sys/netinet/sctp_input.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_input.h>
  44 #include <netinet/sctp_auth.h>
  45 #include <netinet/sctp_indata.h>
  46 #include <netinet/sctp_asconf.h>
  47 #include <netinet/sctp_bsd_addr.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/sctp_crc32.h>
  50 #include <netinet/udp.h>
  51 #include <sys/smp.h>
  52
  53
  54
  55 static void
  56 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
  57 {
  58         struct sctp_nets *net;
  59
  60         /*
  61          * This now not only stops all cookie timers it also stops any INIT
  62          * timers as well. This will make sure that the timers are stopped
  63          * in all collision cases.
  64          */
  65         SCTP_TCB_LOCK_ASSERT(stcb);
  66         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  67                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
  68                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
  69                             stcb->sctp_ep,
  70                             stcb,
  71                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
  72                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
  73                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
  74                             stcb->sctp_ep,
  75                             stcb,
  76                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
  77                 }
  78         }
  79 }
  80
  81 /* INIT handler */
  82 static void
  83 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
  84     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
  85     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
  86     struct sctp_tcb *stcb, int *abort_no_unlock,
  87     uint8_t use_mflowid, uint32_t mflowid,
  88     uint32_t vrf_id, uint16_t port)
  89 {
  90         struct sctp_init *init;
  91         struct mbuf *op_err;
  92
  93         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
  94             (void *)stcb);
  95         if (stcb == NULL) {
  96                 SCTP_INP_RLOCK(inp);
  97         }
  98         /* validate length */
  99         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
 100                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 101                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 102                     use_mflowid, mflowid,
 103                     vrf_id, port);
 104                 if (stcb)
 105                         *abort_no_unlock = 1;
 106                 goto outnow;
 107         }
 108         /* validate parameters */
 109         init = &cp->init;
 110         if (init->initiate_tag == 0) {
 111                 /* protocol error... send abort */
 112                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 113                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 114                     use_mflowid, mflowid,
 115                     vrf_id, port);
 116                 if (stcb)
 117                         *abort_no_unlock = 1;
 118                 goto outnow;
 119         }
 120         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
 121                 /* invalid parameter... send abort */
 122                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 123                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 124                     use_mflowid, mflowid,
 125                     vrf_id, port);
 126                 if (stcb)
 127                         *abort_no_unlock = 1;
 128                 goto outnow;
 129         }
 130         if (init->num_inbound_streams == 0) {
 131                 /* protocol error... send abort */
 132                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 133                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 134                     use_mflowid, mflowid,
 135                     vrf_id, port);
 136                 if (stcb)
 137                         *abort_no_unlock = 1;
 138                 goto outnow;
 139         }
 140         if (init->num_outbound_streams == 0) {
 141                 /* protocol error... send abort */
 142                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
 143                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 144                     use_mflowid, mflowid,
 145                     vrf_id, port);
 146                 if (stcb)
 147                         *abort_no_unlock = 1;
 148                 goto outnow;
 149         }
 150         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
 151             offset + ntohs(cp->ch.chunk_length))) {
 152                 /* auth parameter(s) error... send abort */
 153                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, NULL,
 154                     use_mflowid, mflowid,
 155                     vrf_id, port);
 156                 if (stcb)
 157                         *abort_no_unlock = 1;
 158                 goto outnow;
 159         }
 160         /*
 161          * We are only accepting if we have a socket with positive
 162          * so_qlimit.
 163          */
 164         if ((stcb == NULL) &&
 165             ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 166             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
 167             (inp->sctp_socket == NULL) ||
 168             (inp->sctp_socket->so_qlimit == 0))) {
 169                 /*
 170                  * FIX ME ?? What about TCP model and we have a
 171                  * match/restart case? Actually no fix is needed. the lookup
 172                  * will always find the existing assoc so stcb would not be
 173                  * NULL. It may be questionable to do this since we COULD
 174                  * just send back the INIT-ACK and hope that the app did
 175                  * accept()'s by the time the COOKIE was sent. But there is
 176                  * a price to pay for COOKIE generation and I don't want to
 177                  * pay it on the chance that the app will actually do some
 178                  * accepts(). The App just looses and should NOT be in this
 179                  * state :-)
 180                  */
 181                 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
 182                         sctp_send_abort(m, iphlen, src, dst, sh, 0, NULL,
 183                             use_mflowid, mflowid,
 184                             vrf_id, port);
 185                 }
 186                 goto outnow;
 187         }
 188         if ((stcb != NULL) &&
 189             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 190                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
 191                 sctp_send_shutdown_ack(stcb, NULL);
 192                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 193         } else {
 194                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
 195                 sctp_send_initiate_ack(inp, stcb, m, iphlen, offset, src, dst,
 196                     sh, cp,
 197                     use_mflowid, mflowid,
 198                     vrf_id, port,
 199                     ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
 200         }
 201 outnow:
 202         if (stcb == NULL) {
 203                 SCTP_INP_RUNLOCK(inp);
 204         }
 205 }
 206
 207 /*
 208  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
 209  */
 210
 211 int
 212 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
 213 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
 214     SCTP_UNUSED
 215 #endif
 216 )
 217 {
 218         int unsent_data = 0;
 219         unsigned int i;
 220         struct sctp_stream_queue_pending *sp;
 221         struct sctp_association *asoc;
 222
 223         /*
 224          * This function returns the number of streams that have true unsent
 225          * data on them. Note that as it looks through it will clean up any
 226          * places that have old data that has been sent but left at top of
 227          * stream queue.
 228          */
 229         asoc = &stcb->asoc;
 230         SCTP_TCB_SEND_LOCK(stcb);
 231         if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 232                 /* Check to see if some data queued */
 233                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 234                         /* sa_ignore FREED_MEMORY */
 235                         sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
 236                         if (sp == NULL) {
 237                                 continue;
 238                         }
 239                         if ((sp->msg_is_complete) &&
 240                             (sp->length == 0) &&
 241                             (sp->sender_all_done)) {
 242                                 /*
 243                                  * We are doing differed cleanup. Last time
 244                                  * through when we took all the data the
 245                                  * sender_all_done was not set.
 246                                  */
 247                                 if (sp->put_last_out == 0) {
 248                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
 249                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
 250                                             sp->sender_all_done,
 251                                             sp->length,
 252                                             sp->msg_is_complete,
 253                                             sp->put_last_out);
 254                                 }
 255                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
 256                                 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
 257                                 if (sp->net) {
 258                                         sctp_free_remote_addr(sp->net);
 259                                         sp->net = NULL;
 260                                 }
 261                                 if (sp->data) {
 262                                         sctp_m_freem(sp->data);
 263                                         sp->data = NULL;
 264                                 }
 265                                 sctp_free_a_strmoq(stcb, sp, so_locked);
 266                         } else {
 267                                 unsent_data++;
 268                                 break;
 269                         }
 270                 }
 271         }
 272         SCTP_TCB_SEND_UNLOCK(stcb);
 273         return (unsent_data);
 274 }
 275
 276 static int
 277 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
 278 {
 279         struct sctp_init *init;
 280         struct sctp_association *asoc;
 281         struct sctp_nets *lnet;
 282         unsigned int i;
 283
 284         init = &cp->init;
 285         asoc = &stcb->asoc;
 286         /* save off parameters */
 287         asoc->peer_vtag = ntohl(init->initiate_tag);
 288         asoc->peers_rwnd = ntohl(init->a_rwnd);
 289         /* init tsn's */
 290         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
 291
 292         if (!TAILQ_EMPTY(&asoc->nets)) {
 293                 /* update any ssthresh's that may have a default */
 294                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
 295                         lnet->ssthresh = asoc->peers_rwnd;
 296                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
 297                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
 298                         }
 299                 }
 300         }
 301         SCTP_TCB_SEND_LOCK(stcb);
 302         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
 303                 unsigned int newcnt;
 304                 struct sctp_stream_out *outs;
 305                 struct sctp_stream_queue_pending *sp, *nsp;
 306                 struct sctp_tmit_chunk *chk, *nchk;
 307
 308                 /* abandon the upper streams */
 309                 newcnt = ntohs(init->num_inbound_streams);
 310                 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
 311                         if (chk->rec.data.stream_number >= newcnt) {
 312                                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
 313                                 asoc->send_queue_cnt--;
 314                                 if (chk->data != NULL) {
 315                                         sctp_free_bufspace(stcb, asoc, chk, 1);
 316                                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
 317                                             0, chk, SCTP_SO_NOT_LOCKED);
 318                                         if (chk->data) {
 319                                                 sctp_m_freem(chk->data);
 320                                                 chk->data = NULL;
 321                                         }
 322                                 }
 323                                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 324                                 /* sa_ignore FREED_MEMORY */
 325                         }
 326                 }
 327                 if (asoc->strmout) {
 328                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
 329                                 outs = &asoc->strmout[i];
 330                                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
 331                                         TAILQ_REMOVE(&outs->outqueue, sp, next);
 332                                         asoc->stream_queue_cnt--;
 333                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
 334                                             stcb, 0, sp, SCTP_SO_NOT_LOCKED);
 335                                         if (sp->data) {
 336                                                 sctp_m_freem(sp->data);
 337                                                 sp->data = NULL;
 338                                         }
 339                                         if (sp->net) {
 340                                                 sctp_free_remote_addr(sp->net);
 341                                                 sp->net = NULL;
 342                                         }
 343                                         /* Free the chunk */
 344                                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
 345                                         /* sa_ignore FREED_MEMORY */
 346                                 }
 347                         }
 348                 }
 349                 /* cut back the count */
 350                 asoc->pre_open_streams = newcnt;
 351         }
 352         SCTP_TCB_SEND_UNLOCK(stcb);
 353         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams;
 354
 355         /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
 356         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
 357         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 358                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 359         }
 360         /* This is the next one we expect */
 361         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
 362
 363         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
 364         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
 365
 366         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 367         /* open the requested streams */
 368
 369         if (asoc->strmin != NULL) {
 370                 /* Free the old ones */
 371                 struct sctp_queued_to_read *ctl, *nctl;
 372
 373                 for (i = 0; i < asoc->streamincnt; i++) {
 374                         TAILQ_FOREACH_SAFE(ctl, &asoc->strmin[i].inqueue, next, nctl) {
 375                                 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
 376                                 sctp_free_remote_addr(ctl->whoFrom);
 377                                 ctl->whoFrom = NULL;
 378                                 sctp_m_freem(ctl->data);
 379                                 ctl->data = NULL;
 380                                 sctp_free_a_readq(stcb, ctl);
 381                         }
 382                 }
 383                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
 384         }
 385         asoc->streamincnt = ntohs(init->num_outbound_streams);
 386         if (asoc->streamincnt > MAX_SCTP_STREAMS) {
 387                 asoc->streamincnt = MAX_SCTP_STREAMS;
 388         }
 389         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
 390             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
 391         if (asoc->strmin == NULL) {
 392                 /* we didn't get memory for the streams! */
 393                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
 394                 return (-1);
 395         }
 396         for (i = 0; i < asoc->streamincnt; i++) {
 397                 asoc->strmin[i].stream_no = i;
 398                 asoc->strmin[i].last_sequence_delivered = 0xffff;
 399                 /*
 400                  * U-stream ranges will be set when the cookie is unpacked.
 401                  * Or for the INIT sender they are un set (if pr-sctp not
 402                  * supported) when the INIT-ACK arrives.
