
1816          * "initack_limit" value.  This is because the chk_length field
1817          * includes the length of the cookie, but the cookie is omitted when
1818          * the INIT and INIT_ACK are tacked onto the cookie...
1819          */
1820         initack_limit = offset + cookie_len;
1821
1822         /*
1823          * now that we know the INIT/INIT-ACK are in place, create a new TCB
1824          * and popluate
1825          */
1826
1827         /*
1828          * Here we do a trick, we set in NULL for the proc/thread argument.
1829          * We do this since in effect we only use the p argument when the
1830          * socket is unbound and we must do an implicit bind. Since we are
1831          * getting a cookie, we cannot be unbound.
1832          */
1833         stcb = sctp_aloc_assoc(inp, init_src, 0, &error,
1834             ntohl(initack_cp->init.initiate_tag), vrf_id,
1835             (struct thread *)NULL
1836             );
1837         if (stcb == NULL) {
1838                 struct mbuf *op_err;
1839
1840                 /* memory problem? */
1841                 SCTPDBG(SCTP_DEBUG_INPUT1,
1842                     "process_cookie_new: no room for another TCB!\n");
1843                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1844
1845                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
1846                     sh, op_err, vrf_id, port);
1847                 return (NULL);
1848         }
1849         /* get the correct sctp_nets */
1850         if (netp)
1851                 *netp = sctp_findnet(stcb, init_src);
1852
1853         asoc = &stcb->asoc;
1854         /* get scope variables out of cookie */
1855         asoc->ipv4_local_scope = cookie->ipv4_scope;
1856         asoc->site_scope = cookie->site_scope;
1857         asoc->local_scope = cookie->local_scope;
1858         asoc->loopback_scope = cookie->loopback_scope;
1859
1860         if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) ||
1861             (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) {
1862                 struct mbuf *op_err;
1863
1864                 /*
1865                  * Houston we have a problem. The EP changed while the
1866                  * cookie was in flight. Only recourse is to abort the
1867                  * association.
1868                  */
1869                 atomic_add_int(&stcb->asoc.refcnt, 1);
1870                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
1871                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
1872                     sh, op_err, vrf_id, port);
1873 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1874                 SCTP_TCB_UNLOCK(stcb);
1875                 SCTP_SOCKET_LOCK(so, 1);
1876                 SCTP_TCB_LOCK(stcb);
1877 #endif
1878                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1879                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1880 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1881                 SCTP_SOCKET_UNLOCK(so, 1);
1882 #endif
1883                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1884                 return (NULL);
1885         }
1886         /* process the INIT-ACK info (my info) */
1887         old_tag = asoc->my_vtag;
1888         asoc->assoc_id = asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1889         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1890         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1891         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1892         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1893         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1894         asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1895         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1896         asoc->str_reset_seq_in = asoc->init_seq_number;
1897
1898         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1899
1900         /* process the INIT info (peer's info) */
1901         if (netp)
1902                 retval = sctp_process_init(init_cp, stcb, *netp);
1903         else
1904                 retval = 0;
1905         if (retval < 0) {
1906                 atomic_add_int(&stcb->asoc.refcnt, 1);
1907 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1908                 SCTP_TCB_UNLOCK(stcb);
1909                 SCTP_SOCKET_LOCK(so, 1);
1910                 SCTP_TCB_LOCK(stcb);
1911 #endif
1912                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1913 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1914                 SCTP_SOCKET_UNLOCK(so, 1);
1915 #endif
1916                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1917                 return (NULL);
1918         }
1919         /* load all addresses */
1920         if (sctp_load_addresses_from_init(stcb, m, iphlen,
1921             init_offset + sizeof(struct sctp_init_chunk), initack_offset, sh,
1922             init_src)) {
1923                 atomic_add_int(&stcb->asoc.refcnt, 1);
1924 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1925                 SCTP_TCB_UNLOCK(stcb);
1926                 SCTP_SOCKET_LOCK(so, 1);
1927                 SCTP_TCB_LOCK(stcb);
1928 #endif
1929                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1930 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1931                 SCTP_SOCKET_UNLOCK(so, 1);
1932 #endif
1933                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1934                 return (NULL);
1935         }
1936         /*
1937          * verify any preceding AUTH chunk that was skipped
1938          */
1939         /* pull the local authentication parameters from the cookie/init-ack */
1940         sctp_auth_get_cookie_params(stcb, m,
1941             initack_offset + sizeof(struct sctp_init_ack_chunk),
1942             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
1943         if (auth_skipped) {
1944                 struct sctp_auth_chunk *auth;
1945
1946                 auth = (struct sctp_auth_chunk *)
1947                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
1948                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
1949                         /* auth HMAC failed, dump the assoc and packet */
1950                         SCTPDBG(SCTP_DEBUG_AUTH1,
1951                             "COOKIE-ECHO: AUTH failed\n");
1952                         atomic_add_int(&stcb->asoc.refcnt, 1);
1953 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1954                         SCTP_TCB_UNLOCK(stcb);
1955                         SCTP_SOCKET_LOCK(so, 1);
1956                         SCTP_TCB_LOCK(stcb);
1957 #endif
1958                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
1959 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1960                         SCTP_SOCKET_UNLOCK(so, 1);
1961 #endif
1962                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1963                         return (NULL);
1964                 } else {
1965                         /* remaining chunks checked... good to go */
1966                         stcb->asoc.authenticated = 1;
1967                 }
1968         }
1969         /* update current state */
1970         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
1971         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1972         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1973                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1974                     stcb->sctp_ep, stcb, asoc->primary_destination);
1975         }
1976         sctp_stop_all_cookie_timers(stcb);
1977         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
1978         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1979
1980         /*
1981          * if we're doing ASCONFs, check to see if we have any new local
1982          * addresses that need to get added to the peer (eg. addresses
1983          * changed while cookie echo in flight).  This needs to be done
1984          * after we go to the OPEN state to do the correct asconf
1985          * processing. else, make sure we have the correct addresses in our
1986          * lists
1987          */
1988
1989         /* warning, we re-use sin, sin6, sa_store here! */
1990         /* pull in local_address (our "from" address) */
1991         if (cookie->laddr_type == SCTP_IPV4_ADDRESS) {
1992                 /* source addr is IPv4 */
1993                 sin = (struct sockaddr_in *)initack_src;
1994                 memset(sin, 0, sizeof(*sin));
1995                 sin->sin_family = AF_INET;
1996                 sin->sin_len = sizeof(struct sockaddr_in);
1997                 sin->sin_addr.s_addr = cookie->laddress[0];
1998         } else if (cookie->laddr_type == SCTP_IPV6_ADDRESS) {
1999                 /* source addr is IPv6 */
2000                 sin6 = (struct sockaddr_in6 *)initack_src;
2001                 memset(sin6, 0, sizeof(*sin6));
2002                 sin6->sin6_family = AF_INET6;
2003                 sin6->sin6_len = sizeof(struct sockaddr_in6);
2004                 sin6->sin6_scope_id = cookie->scope_id;
2005                 memcpy(&sin6->sin6_addr, cookie->laddress,
2006                     sizeof(sin6->sin6_addr));
2007         } else {
2008                 atomic_add_int(&stcb->asoc.refcnt, 1);
2009 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2010                 SCTP_TCB_UNLOCK(stcb);
2011                 SCTP_SOCKET_LOCK(so, 1);
2012                 SCTP_TCB_LOCK(stcb);
2013 #endif
2014                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2015 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2016                 SCTP_SOCKET_UNLOCK(so, 1);
2017 #endif
2018                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2019                 return (NULL);
2020         }
2021
2022         /* set up to notify upper layer */
2023         *notification = SCTP_NOTIFY_ASSOC_UP;
2024         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2025             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2026             (inp->sctp_socket->so_qlimit == 0)) {
2027                 /*
2028                  * This is an endpoint that called connect() how it got a
2029                  * cookie that is NEW is a bit of a mystery. It must be that
2030                  * the INIT was sent, but before it got there.. a complete
2031                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
2032                  * should have went to the other code.. not here.. oh well..
2033                  * a bit of protection is worth having..
2034                  */
2035                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2036 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2037                 atomic_add_int(&stcb->asoc.refcnt, 1);
2038                 SCTP_TCB_UNLOCK(stcb);
2039                 SCTP_SOCKET_LOCK(so, 1);
2040                 SCTP_TCB_LOCK(stcb);
2041                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2042                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2043                         SCTP_SOCKET_UNLOCK(so, 1);
2044                         return (NULL);
2045                 }
2046 #endif
2047                 soisconnected(stcb->sctp_socket);
2048 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2049                 SCTP_SOCKET_UNLOCK(so, 1);
2050 #endif
2051         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2052             (inp->sctp_socket->so_qlimit)) {
2053                 /*
2054                  * We don't want to do anything with this one. Since it is
2055                  * the listening guy. The timer will get started for
2056                  * accepted connections in the caller.
2057                  */
2058                 ;
2059         }
2060         /* since we did not send a HB make sure we don't double things */
2061         if ((netp) && (*netp))
2062                 (*netp)->hb_responded = 1;
2063
2064         if (stcb->asoc.sctp_autoclose_ticks &&
2065             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2066                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2067         }
2068         /* calculate the RTT */
2069         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2070         if ((netp) && (*netp)) {
2071                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
2072                     &cookie->time_entered, sctp_align_unsafe_makecopy);
2073         }
2074         /* respond with a COOKIE-ACK */
2075         sctp_send_cookie_ack(stcb);
2076
2077         /*
2078          * check the address lists for any ASCONFs that need to be sent
2079          * AFTER the cookie-ack is sent
2080          */
2081         sctp_check_address_list(stcb, m,
2082             initack_offset + sizeof(struct sctp_init_ack_chunk),
2083             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2084             initack_src, cookie->local_scope, cookie->site_scope,
2085             cookie->ipv4_scope, cookie->loopback_scope);
2086
2087
2088         return (stcb);
2089 }
2090
2091
2092 /*
2093  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2094  * existing (non-NULL) TCB
2095  */
2096 static struct mbuf *
2097 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2098     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2099     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2100     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2101     struct sctp_tcb **locked_tcb, uint32_t vrf_id, uint16_t port)
2102 {
2103         struct sctp_state_cookie *cookie;
2104         struct sockaddr_in6 sin6;
2105         struct sockaddr_in sin;
2106         struct sctp_tcb *l_stcb = *stcb;
2107         struct sctp_inpcb *l_inp;
2108         struct sockaddr *to;
2109         sctp_assoc_t sac_restart_id;
2110         struct sctp_pcb *ep;
2111         struct mbuf *m_sig;
2112         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2113         uint8_t *sig;
2114         uint8_t cookie_ok = 0;
2115         unsigned int size_of_pkt, sig_offset, cookie_offset;
2116         unsigned int cookie_len;
2117         struct timeval now;
2118         struct timeval time_expires;
2119         struct sockaddr_storage dest_store;
2120         struct sockaddr *localep_sa = (struct sockaddr *)&dest_store;
2121         struct ip *iph;
2122         int notification = 0;
2123         struct sctp_nets *netl;
2124         int had_a_existing_tcb = 0;
2125
2126         SCTPDBG(SCTP_DEBUG_INPUT2,
2127             "sctp_handle_cookie: handling COOKIE-ECHO\n");
2128
2129         if (inp_p == NULL) {
2130                 return (NULL);
2131         }
2132         /* First get the destination address setup too. */
2133         iph = mtod(m, struct ip *);
2134         switch (iph->ip_v) {
2135         case IPVERSION:
2136                 {
2137                         /* its IPv4 */
2138                         struct sockaddr_in *lsin;
2139
2140                         lsin = (struct sockaddr_in *)(localep_sa);
2141                         memset(lsin, 0, sizeof(*lsin));
2142                         lsin->sin_family = AF_INET;
2143                         lsin->sin_len = sizeof(*lsin);
2144                         lsin->sin_port = sh->dest_port;
2145                         lsin->sin_addr.s_addr = iph->ip_dst.s_addr;
2146                         size_of_pkt = SCTP_GET_IPV4_LENGTH(iph);
2147                         break;
2148                 }
2149 #ifdef INET6
2150         case IPV6_VERSION >> 4:
2151                 {
2152                         /* its IPv6 */
2153                         struct ip6_hdr *ip6;
2154                         struct sockaddr_in6 *lsin6;
2155
2156                         lsin6 = (struct sockaddr_in6 *)(localep_sa);
2157                         memset(lsin6, 0, sizeof(*lsin6));
2158                         lsin6->sin6_family = AF_INET6;
2159                         lsin6->sin6_len = sizeof(struct sockaddr_in6);
2160                         ip6 = mtod(m, struct ip6_hdr *);
2161                         lsin6->sin6_port = sh->dest_port;
2162                         lsin6->sin6_addr = ip6->ip6_dst;
2163                         size_of_pkt = SCTP_GET_IPV6_LENGTH(ip6) + iphlen;
2164                         break;
2165                 }
2166 #endif
2167         default:
2168                 return (NULL);
2169         }
2170
2171         cookie = &cp->cookie;
2172         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2173         cookie_len = ntohs(cp->ch.chunk_length);
2174
2175         if ((cookie->peerport != sh->src_port) &&
2176             (cookie->myport != sh->dest_port) &&
2177             (cookie->my_vtag != sh->v_tag)) {
2178                 /*
2179                  * invalid ports or bad tag.  Note that we always leave the
2180                  * v_tag in the header in network order and when we stored
2181                  * it in the my_vtag slot we also left it in network order.
2182                  * This maintains the match even though it may be in the
2183                  * opposite byte order of the machine :->
2184                  */
2185                 return (NULL);
2186         }
2187         if (cookie_len > size_of_pkt ||
2188             cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2189             sizeof(struct sctp_init_chunk) +
2190             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2191                 /* cookie too long!  or too small */
2192                 return (NULL);
2193         }
2194         /*
2195          * split off the signature into its own mbuf (since it should not be
2196          * calculated in the sctp_hmac_m() call).
2197          */
2198         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2199         if (sig_offset > size_of_pkt) {
2200                 /* packet not correct size! */
2201                 /* XXX this may already be accounted for earlier... */
2202                 return (NULL);
2203         }
2204         m_sig = m_split(m, sig_offset, M_DONTWAIT);
2205         if (m_sig == NULL) {
2206                 /* out of memory or ?? */
2207                 return (NULL);
2208         }
2209 #ifdef SCTP_MBUF_LOGGING
2210         if (sctp_logging_level & SCTP_MBUF_LOGGING_ENABLE) {
2211                 struct mbuf *mat;
2212
2213                 mat = m_sig;
2214                 while (mat) {
2215                         if (SCTP_BUF_IS_EXTENDED(mat)) {
2216                                 sctp_log_mb(mat, SCTP_MBUF_SPLIT);
2217                         }
2218                         mat = SCTP_BUF_NEXT(mat);
2219                 }
2220         }
2221 #endif
2222
2223         /*
2224          * compute the signature/digest for the cookie
2225          */
2226         ep = &(*inp_p)->sctp_ep;
2227         l_inp = *inp_p;
2228         if (l_stcb) {
2229                 SCTP_TCB_UNLOCK(l_stcb);
2230         }
2231         SCTP_INP_RLOCK(l_inp);
2232         if (l_stcb) {
2233                 SCTP_TCB_LOCK(l_stcb);
2234         }
2235         /* which cookie is it? */
2236         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2237             (ep->current_secret_number != ep->last_secret_number)) {
2238                 /* it's the old cookie */
2239                 (void)sctp_hmac_m(SCTP_HMAC,
2240                     (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2241                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2242         } else {
2243                 /* it's the current cookie */
2244                 (void)sctp_hmac_m(SCTP_HMAC,
2245                     (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
2246                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2247         }
2248         /* get the signature */
2249         SCTP_INP_RUNLOCK(l_inp);
2250         sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
2251         if (sig == NULL) {
2252                 /* couldn't find signature */
2253                 sctp_m_freem(m_sig);
2254                 return (NULL);
2255         }
2256         /* compare the received digest with the computed digest */
2257         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2258                 /* try the old cookie? */
2259                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2260                     (ep->current_secret_number != ep->last_secret_number)) {
2261                         /* compute digest with old */
2262                         (void)sctp_hmac_m(SCTP_HMAC,
2263                             (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2264                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2265                         /* compare */
2266                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2267                                 cookie_ok = 1;
2268                 }
2269         } else {
2270                 cookie_ok = 1;
2271         }
2272
2273         /*
2274          * Now before we continue we must reconstruct our mbuf so that
2275          * normal processing of any other chunks will work.