 403                  */
 404                 TAILQ_INIT(&asoc->strmin[i].inqueue);
 405                 asoc->strmin[i].delivery_started = 0;
 406         }
 407         /*
 408          * load_address_from_init will put the addresses into the
 409          * association when the COOKIE is processed or the INIT-ACK is
 410          * processed. Both types of COOKIE's existing and new call this
 411          * routine. It will remove addresses that are no longer in the
 412          * association (for the restarting case where addresses are
 413          * removed). Up front when the INIT arrives we will discard it if it
 414          * is a restart and new addresses have been added.
 415          */
 416         /* sa_ignore MEMLEAK */
 417         return (0);
 418 }
 419
 420 /*
 421  * INIT-ACK message processing/consumption returns value < 0 on error
 422  */
 423 static int
 424 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
 425     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
 426     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 427     struct sctp_nets *net, int *abort_no_unlock,
 428     uint8_t use_mflowid, uint32_t mflowid,
 429     uint32_t vrf_id)
 430 {
 431         struct sctp_association *asoc;
 432         struct mbuf *op_err;
 433         int retval, abort_flag;
 434         uint32_t initack_limit;
 435         int nat_friendly = 0;
 436
 437         /* First verify that we have no illegal param's */
 438         abort_flag = 0;
 439         op_err = NULL;
 440
 441         op_err = sctp_arethere_unrecognized_parameters(m,
 442             (offset + sizeof(struct sctp_init_chunk)),
 443             &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
 444         if (abort_flag) {
 445                 /* Send an abort and notify peer */
 446                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 447                 *abort_no_unlock = 1;
 448                 return (-1);
 449         }
 450         asoc = &stcb->asoc;
 451         asoc->peer_supports_nat = (uint8_t) nat_friendly;
 452         /* process the peer's parameters in the INIT-ACK */
 453         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
 454         if (retval < 0) {
 455                 return (retval);
 456         }
 457         initack_limit = offset + ntohs(cp->ch.chunk_length);
 458         /* load all addresses */
 459         if ((retval = sctp_load_addresses_from_init(stcb, m,
 460             (offset + sizeof(struct sctp_init_chunk)), initack_limit,
 461             src, dst, NULL))) {
 462                 /* Huh, we should abort */
 463                 SCTPDBG(SCTP_DEBUG_INPUT1,
 464                     "Load addresses from INIT causes an abort %d\n",
 465                     retval);
 466                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 467                     src, dst, sh, NULL,
 468                     use_mflowid, mflowid,
 469                     vrf_id, net->port);
 470                 *abort_no_unlock = 1;
 471                 return (-1);
 472         }
 473         /* if the peer doesn't support asconf, flush the asconf queue */
 474         if (asoc->peer_supports_asconf == 0) {
 475                 struct sctp_asconf_addr *param, *nparam;
 476
 477                 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
 478                         TAILQ_REMOVE(&asoc->asconf_queue, param, next);
 479                         SCTP_FREE(param, SCTP_M_ASC_ADDR);
 480                 }
 481         }
 482         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
 483             stcb->asoc.local_hmacs);
 484         if (op_err) {
 485                 sctp_queue_op_err(stcb, op_err);
 486                 /* queuing will steal away the mbuf chain to the out queue */
 487                 op_err = NULL;
 488         }
 489         /* extract the cookie and queue it to "echo" it back... */
 490         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 491                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 492                     stcb->asoc.overall_error_count,
 493                     0,
 494                     SCTP_FROM_SCTP_INPUT,
 495                     __LINE__);
 496         }
 497         stcb->asoc.overall_error_count = 0;
 498         net->error_count = 0;
 499
 500         /*
 501          * Cancel the INIT timer, We do this first before queueing the
 502          * cookie. We always cancel at the primary to assue that we are
 503          * canceling the timer started by the INIT which always goes to the
 504          * primary.
 505          */
 506         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
 507             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
 508
 509         /* calculate the RTO */
 510         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
 511             SCTP_RTT_FROM_NON_DATA);
 512
 513         retval = sctp_send_cookie_echo(m, offset, stcb, net);
 514         if (retval < 0) {
 515                 /*
 516                  * No cookie, we probably should send a op error. But in any
 517                  * case if there is no cookie in the INIT-ACK, we can
 518                  * abandon the peer, its broke.
 519                  */
 520                 if (retval == -3) {
 521                         /* We abort with an error of missing mandatory param */
 522                         op_err =
 523                             sctp_generate_invmanparam(SCTP_CAUSE_MISSING_PARAM);
 524                         if (op_err) {
 525                                 /*
 526                                  * Expand beyond to include the mandatory
 527                                  * param cookie
 528                                  */
 529                                 struct sctp_inv_mandatory_param *mp;
 530
 531                                 SCTP_BUF_LEN(op_err) =
 532                                     sizeof(struct sctp_inv_mandatory_param);
 533                                 mp = mtod(op_err,
 534                                     struct sctp_inv_mandatory_param *);
 535                                 /* Subtract the reserved param */
 536                                 mp->length =
 537                                     htons(sizeof(struct sctp_inv_mandatory_param) - 2);
 538                                 mp->num_param = htonl(1);
 539                                 mp->param = htons(SCTP_STATE_COOKIE);
 540                                 mp->resv = 0;
 541                         }
 542                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 543                             src, dst, sh, op_err,
 544                             use_mflowid, mflowid,
 545                             vrf_id, net->port);
 546                         *abort_no_unlock = 1;
 547                 }
 548                 return (retval);
 549         }
 550         return (0);
 551 }
 552
 553 static void
 554 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
 555     struct sctp_tcb *stcb, struct sctp_nets *net)
 556 {
 557         struct sockaddr_storage store;
 558         struct sctp_nets *r_net, *f_net;
 559         struct timeval tv;
 560         int req_prim = 0;
 561         uint16_t old_error_counter;
 562
 563 #ifdef INET
 564         struct sockaddr_in *sin;
 565
 566 #endif
 567 #ifdef INET6
 568         struct sockaddr_in6 *sin6;
 569
 570 #endif
 571
 572         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
 573                 /* Invalid length */
 574                 return;
 575         }
 576         memset(&store, 0, sizeof(store));
 577         switch (cp->heartbeat.hb_info.addr_family) {
 578 #ifdef INET
 579         case AF_INET:
 580                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
 581                         sin = (struct sockaddr_in *)&store;
 582                         sin->sin_family = cp->heartbeat.hb_info.addr_family;
 583                         sin->sin_len = cp->heartbeat.hb_info.addr_len;
 584                         sin->sin_port = stcb->rport;
 585                         memcpy(&sin->sin_addr, cp->heartbeat.hb_info.address,
 586                             sizeof(sin->sin_addr));
 587                 } else {
 588                         return;
 589                 }
 590                 break;
 591 #endif
 592 #ifdef INET6
 593         case AF_INET6:
 594                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
 595                         sin6 = (struct sockaddr_in6 *)&store;
 596                         sin6->sin6_family = cp->heartbeat.hb_info.addr_family;
 597                         sin6->sin6_len = cp->heartbeat.hb_info.addr_len;
 598                         sin6->sin6_port = stcb->rport;
 599                         memcpy(&sin6->sin6_addr, cp->heartbeat.hb_info.address,
 600                             sizeof(sin6->sin6_addr));
 601                 } else {
 602                         return;
 603                 }
 604                 break;
 605 #endif
 606         default:
 607                 return;
 608         }
 609         r_net = sctp_findnet(stcb, (struct sockaddr *)&store);
 610         if (r_net == NULL) {
 611                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
 612                 return;
 613         }
 614         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
 615             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
 616             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
 617                 /*
 618                  * If the its a HB and it's random value is correct when can
 619                  * confirm the destination.
 620                  */
 621                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 622                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
 623                         stcb->asoc.primary_destination = r_net;
 624                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
 625                         f_net = TAILQ_FIRST(&stcb->asoc.nets);
 626                         if (f_net != r_net) {
 627                                 /*
 628                                  * first one on the list is NOT the primary
 629                                  * sctp_cmpaddr() is much more efficent if
 630                                  * the primary is the first on the list,
 631                                  * make it so.
 632                                  */
 633                                 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
 634                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
 635                         }
 636                         req_prim = 1;
 637                 }
 638                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 639                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 640                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
 641                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
 642         }
 643         old_error_counter = r_net->error_count;
 644         r_net->error_count = 0;
 645         r_net->hb_responded = 1;
 646         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
 647         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
 648         /* Now lets do a RTO with this */
 649         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
 650             SCTP_RTT_FROM_NON_DATA);
 651         if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
 652                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
 653                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
 654                     0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 655         }
 656         if (r_net->dest_state & SCTP_ADDR_PF) {
 657                 r_net->dest_state &= ~SCTP_ADDR_PF;
 658                 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
 659         }
 660         if (old_error_counter > 0) {
 661                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
 662                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
 663         }
 664         if (r_net == stcb->asoc.primary_destination) {
 665                 if (stcb->asoc.alternate) {
 666                         /* release the alternate, primary is good */
 667                         sctp_free_remote_addr(stcb->asoc.alternate);
 668                         stcb->asoc.alternate = NULL;
 669                 }
 670         }
 671         /* Mobility adaptation */
 672         if (req_prim) {
 673                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 674                     SCTP_MOBILITY_BASE) ||
 675                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 676                     SCTP_MOBILITY_FASTHANDOFF)) &&
 677                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 678                     SCTP_MOBILITY_PRIM_DELETED)) {
 679
 680                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 681                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 682                             SCTP_MOBILITY_FASTHANDOFF)) {
 683                                 sctp_assoc_immediate_retrans(stcb,
 684                                     stcb->asoc.primary_destination);
 685                         }
 686                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 687                             SCTP_MOBILITY_BASE)) {
 688                                 sctp_move_chunks_from_net(stcb,
 689                                     stcb->asoc.deleted_primary);
 690                         }
 691                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 692                             stcb->asoc.deleted_primary);
 693                 }
 694         }
 695 }
 696
 697 static int
 698 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
 699 {
 700         /*
 701          * return 0 means we want you to proceed with the abort non-zero
 702          * means no abort processing
 703          */
 704         struct sctpasochead *head;
 705
 706         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
 707                 /* generate a new vtag and send init */
 708                 LIST_REMOVE(stcb, sctp_asocs);
 709                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 710                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
 711                 /*
 712                  * put it in the bucket in the vtag hash of assoc's for the
 713                  * system
 714                  */
 715                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 716                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 717                 return (1);
 718         }
 719         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
 720                 /*
 721                  * treat like a case where the cookie expired i.e.: - dump
 722                  * current cookie. - generate a new vtag. - resend init.
 723                  */
 724                 /* generate a new vtag and send init */
 725                 LIST_REMOVE(stcb, sctp_asocs);
 726                 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
 727                 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
 728                 sctp_stop_all_cookie_timers(stcb);
 729                 sctp_toss_old_cookies(stcb, &stcb->asoc);
 730                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 731                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
 732                 /*
 733                  * put it in the bucket in the vtag hash of assoc's for the
 734                  * system
 735                  */
 736                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 737                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 738                 return (1);
 739         }
 740         return (0);
 741 }
 742
 743 static int
 744 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
 745     struct sctp_nets *net)
 746 {
 747         /*
 748          * return 0 means we want you to proceed with the abort non-zero
 749          * means no abort processing
 750          */
 751         if (stcb->asoc.peer_supports_auth == 0) {
 752                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
 753                 return (0);
 754         }
 755         sctp_asconf_send_nat_state_update(stcb, net);
 756         return (1);
 757 }
 758
 759
 760 static void
 761 sctp_handle_abort(struct sctp_abort_chunk *abort,
 762     struct sctp_tcb *stcb, struct sctp_nets *net)
 763 {
 764 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 765         struct socket *so;
 766
 767 #endif
 768         uint16_t len;
 769         uint16_t error;
 770
 771         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
 772         if (stcb == NULL)
 773                 return;
 774
 775         len = ntohs(abort->ch.chunk_length);
 776         if (len > sizeof(struct sctp_chunkhdr)) {
 777                 /*
 778                  * Need to check the cause codes for our two magic nat
 779                  * aborts which don't kill the assoc necessarily.