2276          */
2277         {
2278                 struct mbuf *m_at;
2279
2280                 m_at = m;
2281                 while (SCTP_BUF_NEXT(m_at) != NULL) {
2282                         m_at = SCTP_BUF_NEXT(m_at);
2283                 }
2284                 SCTP_BUF_NEXT(m_at) = m_sig;
2285         }
2286
2287         if (cookie_ok == 0) {
2288                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2289                 SCTPDBG(SCTP_DEBUG_INPUT2,
2290                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2291                     (uint32_t) offset, cookie_offset, sig_offset);
2292                 return (NULL);
2293         }
2294         /*
2295          * check the cookie timestamps to be sure it's not stale
2296          */
2297         (void)SCTP_GETTIME_TIMEVAL(&now);
2298         /* Expire time is in Ticks, so we convert to seconds */
2299         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
2300         time_expires.tv_usec = cookie->time_entered.tv_usec;
2301         if (timevalcmp(&now, &time_expires, >)) {
2302                 /* cookie is stale! */
2303                 struct mbuf *op_err;
2304                 struct sctp_stale_cookie_msg *scm;
2305                 uint32_t tim;
2306
2307                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
2308                     0, M_DONTWAIT, 1, MT_DATA);
2309                 if (op_err == NULL) {
2310                         /* FOOBAR */
2311                         return (NULL);
2312                 }
2313                 /* pre-reserve some space */
2314 #ifdef INET6
2315                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
2316 #else
2317                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
2318 #endif
2319                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
2320                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
2321
2322                 /* Set the len */
2323                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
2324                 scm = mtod(op_err, struct sctp_stale_cookie_msg *);
2325                 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
2326                 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
2327                     (sizeof(uint32_t))));
2328                 /* seconds to usec */
2329                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2330                 /* add in usec */
2331                 if (tim == 0)
2332                         tim = now.tv_usec - cookie->time_entered.tv_usec;
2333                 scm->time_usec = htonl(tim);
2334                 sctp_send_operr_to(m, iphlen, op_err, cookie->peers_vtag,
2335                     vrf_id, port);
2336                 return (NULL);
2337         }
2338         /*
2339          * Now we must see with the lookup address if we have an existing
2340          * asoc. This will only happen if we were in the COOKIE-WAIT state
2341          * and a INIT collided with us and somewhere the peer sent the
2342          * cookie on another address besides the single address our assoc
2343          * had for him. In this case we will have one of the tie-tags set at
2344          * least AND the address field in the cookie can be used to look it
2345          * up.
2346          */
2347         to = NULL;
2348         if (cookie->addr_type == SCTP_IPV6_ADDRESS) {
2349                 memset(&sin6, 0, sizeof(sin6));
2350                 sin6.sin6_family = AF_INET6;
2351                 sin6.sin6_len = sizeof(sin6);
2352                 sin6.sin6_port = sh->src_port;
2353                 sin6.sin6_scope_id = cookie->scope_id;
2354                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2355                     sizeof(sin6.sin6_addr.s6_addr));
2356                 to = (struct sockaddr *)&sin6;
2357         } else if (cookie->addr_type == SCTP_IPV4_ADDRESS) {
2358                 memset(&sin, 0, sizeof(sin));
2359                 sin.sin_family = AF_INET;
2360                 sin.sin_len = sizeof(sin);
2361                 sin.sin_port = sh->src_port;
2362                 sin.sin_addr.s_addr = cookie->address[0];
2363                 to = (struct sockaddr *)&sin;
2364         } else {
2365                 /* This should not happen */
2366                 return (NULL);
2367         }
2368         if ((*stcb == NULL) && to) {
2369                 /* Yep, lets check */
2370                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, localep_sa, NULL);
2371                 if (*stcb == NULL) {
2372                         /*
2373                          * We should have only got back the same inp. If we
2374                          * got back a different ep we have a problem. The
2375                          * original findep got back l_inp and now
2376                          */
2377                         if (l_inp != *inp_p) {
2378                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2379                         }
2380                 } else {
2381                         if (*locked_tcb == NULL) {
2382                                 /*
2383                                  * In this case we found the assoc only
2384                                  * after we locked the create lock. This
2385                                  * means we are in a colliding case and we
2386                                  * must make sure that we unlock the tcb if
2387                                  * its one of the cases where we throw away
2388                                  * the incoming packets.
2389                                  */
2390                                 *locked_tcb = *stcb;
2391
2392                                 /*
2393                                  * We must also increment the inp ref count
2394                                  * since the ref_count flags was set when we
2395                                  * did not find the TCB, now we found it
2396                                  * which reduces the refcount.. we must
2397                                  * raise it back out to balance it all :-)
2398                                  */
2399                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2400                                 if ((*stcb)->sctp_ep != l_inp) {
2401                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2402                                             (*stcb)->sctp_ep, l_inp);
2403                                 }
2404                         }
2405                 }
2406         }
2407         if (to == NULL)
2408                 return (NULL);
2409
2410         cookie_len -= SCTP_SIGNATURE_SIZE;
2411         if (*stcb == NULL) {
2412                 /* this is the "normal" case... get a new TCB */
2413                 *stcb = sctp_process_cookie_new(m, iphlen, offset, sh, cookie,
2414                     cookie_len, *inp_p, netp, to, &notification,
2415                     auth_skipped, auth_offset, auth_len, vrf_id, port);
2416         } else {
2417                 /* this is abnormal... cookie-echo on existing TCB */
2418                 had_a_existing_tcb = 1;
2419                 *stcb = sctp_process_cookie_existing(m, iphlen, offset, sh,
2420                     cookie, cookie_len, *inp_p, *stcb, *netp, to,
2421                     &notification, &sac_restart_id, vrf_id);
2422         }
2423
2424         if (*stcb == NULL) {
2425                 /* still no TCB... must be bad cookie-echo */
2426                 return (NULL);
2427         }
2428         /*
2429          * Ok, we built an association so confirm the address we sent the
2430          * INIT-ACK to.
2431          */
2432         netl = sctp_findnet(*stcb, to);
2433         /*
2434          * This code should in theory NOT run but
2435          */
2436         if (netl == NULL) {
2437                 /* TSNH! Huh, why do I need to add this address here? */
2438                 int ret;
2439
2440                 ret = sctp_add_remote_addr(*stcb, to, SCTP_DONOT_SETSCOPE,
2441                     SCTP_IN_COOKIE_PROC);
2442                 netl = sctp_findnet(*stcb, to);
2443         }
2444         if (netl) {
2445                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2446                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2447                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2448                             netl);
2449                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2450                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2451                 }
2452         }
2453         if (*stcb) {
2454                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, *inp_p,
2455                     *stcb, NULL);
2456         }
2457         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2458                 if (!had_a_existing_tcb ||
2459                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2460                         /*
2461                          * If we have a NEW cookie or the connect never
2462                          * reached the connected state during collision we
2463                          * must do the TCP accept thing.
2464                          */
2465                         struct socket *so, *oso;
2466                         struct sctp_inpcb *inp;
2467
2468                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2469                                 /*
2470                                  * For a restart we will keep the same
2471                                  * socket, no need to do anything. I THINK!!
2472                                  */
2473                                 sctp_ulp_notify(notification, *stcb, 0, (void *)&sac_restart_id, SCTP_SO_NOT_LOCKED);
2474                                 return (m);
2475                         }
2476                         oso = (*inp_p)->sctp_socket;
2477                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2478                         SCTP_TCB_UNLOCK((*stcb));
2479                         so = sonewconn(oso, 0
2480                             );
2481                         SCTP_TCB_LOCK((*stcb));
2482                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2483
2484                         if (so == NULL) {
2485                                 struct mbuf *op_err;
2486
2487 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2488                                 struct socket *pcb_so;
2489
2490 #endif
2491                                 /* Too many sockets */
2492                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2493                                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2494                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
2495                                     sh, op_err, vrf_id, port);
2496 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2497                                 pcb_so = SCTP_INP_SO(*inp_p);
2498                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2499                                 SCTP_TCB_UNLOCK((*stcb));
2500                                 SCTP_SOCKET_LOCK(pcb_so, 1);
2501                                 SCTP_TCB_LOCK((*stcb));
2502                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2503 #endif
2504                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2505 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2506                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
2507 #endif
2508                                 return (NULL);
2509                         }
2510                         inp = (struct sctp_inpcb *)so->so_pcb;
2511                         SCTP_INP_INCR_REF(inp);
2512                         /*
2513                          * We add the unbound flag here so that if we get an
2514                          * soabort() before we get the move_pcb done, we
2515                          * will properly cleanup.
2516                          */
2517                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2518                             SCTP_PCB_FLAGS_CONNECTED |
2519                             SCTP_PCB_FLAGS_IN_TCPPOOL |
2520                             SCTP_PCB_FLAGS_UNBOUND |
2521                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2522                             SCTP_PCB_FLAGS_DONT_WAKE);
2523                         inp->sctp_features = (*inp_p)->sctp_features;
2524                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
2525                         inp->sctp_socket = so;
2526                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2527                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2528                         inp->sctp_context = (*inp_p)->sctp_context;
2529                         inp->inp_starting_point_for_iterator = NULL;
2530                         /*
2531                          * copy in the authentication parameters from the
2532                          * original endpoint
2533                          */
2534                         if (inp->sctp_ep.local_hmacs)
2535                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2536                         inp->sctp_ep.local_hmacs =
2537                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2538                         if (inp->sctp_ep.local_auth_chunks)
2539                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2540                         inp->sctp_ep.local_auth_chunks =
2541                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2542                         (void)sctp_copy_skeylist(&(*inp_p)->sctp_ep.shared_keys,
2543                             &inp->sctp_ep.shared_keys);
2544
2545                         /*
2546                          * Now we must move it from one hash table to
2547                          * another and get the tcb in the right place.
2548                          */
2549                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2550
2551                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2552                         SCTP_TCB_UNLOCK((*stcb));
2553
2554                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
2555                             0);
2556                         SCTP_TCB_LOCK((*stcb));
2557                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2558
2559
2560                         /*
2561                          * now we must check to see if we were aborted while
2562                          * the move was going on and the lock/unlock
2563                          * happened.
2564                          */
2565                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2566                                 /*
2567                                  * yep it was, we leave the assoc attached
2568                                  * to the socket since the sctp_inpcb_free()
2569                                  * call will send an abort for us.
2570                                  */
2571                                 SCTP_INP_DECR_REF(inp);
2572                                 return (NULL);
2573                         }
2574                         SCTP_INP_DECR_REF(inp);
2575                         /* Switch over to the new guy */
2576                         *inp_p = inp;
2577                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2578
2579                         /*
2580                          * Pull it from the incomplete queue and wake the
2581                          * guy
2582                          */
2583 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2584                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2585                         SCTP_TCB_UNLOCK((*stcb));
2586                         SCTP_SOCKET_LOCK(so, 1);
2587 #endif
2588                         soisconnected(so);
2589 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2590                         SCTP_TCB_LOCK((*stcb));
2591                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2592                         SCTP_SOCKET_UNLOCK(so, 1);
2593 #endif
2594                         return (m);
2595                 }
2596         }
2597         if ((notification) && ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_UDPTYPE)) {
2598                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2599         }
2600         return (m);
2601 }
2602
2603 static void
2604 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp,
2605     struct sctp_tcb *stcb, struct sctp_nets *net)
2606 {
2607         /* cp must not be used, others call this without a c-ack :-) */
2608         struct sctp_association *asoc;
2609
2610         SCTPDBG(SCTP_DEBUG_INPUT2,
2611             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2612         if (stcb == NULL)
2613                 return;
2614
2615         asoc = &stcb->asoc;
2616
2617         sctp_stop_all_cookie_timers(stcb);
2618         /* process according to association state */
2619         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2620                 /* state change only needed when I am in right state */
2621                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2622                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2623                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2624                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2625                             stcb->sctp_ep, stcb, asoc->primary_destination);
2626
2627                 }
2628                 /* update RTO */
2629                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2630                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2631                 if (asoc->overall_error_count == 0) {
2632                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
2633                             &asoc->time_entered, sctp_align_safe_nocopy);
2634                 }
2635                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2636                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2637                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2638                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2639 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2640                         struct socket *so;
2641
2642 #endif
2643                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2644 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2645                         so = SCTP_INP_SO(stcb->sctp_ep);
2646                         atomic_add_int(&stcb->asoc.refcnt, 1);
2647                         SCTP_TCB_UNLOCK(stcb);
2648                         SCTP_SOCKET_LOCK(so, 1);
2649                         SCTP_TCB_LOCK(stcb);
2650                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2651                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2652                                 SCTP_SOCKET_UNLOCK(so, 1);
2653                                 return;
2654                         }
2655 #endif
2656                         soisconnected(stcb->sctp_socket);
2657 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2658                         SCTP_SOCKET_UNLOCK(so, 1);
2659 #endif
2660                 }
2661                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2662                     stcb, net);
2663                 /*
2664                  * since we did not send a HB make sure we don't double
2665                  * things
2666                  */
2667                 net->hb_responded = 1;
2668
2669                 if (stcb->asoc.sctp_autoclose_ticks &&
2670                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2671                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2672                             stcb->sctp_ep, stcb, NULL);
2673                 }
2674                 /*
2675                  * send ASCONF if parameters are pending and ASCONFs are
2676                  * allowed (eg. addresses changed when init/cookie echo were
2677                  * in flight)
2678                  */
2679                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2680                     (stcb->asoc.peer_supports_asconf) &&
2681                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2682 #ifdef SCTP_TIMER_BASED_ASCONF
2683                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2684                             stcb->sctp_ep, stcb,
2685                             stcb->asoc.primary_destination);
2686 #else
2687                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2688                             SCTP_ADDR_NOT_LOCKED);
2689 #endif
2690                 }
2691         }
2692         /* Toss the cookie if I can */
2693         sctp_toss_old_cookies(stcb, asoc);
2694         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2695                 /* Restart the timer if we have pending data */
2696                 struct sctp_tmit_chunk *chk;
2697
2698                 chk = TAILQ_FIRST(&asoc->sent_queue);
2699                 if (chk) {
2700                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2701                             stcb, chk->whoTo);
2702                 }
2703         }
2704 }
2705
2706 static void
2707 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
2708     struct sctp_tcb *stcb)
2709 {
2710         struct sctp_nets *net;
2711         struct sctp_tmit_chunk *lchk;
2712         uint32_t tsn;
2713
2714         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_ecne_chunk)) {
2715                 return;
2716         }
2717         SCTP_STAT_INCR(sctps_recvecne);
2718         tsn = ntohl(cp->tsn);
2719         /* ECN Nonce stuff: need a resync and disable the nonce sum check */
2720         /* Also we make sure we disable the nonce_wait */
2721         lchk = TAILQ_FIRST(&stcb->asoc.send_queue);
2722         if (lchk == NULL) {
2723                 stcb->asoc.nonce_resync_tsn = stcb->asoc.sending_seq;
2724         } else {
2725                 stcb->asoc.nonce_resync_tsn = lchk->rec.data.TSN_seq;
2726         }
2727         stcb->asoc.nonce_wait_for_ecne = 0;
2728         stcb->asoc.nonce_sum_check = 0;
2729
2730         /* Find where it was sent, if possible */
2731         net = NULL;
2732         lchk = TAILQ_FIRST(&stcb->asoc.sent_queue);
2733         while (lchk) {
2734                 if (lchk->rec.data.TSN_seq == tsn) {
2735                         net = lchk->whoTo;
2736                         break;
2737                 }
2738                 if (compare_with_wrap(lchk->rec.data.TSN_seq, tsn, MAX_SEQ))
2739                         break;
2740                 lchk = TAILQ_NEXT(lchk, sctp_next);
2741         }
2742         if (net == NULL)
2743                 /* default is we use the primary */
2744                 net = stcb->asoc.primary_destination;
2745
2746         if (compare_with_wrap(tsn, stcb->asoc.last_cwr_tsn, MAX_TSN)) {
2747                 /*
2748                  * JRS - Use the congestion control given in the pluggable
2749                  * CC module
2750                  */
2751                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net);
2752                 /*
2753                  * we reduce once every RTT. So we will only lower cwnd at
2754                  * the next sending seq i.e. the resync_tsn.
2755                  */
2756                 stcb->asoc.last_cwr_tsn = stcb->asoc.nonce_resync_tsn;
2757         }
2758         /*
2759          * We always send a CWR this way if our previous one was lost our
2760          * peer will get an update, or if it is not time again to reduce we
2761          * still get the cwr to the peer.
2762          */
2763         sctp_send_cwr(stcb, net, tsn);
2764 }
2765
2766 static void
2767 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb)
2768 {
2769         /*
2770          * Here we get a CWR from the peer. We must look in the outqueue and
2771          * make sure that we have a covered ECNE in teh control chunk part.
2772          * If so remove it.
2773          */
2774         struct sctp_tmit_chunk *chk;
2775         struct sctp_ecne_chunk *ecne;
2776
2777         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
2778                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
2779                         continue;
2780                 }
2781                 /*
2782                  * Look for and remove if it is the right TSN. Since there
2783                  * is only ONE ECNE on the control queue at any one time we
2784                  * don't need to worry about more than one!
2785                  */
2786                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
2787                 if (compare_with_wrap(ntohl(cp->tsn), ntohl(ecne->tsn),
2788                     MAX_TSN) || (cp->tsn == ecne->tsn)) {
2789                         /* this covers this ECNE, we can remove it */
2790                         stcb->asoc.ecn_echo_cnt_onq--;
2791                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
2792                             sctp_next);
2793                         if (chk->data) {
2794                                 sctp_m_freem(chk->data);
2795                                 chk->data = NULL;
2796                         }
2797                         stcb->asoc.ctrl_queue_cnt--;
2798                         sctp_free_a_chunk(stcb, chk);
2799                         break;
2800                 }
2801         }
2802 }
2803
2804 static void
2805 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp,
2806     struct sctp_tcb *stcb, struct sctp_nets *net)
2807 {
2808         struct sctp_association *asoc;
2809
2810 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2811         struct socket *so;
2812
2813 #endif
2814
2815         SCTPDBG(SCTP_DEBUG_INPUT2,
2816             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
2817         if (stcb == NULL)
2818                 return;
2819
2820         asoc = &stcb->asoc;
2821         /* process according to association state */
2822         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
2823                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
2824                 SCTPDBG(SCTP_DEBUG_INPUT2,
2825                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
2826                 SCTP_TCB_UNLOCK(stcb);
2827                 return;
2828         }
2829         /* notify upper layer protocol */
2830         if (stcb->sctp_socket) {
2831                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2832                 /* are the queues empty? they should be */
2833                 if (!TAILQ_EMPTY(&asoc->send_queue) ||
2834                     !TAILQ_EMPTY(&asoc->sent_queue) ||
2835                     !TAILQ_EMPTY(&asoc->out_wheel)) {
2836                         sctp_report_all_outbound(stcb, 0, SCTP_SO_NOT_LOCKED);
2837                 }
2838         }
2839         /* stop the timer */
2840         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2841         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
2842         /* free the TCB */
2843         SCTPDBG(SCTP_DEBUG_INPUT2,
2844             "sctp_handle_shutdown_complete: calls free-asoc\n");
2845 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2846         so = SCTP_INP_SO(stcb->sctp_ep);
2847         atomic_add_int(&stcb->asoc.refcnt, 1);
2848         SCTP_TCB_UNLOCK(stcb);
2849         SCTP_SOCKET_LOCK(so, 1);
2850         SCTP_TCB_LOCK(stcb);
2851         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2852 #endif
2853         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2854 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2855         SCTP_SOCKET_UNLOCK(so, 1);
2856 #endif
2857         return;
2858 }
2859
2860 static int
2861 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
2862     struct sctp_nets *net, uint8_t flg)
2863 {
2864         switch (desc->chunk_type) {
2865                 case SCTP_DATA:
2866                 /* find the tsn to resend (possibly */
2867                 {
2868                         uint32_t tsn;
2869                         struct sctp_tmit_chunk *tp1;
2870
2871                         tsn = ntohl(desc->tsn_ifany);
2872                         tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2873                         while (tp1) {
2874                                 if (tp1->rec.data.TSN_seq == tsn) {
2875                                         /* found it */
2876                                         break;
2877                                 }
2878                                 if (compare_with_wrap(tp1->rec.data.TSN_seq, tsn,
2879                                     MAX_TSN)) {
2880                                         /* not found */
2881                                         tp1 = NULL;
2882                                         break;
2883                                 }
2884                                 tp1 = TAILQ_NEXT(tp1, sctp_next);
2885                         }
2886                         if (tp1 == NULL) {
2887                                 /*
2888                                  * Do it the other way , aka without paying
2889                                  * attention to queue seq order.
2890                                  */
2891                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
2892                                 tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2893                                 while (tp1) {
2894                                         if (tp1->rec.data.TSN_seq == tsn) {
2895                                                 /* found it */
2896                                                 break;
2897                                         }
2898                                         tp1 = TAILQ_NEXT(tp1, sctp_next);
2899                                 }
2900                         }
2901                         if (tp1 == NULL) {
2902                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
2903                         }
2904                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
2905                                 uint8_t *ddp;
2906
2907                                 if ((stcb->asoc.peers_rwnd == 0) &&
2908                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
2909                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
2910                                         return (0);
2911                                 }
2912                                 if (stcb->asoc.peers_rwnd == 0 &&
2913                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
2914                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
2915                                         return (0);
2916                                 }
2917                                 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
2918                                     sizeof(struct sctp_data_chunk));
2919                                 {
2920                                         unsigned int iii;
2921
2922                                         for (iii = 0; iii < sizeof(desc->data_bytes);
2923                                             iii++) {
2924                                                 if (ddp[iii] != desc->data_bytes[iii]) {
2925                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
2926                                                         return (-1);
2927                                                 }
2928                                         }
2929                                 }
2930                                 /*
2931                                  * We zero out the nonce so resync not
2932                                  * needed
2933                                  */
2934                                 tp1->rec.data.ect_nonce = 0;
2935
2936                                 if (tp1->do_rtt) {
2937                                         /*
2938                                          * this guy had a RTO calculation
2939                                          * pending on it, cancel it
2940                                          */
2941                                         tp1->do_rtt = 0;
2942                                 }
2943                                 SCTP_STAT_INCR(sctps_pdrpmark);
2944                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
2945                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
2946                                 tp1->sent = SCTP_DATAGRAM_RESEND;
2947                                 /*
2948                                  * mark it as if we were doing a FR, since
2949                                  * we will be getting gap ack reports behind
2950                                  * the info from the router.
2951                                  */
2952                                 tp1->rec.data.doing_fast_retransmit = 1;
2953                                 /*
2954                                  * mark the tsn with what sequences can
2955                                  * cause a new FR.
2956                                  */
2957                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
2958                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
2959                                 } else {
2960                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
2961                                 }
2962
2963                                 /* restart the timer */
2964                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2965                                     stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
2966                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
2967                                     stcb, tp1->whoTo);
2968
2969                                 /* fix counts and things */
2970                                 if (sctp_logging_level & SCTP_FLIGHT_LOGGING_ENABLE) {
2971                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
2972                                             tp1->whoTo->flight_size,
2973                                             tp1->book_size,
2974                                             (uintptr_t) stcb,
2975                                             tp1->rec.data.TSN_seq);
2976                                 }
2977                                 sctp_flight_size_decrease(tp1);
2978                                 sctp_total_flight_decrease(stcb, tp1);
2979                         } {
2980                                 /* audit code */
2981                                 unsigned int audit;
2982
2983                                 audit = 0;
2984                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
2985                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
2986                                                 audit++;
2987                                 }
2988                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
2989                                     sctp_next) {
2990                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
2991                                                 audit++;
2992                                 }
2993                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
2994                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
2995                                             audit, stcb->asoc.sent_queue_retran_cnt);
2996 #ifndef SCTP_AUDITING_ENABLED
2997                                         stcb->asoc.sent_queue_retran_cnt = audit;
2998 #endif
2999                                 }
3000                         }
3001                 }
3002                 break;
3003         case SCTP_ASCONF:
3004                 {
3005                         struct sctp_tmit_chunk *asconf;
3006
3007                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3008                             sctp_next) {
3009                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3010                                         break;
3011                                 }
3012                         }
3013                         if (asconf) {
3014                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
3015                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3016                                 asconf->sent = SCTP_DATAGRAM_RESEND;
3017                                 asconf->snd_count--;
3018                         }
3019                 }
3020                 break;
3021         case SCTP_INITIATION:
3022                 /* resend the INIT */
3023                 stcb->asoc.dropped_special_cnt++;
3024                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3025                         /*
3026                          * If we can get it in, in a few attempts we do
3027                          * this, otherwise we let the timer fire.
3028                          */
3029                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3030                             stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3031                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3032                 }
3033                 break;
3034         case SCTP_SELECTIVE_ACK:
3035                 /* resend the sack */
3036                 sctp_send_sack(stcb);
3037                 break;
3038         case SCTP_HEARTBEAT_REQUEST:
3039                 /* resend a demand HB */
3040                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3041                         /*
3042                          * Only retransmit if we KNOW we wont destroy the
3043                          * tcb
3044                          */
3045                         (void)sctp_send_hb(stcb, 1, net);
3046                 }
3047                 break;
3048         case SCTP_SHUTDOWN:
3049                 sctp_send_shutdown(stcb, net);
3050                 break;
3051         case SCTP_SHUTDOWN_ACK:
3052                 sctp_send_shutdown_ack(stcb, net);
3053                 break;
3054         case SCTP_COOKIE_ECHO:
3055                 {
3056                         struct sctp_tmit_chunk *cookie;
3057
3058                         cookie = NULL;
3059                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3060                             sctp_next) {
3061                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3062                                         break;
3063                                 }
3064                         }
3065                         if (cookie) {
3066                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
3067                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3068                                 cookie->sent = SCTP_DATAGRAM_RESEND;
3069                                 sctp_stop_all_cookie_timers(stcb);
3070                         }
3071                 }
3072                 break;
3073         case SCTP_COOKIE_ACK:
3074                 sctp_send_cookie_ack(stcb);
3075                 break;
3076         case SCTP_ASCONF_ACK:
3077                 /* resend last asconf ack */
3078                 sctp_send_asconf_ack(stcb);
3079                 break;
3080         case SCTP_FORWARD_CUM_TSN:
3081                 send_forward_tsn(stcb, &stcb->asoc);
3082                 break;
3083                 /* can't do anything with these */
3084         case SCTP_PACKET_DROPPED:
3085         case SCTP_INITIATION_ACK:       /* this should not happen */
3086         case SCTP_HEARTBEAT_ACK:
3087         case SCTP_ABORT_ASSOCIATION:
3088         case SCTP_OPERATION_ERROR:
3089         case SCTP_SHUTDOWN_COMPLETE:
3090         case SCTP_ECN_ECHO:
3091         case SCTP_ECN_CWR:
3092         default:
3093                 break;
3094         }
3095         return (0);
3096 }
3097
3098 void
3099 sctp_reset_in_stream(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
3100 {
3101         int i;
3102         uint16_t temp;
3103
3104         /*
3105          * We set things to 0xffff since this is the last delivered sequence
3106          * and we will be sending in 0 after the reset.
3107          */
3108
3109         if (number_entries) {
3110                 for (i = 0; i < number_entries; i++) {
3111                         temp = ntohs(list[i]);
3112                         if (temp >= stcb->asoc.streamincnt) {
3113                                 continue;
3114                         }
3115                         stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
3116                 }
3117         } else {
3118                 list = NULL;
3119                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
3120                         stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
3121                 }
3122         }
3123         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3124 }
3125
3126 static void
3127 sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
3128 {
3129         int i;
3130
3131         if (number_entries == 0) {
3132                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3133                         stcb->asoc.strmout[i].next_sequence_sent = 0;
3134                 }
3135         } else if (number_entries) {
3136                 for (i = 0; i < number_entries; i++) {
3137                         uint16_t temp;
3138
3139                         temp = ntohs(list[i]);
3140                         if (temp >= stcb->asoc.streamoutcnt) {
3141                                 /* no such stream */
3142                                 continue;
3143                         }
3144                         stcb->asoc.strmout[temp].next_sequence_sent = 0;
3145                 }
3146         }
3147         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3148 }
3149
3150
3151 struct sctp_stream_reset_out_request *
3152 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3153 {
3154         struct sctp_association *asoc;
3155         struct sctp_stream_reset_out_req *req;
3156         struct sctp_stream_reset_out_request *r;
3157         struct sctp_tmit_chunk *chk;
3158         int len, clen;
3159
3160         asoc = &stcb->asoc;
3161         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
3162                 asoc->stream_reset_outstanding = 0;
3163                 return (NULL);
3164         }
3165         if (stcb->asoc.str_reset == NULL) {
3166                 asoc->stream_reset_outstanding = 0;
3167                 return (NULL);
3168         }
3169         chk = stcb->asoc.str_reset;
3170         if (chk->data == NULL) {
3171                 return (NULL);
3172         }
3173         if (bchk) {
3174                 /* he wants a copy of the chk pointer */
3175                 *bchk = chk;
3176         }
3177         clen = chk->send_size;
3178         req = mtod(chk->data, struct sctp_stream_reset_out_req *);
3179         r = &req->sr_req;
3180         if (ntohl(r->request_seq) == seq) {
3181                 /* found it */
3182                 return (r);
3183         }
3184         len = SCTP_SIZE32(ntohs(r->ph.param_length));
3185         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3186                 /* move to the next one, there can only be a max of two */
3187                 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len);
3188                 if (ntohl(r->request_seq) == seq) {
3189                         return (r);
3190                 }
3191         }
3192         /* that seq is not here */
3193         return (NULL);
3194 }
3195
3196 static void
3197 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3198 {
3199         struct sctp_association *asoc;
3200         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
3201
3202         if (stcb->asoc.str_reset == NULL) {
3203                 return;
3204         }
3205         asoc = &stcb->asoc;
3206
3207         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3208         TAILQ_REMOVE(&asoc->control_send_queue,
3209             chk,
3210             sctp_next);
3211         if (chk->data) {
3212                 sctp_m_freem(chk->data);
3213                 chk->data = NULL;
3214         }
3215         asoc->ctrl_queue_cnt--;
3216         sctp_free_a_chunk(stcb, chk);
3217         /* sa_ignore NO_NULL_CHK */
3218         stcb->asoc.str_reset = NULL;
3219 }
3220
3221
3222 static int
3223 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3224     uint32_t seq, uint32_t action,
3225     struct sctp_stream_reset_response *respin)
3226 {
3227         uint16_t type;
3228         int lparm_len;
3229         struct sctp_association *asoc = &stcb->asoc;
3230         struct sctp_tmit_chunk *chk;
3231         struct sctp_stream_reset_out_request *srparam;
3232         int number_entries;
3233
3234         if (asoc->stream_reset_outstanding == 0) {
3235                 /* duplicate */
3236                 return (0);
3237         }
3238         if (seq == stcb->asoc.str_reset_seq_out) {
3239                 srparam = sctp_find_stream_reset(stcb, seq, &chk);
3240                 if (srparam) {
3241                         stcb->asoc.str_reset_seq_out++;
3242                         type = ntohs(srparam->ph.param_type);
3243                         lparm_len = ntohs(srparam->ph.param_length);
3244                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
3245                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3246                                 asoc->stream_reset_out_is_outstanding = 0;
3247                                 if (asoc->stream_reset_outstanding)
3248                                         asoc->stream_reset_outstanding--;
3249                                 if (action == SCTP_STREAM_RESET_PERFORMED) {
3250                                         /* do it */
3251                                         sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams);
3252                                 } else {
3253                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
3254                                 }
3255                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
3256                                 /* Answered my request */
3257                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3258                                 if (asoc->stream_reset_outstanding)
3259                                         asoc->stream_reset_outstanding--;
3260                                 if (action != SCTP_STREAM_RESET_PERFORMED) {
3261                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb, number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
3262                                 }
3263                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3264                                 /**
3265                                  * a) Adopt the new in tsn.