 780                  */
 781                 struct sctp_missing_nat_state *natc;
 782
 783                 natc = (struct sctp_missing_nat_state *)(abort + 1);
 784                 error = ntohs(natc->cause);
 785                 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
 786                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
 787                             abort->ch.chunk_flags);
 788                         if (sctp_handle_nat_colliding_state(stcb)) {
 789                                 return;
 790                         }
 791                 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
 792                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
 793                             abort->ch.chunk_flags);
 794                         if (sctp_handle_nat_missing_state(stcb, net)) {
 795                                 return;
 796                         }
 797                 }
 798         } else {
 799                 error = 0;
 800         }
 801         /* stop any receive timers */
 802         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
 803         /* notify user of the abort and clean up... */
 804         sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
 805         /* free the tcb */
 806         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
 807         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 808             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 809                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 810         }
 811 #ifdef SCTP_ASOCLOG_OF_TSNS
 812         sctp_print_out_track_log(stcb);
 813 #endif
 814 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 815         so = SCTP_INP_SO(stcb->sctp_ep);
 816         atomic_add_int(&stcb->asoc.refcnt, 1);
 817         SCTP_TCB_UNLOCK(stcb);
 818         SCTP_SOCKET_LOCK(so, 1);
 819         SCTP_TCB_LOCK(stcb);
 820         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 821 #endif
 822         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
 823         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 824             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
 825 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 826         SCTP_SOCKET_UNLOCK(so, 1);
 827 #endif
 828         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
 829 }
 830
 831 static void
 832 sctp_start_net_timers(struct sctp_tcb *stcb)
 833 {
 834         uint32_t cnt_hb_sent;
 835         struct sctp_nets *net;
 836
 837         cnt_hb_sent = 0;
 838         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 839                 /*
 840                  * For each network start: 1) A pmtu timer. 2) A HB timer 3)
 841                  * If the dest in unconfirmed send a hb as well if under
 842                  * max_hb_burst have been sent.
 843                  */
 844                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 845                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
 846                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
 847                     (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
 848                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 849                         cnt_hb_sent++;
 850                 }
 851         }
 852         if (cnt_hb_sent) {
 853                 sctp_chunk_output(stcb->sctp_ep, stcb,
 854                     SCTP_OUTPUT_FROM_COOKIE_ACK,
 855                     SCTP_SO_NOT_LOCKED);
 856         }
 857 }
 858
 859
 860 static void
 861 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
 862     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
 863 {
 864         struct sctp_association *asoc;
 865         int some_on_streamwheel;
 866
 867 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 868         struct socket *so;
 869
 870 #endif
 871
 872         SCTPDBG(SCTP_DEBUG_INPUT2,
 873             "sctp_handle_shutdown: handling SHUTDOWN\n");
 874         if (stcb == NULL)
 875                 return;
 876         asoc = &stcb->asoc;
 877         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
 878             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 879                 return;
 880         }
 881         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
 882                 /* Shutdown NOT the expected size */
 883                 return;
 884         } else {
 885                 sctp_update_acked(stcb, cp, abort_flag);
 886                 if (*abort_flag) {
 887                         return;
 888                 }
 889         }
 890         if (asoc->control_pdapi) {
 891                 /*
 892                  * With a normal shutdown we assume the end of last record.
 893                  */
 894                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
 895                 asoc->control_pdapi->end_added = 1;
 896                 asoc->control_pdapi->pdapi_aborted = 1;
 897                 asoc->control_pdapi = NULL;
 898                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 899 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 900                 so = SCTP_INP_SO(stcb->sctp_ep);
 901                 atomic_add_int(&stcb->asoc.refcnt, 1);
 902                 SCTP_TCB_UNLOCK(stcb);
 903                 SCTP_SOCKET_LOCK(so, 1);
 904                 SCTP_TCB_LOCK(stcb);
 905                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 906                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 907                         /* assoc was freed while we were unlocked */
 908                         SCTP_SOCKET_UNLOCK(so, 1);
 909                         return;
 910                 }
 911 #endif
 912                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 913 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 914                 SCTP_SOCKET_UNLOCK(so, 1);
 915 #endif
 916         }
 917         /* goto SHUTDOWN_RECEIVED state to block new requests */
 918         if (stcb->sctp_socket) {
 919                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 920                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
 921                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 922                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
 923                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 924                         /*
 925                          * notify upper layer that peer has initiated a
 926                          * shutdown
 927                          */
 928                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 929
 930                         /* reset time */
 931                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 932                 }
 933         }
 934         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
 935                 /*
 936                  * stop the shutdown timer, since we WILL move to
 937                  * SHUTDOWN-ACK-SENT.
 938                  */
 939                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
 940         }
 941         /* Now is there unsent data on a stream somewhere? */
 942         some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
 943
 944         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 945             !TAILQ_EMPTY(&asoc->sent_queue) ||
 946             some_on_streamwheel) {
 947                 /* By returning we will push more data out */
 948                 return;
 949         } else {
 950                 /* no outstanding data to send, so move on... */
 951                 /* send SHUTDOWN-ACK */
 952                 sctp_send_shutdown_ack(stcb, net);
 953                 /* move to SHUTDOWN-ACK-SENT state */
 954                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
 955                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 956                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 957                 }
 958                 SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
 959                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 960                 sctp_stop_timers_for_shutdown(stcb);
 961                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep,
 962                     stcb, net);
 963         }
 964 }
 965
 966 static void
 967 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
 968     struct sctp_tcb *stcb,
 969     struct sctp_nets *net)
 970 {
 971         struct sctp_association *asoc;
 972
 973 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 974         struct socket *so;
 975
 976         so = SCTP_INP_SO(stcb->sctp_ep);
 977 #endif
 978         SCTPDBG(SCTP_DEBUG_INPUT2,
 979             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
 980         if (stcb == NULL)
 981                 return;
 982
 983         asoc = &stcb->asoc;
 984         /* process according to association state */
 985         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
 986             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 987                 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
 988                 sctp_send_shutdown_complete(stcb, net, 1);
 989                 SCTP_TCB_UNLOCK(stcb);
 990                 return;
 991         }
 992         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
 993             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 994                 /* unexpected SHUTDOWN-ACK... so ignore... */
 995                 SCTP_TCB_UNLOCK(stcb);
 996                 return;
 997         }
 998         if (asoc->control_pdapi) {
 999                 /*
1000                  * With a normal shutdown we assume the end of last record.
1001                  */
1002                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
1003                 asoc->control_pdapi->end_added = 1;
1004                 asoc->control_pdapi->pdapi_aborted = 1;
1005                 asoc->control_pdapi = NULL;
1006                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1007 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1008                 atomic_add_int(&stcb->asoc.refcnt, 1);
1009                 SCTP_TCB_UNLOCK(stcb);
1010                 SCTP_SOCKET_LOCK(so, 1);
1011                 SCTP_TCB_LOCK(stcb);
1012                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1013                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1014                         /* assoc was freed while we were unlocked */
1015                         SCTP_SOCKET_UNLOCK(so, 1);
1016                         return;
1017                 }
1018 #endif
1019                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1020 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1021                 SCTP_SOCKET_UNLOCK(so, 1);
1022 #endif
1023         }
1024         /* are the queues empty? */
1025         if (!TAILQ_EMPTY(&asoc->send_queue) ||
1026             !TAILQ_EMPTY(&asoc->sent_queue) ||
1027             !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
1028                 sctp_report_all_outbound(stcb, 0, 0, SCTP_SO_NOT_LOCKED);
1029         }
1030         /* stop the timer */
1031         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
1032         /* send SHUTDOWN-COMPLETE */
1033         sctp_send_shutdown_complete(stcb, net, 0);
1034         /* notify upper layer protocol */
1035         if (stcb->sctp_socket) {
1036                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1037                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1038                         stcb->sctp_socket->so_snd.sb_cc = 0;
1039                 }
1040                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1041         }
1042         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
1043         /* free the TCB but first save off the ep */
1044 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1045         atomic_add_int(&stcb->asoc.refcnt, 1);
1046         SCTP_TCB_UNLOCK(stcb);
1047         SCTP_SOCKET_LOCK(so, 1);
1048         SCTP_TCB_LOCK(stcb);
1049         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1050 #endif
1051         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1052             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
1053 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1054         SCTP_SOCKET_UNLOCK(so, 1);
1055 #endif
1056 }
1057
1058 /*
1059  * Skip past the param header and then we will find the chunk that caused the
1060  * problem. There are two possiblities ASCONF or FWD-TSN other than that and
1061  * our peer must be broken.
1062  */
1063 static void
1064 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
1065     struct sctp_nets *net)
1066 {
1067         struct sctp_chunkhdr *chk;
1068
1069         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
1070         switch (chk->chunk_type) {
1071         case SCTP_ASCONF_ACK:
1072         case SCTP_ASCONF:
1073                 sctp_asconf_cleanup(stcb, net);
1074                 break;
1075         case SCTP_FORWARD_CUM_TSN:
1076                 stcb->asoc.peer_supports_prsctp = 0;
1077                 break;
1078         default:
1079                 SCTPDBG(SCTP_DEBUG_INPUT2,
1080                     "Peer does not support chunk type %d(%x)??\n",
1081                     chk->chunk_type, (uint32_t) chk->chunk_type);
1082                 break;
1083         }
1084 }
1085
1086 /*
1087  * Skip past the param header and then we will find the param that caused the
1088  * problem.  There are a number of param's in a ASCONF OR the prsctp param
1089  * these will turn of specific features.
1090  */
1091 static void
1092 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
1093 {
1094         struct sctp_paramhdr *pbad;
1095
1096         pbad = phdr + 1;
1097         switch (ntohs(pbad->param_type)) {
1098                 /* pr-sctp draft */
1099         case SCTP_PRSCTP_SUPPORTED:
1100                 stcb->asoc.peer_supports_prsctp = 0;
1101                 break;
1102         case SCTP_SUPPORTED_CHUNK_EXT:
1103                 break;
1104                 /* draft-ietf-tsvwg-addip-sctp */
1105         case SCTP_HAS_NAT_SUPPORT:
1106                 stcb->asoc.peer_supports_nat = 0;
1107                 break;
1108         case SCTP_ADD_IP_ADDRESS:
1109         case SCTP_DEL_IP_ADDRESS:
1110         case SCTP_SET_PRIM_ADDR:
1111                 stcb->asoc.peer_supports_asconf = 0;
1112                 break;
1113         case SCTP_SUCCESS_REPORT:
1114         case SCTP_ERROR_CAUSE_IND:
1115                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
1116                 SCTPDBG(SCTP_DEBUG_INPUT2,
1117                     "Turning off ASCONF to this strange peer\n");
1118                 stcb->asoc.peer_supports_asconf = 0;
1119                 break;
1120         default:
1121                 SCTPDBG(SCTP_DEBUG_INPUT2,
1122                     "Peer does not support param type %d(%x)??\n",
1123                     pbad->param_type, (uint32_t) pbad->param_type);
1124                 break;
1125         }
1126 }
1127
1128 static int
1129 sctp_handle_error(struct sctp_chunkhdr *ch,
1130     struct sctp_tcb *stcb, struct sctp_nets *net)
1131 {
1132         int chklen;
1133         struct sctp_paramhdr *phdr;
1134         uint16_t error, error_type;
1135         uint16_t error_len;
1136         struct sctp_association *asoc;
1137         int adjust;
1138
1139 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1140         struct socket *so;
1141
1142 #endif
1143
1144         /* parse through all of the errors and process */
1145         asoc = &stcb->asoc;
1146         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
1147             sizeof(struct sctp_chunkhdr));
1148         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
1149         error = 0;
1150         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
1151                 /* Process an Error Cause */
1152                 error_type = ntohs(phdr->param_type);
1153                 error_len = ntohs(phdr->param_length);
1154                 if ((error_len > chklen) || (error_len == 0)) {
1155                         /* invalid param length for this param */
1156                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
1157                             chklen, error_len);
1158                         return (0);
1159                 }
1160                 if (error == 0) {
1161                         /* report the first error cause */
1162                         error = error_type;
1163                 }
1164                 switch (error_type) {
1165                 case SCTP_CAUSE_INVALID_STREAM:
1166                 case SCTP_CAUSE_MISSING_PARAM:
1167                 case SCTP_CAUSE_INVALID_PARAM:
1168                 case SCTP_CAUSE_NO_USER_DATA:
1169                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
1170                             error_type);
1171                         break;
1172                 case SCTP_CAUSE_NAT_COLLIDING_STATE:
1173                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
1174                             ch->chunk_flags);
1175                         if (sctp_handle_nat_colliding_state(stcb)) {
1176                                 return (0);
1177                         }
1178                         break;
1179                 case SCTP_CAUSE_NAT_MISSING_STATE:
1180                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
1181                             ch->chunk_flags);
1182                         if (sctp_handle_nat_missing_state(stcb, net)) {
1183                                 return (0);
1184                         }
1185                         break;
1186                 case SCTP_CAUSE_STALE_COOKIE:
1187                         /*
1188                          * We only act if we have echoed a cookie and are
1189                          * waiting.