3266                                  * b) reset the map
3267                                  * c) Adopt the new out-tsn
3268                                  */
3269                                 struct sctp_stream_reset_response_tsn *resp;
3270                                 struct sctp_forward_tsn_chunk fwdtsn;
3271                                 int abort_flag = 0;
3272
3273                                 if (respin == NULL) {
3274                                         /* huh ? */
3275                                         return (0);
3276                                 }
3277                                 if (action == SCTP_STREAM_RESET_PERFORMED) {
3278                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
3279                                         asoc->stream_reset_outstanding--;
3280                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3281                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3282                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3283                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3284                                         if (abort_flag) {
3285                                                 return (1);
3286                                         }
3287                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3288                                         stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3289                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3290                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3291                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3292                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3293
3294                                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3295                                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3296
3297                                 }
3298                         }
3299                         /* get rid of the request and get the request flags */
3300                         if (asoc->stream_reset_outstanding == 0) {
3301                                 sctp_clean_up_stream_reset(stcb);
3302                         }
3303                 }
3304         }
3305         return (0);
3306 }
3307
3308 static void
3309 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
3310     struct sctp_tmit_chunk *chk,
3311     struct sctp_stream_reset_in_request *req, int trunc)
3312 {
3313         uint32_t seq;
3314         int len, i;
3315         int number_entries;
3316         uint16_t temp;
3317
3318         /*
3319          * peer wants me to send a str-reset to him for my outgoing seq's if
3320          * seq_in is right.
3321          */
3322         struct sctp_association *asoc = &stcb->asoc;
3323
3324         seq = ntohl(req->request_seq);
3325         if (asoc->str_reset_seq_in == seq) {
3326                 if (trunc) {
3327                         /* Can't do it, since they exceeded our buffer size  */
3328                         asoc->last_reset_action[1] = asoc->last_reset_action[0];
3329                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
3330                         sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3331                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
3332                         len = ntohs(req->ph.param_length);
3333                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
3334                         for (i = 0; i < number_entries; i++) {
3335                                 temp = ntohs(req->list_of_streams[i]);
3336                                 req->list_of_streams[i] = temp;
3337                         }
3338                         /* move the reset action back one */
3339                         asoc->last_reset_action[1] = asoc->last_reset_action[0];
3340                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3341                         sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
3342                             asoc->str_reset_seq_out,
3343                             seq, (asoc->sending_seq - 1));
3344                         asoc->stream_reset_out_is_outstanding = 1;
3345                         asoc->str_reset = chk;
3346                         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
3347                         stcb->asoc.stream_reset_outstanding++;
3348                 } else {
3349                         /* Can't do it, since we have sent one out */
3350                         asoc->last_reset_action[1] = asoc->last_reset_action[0];
3351                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_TRY_LATER;
3352                         sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3353                 }
3354                 asoc->str_reset_seq_in++;
3355         } else if (asoc->str_reset_seq_in - 1 == seq) {
3356                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3357         } else if (asoc->str_reset_seq_in - 2 == seq) {
3358                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3359         } else {
3360                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3361         }
3362 }
3363
3364 static int
3365 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3366     struct sctp_tmit_chunk *chk,
3367     struct sctp_stream_reset_tsn_request *req)
3368 {
3369         /* reset all in and out and update the tsn */
3370         /*
3371          * A) reset my str-seq's on in and out. B) Select a receive next,
3372          * and set cum-ack to it. Also process this selected number as a
3373          * fwd-tsn as well. C) set in the response my next sending seq.
3374          */
3375         struct sctp_forward_tsn_chunk fwdtsn;
3376         struct sctp_association *asoc = &stcb->asoc;
3377         int abort_flag = 0;
3378         uint32_t seq;
3379
3380         seq = ntohl(req->request_seq);
3381         if (asoc->str_reset_seq_in == seq) {
3382                 fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3383                 fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3384                 fwdtsn.ch.chunk_flags = 0;
3385                 fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3386                 sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3387                 if (abort_flag) {
3388                         return (1);
3389                 }
3390                 stcb->asoc.highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3391                 stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3392                 stcb->asoc.mapping_array_base_tsn = stcb->asoc.highest_tsn_inside_map + 1;
3393                 memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3394                 atomic_add_int(&stcb->asoc.sending_seq, 1);
3395                 /* save off historical data for retrans */
3396                 stcb->asoc.last_sending_seq[1] = stcb->asoc.last_sending_seq[0];
3397                 stcb->asoc.last_sending_seq[0] = stcb->asoc.sending_seq;
3398                 stcb->asoc.last_base_tsnsent[1] = stcb->asoc.last_base_tsnsent[0];
3399                 stcb->asoc.last_base_tsnsent[0] = stcb->asoc.mapping_array_base_tsn;
3400
3401                 sctp_add_stream_reset_result_tsn(chk,
3402                     ntohl(req->request_seq),
3403                     SCTP_STREAM_RESET_PERFORMED,
3404                     stcb->asoc.sending_seq,
3405                     stcb->asoc.mapping_array_base_tsn);
3406                 sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3407                 sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3408                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3409                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3410
3411                 asoc->str_reset_seq_in++;
3412         } else if (asoc->str_reset_seq_in - 1 == seq) {
3413                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3414                     stcb->asoc.last_sending_seq[0],
3415                     stcb->asoc.last_base_tsnsent[0]
3416                     );
3417         } else if (asoc->str_reset_seq_in - 2 == seq) {
3418                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3419                     stcb->asoc.last_sending_seq[1],
3420                     stcb->asoc.last_base_tsnsent[1]
3421                     );
3422         } else {
3423                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3424         }
3425         return (0);
3426 }
3427
3428 static void
3429 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3430     struct sctp_tmit_chunk *chk,
3431     struct sctp_stream_reset_out_request *req, int trunc)
3432 {
3433         uint32_t seq, tsn;
3434         int number_entries, len;
3435         struct sctp_association *asoc = &stcb->asoc;
3436
3437         seq = ntohl(req->request_seq);
3438
3439         /* now if its not a duplicate we process it */
3440         if (asoc->str_reset_seq_in == seq) {
3441                 len = ntohs(req->ph.param_length);
3442                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3443                 /*
3444                  * the sender is resetting, handle the list issue.. we must
3445                  * a) verify if we can do the reset, if so no problem b) If
3446                  * we can't do the reset we must copy the request. c) queue
3447                  * it, and setup the data in processor to trigger it off
3448                  * when needed and dequeue all the queued data.
3449                  */
3450                 tsn = ntohl(req->send_reset_at_tsn);
3451
3452                 /* move the reset action back one */
3453                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3454                 if (trunc) {
3455                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
3456                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
3457                 } else if ((tsn == asoc->cumulative_tsn) ||
3458                     (compare_with_wrap(asoc->cumulative_tsn, tsn, MAX_TSN))) {
3459                         /* we can do it now */
3460                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3461                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3462                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3463                 } else {
3464                         /*
3465                          * we must queue it up and thus wait for the TSN's
3466                          * to arrive that are at or before tsn
3467                          */
3468                         struct sctp_stream_reset_list *liste;
3469                         int siz;
3470
3471                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3472                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3473                             siz, SCTP_M_STRESET);
3474                         if (liste == NULL) {
3475                                 /* gak out of memory */
3476                                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_DENIED);
3477                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_DENIED;
3478                                 return;
3479                         }
3480                         liste->tsn = tsn;
3481                         liste->number_entries = number_entries;
3482                         memcpy(&liste->req, req,
3483                             (sizeof(struct sctp_stream_reset_out_request) + (number_entries * sizeof(uint16_t))));
3484                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3485                         sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_PERFORMED);
3486                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_PERFORMED;
3487                 }
3488                 asoc->str_reset_seq_in++;
3489         } else if ((asoc->str_reset_seq_in - 1) == seq) {
3490                 /*
3491                  * one seq back, just echo back last action since my
3492                  * response was lost.
3493                  */
3494                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3495         } else if ((asoc->str_reset_seq_in - 2) == seq) {
3496                 /*
3497                  * two seq back, just echo back last action since my
3498                  * response was lost.
3499                  */
3500                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3501         } else {
3502                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_BAD_SEQNO);
3503         }
3504 }
3505
3506 #ifdef __GNUC__
3507 __attribute__((noinline))
3508 #endif
3509         static int
3510             sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3511         struct sctp_stream_reset_out_req *sr_req)
3512 {
3513         int chk_length, param_len, ptype;
3514         struct sctp_paramhdr pstore;
3515         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
3516
3517         uint32_t seq;
3518         int num_req = 0;
3519         int trunc = 0;
3520         struct sctp_tmit_chunk *chk;
3521         struct sctp_chunkhdr *ch;
3522         struct sctp_paramhdr *ph;
3523         int ret_code = 0;
3524         int num_param = 0;
3525
3526         /* now it may be a reset or a reset-response */
3527         chk_length = ntohs(sr_req->ch.chunk_length);
3528
3529         /* setup for adding the response */
3530         sctp_alloc_a_chunk(stcb, chk);
3531         if (chk == NULL) {
3532                 return (ret_code);
3533         }
3534         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
3535         chk->rec.chunk_id.can_take_data = 0;
3536         chk->asoc = &stcb->asoc;
3537         chk->no_fr_allowed = 0;
3538         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
3539         chk->book_size_scale = 0;
3540         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3541         if (chk->data == NULL) {
3542 strres_nochunk:
3543                 if (chk->data) {
3544                         sctp_m_freem(chk->data);
3545                         chk->data = NULL;
3546                 }
3547                 sctp_free_a_chunk(stcb, chk);
3548                 return (ret_code);
3549         }
3550         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
3551
3552         /* setup chunk parameters */
3553         chk->sent = SCTP_DATAGRAM_UNSENT;
3554         chk->snd_count = 0;
3555         chk->whoTo = stcb->asoc.primary_destination;
3556         atomic_add_int(&chk->whoTo->ref_count, 1);
3557
3558         ch = mtod(chk->data, struct sctp_chunkhdr *);
3559         ch->chunk_type = SCTP_STREAM_RESET;
3560         ch->chunk_flags = 0;
3561         ch->chunk_length = htons(chk->send_size);
3562         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
3563         offset += sizeof(struct sctp_chunkhdr);
3564         while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) {
3565                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *) & pstore);
3566                 if (ph == NULL)
3567                         break;
3568                 param_len = ntohs(ph->param_length);
3569                 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) {
3570                         /* bad param */
3571                         break;
3572                 }
3573                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, (int)sizeof(cstore)),
3574                     (uint8_t *) & cstore);
3575                 ptype = ntohs(ph->param_type);
3576                 num_param++;
3577                 if (param_len > (int)sizeof(cstore)) {
3578                         trunc = 1;
3579                 } else {
3580                         trunc = 0;
3581                 }
3582
3583                 if (num_param > SCTP_MAX_RESET_PARAMS) {
3584                         /* hit the max of parameters already sorry.. */
3585                         break;
3586                 }
3587                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
3588                         struct sctp_stream_reset_out_request *req_out;
3589
3590                         req_out = (struct sctp_stream_reset_out_request *)ph;
3591                         num_req++;
3592                         if (stcb->asoc.stream_reset_outstanding) {
3593                                 seq = ntohl(req_out->response_seq);
3594                                 if (seq == stcb->asoc.str_reset_seq_out) {
3595                                         /* implicit ack */
3596                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_PERFORMED, NULL);
3597                                 }
3598                         }
3599                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
3600                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
3601                         struct sctp_stream_reset_in_request *req_in;
3602
3603                         num_req++;
3604
3605                         req_in = (struct sctp_stream_reset_in_request *)ph;
3606
3607                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
3608                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
3609                         struct sctp_stream_reset_tsn_request *req_tsn;
3610
3611                         num_req++;
3612                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
3613
3614                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
3615                                 ret_code = 1;
3616                                 goto strres_nochunk;
3617                         }
3618                         /* no more */
3619                         break;
3620                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
3621                         struct sctp_stream_reset_response *resp;
3622                         uint32_t result;
3623
3624                         resp = (struct sctp_stream_reset_response *)ph;
3625                         seq = ntohl(resp->response_seq);
3626                         result = ntohl(resp->result);
3627                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
3628                                 ret_code = 1;
3629                                 goto strres_nochunk;
3630                         }
3631                 } else {
3632                         break;
3633                 }
3634                 offset += SCTP_SIZE32(param_len);
3635                 chk_length -= SCTP_SIZE32(param_len);
3636         }
3637         if (num_req == 0) {
3638                 /* we have no response free the stuff */
3639                 goto strres_nochunk;
3640         }
3641         /* ok we have a chunk to link in */
3642         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
3643             chk,
3644             sctp_next);
3645         stcb->asoc.ctrl_queue_cnt++;
3646         return (ret_code);
3647 }
3648
3649 /*
3650  * Handle a router or endpoints report of a packet loss, there are two ways
3651  * to handle this, either we get the whole packet and must disect it
3652  * ourselves (possibly with truncation and or corruption) or it is a summary
3653  * from a middle box that did the disectting for us.
3654  */
3655 static void
3656 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
3657     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
3658 {
3659         uint32_t bottle_bw, on_queue;
3660         uint16_t trunc_len;
3661         unsigned int chlen;
3662         unsigned int at;
3663         struct sctp_chunk_desc desc;
3664         struct sctp_chunkhdr *ch;
3665
3666         chlen = ntohs(cp->ch.chunk_length);
3667         chlen -= sizeof(struct sctp_pktdrop_chunk);
3668         /* XXX possible chlen underflow */
3669         if (chlen == 0) {
3670                 ch = NULL;
3671                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
3672                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
3673         } else {
3674                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
3675                 chlen -= sizeof(struct sctphdr);
3676                 /* XXX possible chlen underflow */
3677                 memset(&desc, 0, sizeof(desc));
3678         }
3679         trunc_len = (uint16_t) ntohs(cp->trunc_len);
3680         if (trunc_len > limit) {
3681                 trunc_len = limit;
3682         }
3683         /* now the chunks themselves */
3684         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
3685                 desc.chunk_type = ch->chunk_type;
3686                 /* get amount we need to move */
3687                 at = ntohs(ch->chunk_length);
3688                 if (at < sizeof(struct sctp_chunkhdr)) {
3689                         /* corrupt chunk, maybe at the end? */
3690                         SCTP_STAT_INCR(sctps_pdrpcrupt);
3691                         break;
3692                 }
3693                 if (trunc_len == 0) {
3694                         /* we are supposed to have all of it */
3695                         if (at > chlen) {
3696                                 /* corrupt skip it */
3697                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
3698                                 break;
3699                         }
3700                 } else {
3701                         /* is there enough of it left ? */
3702                         if (desc.chunk_type == SCTP_DATA) {
3703                                 if (chlen < (sizeof(struct sctp_data_chunk) +
3704                                     sizeof(desc.data_bytes))) {
3705                                         break;
3706                                 }
3707                         } else {
3708                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
3709                                         break;
3710                                 }
3711                         }
3712                 }
3713                 if (desc.chunk_type == SCTP_DATA) {
3714                         /* can we get out the tsn? */
3715                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3716                                 SCTP_STAT_INCR(sctps_pdrpmbda);
3717
3718                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
3719                                 /* yep */
3720                                 struct sctp_data_chunk *dcp;
3721                                 uint8_t *ddp;
3722                                 unsigned int iii;
3723
3724                                 dcp = (struct sctp_data_chunk *)ch;
3725                                 ddp = (uint8_t *) (dcp + 1);
3726                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
3727                                         desc.data_bytes[iii] = ddp[iii];
3728                                 }
3729                                 desc.tsn_ifany = dcp->dp.tsn;
3730                         } else {
3731                                 /* nope we are done. */
3732                                 SCTP_STAT_INCR(sctps_pdrpnedat);
3733                                 break;
3734                         }
3735                 } else {
3736                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
3737                                 SCTP_STAT_INCR(sctps_pdrpmbct);
3738                 }
3739
3740                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
3741                         SCTP_STAT_INCR(sctps_pdrppdbrk);
3742                         break;
3743                 }
3744                 if (SCTP_SIZE32(at) > chlen) {
3745                         break;
3746                 }
3747                 chlen -= SCTP_SIZE32(at);
3748                 if (chlen < sizeof(struct sctp_chunkhdr)) {
3749                         /* done, none left */
3750                         break;
3751                 }
3752                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
3753         }
3754         /* Now update any rwnd --- possibly */
3755         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
3756                 /* From a peer, we get a rwnd report */
3757                 uint32_t a_rwnd;
3758
3759                 SCTP_STAT_INCR(sctps_pdrpfehos);
3760
3761                 bottle_bw = ntohl(cp->bottle_bw);
3762                 on_queue = ntohl(cp->current_onq);
3763                 if (bottle_bw && on_queue) {
3764                         /* a rwnd report is in here */
3765                         if (bottle_bw > on_queue)
3766                                 a_rwnd = bottle_bw - on_queue;
3767                         else
3768                                 a_rwnd = 0;
3769
3770                         if (a_rwnd == 0)
3771                                 stcb->asoc.peers_rwnd = 0;
3772                         else {
3773                                 if (a_rwnd > stcb->asoc.total_flight) {
3774                                         stcb->asoc.peers_rwnd =
3775                                             a_rwnd - stcb->asoc.total_flight;
3776                                 } else {
3777                                         stcb->asoc.peers_rwnd = 0;
3778                                 }
3779                                 if (stcb->asoc.peers_rwnd <
3780                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3781                                         /* SWS sender side engages */
3782                                         stcb->asoc.peers_rwnd = 0;
3783                                 }
3784                         }
3785                 }
3786         } else {
3787                 SCTP_STAT_INCR(sctps_pdrpfmbox);
3788         }
3789
3790         /* now middle boxes in sat networks get a cwnd bump */
3791         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
3792             (stcb->asoc.sat_t3_loss_recovery == 0) &&
3793             (stcb->asoc.sat_network)) {
3794                 /*
3795                  * This is debateable but for sat networks it makes sense
3796                  * Note if a T3 timer has went off, we will prohibit any
3797                  * changes to cwnd until we exit the t3 loss recovery.
3798                  */
3799                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
3800                     net, cp, &bottle_bw, &on_queue);
3801         }
3802 }
3803
3804 /*
3805  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
3806  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
3807  * offset: offset into the mbuf chain to first chunkhdr - length: is the
3808  * length of the complete packet outputs: - length: modified to remaining
3809  * length after control processing - netp: modified to new sctp_nets after
3810  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
3811  * bad packet,...) otherwise return the tcb for this packet
3812  */
3813 #ifdef __GNUC__
3814 __attribute__((noinline))
3815 #endif
3816         static struct sctp_tcb *
3817                  sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
3818              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
3819              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
3820              uint32_t vrf_id, uint16_t port)
3821 {
3822         struct sctp_association *asoc;
3823         uint32_t vtag_in;
3824         int num_chunks = 0;     /* number of control chunks processed */
3825         uint32_t chk_length;
3826         int ret;
3827         int abort_no_unlock = 0;
3828
3829         /*
3830          * How big should this be, and should it be alloc'd? Lets try the
3831          * d-mtu-ceiling for now (2k) and that should hopefully work ...
3832          * until we get into jumbo grams and such..
3833          */
3834         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
3835         struct sctp_tcb *locked_tcb = stcb;
3836         int got_auth = 0;
3837         uint32_t auth_offset = 0, auth_len = 0;
3838         int auth_skipped = 0;
3839         int asconf_cnt = 0;
3840
3841 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3842         struct socket *so;
3843
3844 #endif
3845
3846         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
3847             iphlen, *offset, length, stcb);
3848
3849         /* validate chunk header length... */
3850         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
3851                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
3852                     ntohs(ch->chunk_length));
3853                 if (locked_tcb) {
3854                         SCTP_TCB_UNLOCK(locked_tcb);
3855                 }
3856                 return (NULL);
3857         }
3858         /*
3859          * validate the verification tag
3860          */
3861         vtag_in = ntohl(sh->v_tag);
3862
3863         if (locked_tcb) {
3864                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
3865         }
3866         if (ch->chunk_type == SCTP_INITIATION) {
3867                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
3868                     ntohs(ch->chunk_length), vtag_in);
3869                 if (vtag_in != 0) {
3870                         /* protocol error- silently discard... */
3871                         SCTP_STAT_INCR(sctps_badvtag);
3872                         if (locked_tcb) {
3873                                 SCTP_TCB_UNLOCK(locked_tcb);
3874                         }
3875                         return (NULL);
3876                 }
3877         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
3878                 /*
3879                  * If there is no stcb, skip the AUTH chunk and process
3880                  * later after a stcb is found (to validate the lookup was
3881                  * valid.
3882                  */
3883                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
3884                     (stcb == NULL) && !sctp_auth_disable) {
3885                         /* save this chunk for later processing */
3886                         auth_skipped = 1;
3887                         auth_offset = *offset;
3888                         auth_len = ntohs(ch->chunk_length);
3889
3890                         /* (temporarily) move past this chunk */
3891                         *offset += SCTP_SIZE32(auth_len);
3892                         if (*offset >= length) {
3893                                 /* no more data left in the mbuf chain */
3894                                 *offset = length;
3895                                 if (locked_tcb) {
3896                                         SCTP_TCB_UNLOCK(locked_tcb);
3897                                 }
3898                                 return (NULL);
3899                         }
3900                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
3901                             sizeof(struct sctp_chunkhdr), chunk_buf);
3902                 }
3903                 if (ch == NULL) {
3904                         /* Help */
3905                         *offset = length;
3906                         if (locked_tcb) {
3907                                 SCTP_TCB_UNLOCK(locked_tcb);
3908                         }
3909                         return (NULL);
3910                 }
3911                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
3912                         goto process_control_chunks;
3913                 }
3914                 /*
3915                  * first check if it's an ASCONF with an unknown src addr we
3916                  * need to look inside to find the association
3917                  */
3918                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
3919                         struct sctp_chunkhdr *asconf_ch = ch;
3920                         uint32_t asconf_offset = 0, asconf_len = 0;
3921
3922                         /* inp's refcount may be reduced */
3923                         SCTP_INP_INCR_REF(inp);
3924
3925                         asconf_offset = *offset;
3926                         do {
3927                                 asconf_len = ntohs(asconf_ch->chunk_length);
3928                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
3929                                         break;
3930                                 stcb = sctp_findassociation_ep_asconf(m, iphlen,
3931                                     *offset, sh, &inp, netp);
3932                                 if (stcb != NULL)
3933                                         break;
3934                                 asconf_offset += SCTP_SIZE32(asconf_len);
3935                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
3936                                     sizeof(struct sctp_chunkhdr), chunk_buf);
3937                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
3938                         if (stcb == NULL) {
3939                                 /*
3940                                  * reduce inp's refcount if not reduced in
3941                                  * sctp_findassociation_ep_asconf().
3942                                  */
3943                                 SCTP_INP_DECR_REF(inp);
3944                         } else {
3945                                 locked_tcb = stcb;
3946                         }
3947
3948                         /* now go back and verify any auth chunk to be sure */
3949                         if (auth_skipped && (stcb != NULL)) {
3950                                 struct sctp_auth_chunk *auth;
3951
3952                                 auth = (struct sctp_auth_chunk *)
3953                                     sctp_m_getptr(m, auth_offset,
3954                                     auth_len, chunk_buf);
3955                                 got_auth = 1;
3956                                 auth_skipped = 0;
3957                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
3958                                     auth_offset)) {
3959                                         /* auth HMAC failed so dump it */
3960                                         *offset = length;
3961                                         if (locked_tcb) {
3962                                                 SCTP_TCB_UNLOCK(locked_tcb);
3963                                         }
3964                                         return (NULL);
3965                                 } else {
3966                                         /* remaining chunks are HMAC checked */
3967                                         stcb->asoc.authenticated = 1;
3968                                 }
3969                         }
3970                 }
3971                 if (stcb == NULL) {
3972                         /* no association, so it's out of the blue... */
3973                         sctp_handle_ootb(m, iphlen, *offset, sh, inp, NULL,
3974                             vrf_id, port);
3975                         *offset = length;
3976                         if (locked_tcb) {
3977                                 SCTP_TCB_UNLOCK(locked_tcb);
3978                         }
3979                         return (NULL);
3980                 }
3981                 asoc = &stcb->asoc;
3982                 /* ABORT and SHUTDOWN can use either v_tag... */
3983                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
3984                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
3985                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
3986                         if ((vtag_in == asoc->my_vtag) ||
3987                             ((ch->chunk_flags & SCTP_HAD_NO_TCB) &&
3988                             (vtag_in == asoc->peer_vtag))) {
3989                                 /* this is valid */
3990                         } else {
3991                                 /* drop this packet... */
3992                                 SCTP_STAT_INCR(sctps_badvtag);
3993                                 if (locked_tcb) {
3994                                         SCTP_TCB_UNLOCK(locked_tcb);
3995                                 }
3996                                 return (NULL);
3997                         }
3998                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
3999                         if (vtag_in != asoc->my_vtag) {
4000                                 /*
4001                                  * this could be a stale SHUTDOWN-ACK or the
4002                                  * peer never got the SHUTDOWN-COMPLETE and
4003                                  * is still hung; we have started a new asoc
4004                                  * but it won't complete until the shutdown
4005                                  * is completed
4006                                  */
4007                                 if (locked_tcb) {
4008                                         SCTP_TCB_UNLOCK(locked_tcb);
4009                                 }
4010                                 sctp_handle_ootb(m, iphlen, *offset, sh, inp,
4011                                     NULL, vrf_id, port);
4012                                 return (NULL);
4013                         }
4014                 } else {
4015                         /* for all other chunks, vtag must match */
4016                         if (vtag_in != asoc->my_vtag) {
4017                                 /* invalid vtag... */
4018                                 SCTPDBG(SCTP_DEBUG_INPUT3,
4019                                     "invalid vtag: %xh, expect %xh\n",
4020                                     vtag_in, asoc->my_vtag);
4021                                 SCTP_STAT_INCR(sctps_badvtag);
4022                                 if (locked_tcb) {
4023                                         SCTP_TCB_UNLOCK(locked_tcb);
4024                                 }
4025                                 *offset = length;
4026                                 return (NULL);
4027                         }
4028                 }
4029         }                       /* end if !SCTP_COOKIE_ECHO */
4030         /*
4031          * process all control chunks...
4032          */
4033         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4034             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4035             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
4036                 /* implied cookie-ack.. we must have lost the ack */
4037                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4038                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4039                             stcb->asoc.overall_error_count,
4040                             0,
4041                             SCTP_FROM_SCTP_INPUT,
4042                             __LINE__);
4043                 }
4044                 stcb->asoc.overall_error_count = 0;
4045                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4046                     *netp);
4047         }
4048 process_control_chunks:
4049         while (IS_SCTP_CONTROL(ch)) {
4050                 /* validate chunk length */
4051                 chk_length = ntohs(ch->chunk_length);
4052                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4053                     ch->chunk_type, chk_length);
4054                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4055                 if (chk_length < sizeof(*ch) ||
4056                     (*offset + (int)chk_length) > length) {
4057                         *offset = length;
4058                         if (locked_tcb) {
4059                                 SCTP_TCB_UNLOCK(locked_tcb);
4060                         }
4061                         return (NULL);
4062                 }
4063                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4064                 /*
4065                  * INIT-ACK only gets the init ack "header" portion only
4066                  * because we don't have to process the peer's COOKIE. All
4067                  * others get a complete chunk.
4068                  */
4069                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
4070                     (ch->chunk_type == SCTP_INITIATION)) {
4071                         /* get an init-ack chunk */
4072                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4073                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
4074                         if (ch == NULL) {
4075                                 *offset = length;
4076                                 if (locked_tcb) {
4077                                         SCTP_TCB_UNLOCK(locked_tcb);
4078                                 }
4079                                 return (NULL);
4080                         }
4081                 } else {
4082                         /* For cookies and all other chunks. */
4083                         if (chk_length > sizeof(chunk_buf)) {
4084                                 /*
4085                                  * use just the size of the chunk buffer so
4086                                  * the front part of our chunks fit in
4087                                  * contiguous space up to the chunk buffer
4088                                  * size (508 bytes). For chunks that need to
4089                                  * get more than that they must use the
4090                                  * sctp_m_getptr() function or other means
4091                                  * (e.g. know how to parse mbuf chains).
4092                                  * Cookies do this already.