1190                          */
1191                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
1192                                 int *p;
1193
1194                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
1195                                 /* Save the time doubled */
1196                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
1197                                 asoc->stale_cookie_count++;
1198                                 if (asoc->stale_cookie_count >
1199                                     asoc->max_init_times) {
1200                                         sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
1201                                         /* now free the asoc */
1202 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1203                                         so = SCTP_INP_SO(stcb->sctp_ep);
1204                                         atomic_add_int(&stcb->asoc.refcnt, 1);
1205                                         SCTP_TCB_UNLOCK(stcb);
1206                                         SCTP_SOCKET_LOCK(so, 1);
1207                                         SCTP_TCB_LOCK(stcb);
1208                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1209 #endif
1210                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1211                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1212 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1213                                         SCTP_SOCKET_UNLOCK(so, 1);
1214 #endif
1215                                         return (-1);
1216                                 }
1217                                 /* blast back to INIT state */
1218                                 sctp_toss_old_cookies(stcb, &stcb->asoc);
1219                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
1220                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
1221                                 sctp_stop_all_cookie_timers(stcb);
1222                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1223                         }
1224                         break;
1225                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1226                         /*
1227                          * Nothing we can do here, we don't do hostname
1228                          * addresses so if the peer does not like my IPv6
1229                          * (or IPv4 for that matter) it does not matter. If
1230                          * they don't support that type of address, they can
1231                          * NOT possibly get that packet type... i.e. with no
1232                          * IPv6 you can't recieve a IPv6 packet. so we can
1233                          * safely ignore this one. If we ever added support
1234                          * for HOSTNAME Addresses, then we would need to do
1235                          * something here.
1236                          */
1237                         break;
1238                 case SCTP_CAUSE_UNRECOG_CHUNK:
1239                         sctp_process_unrecog_chunk(stcb, phdr, net);
1240                         break;
1241                 case SCTP_CAUSE_UNRECOG_PARAM:
1242                         sctp_process_unrecog_param(stcb, phdr);
1243                         break;
1244                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1245                         /*
1246                          * We ignore this since the timer will drive out a
1247                          * new cookie anyway and there timer will drive us
1248                          * to send a SHUTDOWN_COMPLETE. We can't send one
1249                          * here since we don't have their tag.
1250                          */
1251                         break;
1252                 case SCTP_CAUSE_DELETING_LAST_ADDR:
1253                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
1254                 case SCTP_CAUSE_DELETING_SRC_ADDR:
1255                         /*
1256                          * We should NOT get these here, but in a
1257                          * ASCONF-ACK.
1258                          */
1259                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
1260                             error_type);
1261                         break;
1262                 case SCTP_CAUSE_OUT_OF_RESC:
1263                         /*
1264                          * And what, pray tell do we do with the fact that
1265                          * the peer is out of resources? Not really sure we
1266                          * could do anything but abort. I suspect this
1267                          * should have came WITH an abort instead of in a
1268                          * OP-ERROR.
1269                          */
1270                         break;
1271                 default:
1272                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
1273                             error_type);
1274                         break;
1275                 }
1276                 adjust = SCTP_SIZE32(error_len);
1277                 chklen -= adjust;
1278                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
1279         }
1280         sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);
1281         return (0);
1282 }
1283
1284 static int
1285 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1286     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
1287     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1288     struct sctp_nets *net, int *abort_no_unlock,
1289     uint8_t use_mflowid, uint32_t mflowid,
1290     uint32_t vrf_id)
1291 {
1292         struct sctp_init_ack *init_ack;
1293         struct mbuf *op_err;
1294
1295         SCTPDBG(SCTP_DEBUG_INPUT2,
1296             "sctp_handle_init_ack: handling INIT-ACK\n");
1297
1298         if (stcb == NULL) {
1299                 SCTPDBG(SCTP_DEBUG_INPUT2,
1300                     "sctp_handle_init_ack: TCB is null\n");
1301                 return (-1);
1302         }
1303         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
1304                 /* Invalid length */
1305                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1306                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1307                     src, dst, sh, op_err,
1308                     use_mflowid, mflowid,
1309                     vrf_id, net->port);
1310                 *abort_no_unlock = 1;
1311                 return (-1);
1312         }
1313         init_ack = &cp->init;
1314         /* validate parameters */
1315         if (init_ack->initiate_tag == 0) {
1316                 /* protocol error... send an abort */
1317                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1318                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1319                     src, dst, sh, op_err,
1320                     use_mflowid, mflowid,
1321                     vrf_id, net->port);
1322                 *abort_no_unlock = 1;
1323                 return (-1);
1324         }
1325         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
1326                 /* protocol error... send an abort */
1327                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1328                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1329                     src, dst, sh, op_err,
1330                     use_mflowid, mflowid,
1331                     vrf_id, net->port);
1332                 *abort_no_unlock = 1;
1333                 return (-1);
1334         }
1335         if (init_ack->num_inbound_streams == 0) {
1336                 /* protocol error... send an abort */
1337                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1338                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1339                     src, dst, sh, op_err,
1340                     use_mflowid, mflowid,
1341                     vrf_id, net->port);
1342                 *abort_no_unlock = 1;
1343                 return (-1);
1344         }
1345         if (init_ack->num_outbound_streams == 0) {
1346                 /* protocol error... send an abort */
1347                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_INVALID_PARAM);
1348                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1349                     src, dst, sh, op_err,
1350                     use_mflowid, mflowid,
1351                     vrf_id, net->port);
1352                 *abort_no_unlock = 1;
1353                 return (-1);
1354         }
1355         /* process according to association state... */
1356         switch (stcb->asoc.state & SCTP_STATE_MASK) {
1357         case SCTP_STATE_COOKIE_WAIT:
1358                 /* this is the expected state for this chunk */
1359                 /* process the INIT-ACK parameters */
1360                 if (stcb->asoc.primary_destination->dest_state &
1361                     SCTP_ADDR_UNCONFIRMED) {
1362                         /*
1363                          * The primary is where we sent the INIT, we can
1364                          * always consider it confirmed when the INIT-ACK is
1365                          * returned. Do this before we load addresses
1366                          * though.
1367                          */
1368                         stcb->asoc.primary_destination->dest_state &=
1369                             ~SCTP_ADDR_UNCONFIRMED;
1370                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1371                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1372                 }
1373                 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
1374                     net, abort_no_unlock,
1375                     use_mflowid, mflowid,
1376                     vrf_id) < 0) {
1377                         /* error in parsing parameters */
1378                         return (-1);
1379                 }
1380                 /* update our state */
1381                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1382                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
1383
1384                 /* reset the RTO calc */
1385                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1386                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1387                             stcb->asoc.overall_error_count,
1388                             0,
1389                             SCTP_FROM_SCTP_INPUT,
1390                             __LINE__);
1391                 }
1392                 stcb->asoc.overall_error_count = 0;
1393                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1394                 /*
1395                  * collapse the init timer back in case of a exponential
1396                  * backoff
1397                  */
1398                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1399                     stcb, net);
1400                 /*
1401                  * the send at the end of the inbound data processing will
1402                  * cause the cookie to be sent
1403                  */
1404                 break;
1405         case SCTP_STATE_SHUTDOWN_SENT:
1406                 /* incorrect state... discard */
1407                 break;
1408         case SCTP_STATE_COOKIE_ECHOED:
1409                 /* incorrect state... discard */
1410                 break;
1411         case SCTP_STATE_OPEN:
1412                 /* incorrect state... discard */
1413                 break;
1414         case SCTP_STATE_EMPTY:
1415         case SCTP_STATE_INUSE:
1416         default:
1417                 /* incorrect state... discard */
1418                 return (-1);
1419                 break;
1420         }
1421         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1422         return (0);
1423 }
1424
1425 static struct sctp_tcb *
1426 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1427     struct sockaddr *src, struct sockaddr *dst,
1428     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1429     struct sctp_inpcb *inp, struct sctp_nets **netp,
1430     struct sockaddr *init_src, int *notification,
1431     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1432     uint8_t use_mflowid, uint32_t mflowid,
1433     uint32_t vrf_id, uint16_t port);
1434
1435
1436 /*
1437  * handle a state cookie for an existing association m: input packet mbuf
1438  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1439  * "split" mbuf and the cookie signature does not exist offset: offset into
1440  * mbuf to the cookie-echo chunk
1441  */
1442 static struct sctp_tcb *
1443 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1444     struct sockaddr *src, struct sockaddr *dst,
1445     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1446     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
1447     struct sockaddr *init_src, int *notification,
1448     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1449     uint8_t use_mflowid, uint32_t mflowid,
1450     uint32_t vrf_id, uint16_t port)
1451 {
1452         struct sctp_association *asoc;
1453         struct sctp_init_chunk *init_cp, init_buf;
1454         struct sctp_init_ack_chunk *initack_cp, initack_buf;
1455         struct sctp_nets *net;
1456         struct mbuf *op_err;
1457         struct sctp_paramhdr *ph;
1458         int init_offset, initack_offset, i;
1459         int retval;
1460         int spec_flag = 0;
1461         uint32_t how_indx;
1462
1463         net = *netp;
1464         /* I know that the TCB is non-NULL from the caller */
1465         asoc = &stcb->asoc;
1466         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1467                 if (asoc->cookie_how[how_indx] == 0)
1468                         break;
1469         }
1470         if (how_indx < sizeof(asoc->cookie_how)) {
1471                 asoc->cookie_how[how_indx] = 1;
1472         }
1473         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1474                 /* SHUTDOWN came in after sending INIT-ACK */
1475                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1476                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
1477                     0, M_DONTWAIT, 1, MT_DATA);
1478                 if (op_err == NULL) {
1479                         /* FOOBAR */
1480                         return (NULL);
1481                 }
1482                 /* Set the len */
1483                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
1484                 ph = mtod(op_err, struct sctp_paramhdr *);
1485                 ph->param_type = htons(SCTP_CAUSE_COOKIE_IN_SHUTDOWN);
1486                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
1487                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
1488                     use_mflowid, mflowid,
1489                     vrf_id, net->port);
1490                 if (how_indx < sizeof(asoc->cookie_how))
1491                         asoc->cookie_how[how_indx] = 2;
1492                 return (NULL);
1493         }
1494         /*
1495          * find and validate the INIT chunk in the cookie (peer's info) the
1496          * INIT should start after the cookie-echo header struct (chunk
1497          * header, state cookie header struct)
1498          */
1499         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1500
1501         init_cp = (struct sctp_init_chunk *)
1502             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1503             (uint8_t *) & init_buf);
1504         if (init_cp == NULL) {
1505                 /* could not pull a INIT chunk in cookie */
1506                 return (NULL);
1507         }
1508         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1509                 return (NULL);
1510         }
1511         /*
1512          * find and validate the INIT-ACK chunk in the cookie (my info) the
1513          * INIT-ACK follows the INIT chunk
1514          */
1515         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
1516         initack_cp = (struct sctp_init_ack_chunk *)
1517             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1518             (uint8_t *) & initack_buf);
1519         if (initack_cp == NULL) {
1520                 /* could not pull INIT-ACK chunk in cookie */
1521                 return (NULL);
1522         }
1523         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1524                 return (NULL);
1525         }
1526         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1527             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1528                 /*
1529                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
1530                  * to get into the OPEN state
1531                  */
1532                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1533                         /*-
1534                          * Opps, this means that we somehow generated two vtag's
1535                          * the same. I.e. we did:
1536                          *  Us               Peer
1537                          *   <---INIT(tag=a)------
1538                          *   ----INIT-ACK(tag=t)-->
1539                          *   ----INIT(tag=t)------> *1
1540                          *   <---INIT-ACK(tag=a)---
1541                          *   <----CE(tag=t)------------- *2
1542                          *
1543                          * At point *1 we should be generating a different
1544                          * tag t'. Which means we would throw away the CE and send
1545                          * ours instead. Basically this is case C (throw away side).