4093                                  */
4094                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4095                                     (sizeof(chunk_buf) - 4),
4096                                     chunk_buf);
4097                                 if (ch == NULL) {
4098                                         *offset = length;
4099                                         if (locked_tcb) {
4100                                                 SCTP_TCB_UNLOCK(locked_tcb);
4101                                         }
4102                                         return (NULL);
4103                                 }
4104                         } else {
4105                                 /* We can fit it all */
4106                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4107                                     chk_length, chunk_buf);
4108                                 if (ch == NULL) {
4109                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
4110                                         *offset = length;
4111                                         if (locked_tcb) {
4112                                                 SCTP_TCB_UNLOCK(locked_tcb);
4113                                         }
4114                                         return (NULL);
4115                                 }
4116                         }
4117                 }
4118                 num_chunks++;
4119                 /* Save off the last place we got a control from */
4120                 if (stcb != NULL) {
4121                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
4122                                 /*
4123                                  * allow last_control to be NULL if
4124                                  * ASCONF... ASCONF processing will find the
4125                                  * right net later
4126                                  */
4127                                 if ((netp != NULL) && (*netp != NULL))
4128                                         stcb->asoc.last_control_chunk_from = *netp;
4129                         }
4130                 }
4131 #ifdef SCTP_AUDITING_ENABLED
4132                 sctp_audit_log(0xB0, ch->chunk_type);
4133 #endif
4134
4135                 /* check to see if this chunk required auth, but isn't */
4136                 if ((stcb != NULL) && !sctp_auth_disable &&
4137                     sctp_auth_is_required_chunk(ch->chunk_type,
4138                     stcb->asoc.local_auth_chunks) &&
4139                     !stcb->asoc.authenticated) {
4140                         /* "silently" ignore */
4141                         SCTP_STAT_INCR(sctps_recvauthmissing);
4142                         goto next_chunk;
4143                 }
4144                 switch (ch->chunk_type) {
4145                 case SCTP_INITIATION:
4146                         /* must be first and only chunk */
4147                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
4148                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4149                                 /* We are not interested anymore? */
4150                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4151                                         /*
4152                                          * collision case where we are
4153                                          * sending to them too
4154                                          */
4155                                         ;
4156                                 } else {
4157                                         if (locked_tcb) {
4158                                                 SCTP_TCB_UNLOCK(locked_tcb);
4159                                         }
4160                                         *offset = length;
4161                                         return (NULL);
4162                                 }
4163                         }
4164                         if ((chk_length > SCTP_LARGEST_INIT_ACCEPTED) ||
4165                             (num_chunks > 1) ||
4166                             (sctp_strict_init && (length - *offset > (int)SCTP_SIZE32(chk_length)))) {
4167                                 *offset = length;
4168                                 if (locked_tcb) {
4169                                         SCTP_TCB_UNLOCK(locked_tcb);
4170                                 }
4171                                 return (NULL);
4172                         }
4173                         if ((stcb != NULL) &&
4174                             (SCTP_GET_STATE(&stcb->asoc) ==
4175                             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4176                                 sctp_send_shutdown_ack(stcb,
4177                                     stcb->asoc.primary_destination);
4178                                 *offset = length;
4179                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4180                                 if (locked_tcb) {
4181                                         SCTP_TCB_UNLOCK(locked_tcb);
4182                                 }
4183                                 return (NULL);
4184                         }
4185                         if (netp) {
4186                                 sctp_handle_init(m, iphlen, *offset, sh,
4187                                     (struct sctp_init_chunk *)ch, inp,
4188                                     stcb, *netp, &abort_no_unlock, vrf_id, port);
4189                         }
4190                         if (abort_no_unlock)
4191                                 return (NULL);
4192
4193                         *offset = length;
4194                         if (locked_tcb) {
4195                                 SCTP_TCB_UNLOCK(locked_tcb);
4196                         }
4197                         return (NULL);
4198                         break;
4199                 case SCTP_PAD_CHUNK:
4200                         break;
4201                 case SCTP_INITIATION_ACK:
4202                         /* must be first and only chunk */
4203                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
4204                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4205                                 /* We are not interested anymore */
4206                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4207                                         ;
4208                                 } else {
4209                                         if (locked_tcb) {
4210                                                 SCTP_TCB_UNLOCK(locked_tcb);
4211                                         }
4212                                         *offset = length;
4213                                         if (stcb) {
4214 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4215                                                 so = SCTP_INP_SO(inp);
4216                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4217                                                 SCTP_TCB_UNLOCK(stcb);
4218                                                 SCTP_SOCKET_LOCK(so, 1);
4219                                                 SCTP_TCB_LOCK(stcb);
4220                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4221 #endif
4222                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
4223 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4224                                                 SCTP_SOCKET_UNLOCK(so, 1);
4225 #endif
4226                                         }
4227                                         return (NULL);
4228                                 }
4229                         }
4230                         if ((num_chunks > 1) ||
4231                             (sctp_strict_init && (length - *offset > (int)SCTP_SIZE32(chk_length)))) {
4232                                 *offset = length;
4233                                 if (locked_tcb) {
4234                                         SCTP_TCB_UNLOCK(locked_tcb);
4235                                 }
4236                                 return (NULL);
4237                         }
4238                         if ((netp) && (*netp)) {
4239                                 ret = sctp_handle_init_ack(m, iphlen, *offset, sh,
4240                                     (struct sctp_init_ack_chunk *)ch, stcb, *netp, &abort_no_unlock, vrf_id);
4241                         } else {
4242                                 ret = -1;
4243                         }
4244                         /*
4245                          * Special case, I must call the output routine to
4246                          * get the cookie echoed
4247                          */
4248                         if (abort_no_unlock)
4249                                 return (NULL);
4250
4251                         if ((stcb) && ret == 0)
4252                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4253                         *offset = length;
4254                         if (locked_tcb) {
4255                                 SCTP_TCB_UNLOCK(locked_tcb);
4256                         }
4257                         return (NULL);
4258                         break;
4259                 case SCTP_SELECTIVE_ACK:
4260                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
4261                         SCTP_STAT_INCR(sctps_recvsacks);
4262                         {
4263                                 struct sctp_sack_chunk *sack;
4264                                 int abort_now = 0;
4265                                 uint32_t a_rwnd, cum_ack;
4266                                 uint16_t num_seg;
4267                                 int nonce_sum_flag;
4268
4269                                 if ((stcb == NULL) || (chk_length < sizeof(struct sctp_sack_chunk))) {
4270                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on sack chunk, too small\n");
4271                         ignore_sack:
4272                                         *offset = length;
4273                                         if (locked_tcb) {
4274                                                 SCTP_TCB_UNLOCK(locked_tcb);
4275                                         }
4276                                         return (NULL);
4277                                 }
4278                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4279                                         /*-
4280                                          * If we have sent a shutdown-ack, we will pay no
4281                                          * attention to a sack sent in to us since
4282                                          * we don't care anymore.
4283                                          */
4284                                         goto ignore_sack;
4285                                 }
4286                                 sack = (struct sctp_sack_chunk *)ch;
4287                                 nonce_sum_flag = ch->chunk_flags & SCTP_SACK_NONCE_SUM;
4288                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
4289                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
4290                                 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
4291                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4292                                     cum_ack,
4293                                     num_seg,
4294                                     a_rwnd
4295                                     );
4296                                 stcb->asoc.seen_a_sack_this_pkt = 1;
4297                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
4298                                     (num_seg == 0) &&
4299                                     ((compare_with_wrap(cum_ack, stcb->asoc.last_acked_seq, MAX_TSN)) ||
4300                                     (cum_ack == stcb->asoc.last_acked_seq)) &&
4301                                     (stcb->asoc.saw_sack_with_frags == 0) &&
4302                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
4303                                     ) {
4304                                         /*
4305                                          * We have a SIMPLE sack having no
4306                                          * prior segments and data on sent
4307                                          * queue to be acked.. Use the
4308                                          * faster path sack processing. We
4309                                          * also allow window update sacks
4310                                          * with no missing segments to go
4311                                          * this way too.
4312                                          */
4313                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, nonce_sum_flag,
4314                                             &abort_now);
4315                                 } else {
4316                                         if (netp && *netp)
4317                                                 sctp_handle_sack(m, *offset,
4318                                                     sack, stcb, *netp, &abort_now, chk_length, a_rwnd);
4319                                 }
4320                                 if (abort_now) {
4321                                         /* ABORT signal from sack processing */
4322                                         *offset = length;
4323                                         return (NULL);
4324                                 }
4325                         }
4326                         break;
4327                 case SCTP_HEARTBEAT_REQUEST:
4328                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
4329                         if ((stcb) && netp && *netp) {
4330                                 SCTP_STAT_INCR(sctps_recvheartbeat);
4331                                 sctp_send_heartbeat_ack(stcb, m, *offset,
4332                                     chk_length, *netp);
4333
4334                                 /* He's alive so give him credit */
4335                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4336                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4337                                             stcb->asoc.overall_error_count,
4338                                             0,
4339                                             SCTP_FROM_SCTP_INPUT,
4340                                             __LINE__);
4341                                 }
4342                                 stcb->asoc.overall_error_count = 0;
4343                         }
4344                         break;
4345                 case SCTP_HEARTBEAT_ACK:
4346                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
4347                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
4348                                 /* Its not ours */
4349                                 *offset = length;
4350                                 if (locked_tcb) {
4351                                         SCTP_TCB_UNLOCK(locked_tcb);
4352                                 }
4353                                 return (NULL);
4354                         }
4355                         /* He's alive so give him credit */
4356                         if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4357                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4358                                     stcb->asoc.overall_error_count,
4359                                     0,
4360                                     SCTP_FROM_SCTP_INPUT,
4361                                     __LINE__);
4362                         }
4363                         stcb->asoc.overall_error_count = 0;
4364                         SCTP_STAT_INCR(sctps_recvheartbeatack);
4365                         if (netp && *netp)
4366                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
4367                                     stcb, *netp);
4368                         break;
4369                 case SCTP_ABORT_ASSOCIATION:
4370                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
4371                             stcb);
4372                         if ((stcb) && netp && *netp)
4373                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
4374                                     stcb, *netp);
4375                         *offset = length;
4376                         return (NULL);
4377                         break;
4378                 case SCTP_SHUTDOWN:
4379                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
4380                             stcb);
4381                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
4382                                 *offset = length;
4383                                 if (locked_tcb) {
4384                                         SCTP_TCB_UNLOCK(locked_tcb);
4385                                 }
4386                                 return (NULL);
4387                         }
4388                         if (netp && *netp) {
4389                                 int abort_flag = 0;
4390
4391                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
4392                                     stcb, *netp, &abort_flag);
4393                                 if (abort_flag) {
4394                                         *offset = length;
4395                                         return (NULL);
4396                                 }
4397                         }
4398                         break;
4399                 case SCTP_SHUTDOWN_ACK:
4400                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", stcb);
4401                         if ((stcb) && (netp) && (*netp))
4402                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
4403                         *offset = length;
4404                         return (NULL);
4405                         break;
4406
4407                 case SCTP_OPERATION_ERROR:
4408                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
4409                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
4410
4411                                 *offset = length;
4412                                 return (NULL);
4413                         }
4414                         break;
4415                 case SCTP_COOKIE_ECHO:
4416                         SCTPDBG(SCTP_DEBUG_INPUT3,
4417                             "SCTP_COOKIE-ECHO, stcb %p\n", stcb);
4418                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4419                                 ;
4420                         } else {
4421                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4422                                         /* We are not interested anymore */
4423                                         *offset = length;
4424                                         return (NULL);
4425                                 }
4426                         }
4427                         /*
4428                          * First are we accepting? We do this again here
4429                          * sincen it is possible that a previous endpoint
4430                          * WAS listening responded to a INIT-ACK and then
4431                          * closed. We opened and bound.. and are now no
4432                          * longer listening.
4433                          */
4434
4435                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
4436                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4437                                     (sctp_abort_if_one_2_one_hits_limit)) {
4438                                         struct mbuf *oper;
4439                                         struct sctp_paramhdr *phdr;
4440
4441                                         oper = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4442                                             0, M_DONTWAIT, 1, MT_DATA);
4443                                         if (oper) {
4444                                                 SCTP_BUF_LEN(oper) =
4445                                                     sizeof(struct sctp_paramhdr);
4446                                                 phdr = mtod(oper,
4447                                                     struct sctp_paramhdr *);
4448                                                 phdr->param_type =
4449                                                     htons(SCTP_CAUSE_OUT_OF_RESC);
4450                                                 phdr->param_length =
4451                                                     htons(sizeof(struct sctp_paramhdr));
4452                                         }
4453                                         sctp_abort_association(inp, stcb, m,
4454                                             iphlen, sh, oper, vrf_id, port);
4455                                 }
4456                                 *offset = length;
4457                                 return (NULL);
4458                         } else {
4459                                 struct mbuf *ret_buf;
4460                                 struct sctp_inpcb *linp;
4461
4462                                 if (stcb) {
4463                                         linp = NULL;
4464                                 } else {
4465                                         linp = inp;
4466                                 }
4467
4468                                 if (linp) {
4469                                         SCTP_ASOC_CREATE_LOCK(linp);
4470                                 }
4471                                 if (netp) {
4472                                         ret_buf =
4473                                             sctp_handle_cookie_echo(m, iphlen,
4474                                             *offset, sh,
4475                                             (struct sctp_cookie_echo_chunk *)ch,
4476                                             &inp, &stcb, netp,
4477                                             auth_skipped,
4478                                             auth_offset,
4479                                             auth_len,
4480                                             &locked_tcb,
4481                                             vrf_id,
4482                                             port);
4483                                 } else {
4484                                         ret_buf = NULL;
4485                                 }
4486                                 if (linp) {
4487                                         SCTP_ASOC_CREATE_UNLOCK(linp);
4488                                 }
4489                                 if (ret_buf == NULL) {
4490                                         if (locked_tcb) {
4491                                                 SCTP_TCB_UNLOCK(locked_tcb);
4492                                         }
4493                                         SCTPDBG(SCTP_DEBUG_INPUT3,
4494                                             "GAK, null buffer\n");
4495                                         auth_skipped = 0;
4496                                         *offset = length;
4497                                         return (NULL);
4498                                 }
4499                                 /* if AUTH skipped, see if it verified... */
4500                                 if (auth_skipped) {
4501                                         got_auth = 1;
4502                                         auth_skipped = 0;
4503                                 }
4504                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
4505                                         /*
4506                                          * Restart the timer if we have
4507                                          * pending data
4508                                          */
4509                                         struct sctp_tmit_chunk *chk;
4510
4511                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
4512                                         if (chk) {
4513                                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4514                                                     stcb->sctp_ep, stcb,
4515                                                     chk->whoTo);
4516                                         }
4517                                 }
4518                         }
4519                         break;
4520                 case SCTP_COOKIE_ACK:
4521                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", stcb);
4522                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
4523                                 if (locked_tcb) {
4524                                         SCTP_TCB_UNLOCK(locked_tcb);
4525                                 }
4526                                 return (NULL);
4527                         }
4528                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4529                                 /* We are not interested anymore */
4530                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4531                                         ;
4532                                 } else if (stcb) {
4533 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4534                                         so = SCTP_INP_SO(inp);
4535                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4536                                         SCTP_TCB_UNLOCK(stcb);
4537                                         SCTP_SOCKET_LOCK(so, 1);
4538                                         SCTP_TCB_LOCK(stcb);
4539                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4540 #endif
4541                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
4542 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4543                                         SCTP_SOCKET_UNLOCK(so, 1);
4544 #endif
4545                                         *offset = length;
4546                                         return (NULL);
4547                                 }
4548                         }
4549                         /* He's alive so give him credit */