1546                          */
1547                         if (how_indx < sizeof(asoc->cookie_how))
1548                                 asoc->cookie_how[how_indx] = 17;
1549                         return (NULL);
1550
1551                 }
1552                 switch SCTP_GET_STATE
1553                         (asoc) {
1554                 case SCTP_STATE_COOKIE_WAIT:
1555                 case SCTP_STATE_COOKIE_ECHOED:
1556                         /*
1557                          * INIT was sent but got a COOKIE_ECHO with the
1558                          * correct tags... just accept it...but we must
1559                          * process the init so that we can make sure we have
1560                          * the right seq no's.
1561                          */
1562                         /* First we must process the INIT !! */
1563                         retval = sctp_process_init(init_cp, stcb);
1564                         if (retval < 0) {
1565                                 if (how_indx < sizeof(asoc->cookie_how))
1566                                         asoc->cookie_how[how_indx] = 3;
1567                                 return (NULL);
1568                         }
1569                         /* we have already processed the INIT so no problem */
1570                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb,
1571                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1572                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1573                         /* update current state */
1574                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1575                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1576                         else
1577                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1578
1579                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1580                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1581                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1582                                     stcb->sctp_ep, stcb, asoc->primary_destination);
1583                         }
1584                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1585                         sctp_stop_all_cookie_timers(stcb);
1586                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1587                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1588                             (inp->sctp_socket->so_qlimit == 0)
1589                             ) {
1590 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1591                                 struct socket *so;
1592
1593 #endif
1594                                 /*
1595                                  * Here is where collision would go if we
1596                                  * did a connect() and instead got a
1597                                  * init/init-ack/cookie done before the
1598                                  * init-ack came back..
1599                                  */
1600                                 stcb->sctp_ep->sctp_flags |=
1601                                     SCTP_PCB_FLAGS_CONNECTED;
1602 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1603                                 so = SCTP_INP_SO(stcb->sctp_ep);
1604                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1605                                 SCTP_TCB_UNLOCK(stcb);
1606                                 SCTP_SOCKET_LOCK(so, 1);
1607                                 SCTP_TCB_LOCK(stcb);
1608                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1609                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1610                                         SCTP_SOCKET_UNLOCK(so, 1);
1611                                         return (NULL);
1612                                 }
1613 #endif
1614                                 soisconnected(stcb->sctp_socket);
1615 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1616                                 SCTP_SOCKET_UNLOCK(so, 1);
1617 #endif
1618                         }
1619                         /* notify upper layer */
1620                         *notification = SCTP_NOTIFY_ASSOC_UP;
1621                         /*
1622                          * since we did not send a HB make sure we don't
1623                          * double things
1624                          */
1625                         net->hb_responded = 1;
1626                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
1627                             &cookie->time_entered,
1628                             sctp_align_unsafe_makecopy,
1629                             SCTP_RTT_FROM_NON_DATA);
1630
1631                         if (stcb->asoc.sctp_autoclose_ticks &&
1632                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1633                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1634                                     inp, stcb, NULL);
1635                         }
1636                         break;
1637                 default:
1638                         /*
1639                          * we're in the OPEN state (or beyond), so peer must
1640                          * have simply lost the COOKIE-ACK
1641                          */
1642                         break;
1643                         }       /* end switch */
1644                 sctp_stop_all_cookie_timers(stcb);
1645                 /*
1646                  * We ignore the return code here.. not sure if we should
1647                  * somehow abort.. but we do have an existing asoc. This
1648                  * really should not fail.
1649                  */
1650                 if (sctp_load_addresses_from_init(stcb, m,
1651                     init_offset + sizeof(struct sctp_init_chunk),
1652                     initack_offset, src, dst, init_src)) {
1653                         if (how_indx < sizeof(asoc->cookie_how))
1654                                 asoc->cookie_how[how_indx] = 4;
1655                         return (NULL);
1656                 }
1657                 /* respond with a COOKIE-ACK */
1658                 sctp_toss_old_cookies(stcb, asoc);
1659                 sctp_send_cookie_ack(stcb);
1660                 if (how_indx < sizeof(asoc->cookie_how))
1661                         asoc->cookie_how[how_indx] = 5;
1662                 return (stcb);
1663         }
1664         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1665             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1666             cookie->tie_tag_my_vtag == 0 &&
1667             cookie->tie_tag_peer_vtag == 0) {
1668                 /*
1669                  * case C in Section 5.2.4 Table 2: XMOO silently discard
1670                  */
1671                 if (how_indx < sizeof(asoc->cookie_how))
1672                         asoc->cookie_how[how_indx] = 6;
1673                 return (NULL);
1674         }
1675         /*
1676          * If nat support, and the below and stcb is established, send back
1677          * a ABORT(colliding state) if we are established.
1678          */
1679         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
1680             (asoc->peer_supports_nat) &&
1681             ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1682             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1683             (asoc->peer_vtag == 0)))) {
1684                 /*
1685                  * Special case - Peer's support nat. We may have two init's
1686                  * that we gave out the same tag on since one was not
1687                  * established.. i.e. we get INIT from host-1 behind the nat
1688                  * and we respond tag-a, we get a INIT from host-2 behind
1689                  * the nat and we get tag-a again. Then we bring up host-1
1690                  * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
1691                  * Now we have colliding state. We must send an abort here
1692                  * with colliding state indication.
1693                  */
1694                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
1695                     0, M_DONTWAIT, 1, MT_DATA);
1696                 if (op_err == NULL) {
1697                         /* FOOBAR */
1698                         return (NULL);
1699                 }
1700                 /* pre-reserve some space */
1701 #ifdef INET6
1702                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip6_hdr));
1703 #else
1704                 SCTP_BUF_RESV_UF(op_err, sizeof(struct ip));
1705 #endif
1706                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctphdr));
1707                 SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1708                 /* Set the len */
1709                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_paramhdr);
1710                 ph = mtod(op_err, struct sctp_paramhdr *);
1711                 ph->param_type = htons(SCTP_CAUSE_NAT_COLLIDING_STATE);
1712                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
1713                 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
1714                     use_mflowid, mflowid,
1715                     vrf_id, port);
1716                 return (NULL);
1717         }
1718         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1719             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1720             (asoc->peer_vtag == 0))) {
1721                 /*
1722                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1723                  * should be ok, re-accept peer info
1724                  */
1725                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1726                         /*
1727                          * Extension of case C. If we hit this, then the
1728                          * random number generator returned the same vtag
1729                          * when we first sent our INIT-ACK and when we later
1730                          * sent our INIT. The side with the seq numbers that
1731                          * are different will be the one that normnally
1732                          * would have hit case C. This in effect "extends"
1733                          * our vtags in this collision case to be 64 bits.
1734                          * The same collision could occur aka you get both
1735                          * vtag and seq number the same twice in a row.. but
1736                          * is much less likely. If it did happen then we
1737                          * would proceed through and bring up the assoc.. we
1738                          * may end up with the wrong stream setup however..
1739                          * which would be bad.. but there is no way to
1740                          * tell.. until we send on a stream that does not
1741                          * exist :-)
1742                          */
1743                         if (how_indx < sizeof(asoc->cookie_how))
1744                                 asoc->cookie_how[how_indx] = 7;
1745
1746                         return (NULL);
1747                 }
1748                 if (how_indx < sizeof(asoc->cookie_how))
1749                         asoc->cookie_how[how_indx] = 8;
1750                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1751                 sctp_stop_all_cookie_timers(stcb);
1752                 /*
1753                  * since we did not send a HB make sure we don't double
1754                  * things
1755                  */
1756                 net->hb_responded = 1;
1757                 if (stcb->asoc.sctp_autoclose_ticks &&
1758                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1759                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1760                             NULL);
1761                 }
1762                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1763                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1764
1765                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1766                         /*
1767                          * Ok the peer probably discarded our data (if we
1768                          * echoed a cookie+data). So anything on the
1769                          * sent_queue should be marked for retransmit, we
1770                          * may not get something to kick us so it COULD
1771                          * still take a timeout to move these.. but it can't
1772                          * hurt to mark them.
1773                          */
1774                         struct sctp_tmit_chunk *chk;
1775
1776                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1777                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
1778                                         chk->sent = SCTP_DATAGRAM_RESEND;
1779                                         sctp_flight_size_decrease(chk);
1780                                         sctp_total_flight_decrease(stcb, chk);
1781                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1782                                         spec_flag++;
1783                                 }
1784                         }
1785
1786                 }
1787                 /* process the INIT info (peer's info) */
1788                 retval = sctp_process_init(init_cp, stcb);
1789                 if (retval < 0) {
1790                         if (how_indx < sizeof(asoc->cookie_how))
1791                                 asoc->cookie_how[how_indx] = 9;
1792                         return (NULL);
1793                 }
1794                 if (sctp_load_addresses_from_init(stcb, m,
1795                     init_offset + sizeof(struct sctp_init_chunk),
1796                     initack_offset, src, dst, init_src)) {
1797                         if (how_indx < sizeof(asoc->cookie_how))
1798                                 asoc->cookie_how[how_indx] = 10;
1799                         return (NULL);
1800                 }
1801                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1802                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1803                         *notification = SCTP_NOTIFY_ASSOC_UP;
1804
1805                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1806                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1807                             (inp->sctp_socket->so_qlimit == 0)) {
1808 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1809                                 struct socket *so;
1810
1811 #endif
1812                                 stcb->sctp_ep->sctp_flags |=
1813                                     SCTP_PCB_FLAGS_CONNECTED;
1814 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1815                                 so = SCTP_INP_SO(stcb->sctp_ep);
1816                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1817                                 SCTP_TCB_UNLOCK(stcb);
1818                                 SCTP_SOCKET_LOCK(so, 1);
1819                                 SCTP_TCB_LOCK(stcb);
1820                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1821                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1822                                         SCTP_SOCKET_UNLOCK(so, 1);
1823                                         return (NULL);
1824                                 }
1825 #endif
1826                                 soisconnected(stcb->sctp_socket);
1827 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1828                                 SCTP_SOCKET_UNLOCK(so, 1);
1829 #endif
1830                         }
1831                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1832                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1833                         else
1834                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1835                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1836                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1837                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1838                 } else {
1839                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1840                 }
1841                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1842                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1843                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1844                             stcb->sctp_ep, stcb, asoc->primary_destination);
1845                 }
1846                 sctp_stop_all_cookie_timers(stcb);
1847                 sctp_toss_old_cookies(stcb, asoc);
1848                 sctp_send_cookie_ack(stcb);
1849                 if (spec_flag) {
1850                         /*
1851                          * only if we have retrans set do we do this. What
1852                          * this call does is get only the COOKIE-ACK out and
1853                          * then when we return the normal call to
1854                          * sctp_chunk_output will get the retrans out behind
1855                          * this.