4550                         if ((stcb) && netp && *netp) {
4551                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4552                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4553                                             stcb->asoc.overall_error_count,
4554                                             0,
4555                                             SCTP_FROM_SCTP_INPUT,
4556                                             __LINE__);
4557                                 }
4558                                 stcb->asoc.overall_error_count = 0;
4559                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
4560                         }
4561                         break;
4562                 case SCTP_ECN_ECHO:
4563                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
4564                         /* He's alive so give him credit */
4565                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
4566                                 /* Its not ours */
4567                                 if (locked_tcb) {
4568                                         SCTP_TCB_UNLOCK(locked_tcb);
4569                                 }
4570                                 *offset = length;
4571                                 return (NULL);
4572                         }
4573                         if (stcb) {
4574                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4575                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4576                                             stcb->asoc.overall_error_count,
4577                                             0,
4578                                             SCTP_FROM_SCTP_INPUT,
4579                                             __LINE__);
4580                                 }
4581                                 stcb->asoc.overall_error_count = 0;
4582                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
4583                                     stcb);
4584                         }
4585                         break;
4586                 case SCTP_ECN_CWR:
4587                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
4588                         /* He's alive so give him credit */
4589                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
4590                                 /* Its not ours */
4591                                 if (locked_tcb) {
4592                                         SCTP_TCB_UNLOCK(locked_tcb);
4593                                 }
4594                                 *offset = length;
4595                                 return (NULL);
4596                         }
4597                         if (stcb) {
4598                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4599                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4600                                             stcb->asoc.overall_error_count,
4601                                             0,
4602                                             SCTP_FROM_SCTP_INPUT,
4603                                             __LINE__);
4604                                 }
4605                                 stcb->asoc.overall_error_count = 0;
4606                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb);
4607                         }
4608                         break;
4609                 case SCTP_SHUTDOWN_COMPLETE:
4610                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", stcb);
4611                         /* must be first and only chunk */
4612                         if ((num_chunks > 1) ||
4613                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4614                                 *offset = length;
4615                                 if (locked_tcb) {
4616                                         SCTP_TCB_UNLOCK(locked_tcb);
4617                                 }
4618                                 return (NULL);
4619                         }
4620                         if ((stcb) && netp && *netp) {
4621                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
4622                                     stcb, *netp);
4623                         }
4624                         *offset = length;
4625                         return (NULL);
4626                         break;
4627                 case SCTP_ASCONF:
4628                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
4629                         /* He's alive so give him credit */
4630                         if (stcb) {
4631                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4632                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4633                                             stcb->asoc.overall_error_count,
4634                                             0,
4635                                             SCTP_FROM_SCTP_INPUT,
4636                                             __LINE__);
4637                                 }
4638                                 stcb->asoc.overall_error_count = 0;
4639                                 sctp_handle_asconf(m, *offset,
4640                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
4641                                 asconf_cnt++;
4642                         }
4643                         break;
4644                 case SCTP_ASCONF_ACK:
4645                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
4646                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
4647                                 /* Its not ours */
4648                                 if (locked_tcb) {
4649                                         SCTP_TCB_UNLOCK(locked_tcb);
4650                                 }
4651                                 *offset = length;
4652                                 return (NULL);
4653                         }
4654                         if ((stcb) && netp && *netp) {
4655                                 /* He's alive so give him credit */
4656                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4657                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4658                                             stcb->asoc.overall_error_count,
4659                                             0,
4660                                             SCTP_FROM_SCTP_INPUT,
4661                                             __LINE__);
4662                                 }
4663                                 stcb->asoc.overall_error_count = 0;
4664                                 sctp_handle_asconf_ack(m, *offset,
4665                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
4666                                 if (abort_no_unlock)
4667                                         return (NULL);
4668                         }
4669                         break;
4670                 case SCTP_FORWARD_CUM_TSN:
4671                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
4672                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
4673                                 /* Its not ours */
4674                                 if (locked_tcb) {
4675                                         SCTP_TCB_UNLOCK(locked_tcb);
4676                                 }
4677                                 *offset = length;
4678                                 return (NULL);
4679                         }
4680                         /* He's alive so give him credit */
4681                         if (stcb) {
4682                                 int abort_flag = 0;
4683
4684                                 stcb->asoc.overall_error_count = 0;
4685                                 if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4686                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4687                                             stcb->asoc.overall_error_count,
4688                                             0,
4689                                             SCTP_FROM_SCTP_INPUT,
4690                                             __LINE__);
4691                                 }
4692                                 *fwd_tsn_seen = 1;
4693                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4694                                         /* We are not interested anymore */
4695 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4696                                         so = SCTP_INP_SO(inp);
4697                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4698                                         SCTP_TCB_UNLOCK(stcb);
4699                                         SCTP_SOCKET_LOCK(so, 1);
4700                                         SCTP_TCB_LOCK(stcb);
4701                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4702 #endif
4703                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4704 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4705                                         SCTP_SOCKET_UNLOCK(so, 1);
4706 #endif
4707                                         *offset = length;
4708                                         return (NULL);
4709                                 }
4710                                 sctp_handle_forward_tsn(stcb,
4711                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
4712                                 if (abort_flag) {
4713                                         *offset = length;
4714                                         return (NULL);
4715                                 } else {
4716                                         if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
4717                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4718                                                     stcb->asoc.overall_error_count,
4719                                                     0,
4720                                                     SCTP_FROM_SCTP_INPUT,
4721                                                     __LINE__);
4722                                         }
4723                                         stcb->asoc.overall_error_count = 0;
4724                                 }
4725
4726                         }
4727                         break;
4728                 case SCTP_STREAM_RESET:
4729                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
4730                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
4731                                 /* Its not ours */
4732                                 if (locked_tcb) {
4733                                         SCTP_TCB_UNLOCK(locked_tcb);
4734                                 }
4735                                 *offset = length;
4736                                 return (NULL);
4737                         }
4738                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4739                                 /* We are not interested anymore */
4740 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4741                                 so = SCTP_INP_SO(inp);
4742                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4743                                 SCTP_TCB_UNLOCK(stcb);
4744                                 SCTP_SOCKET_LOCK(so, 1);
4745                                 SCTP_TCB_LOCK(stcb);
4746                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4747 #endif
4748                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
4749 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4750                                 SCTP_SOCKET_UNLOCK(so, 1);
4751 #endif
4752                                 *offset = length;
4753                                 return (NULL);
4754                         }
4755                         if (stcb->asoc.peer_supports_strreset == 0) {
4756                                 /*
4757                                  * hmm, peer should have announced this, but
4758                                  * we will turn it on since he is sending us
4759                                  * a stream reset.
4760                                  */
4761                                 stcb->asoc.peer_supports_strreset = 1;
4762                         }
4763                         if (sctp_handle_stream_reset(stcb, m, *offset, (struct sctp_stream_reset_out_req *)ch)) {
4764                                 /* stop processing */
4765                                 *offset = length;
4766                                 return (NULL);
4767                         }
4768                         break;
4769                 case SCTP_PACKET_DROPPED:
4770                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
4771                         /* re-get it all please */
4772                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
4773                                 /* Its not ours */
4774                                 if (locked_tcb) {
4775                                         SCTP_TCB_UNLOCK(locked_tcb);
4776                                 }
4777                                 *offset = length;
4778                                 return (NULL);
4779                         }
4780                         if (ch && (stcb) && netp && (*netp)) {
4781                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
4782                                     stcb, *netp,
4783                                     min(chk_length, (sizeof(chunk_buf) - 4)));
4784
4785                         }
4786                         break;
4787
4788                 case SCTP_AUTHENTICATION:
4789                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
4790                         if (sctp_auth_disable)
4791                                 goto unknown_chunk;
4792
4793                         if (stcb == NULL) {
4794                                 /* save the first AUTH for later processing */
4795                                 if (auth_skipped == 0) {
4796                                         auth_offset = *offset;
4797                                         auth_len = chk_length;
4798                                         auth_skipped = 1;
4799                                 }
4800                                 /* skip this chunk (temporarily) */
4801                                 goto next_chunk;
4802                         }
4803                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
4804                             (chk_length > (sizeof(struct sctp_auth_chunk) +
4805                             SCTP_AUTH_DIGEST_LEN_MAX))) {
4806                                 /* Its not ours */
4807                                 if (locked_tcb) {
4808                                         SCTP_TCB_UNLOCK(locked_tcb);
4809                                 }
4810                                 *offset = length;
4811                                 return (NULL);
4812                         }
4813                         if (got_auth == 1) {
4814                                 /* skip this chunk... it's already auth'd */
4815                                 goto next_chunk;
4816                         }
4817                         got_auth = 1;
4818                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
4819                             m, *offset)) {
4820                                 /* auth HMAC failed so dump the packet */
4821                                 *offset = length;
4822                                 return (stcb);
4823                         } else {
4824                                 /* remaining chunks are HMAC checked */
4825                                 stcb->asoc.authenticated = 1;
4826                         }
4827                         break;
4828
4829                 default:
4830         unknown_chunk:
4831                         /* it's an unknown chunk! */
4832                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
4833                                 struct mbuf *mm;
4834                                 struct sctp_paramhdr *phd;
4835
4836                                 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
4837                                     0, M_DONTWAIT, 1, MT_DATA);
4838                                 if (mm) {
4839                                         phd = mtod(mm, struct sctp_paramhdr *);
4840                                         /*
4841                                          * We cheat and use param type since
4842                                          * we did not bother to define a
4843                                          * error cause struct. They are the
4844                                          * same basic format with different
4845                                          * names.
4846                                          */
4847                                         phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
4848                                         phd->param_length = htons(chk_length + sizeof(*phd));
4849                                         SCTP_BUF_LEN(mm) = sizeof(*phd);
4850                                         SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, SCTP_SIZE32(chk_length),
4851                                             M_DONTWAIT);
4852                                         if (SCTP_BUF_NEXT(mm)) {
4853 #ifdef SCTP_MBUF_LOGGING
4854                                                 if (sctp_logging_level & SCTP_MBUF_LOGGING_ENABLE) {
4855                                                         struct mbuf *mat;
4856
4857                                                         mat = SCTP_BUF_NEXT(mm);
4858                                                         while (mat) {
4859                                                                 if (SCTP_BUF_IS_EXTENDED(mat)) {
4860                                                                         sctp_log_mb(mat, SCTP_MBUF_ICOPY);
4861                                                                 }
4862                                                                 mat = SCTP_BUF_NEXT(mat);
4863                                                         }
4864                                                 }
4865 #endif
4866                                                 sctp_queue_op_err(stcb, mm);
4867                                         } else {
4868                                                 sctp_m_freem(mm);
4869                                         }
4870                                 }
4871                         }
4872                         if ((ch->chunk_type & 0x80) == 0) {
4873                                 /* discard this packet */
4874                                 *offset = length;
4875                                 return (stcb);
4876                         }       /* else skip this bad chunk and continue... */
4877                         break;
4878                 }               /* switch (ch->chunk_type) */
4879
4880
4881 next_chunk:
4882                 /* get the next chunk */
4883                 *offset += SCTP_SIZE32(chk_length);
4884                 if (*offset >= length) {
4885                         /* no more data left in the mbuf chain */
4886                         break;
4887                 }
4888                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4889                     sizeof(struct sctp_chunkhdr), chunk_buf);
4890                 if (ch == NULL) {
4891                         if (locked_tcb) {
4892                                 SCTP_TCB_UNLOCK(locked_tcb);
4893                         }
4894                         *offset = length;
4895                         return (NULL);
4896                 }
4897         }                       /* while */
4898
4899         if (asconf_cnt > 0 && stcb != NULL) {
4900                 sctp_send_asconf_ack(stcb);
4901         }
4902         return (stcb);
4903 }
4904
4905
4906 /*
4907  * Process the ECN bits we have something set so we must look to see if it is
4908  * ECN(0) or ECN(1) or CE
4909  */
4910 static void
4911 sctp_process_ecn_marked_a(struct sctp_tcb *stcb, struct sctp_nets *net,
4912     uint8_t ecn_bits)
4913 {
4914         if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4915                 ;
4916         } else if ((ecn_bits & SCTP_ECT1_BIT) == SCTP_ECT1_BIT) {
4917                 /*
4918                  * we only add to the nonce sum for ECT1, ECT0 does not
4919                  * change the NS bit (that we have yet to find a way to send
4920                  * it yet).
4921                  */
4922
4923                 /* ECN Nonce stuff */
4924                 stcb->asoc.receiver_nonce_sum++;
4925                 stcb->asoc.receiver_nonce_sum &= SCTP_SACK_NONCE_SUM;
4926
4927                 /*
4928                  * Drag up the last_echo point if cumack is larger since we
4929                  * don't want the point falling way behind by more than
4930                  * 2^^31 and then having it be incorrect.
4931                  */
4932                 if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4933                     stcb->asoc.last_echo_tsn, MAX_TSN)) {
4934                         stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4935                 }
4936         } else if ((ecn_bits & SCTP_ECT0_BIT) == SCTP_ECT0_BIT) {
4937                 /*
4938                  * Drag up the last_echo point if cumack is larger since we
4939                  * don't want the point falling way behind by more than
4940                  * 2^^31 and then having it be incorrect.
4941                  */
4942                 if (compare_with_wrap(stcb->asoc.cumulative_tsn,
4943                     stcb->asoc.last_echo_tsn, MAX_TSN)) {
4944                         stcb->asoc.last_echo_tsn = stcb->asoc.cumulative_tsn;
4945                 }
4946         }
4947 }
4948
4949 static void
4950 sctp_process_ecn_marked_b(struct sctp_tcb *stcb, struct sctp_nets *net,
4951     uint32_t high_tsn, uint8_t ecn_bits)
4952 {
4953         if ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS) {
4954                 /*
4955                  * we possibly must notify the sender that a congestion
4956                  * window reduction is in order. We do this by adding a ECNE
4957                  * chunk to the output chunk queue. The incoming CWR will
4958                  * remove this chunk.
4959                  */
4960                 if (compare_with_wrap(high_tsn, stcb->asoc.last_echo_tsn,
4961                     MAX_TSN)) {
4962                         /* Yep, we need to add a ECNE */
4963                         sctp_send_ecn_echo(stcb, net, high_tsn);
4964                         stcb->asoc.last_echo_tsn = high_tsn;
4965                 }
4966         }
4967 }
4968
4969 #ifdef INVARIANTS
4970 static void
4971 sctp_validate_no_locks(struct sctp_inpcb *inp)
4972 {
4973         struct sctp_tcb *stcb;
4974
4975         LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
4976                 if (mtx_owned(&stcb->tcb_mtx)) {
4977                         panic("Own lock on stcb at return from input");
4978                 }
4979         }
4980 }
4981
4982 #endif
4983
4984 /*
4985  * common input chunk processing (v4 and v6)
4986  */
4987 void
4988 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset,
4989     int length, struct sctphdr *sh, struct sctp_chunkhdr *ch,
4990     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets *net,
4991     uint8_t ecn_bits, uint32_t vrf_id, uint16_t port)
4992 {
4993         /*
4994          * Control chunk processing
4995          */
4996         uint32_t high_tsn;
4997         int fwd_tsn_seen = 0, data_processed = 0;
4998         struct mbuf *m = *mm;
4999         int abort_flag = 0;
5000         int un_sent;
5001
5002         SCTP_STAT_INCR(sctps_recvdatagrams);
5003 #ifdef SCTP_AUDITING_ENABLED
5004         sctp_audit_log(0xE0, 1);
5005         sctp_auditing(0, inp, stcb, net);
5006 #endif
5007
5008         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d stcb:%p\n",
5009             m, iphlen, offset, stcb);
5010         if (stcb) {
5011                 /* always clear this before beginning a packet */
5012                 stcb->asoc.authenticated = 0;
5013                 stcb->asoc.seen_a_sack_this_pkt = 0;
5014                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5015                     stcb, stcb->asoc.state);
5016
5017                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5018                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5019                         /*-
5020                          * If we hit here, we had a ref count
5021                          * up when the assoc was aborted and the
5022                          * timer is clearing out the assoc, we should
5023                          * NOT respond to any packet.. its OOTB.
5024                          */
5025                         SCTP_TCB_UNLOCK(stcb);
5026                         sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
5027                             vrf_id, port);
5028                         goto out_now;
5029                 }
5030         }
5031         if (IS_SCTP_CONTROL(ch)) {
5032                 /* process the control portion of the SCTP packet */
5033                 /* sa_ignore NO_NULL_CHK */
5034                 stcb = sctp_process_control(m, iphlen, &offset, length, sh, ch,
5035                     inp, stcb, &net, &fwd_tsn_seen, vrf_id, port);
5036                 if (stcb) {
5037                         /*
5038                          * This covers us if the cookie-echo was there and
5039                          * it changes our INP.
5040                          */
5041                         inp = stcb->sctp_ep;
5042                 }
5043         } else {
5044                 /*
5045                  * no control chunks, so pre-process DATA chunks (these
5046                  * checks are taken care of by control processing)
5047                  */
5048
5049                 /*
5050                  * if DATA only packet, and auth is required, then punt...
5051                  * can't have authenticated without any AUTH (control)
5052                  * chunks
5053                  */
5054                 if ((stcb != NULL) && !sctp_auth_disable &&
5055                     sctp_auth_is_required_chunk(SCTP_DATA,
5056                     stcb->asoc.local_auth_chunks)) {
5057                         /* "silently" ignore */
5058                         SCTP_STAT_INCR(sctps_recvauthmissing);
5059                         SCTP_TCB_UNLOCK(stcb);
5060                         goto out_now;
5061                 }
5062                 if (stcb == NULL) {
5063                         /* out of the blue DATA chunk */
5064                         sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
5065                             vrf_id, port);
5066                         goto out_now;
5067                 }
5068                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5069                         /* v_tag mismatch! */
5070                         SCTP_STAT_INCR(sctps_badvtag);
5071                         SCTP_TCB_UNLOCK(stcb);
5072                         goto out_now;
5073                 }
5074         }
5075
5076         if (stcb == NULL) {
5077                 /*
5078                  * no valid TCB for this packet, or we found it's a bad
5079                  * packet while processing control, or we're done with this
5080                  * packet (done or skip rest of data), so we drop it...
5081                  */
5082                 goto out_now;
5083         }
5084         /*
5085          * DATA chunk processing
5086          */
5087         /* plow through the data chunks while length > offset */
5088
5089         /*
5090          * Rest should be DATA only.  Check authentication state if AUTH for
5091          * DATA is required.
5092          */
5093         if ((length > offset) && (stcb != NULL) && !sctp_auth_disable &&
5094             sctp_auth_is_required_chunk(SCTP_DATA,
5095             stcb->asoc.local_auth_chunks) &&
5096             !stcb->asoc.authenticated) {
5097                 /* "silently" ignore */
5098                 SCTP_STAT_INCR(sctps_recvauthmissing);
5099                 SCTPDBG(SCTP_DEBUG_AUTH1,
5100                     "Data chunk requires AUTH, skipped\n");
5101                 goto trigger_send;
5102         }
5103         if (length > offset) {
5104                 int retval;
5105
5106                 /*
5107                  * First check to make sure our state is correct. We would
5108                  * not get here unless we really did have a tag, so we don't
5109                  * abort if this happens, just dump the chunk silently.
5110                  */
5111                 switch (SCTP_GET_STATE(&stcb->asoc)) {
5112                 case SCTP_STATE_COOKIE_ECHOED:
5113                         /*
5114                          * we consider data with valid tags in this state
5115                          * shows us the cookie-ack was lost. Imply it was
5116                          * there.
5117                          */
5118                         if (sctp_logging_level & SCTP_THRESHOLD_LOGGING) {
5119                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5120                                     stcb->asoc.overall_error_count,
5121                                     0,
5122                                     SCTP_FROM_SCTP_INPUT,
5123                                     __LINE__);
5124                         }
5125                         stcb->asoc.overall_error_count = 0;
5126                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
5127                         break;
5128                 case SCTP_STATE_COOKIE_WAIT:
5129                         /*
5130                          * We consider OOTB any data sent during asoc setup.
5131                          */
5132                         sctp_handle_ootb(m, iphlen, offset, sh, inp, NULL,
5133                             vrf_id, port);
5134                         SCTP_TCB_UNLOCK(stcb);
5135                         goto out_now;
5136                         /* sa_ignore NOTREACHED */
5137                         break;
5138                 case SCTP_STATE_EMPTY:  /* should not happen */
5139                 case SCTP_STATE_INUSE:  /* should not happen */
5140                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
5141                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5142                 default:
5143                         SCTP_TCB_UNLOCK(stcb);
5144                         goto out_now;
5145                         /* sa_ignore NOTREACHED */
5146                         break;
5147                 case SCTP_STATE_OPEN:
5148                 case SCTP_STATE_SHUTDOWN_SENT:
5149                         break;
5150                 }
5151                 /* take care of ECN, part 1. */
5152                 if (stcb->asoc.ecn_allowed &&
5153                     (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
5154                         sctp_process_ecn_marked_a(stcb, net, ecn_bits);
5155                 }
5156                 /* plow through the data chunks while length > offset */
5157                 retval = sctp_process_data(mm, iphlen, &offset, length, sh,
5158                     inp, stcb, net, &high_tsn);
5159                 if (retval == 2) {
5160                         /*
5161                          * The association aborted, NO UNLOCK needed since
5162                          * the association is destroyed.
5163                          */
5164                         goto out_now;
5165                 }
5166                 data_processed = 1;
5167                 if (retval == 0) {
5168                         /* take care of ecn part 2. */
5169                         if (stcb->asoc.ecn_allowed &&
5170                             (ecn_bits & (SCTP_ECT0_BIT | SCTP_ECT1_BIT))) {
5171                                 sctp_process_ecn_marked_b(stcb, net, high_tsn,
5172                                     ecn_bits);
5173                         }
5174                 }
5175                 /*
5176                  * Anything important needs to have been m_copy'ed in
5177                  * process_data
5178                  */
5179         }
5180         if ((data_processed == 0) && (fwd_tsn_seen)) {
5181                 int was_a_gap = 0;
5182
5183                 if (compare_with_wrap(stcb->asoc.highest_tsn_inside_map,
5184                     stcb->asoc.cumulative_tsn, MAX_TSN)) {
5185                         /* there was a gap before this data was processed */
5186                         was_a_gap = 1;
5187                 }
5188                 sctp_sack_check(stcb, 1, was_a_gap, &abort_flag);
5189                 if (abort_flag) {
5190                         /* Again, we aborted so NO UNLOCK needed */
5191                         goto out_now;
5192                 }
5193         }
5194         /* trigger send of any chunks in queue... */
5195 trigger_send:
5196 #ifdef SCTP_AUDITING_ENABLED
5197         sctp_audit_log(0xE0, 2);
5198         sctp_auditing(1, inp, stcb, net);
5199 #endif
5200         SCTPDBG(SCTP_DEBUG_INPUT1,
5201             "Check for chunk output prw:%d tqe:%d tf=%d\n",
5202             stcb->asoc.peers_rwnd,
5203             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
5204             stcb->asoc.total_flight);
5205         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
5206
5207         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue) ||
5208             ((un_sent) &&
5209             (stcb->asoc.peers_rwnd > 0 ||
5210             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
5211                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
5212                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
5213                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
5214         }
5215 #ifdef SCTP_AUDITING_ENABLED
5216         sctp_audit_log(0xE0, 3);
5217         sctp_auditing(2, inp, stcb, net);
5218 #endif
5219         SCTP_TCB_UNLOCK(stcb);
5220 out_now:
5221 #ifdef INVARIANTS
5222         sctp_validate_no_locks(inp);
5223 #endif
5224         return;
5225 }
5226
5227
5228 void
5229 sctp_input_with_port(i_pak, off, port)
5230         struct mbuf *i_pak;
5231         int off;
5232         uint16_t port;
5233 {
5234 #ifdef SCTP_MBUF_LOGGING
5235         struct mbuf *mat;
5236
5237 #endif
5238         struct mbuf *m;
5239         int iphlen;
5240         uint32_t vrf_id = 0;
5241         uint8_t ecn_bits;
5242         struct ip *ip;
5243         struct sctphdr *sh;
5244         struct sctp_inpcb *inp = NULL;
5245
5246         uint32_t check, calc_check;
5247         struct sctp_nets *net;
5248         struct sctp_tcb *stcb = NULL;
5249         struct sctp_chunkhdr *ch;
5250         int refcount_up = 0;
5251         int length, mlen, offset;
5252
5253
5254         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
5255                 SCTP_RELEASE_PKT(i_pak);
5256                 return;
5257         }
5258         mlen = SCTP_HEADER_LEN(i_pak);
5259         iphlen = off;
5260         m = SCTP_HEADER_TO_CHAIN(i_pak);
5261
5262         net = NULL;
5263         SCTP_STAT_INCR(sctps_recvpackets);
5264         SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
5265
5266
5267 #ifdef SCTP_MBUF_LOGGING
5268         /* Log in any input mbufs */
5269         if (sctp_logging_level & SCTP_MBUF_LOGGING_ENABLE) {
5270                 mat = m;
5271                 while (mat) {
5272                         if (SCTP_BUF_IS_EXTENDED(mat)) {
5273                                 sctp_log_mb(mat, SCTP_MBUF_INPUT);
5274                         }
5275                         mat = SCTP_BUF_NEXT(mat);
5276                 }
5277         }
5278 #endif
5279 #ifdef  SCTP_PACKET_LOGGING
5280         if (sctp_logging_level & SCTP_LAST_PACKET_TRACING)
5281                 sctp_packet_log(m, mlen);
5282 #endif
5283         /*
5284          * Must take out the iphlen, since mlen expects this (only effect lb
5285          * case)
5286          */
5287         mlen -= iphlen;
5288
5289         /*
5290          * Get IP, SCTP, and first chunk header together in first mbuf.
5291          */
5292         ip = mtod(m, struct ip *);
5293         offset = iphlen + sizeof(*sh) + sizeof(*ch);
5294         if (SCTP_BUF_LEN(m) < offset) {
5295                 if ((m = m_pullup(m, offset)) == 0) {
5296                         SCTP_STAT_INCR(sctps_hdrops);
5297                         return;
5298                 }
5299                 ip = mtod(m, struct ip *);
5300         }
5301         sh = (struct sctphdr *)((caddr_t)ip + iphlen);
5302         ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh));
5303         SCTPDBG(SCTP_DEBUG_INPUT1,
5304             "sctp_input() length:%d iphlen:%d\n", mlen, iphlen);
5305
5306         /* SCTP does not allow broadcasts or multicasts */
5307         if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
5308                 goto bad;
5309         }
5310         if (SCTP_IS_IT_BROADCAST(ip->ip_dst, m)) {
5311                 /*
5312                  * We only look at broadcast if its a front state, All
5313                  * others we will not have a tcb for anyway.
5314                  */
5315                 goto bad;
5316         }
5317         /* validate SCTP checksum */
5318         check = sh->checksum;   /* save incoming checksum */
5319         if ((check == 0) && (sctp_no_csum_on_loopback) &&
5320             ((ip->ip_src.s_addr == ip->ip_dst.s_addr) ||
5321             (SCTP_IS_IT_LOOPBACK(m)))
5322             ) {
5323                 goto sctp_skip_csum_4;
5324         }
5325         sh->checksum = 0;       /* prepare for calc */
5326         calc_check = sctp_calculate_sum(m, &mlen, iphlen);
5327         if (calc_check != check) {
5328                 SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
5329                     calc_check, check, m, mlen, iphlen);
5330
5331                 stcb = sctp_findassociation_addr(m, iphlen,
5332                     offset - sizeof(*ch),
5333                     sh, ch, &inp, &net,
5334                     vrf_id);
5335                 if ((net) && (port)) {
5336                         if (net->port == 0) {
5337                                 sctp_pathmtu_adjustment(inp, stcb, net, net->mtu - sizeof(struct udphdr));
5338                         }
5339                         net->port = port;
5340                 }
5341                 if ((inp) && (stcb)) {
5342                         sctp_send_packet_dropped(stcb, net, m, iphlen, 1);
5343                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5344                 } else if ((inp != NULL) && (stcb == NULL)) {
5345                         refcount_up = 1;
5346                 }
5347                 SCTP_STAT_INCR(sctps_badsum);
5348                 SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5349                 goto bad;
5350         }
5351         sh->checksum = calc_check;
5352 sctp_skip_csum_4:
5353         /* destination port of 0 is illegal, based on RFC2960. */
5354         if (sh->dest_port == 0) {
5355                 SCTP_STAT_INCR(sctps_hdrops);
5356                 goto bad;
5357         }
5358         /* validate mbuf chain length with IP payload length */
5359         if (mlen < (ip->ip_len - iphlen)) {
5360                 SCTP_STAT_INCR(sctps_hdrops);
5361                 goto bad;
5362         }
5363         /*
5364          * Locate pcb and tcb for datagram sctp_findassociation_addr() wants
5365          * IP/SCTP/first chunk header...
5366          */
5367         stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
5368             sh, ch, &inp, &net, vrf_id);
5369         if ((net) && (port)) {
5370                 if (net->port == 0) {
5371                         sctp_pathmtu_adjustment(inp, stcb, net, net->mtu - sizeof(struct udphdr));
5372                 }
5373                 net->port = port;
5374         }
5375         /* inp's ref-count increased && stcb locked */
5376         if (inp == NULL) {
5377                 struct sctp_init_chunk *init_chk, chunk_buf;
5378
5379                 SCTP_STAT_INCR(sctps_noport);
5380 #ifdef ICMP_BANDLIM
5381                 /*
5382                  * we use the bandwidth limiting to protect against sending
5383                  * too many ABORTS all at once. In this case these count the
5384                  * same as an ICMP message.
5385                  */
5386                 if (badport_bandlim(0) < 0)
5387                         goto bad;
5388 #endif                          /* ICMP_BANDLIM */
5389                 SCTPDBG(SCTP_DEBUG_INPUT1,
5390                     "Sending a ABORT from packet entry!\n");
5391                 if (ch->chunk_type == SCTP_INITIATION) {
5392                         /*
5393                          * we do a trick here to get the INIT tag, dig in
5394                          * and get the tag from the INIT and put it in the
5395                          * common header.
5396                          */
5397                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
5398                             iphlen + sizeof(*sh), sizeof(*init_chk),
5399                             (uint8_t *) & chunk_buf);
5400                         if (init_chk != NULL)
5401                                 sh->v_tag = init_chk->init.initiate_tag;
5402                 }
5403                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5404                         sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id, port);
5405                         goto bad;
5406                 }
5407                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5408                         goto bad;
5409                 }
5410                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION)
5411                         sctp_send_abort(m, iphlen, sh, 0, NULL, vrf_id, port);
5412                 goto bad;
5413         } else if (stcb == NULL) {
5414                 refcount_up = 1;
5415         }
5416 #ifdef IPSEC
5417         /*
5418          * I very much doubt any of the IPSEC stuff will work but I have no
5419          * idea, so I will leave it in place.
5420          */
5421         if (inp && ipsec4_in_reject(m, &inp->ip_inp.inp)) {
5422                 ipsec4stat.in_polvio++;
5423                 SCTP_STAT_INCR(sctps_hdrops);
5424                 goto bad;
5425         }
5426 #endif                          /* IPSEC */
5427
5428         /*
5429          * common chunk processing
5430          */
5431         length = ip->ip_len + iphlen;
5432         offset -= sizeof(struct sctp_chunkhdr);
5433
5434         ecn_bits = ip->ip_tos;
5435
5436         /* sa_ignore NO_NULL_CHK */
5437         sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
5438             inp, stcb, net, ecn_bits, vrf_id, port);
5439         /* inp's ref-count reduced && stcb unlocked */
5440         if (m) {
5441                 sctp_m_freem(m);
5442         }
5443         if ((inp) && (refcount_up)) {
5444                 /* reduce ref-count */
5445                 SCTP_INP_DECR_REF(inp);
5446         }
5447         return;
5448 bad:
5449         if (stcb) {
5450                 SCTP_TCB_UNLOCK(stcb);
5451         }
5452         if ((inp) && (refcount_up)) {
5453                 /* reduce ref-count */
5454                 SCTP_INP_DECR_REF(inp);
5455         }
5456         if (m) {
5457                 sctp_m_freem(m);
5458         }
5459         return;
5460 }
5461 void
5462 sctp_input(i_pak, off)
5463         struct mbuf *i_pak;
5464         int off;
5465 {
5466         sctp_input_with_port(i_pak, off, 0);
5467 }