1856                          */
1857                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1858                 }
1859                 if (how_indx < sizeof(asoc->cookie_how))
1860                         asoc->cookie_how[how_indx] = 11;
1861
1862                 return (stcb);
1863         }
1864         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1865             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1866             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1867             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1868             cookie->tie_tag_peer_vtag != 0) {
1869                 struct sctpasochead *head;
1870
1871                 if (asoc->peer_supports_nat) {
1872                         /*
1873                          * This is a gross gross hack. just call the
1874                          * cookie_new code since we are allowing a duplicate
1875                          * association. I hope this works...
1876                          */
1877                         return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
1878                             sh, cookie, cookie_len,
1879                             inp, netp, init_src, notification,
1880                             auth_skipped, auth_offset, auth_len,
1881                             use_mflowid, mflowid,
1882                             vrf_id, port));
1883                 }
1884                 /*
1885                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1886                  */
1887                 /* temp code */
1888                 if (how_indx < sizeof(asoc->cookie_how))
1889                         asoc->cookie_how[how_indx] = 12;
1890                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1891                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1892
1893                 /* notify upper layer */
1894                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
1895                 atomic_add_int(&stcb->asoc.refcnt, 1);
1896                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1897                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1898                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1899                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1900                 }
1901                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1902                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1903                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1904                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1905                 }
1906                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1907                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1908                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1909                             stcb->sctp_ep, stcb, asoc->primary_destination);
1910
1911                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1912                         /* move to OPEN state, if not in SHUTDOWN_SENT */
1913                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1914                 }
1915                 asoc->pre_open_streams =
1916                     ntohs(initack_cp->init.num_outbound_streams);
1917                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1918                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1919                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1920
1921                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1922
1923                 asoc->str_reset_seq_in = asoc->init_seq_number;
1924
1925                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1926                 if (asoc->mapping_array) {
1927                         memset(asoc->mapping_array, 0,
1928                             asoc->mapping_array_size);
1929                 }
1930                 if (asoc->nr_mapping_array) {
1931                         memset(asoc->nr_mapping_array, 0,
1932                             asoc->mapping_array_size);
1933                 }
1934                 SCTP_TCB_UNLOCK(stcb);
1935                 SCTP_INP_INFO_WLOCK();
1936                 SCTP_INP_WLOCK(stcb->sctp_ep);
1937                 SCTP_TCB_LOCK(stcb);
1938                 atomic_add_int(&stcb->asoc.refcnt, -1);
1939                 /* send up all the data */
1940                 SCTP_TCB_SEND_LOCK(stcb);
1941
1942                 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_NOT_LOCKED);
1943                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1944                         stcb->asoc.strmout[i].stream_no = i;
1945                         stcb->asoc.strmout[i].next_sequence_sent = 0;
1946                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
1947                 }
1948                 /* process the INIT-ACK info (my info) */
1949                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1950                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1951
1952                 /* pull from vtag hash */
1953                 LIST_REMOVE(stcb, sctp_asocs);
1954                 /* re-insert to new vtag position */
1955                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1956                     SCTP_BASE_INFO(hashasocmark))];
1957                 /*
1958                  * put it in the bucket in the vtag hash of assoc's for the
1959                  * system
1960                  */
1961                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1962
1963                 /* process the INIT info (peer's info) */
1964                 SCTP_TCB_SEND_UNLOCK(stcb);
1965                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
1966                 SCTP_INP_INFO_WUNLOCK();
1967
1968                 retval = sctp_process_init(init_cp, stcb);
1969                 if (retval < 0) {
1970                         if (how_indx < sizeof(asoc->cookie_how))
1971                                 asoc->cookie_how[how_indx] = 13;
1972
1973                         return (NULL);
1974                 }
1975                 /*
1976                  * since we did not send a HB make sure we don't double
1977                  * things
1978                  */
1979                 net->hb_responded = 1;
1980
1981                 if (sctp_load_addresses_from_init(stcb, m,
1982                     init_offset + sizeof(struct sctp_init_chunk),
1983                     initack_offset, src, dst, init_src)) {
1984                         if (how_indx < sizeof(asoc->cookie_how))
1985                                 asoc->cookie_how[how_indx] = 14;
1986
1987                         return (NULL);
1988                 }
1989                 /* respond with a COOKIE-ACK */
1990                 sctp_stop_all_cookie_timers(stcb);
1991                 sctp_toss_old_cookies(stcb, asoc);
1992                 sctp_send_cookie_ack(stcb);
1993                 if (how_indx < sizeof(asoc->cookie_how))
1994                         asoc->cookie_how[how_indx] = 15;
1995
1996                 return (stcb);
1997         }
1998         if (how_indx < sizeof(asoc->cookie_how))
1999                 asoc->cookie_how[how_indx] = 16;
2000         /* all other cases... */
2001         return (NULL);
2002 }
2003
2004
2005 /*
2006  * handle a state cookie for a new association m: input packet mbuf chain--
2007  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
2008  * and the cookie signature does not exist offset: offset into mbuf to the
2009  * cookie-echo chunk length: length of the cookie chunk to: where the init
2010  * was from returns a new TCB
2011  */
2012 static struct sctp_tcb *
2013 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
2014     struct sockaddr *src, struct sockaddr *dst,
2015     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
2016     struct sctp_inpcb *inp, struct sctp_nets **netp,
2017     struct sockaddr *init_src, int *notification,
2018     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2019     uint8_t use_mflowid, uint32_t mflowid,
2020     uint32_t vrf_id, uint16_t port)
2021 {
2022         struct sctp_tcb *stcb;
2023         struct sctp_init_chunk *init_cp, init_buf;
2024         struct sctp_init_ack_chunk *initack_cp, initack_buf;
2025         struct sockaddr_storage sa_store;
2026         struct sockaddr *initack_src = (struct sockaddr *)&sa_store;
2027         struct sctp_association *asoc;
2028         int init_offset, initack_offset, initack_limit;
2029         int retval;
2030         int error = 0;
2031         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
2032
2033 #ifdef INET
2034         struct sockaddr_in *sin;
2035
2036 #endif
2037 #ifdef INET6
2038         struct sockaddr_in6 *sin6;
2039
2040 #endif
2041 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2042         struct socket *so;
2043
2044         so = SCTP_INP_SO(inp);
2045 #endif
2046
2047         /*
2048          * find and validate the INIT chunk in the cookie (peer's info) the
2049          * INIT should start after the cookie-echo header struct (chunk
2050          * header, state cookie header struct)
2051          */
2052         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
2053         init_cp = (struct sctp_init_chunk *)
2054             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
2055             (uint8_t *) & init_buf);
2056         if (init_cp == NULL) {
2057                 /* could not pull a INIT chunk in cookie */
2058                 SCTPDBG(SCTP_DEBUG_INPUT1,
2059                     "process_cookie_new: could not pull INIT chunk hdr\n");
2060                 return (NULL);
2061         }
2062         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
2063                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
2064                 return (NULL);
2065         }
2066         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
2067         /*
2068          * find and validate the INIT-ACK chunk in the cookie (my info) the
2069          * INIT-ACK follows the INIT chunk
2070          */
2071         initack_cp = (struct sctp_init_ack_chunk *)
2072             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
2073             (uint8_t *) & initack_buf);
2074         if (initack_cp == NULL) {
2075                 /* could not pull INIT-ACK chunk in cookie */
2076                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
2077                 return (NULL);
2078         }
2079         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
2080                 return (NULL);
2081         }
2082         /*
2083          * NOTE: We can't use the INIT_ACK's chk_length to determine the
2084          * "initack_limit" value.  This is because the chk_length field
2085          * includes the length of the cookie, but the cookie is omitted when
2086          * the INIT and INIT_ACK are tacked onto the cookie...
2087          */
2088         initack_limit = offset + cookie_len;
2089
2090         /*
2091          * now that we know the INIT/INIT-ACK are in place, create a new TCB
2092          * and popluate
2093          */
2094
2095         /*
2096          * Here we do a trick, we set in NULL for the proc/thread argument.
2097          * We do this since in effect we only use the p argument when the
2098          * socket is unbound and we must do an implicit bind. Since we are
2099          * getting a cookie, we cannot be unbound.
2100          */
2101         stcb = sctp_aloc_assoc(inp, init_src, &error,
2102             ntohl(initack_cp->init.initiate_tag), vrf_id,
2103             (struct thread *)NULL
2104             );
2105         if (stcb == NULL) {
2106                 struct mbuf *op_err;
2107
2108                 /* memory problem? */
2109                 SCTPDBG(SCTP_DEBUG_INPUT1,
2110                     "process_cookie_new: no room for another TCB!\n");
2111                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2112
2113                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2114                     src, dst, sh, op_err,
2115                     use_mflowid, mflowid,
2116                     vrf_id, port);
2117                 return (NULL);
2118         }
2119         /* get the correct sctp_nets */
2120         if (netp)
2121                 *netp = sctp_findnet(stcb, init_src);
2122
2123         asoc = &stcb->asoc;
2124         /* get scope variables out of cookie */
2125         asoc->ipv4_local_scope = cookie->ipv4_scope;
2126         asoc->site_scope = cookie->site_scope;
2127         asoc->local_scope = cookie->local_scope;
2128         asoc->loopback_scope = cookie->loopback_scope;
2129
2130         if ((asoc->ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2131             (asoc->ipv6_addr_legal != cookie->ipv6_addr_legal)) {
2132                 struct mbuf *op_err;
2133
2134                 /*
2135                  * Houston we have a problem. The EP changed while the
2136                  * cookie was in flight. Only recourse is to abort the
2137                  * association.
2138                  */
2139                 atomic_add_int(&stcb->asoc.refcnt, 1);
2140                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2141                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2142                     src, dst, sh, op_err,
2143                     use_mflowid, mflowid,
2144                     vrf_id, port);
2145 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2146                 SCTP_TCB_UNLOCK(stcb);
2147                 SCTP_SOCKET_LOCK(so, 1);
2148                 SCTP_TCB_LOCK(stcb);
2149 #endif
2150                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2151                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
2152 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2153                 SCTP_SOCKET_UNLOCK(so, 1);
2154 #endif
2155                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2156                 return (NULL);
2157         }
2158         /* process the INIT-ACK info (my info) */
2159         asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
2160         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2161         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
2162         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
2163         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
2164         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
2165         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
2166         asoc->str_reset_seq_in = asoc->init_seq_number;
2167
2168         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
2169
2170         /* process the INIT info (peer's info) */
2171         if (netp)
2172                 retval = sctp_process_init(init_cp, stcb);
2173         else
2174                 retval = 0;
2175         if (retval < 0) {
2176                 atomic_add_int(&stcb->asoc.refcnt, 1);
2177 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2178                 SCTP_TCB_UNLOCK(stcb);
2179                 SCTP_SOCKET_LOCK(so, 1);
2180                 SCTP_TCB_LOCK(stcb);
2181 #endif
2182                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
2183 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2184                 SCTP_SOCKET_UNLOCK(so, 1);
2185 #endif
2186                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2187                 return (NULL);
2188         }
2189         /* load all addresses */
2190         if (sctp_load_addresses_from_init(stcb, m,
2191             init_offset + sizeof(struct sctp_init_chunk), initack_offset,
2192             src, dst, init_src)) {
2193                 atomic_add_int(&stcb->asoc.refcnt, 1);
2194 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2195                 SCTP_TCB_UNLOCK(stcb);
2196                 SCTP_SOCKET_LOCK(so, 1);
2197                 SCTP_TCB_LOCK(stcb);
2198 #endif
2199                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
2200 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2201                 SCTP_SOCKET_UNLOCK(so, 1);
2202 #endif
2203                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2204                 return (NULL);
2205         }
2206         /*
2207          * verify any preceding AUTH chunk that was skipped
2208          */
2209         /* pull the local authentication parameters from the cookie/init-ack */
2210         sctp_auth_get_cookie_params(stcb, m,
2211             initack_offset + sizeof(struct sctp_init_ack_chunk),
2212             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
2213         if (auth_skipped) {
2214                 struct sctp_auth_chunk *auth;
2215
2216                 auth = (struct sctp_auth_chunk *)
2217                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
2218                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
2219                         /* auth HMAC failed, dump the assoc and packet */
2220                         SCTPDBG(SCTP_DEBUG_AUTH1,
2221                             "COOKIE-ECHO: AUTH failed\n");
2222                         atomic_add_int(&stcb->asoc.refcnt, 1);
2223 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2224                         SCTP_TCB_UNLOCK(stcb);
2225                         SCTP_SOCKET_LOCK(so, 1);
2226                         SCTP_TCB_LOCK(stcb);
2227 #endif
2228                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
2229 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2230                         SCTP_SOCKET_UNLOCK(so, 1);
2231 #endif
2232                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2233                         return (NULL);
2234                 } else {
2235                         /* remaining chunks checked... good to go */
2236                         stcb->asoc.authenticated = 1;
2237                 }
2238         }
2239         /* update current state */
2240         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2241         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2242         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2243                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2244                     stcb->sctp_ep, stcb, asoc->primary_destination);
2245         }
2246         sctp_stop_all_cookie_timers(stcb);
2247         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
2248         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2249
2250         /*
2251          * if we're doing ASCONFs, check to see if we have any new local
2252          * addresses that need to get added to the peer (eg. addresses
2253          * changed while cookie echo in flight).  This needs to be done
2254          * after we go to the OPEN state to do the correct asconf
2255          * processing. else, make sure we have the correct addresses in our
2256          * lists
2257          */
2258
2259         /* warning, we re-use sin, sin6, sa_store here! */
2260         /* pull in local_address (our "from" address) */
2261         switch (cookie->laddr_type) {
2262 #ifdef INET
2263         case SCTP_IPV4_ADDRESS:
2264                 /* source addr is IPv4 */
2265                 sin = (struct sockaddr_in *)initack_src;
2266                 memset(sin, 0, sizeof(*sin));
2267                 sin->sin_family = AF_INET;
2268                 sin->sin_len = sizeof(struct sockaddr_in);
2269                 sin->sin_addr.s_addr = cookie->laddress[0];
2270                 break;
2271 #endif
2272 #ifdef INET6
2273         case SCTP_IPV6_ADDRESS:
2274                 /* source addr is IPv6 */
2275                 sin6 = (struct sockaddr_in6 *)initack_src;
2276                 memset(sin6, 0, sizeof(*sin6));
2277                 sin6->sin6_family = AF_INET6;
2278                 sin6->sin6_len = sizeof(struct sockaddr_in6);
2279                 sin6->sin6_scope_id = cookie->scope_id;
2280                 memcpy(&sin6->sin6_addr, cookie->laddress,
2281                     sizeof(sin6->sin6_addr));
2282                 break;
2283 #endif
2284         default:
2285                 atomic_add_int(&stcb->asoc.refcnt, 1);
2286 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2287                 SCTP_TCB_UNLOCK(stcb);
2288                 SCTP_SOCKET_LOCK(so, 1);
2289                 SCTP_TCB_LOCK(stcb);
2290 #endif
2291                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2292 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2293                 SCTP_SOCKET_UNLOCK(so, 1);
2294 #endif
2295                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2296                 return (NULL);
2297         }
2298
2299         /* set up to notify upper layer */
2300         *notification = SCTP_NOTIFY_ASSOC_UP;
2301         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2302             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2303             (inp->sctp_socket->so_qlimit == 0)) {
2304                 /*
2305                  * This is an endpoint that called connect() how it got a
2306                  * cookie that is NEW is a bit of a mystery. It must be that
2307                  * the INIT was sent, but before it got there.. a complete
2308                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
2309                  * should have went to the other code.. not here.. oh well..
2310                  * a bit of protection is worth having..
2311                  */
2312                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2313 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2314                 atomic_add_int(&stcb->asoc.refcnt, 1);
2315                 SCTP_TCB_UNLOCK(stcb);
2316                 SCTP_SOCKET_LOCK(so, 1);
2317                 SCTP_TCB_LOCK(stcb);
2318                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2319                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2320                         SCTP_SOCKET_UNLOCK(so, 1);
2321                         return (NULL);
2322                 }
2323 #endif
2324                 soisconnected(stcb->sctp_socket);
2325 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2326                 SCTP_SOCKET_UNLOCK(so, 1);
2327 #endif
2328         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2329             (inp->sctp_socket->so_qlimit)) {
2330                 /*
2331                  * We don't want to do anything with this one. Since it is
2332                  * the listening guy. The timer will get started for
2333                  * accepted connections in the caller.
2334                  */
2335                 ;
2336         }
2337         /* since we did not send a HB make sure we don't double things */
2338         if ((netp) && (*netp))
2339                 (*netp)->hb_responded = 1;
2340
2341         if (stcb->asoc.sctp_autoclose_ticks &&
2342             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2343                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2344         }
2345         /* calculate the RTT */
2346         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2347         if ((netp) && (*netp)) {
2348                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
2349                     &cookie->time_entered, sctp_align_unsafe_makecopy,
2350                     SCTP_RTT_FROM_NON_DATA);
2351         }
2352         /* respond with a COOKIE-ACK */
2353         sctp_send_cookie_ack(stcb);
2354
2355         /*
2356          * check the address lists for any ASCONFs that need to be sent
2357          * AFTER the cookie-ack is sent
2358          */
2359         sctp_check_address_list(stcb, m,
2360             initack_offset + sizeof(struct sctp_init_ack_chunk),
2361             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2362             initack_src, cookie->local_scope, cookie->site_scope,
2363             cookie->ipv4_scope, cookie->loopback_scope);
2364
2365
2366         return (stcb);
2367 }
2368
2369 /*
2370  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
2371  * we NEED to make sure we are not already using the vtag. If so we
2372  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
2373         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
2374                                                             SCTP_BASE_INFO(hashasocmark))];
2375         LIST_FOREACH(stcb, head, sctp_asocs) {
2376                 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
2377                        -- SEND ABORT - TRY AGAIN --
2378                 }
2379         }
2380 */
2381
2382 /*
2383  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2384  * existing (non-NULL) TCB
2385  */
2386 static struct mbuf *
2387 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2388     struct sockaddr *src, struct sockaddr *dst,
2389     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2390     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2391     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2392     struct sctp_tcb **locked_tcb,
2393     uint8_t use_mflowid, uint32_t mflowid,
2394     uint32_t vrf_id, uint16_t port)
2395 {
2396         struct sctp_state_cookie *cookie;
2397         struct sctp_tcb *l_stcb = *stcb;
2398         struct sctp_inpcb *l_inp;
2399         struct sockaddr *to;
2400         struct sctp_pcb *ep;
2401         struct mbuf *m_sig;
2402         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2403         uint8_t *sig;
2404         uint8_t cookie_ok = 0;
2405         unsigned int sig_offset, cookie_offset;
2406         unsigned int cookie_len;
2407         struct timeval now;
2408         struct timeval time_expires;
2409         int notification = 0;
2410         struct sctp_nets *netl;
2411         int had_a_existing_tcb = 0;
2412         int send_int_conf = 0;
2413
2414 #ifdef INET
2415         struct sockaddr_in sin;
2416
2417 #endif
2418 #ifdef INET6
2419         struct sockaddr_in6 sin6;
2420
2421 #endif
2422
2423         SCTPDBG(SCTP_DEBUG_INPUT2,
2424             "sctp_handle_cookie: handling COOKIE-ECHO\n");
2425
2426         if (inp_p == NULL) {
2427                 return (NULL);
2428         }
2429         cookie = &cp->cookie;
2430         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2431         cookie_len = ntohs(cp->ch.chunk_length);
2432
2433         if ((cookie->peerport != sh->src_port) &&
2434             (cookie->myport != sh->dest_port) &&
2435             (cookie->my_vtag != sh->v_tag)) {
2436                 /*
2437                  * invalid ports or bad tag.  Note that we always leave the
2438                  * v_tag in the header in network order and when we stored
2439                  * it in the my_vtag slot we also left it in network order.
2440                  * This maintains the match even though it may be in the
2441                  * opposite byte order of the machine :->
2442                  */
2443                 return (NULL);
2444         }
2445         if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2446             sizeof(struct sctp_init_chunk) +
2447             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2448                 /* cookie too small */
2449                 return (NULL);
2450         }
2451         /*
2452          * split off the signature into its own mbuf (since it should not be
2453          * calculated in the sctp_hmac_m() call).
2454          */
2455         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2456         m_sig = m_split(m, sig_offset, M_DONTWAIT);
2457         if (m_sig == NULL) {
2458                 /* out of memory or ?? */
2459                 return (NULL);
2460         }
2461 #ifdef SCTP_MBUF_LOGGING
2462         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2463                 struct mbuf *mat;
2464
2465                 for (mat = m_sig; mat; mat = SCTP_BUF_NEXT(mat)) {
2466                         if (SCTP_BUF_IS_EXTENDED(mat)) {
2467                                 sctp_log_mb(mat, SCTP_MBUF_SPLIT);
2468                         }
2469                 }
2470         }
2471 #endif
2472
2473         /*
2474          * compute the signature/digest for the cookie
2475          */
2476         ep = &(*inp_p)->sctp_ep;
2477         l_inp = *inp_p;
2478         if (l_stcb) {
2479                 SCTP_TCB_UNLOCK(l_stcb);
2480         }
2481         SCTP_INP_RLOCK(l_inp);
2482         if (l_stcb) {
2483                 SCTP_TCB_LOCK(l_stcb);
2484         }
2485         /* which cookie is it? */
2486         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2487             (ep->current_secret_number != ep->last_secret_number)) {
2488                 /* it's the old cookie */
2489                 (void)sctp_hmac_m(SCTP_HMAC,
2490                     (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2491                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2492         } else {
2493                 /* it's the current cookie */
2494                 (void)sctp_hmac_m(SCTP_HMAC,
2495                     (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
2496                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2497         }
2498         /* get the signature */
2499         SCTP_INP_RUNLOCK(l_inp);
2500         sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
2501         if (sig == NULL) {
2502                 /* couldn't find signature */
2503                 sctp_m_freem(m_sig);
2504                 return (NULL);
2505         }
2506         /* compare the received digest with the computed digest */
2507         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2508                 /* try the old cookie? */
2509                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2510                     (ep->current_secret_number != ep->last_secret_number)) {
2511                         /* compute digest with old */
2512                         (void)sctp_hmac_m(SCTP_HMAC,
2513                             (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2514                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2515                         /* compare */
2516                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2517                                 cookie_ok = 1;
2518                 }
2519         } else {
2520                 cookie_ok = 1;
2521         }
2522
2523         /*
2524          * Now before we continue we must reconstruct our mbuf so that
2525          * normal processing of any other chunks will work.
2526          */
2527         {
2528                 struct mbuf *m_at;
2529
2530                 m_at = m;
2531                 while (SCTP_BUF_NEXT(m_at) != NULL) {
2532                         m_at = SCTP_BUF_NEXT(m_at);
2533                 }
2534                 SCTP_BUF_NEXT(m_at) = m_sig;
2535         }
2536
2537         if (cookie_ok == 0) {
2538                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2539                 SCTPDBG(SCTP_DEBUG_INPUT2,
2540                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2541                     (uint32_t) offset, cookie_offset, sig_offset);
2542                 return (NULL);
2543         }
2544         /*
2545          * check the cookie timestamps to be sure it's not stale
2546          */
2547         (void)SCTP_GETTIME_TIMEVAL(&now);
2548         /* Expire time is in Ticks, so we convert to seconds */
2549         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
2550         time_expires.tv_usec = cookie->time_entered.tv_usec;
2551         /*
2552          * TODO sctp_constants.h needs alternative time macros when _KERNEL
2553          * is undefined.
2554          */
2555         if (timevalcmp(&now, &time_expires, >)) {
2556                 /* cookie is stale! */
2557                 struct mbuf *op_err;
2558                 struct sctp_stale_cookie_msg *scm;
2559                 uint32_t tim;
2560
2561                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_stale_cookie_msg),
2562                     0, M_DONTWAIT, 1, MT_DATA);
2563                 if (op_err == NULL) {
2564                         /* FOOBAR */
2565                         return (NULL);
2566                 }
2567                 /* Set the len */
2568                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_stale_cookie_msg);
2569                 scm = mtod(op_err, struct sctp_stale_cookie_msg *);
2570                 scm->ph.param_type = htons(SCTP_CAUSE_STALE_COOKIE);
2571                 scm->ph.param_length = htons((sizeof(struct sctp_paramhdr) +
2572                     (sizeof(uint32_t))));
2573                 /* seconds to usec */
2574                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2575                 /* add in usec */
2576                 if (tim == 0)
2577                         tim = now.tv_usec - cookie->time_entered.tv_usec;
2578                 scm->time_usec = htonl(tim);
2579                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
2580                     use_mflowid, mflowid,
2581                     vrf_id, port);
2582                 return (NULL);
2583         }
2584         /*
2585          * Now we must see with the lookup address if we have an existing
2586          * asoc. This will only happen if we were in the COOKIE-WAIT state
2587          * and a INIT collided with us and somewhere the peer sent the
2588          * cookie on another address besides the single address our assoc
2589          * had for him. In this case we will have one of the tie-tags set at
2590          * least AND the address field in the cookie can be used to look it
2591          * up.
2592          */
2593         to = NULL;
2594         switch (cookie->addr_type) {
2595 #ifdef INET6
2596         case SCTP_IPV6_ADDRESS:
2597                 memset(&sin6, 0, sizeof(sin6));
2598                 sin6.sin6_family = AF_INET6;
2599                 sin6.sin6_len = sizeof(sin6);
2600                 sin6.sin6_port = sh->src_port;
2601                 sin6.sin6_scope_id = cookie->scope_id;
2602                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2603                     sizeof(sin6.sin6_addr.s6_addr));
2604                 to = (struct sockaddr *)&sin6;
2605                 break;
2606 #endif
2607 #ifdef INET
2608         case SCTP_IPV4_ADDRESS:
2609                 memset(&sin, 0, sizeof(sin));
2610                 sin.sin_family = AF_INET;
2611                 sin.sin_len = sizeof(sin);
2612                 sin.sin_port = sh->src_port;
2613                 sin.sin_addr.s_addr = cookie->address[0];
2614                 to = (struct sockaddr *)&sin;
2615                 break;
2616 #endif
2617         default:
2618                 /* This should not happen */
2619                 return (NULL);
2620         }
2621         if ((*stcb == NULL) && to) {
2622                 /* Yep, lets check */
2623                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
2624                 if (*stcb == NULL) {
2625                         /*
2626                          * We should have only got back the same inp. If we
2627                          * got back a different ep we have a problem. The
2628                          * original findep got back l_inp and now
2629                          */
2630                         if (l_inp != *inp_p) {
2631                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2632                         }
2633                 } else {
2634                         if (*locked_tcb == NULL) {
2635                                 /*
2636                                  * In this case we found the assoc only
2637                                  * after we locked the create lock. This
2638                                  * means we are in a colliding case and we
2639                                  * must make sure that we unlock the tcb if
2640                                  * its one of the cases where we throw away
2641                                  * the incoming packets.
2642                                  */
2643                                 *locked_tcb = *stcb;
2644
2645                                 /*
2646                                  * We must also increment the inp ref count
2647                                  * since the ref_count flags was set when we
2648                                  * did not find the TCB, now we found it
2649                                  * which reduces the refcount.. we must
2650                                  * raise it back out to balance it all :-)
2651                                  */
2652                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2653                                 if ((*stcb)->sctp_ep != l_inp) {
2654                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2655                                             (void *)(*stcb)->sctp_ep, (void *)l_inp);
2656                                 }
2657                         }
2658                 }
2659         }
2660         if (to == NULL) {
2661                 return (NULL);
2662         }
2663         cookie_len -= SCTP_SIGNATURE_SIZE;
2664         if (*stcb == NULL) {
2665                 /* this is the "normal" case... get a new TCB */
2666                 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
2667                     cookie, cookie_len, *inp_p,
2668                     netp, to, &notification,
2669                     auth_skipped, auth_offset, auth_len,
2670                     use_mflowid, mflowid,
2671                     vrf_id, port);
2672         } else {
2673                 /* this is abnormal... cookie-echo on existing TCB */
2674                 had_a_existing_tcb = 1;
2675                 *stcb = sctp_process_cookie_existing(m, iphlen, offset,
2676                     src, dst, sh,
2677                     cookie, cookie_len, *inp_p, *stcb, netp, to,
2678                     &notification, auth_skipped, auth_offset, auth_len,
2679                     use_mflowid, mflowid,
2680                     vrf_id, port);
2681         }
2682
2683         if (*stcb == NULL) {
2684                 /* still no TCB... must be bad cookie-echo */
2685                 return (NULL);
2686         }
2687         if ((*netp != NULL) && (use_mflowid != 0)) {
2688                 (*netp)->flowid = mflowid;
2689 #ifdef INVARIANTS
2690                 (*netp)->flowidset = 1;
2691 #endif
2692         }
2693         /*
2694          * Ok, we built an association so confirm the address we sent the
2695          * INIT-ACK to.
2696          */
2697         netl = sctp_findnet(*stcb, to);
2698         /*
2699          * This code should in theory NOT run but
2700          */
2701         if (netl == NULL) {
2702                 /* TSNH! Huh, why do I need to add this address here? */
2703                 if (sctp_add_remote_addr(*stcb, to, NULL, SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
2704                         return (NULL);
2705                 }
2706                 netl = sctp_findnet(*stcb, to);
2707         }
2708         if (netl) {
2709                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2710                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2711                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2712                             netl);
2713                         send_int_conf = 1;
2714                 }
2715         }
2716         sctp_start_net_timers(*stcb);
2717         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2718                 if (!had_a_existing_tcb ||
2719                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2720                         /*
2721                          * If we have a NEW cookie or the connect never
2722                          * reached the connected state during collision we
2723                          * must do the TCP accept thing.
2724                          */
2725                         struct socket *so, *oso;
2726                         struct sctp_inpcb *inp;
2727
2728                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2729                                 /*
2730                                  * For a restart we will keep the same
2731                                  * socket, no need to do anything. I THINK!!
2732                                  */
2733                                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2734                                 if (send_int_conf) {
2735                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2736                                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2737                                 }
2738                                 return (m);
2739                         }
2740                         oso = (*inp_p)->sctp_socket;
2741                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2742                         SCTP_TCB_UNLOCK((*stcb));
2743                         CURVNET_SET(oso->so_vnet);
2744                         so = sonewconn(oso, 0
2745                             );
2746                         CURVNET_RESTORE();
2747                         SCTP_TCB_LOCK((*stcb));
2748                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2749
2750                         if (so == NULL) {
2751                                 struct mbuf *op_err;
2752
2753 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2754                                 struct socket *pcb_so;
2755
2756 #endif
2757                                 /* Too many sockets */
2758                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2759                                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
2760                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
2761                                     src, dst, sh, op_err,
2762                                     use_mflowid, mflowid,
2763                                     vrf_id, port);
2764 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2765                                 pcb_so = SCTP_INP_SO(*inp_p);
2766                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2767                                 SCTP_TCB_UNLOCK((*stcb));
2768                                 SCTP_SOCKET_LOCK(pcb_so, 1);
2769                                 SCTP_TCB_LOCK((*stcb));
2770                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2771 #endif
2772                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2773 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2774                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
2775 #endif
2776                                 return (NULL);
2777                         }
2778                         inp = (struct sctp_inpcb *)so->so_pcb;
2779                         SCTP_INP_INCR_REF(inp);
2780                         /*
2781                          * We add the unbound flag here so that if we get an
2782                          * soabort() before we get the move_pcb done, we
2783                          * will properly cleanup.
2784                          */
2785                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2786                             SCTP_PCB_FLAGS_CONNECTED |
2787                             SCTP_PCB_FLAGS_IN_TCPPOOL |
2788                             SCTP_PCB_FLAGS_UNBOUND |
2789                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2790                             SCTP_PCB_FLAGS_DONT_WAKE);
2791                         inp->sctp_features = (*inp_p)->sctp_features;
2792                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
2793                         inp->sctp_socket = so;
2794                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2795                         inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
2796                         inp->sctp_ecn_enable = (*inp_p)->sctp_ecn_enable;
2797                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2798                         inp->sctp_context = (*inp_p)->sctp_context;
2799                         inp->local_strreset_support = (*inp_p)->local_strreset_support;
2800                         inp->inp_starting_point_for_iterator = NULL;
2801                         /*
2802                          * copy in the authentication parameters from the
2803                          * original endpoint
2804                          */
2805                         if (inp->sctp_ep.local_hmacs)
2806                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2807                         inp->sctp_ep.local_hmacs =
2808                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2809                         if (inp->sctp_ep.local_auth_chunks)
2810                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2811                         inp->sctp_ep.local_auth_chunks =
2812                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2813
2814                         /*
2815                          * Now we must move it from one hash table to
2816                          * another and get the tcb in the right place.
2817                          */
2818
2819                         /*
2820                          * This is where the one-2-one socket is put into
2821                          * the accept state waiting for the accept!
2822                          */
2823                         if (*stcb) {
2824                                 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
2825                         }
2826                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2827
2828                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2829                         SCTP_TCB_UNLOCK((*stcb));
2830
2831                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
2832                             0);
2833                         SCTP_TCB_LOCK((*stcb));
2834                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2835
2836
2837                         /*
2838                          * now we must check to see if we were aborted while
2839                          * the move was going on and the lock/unlock
2840                          * happened.
2841                          */
2842                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2843                                 /*
2844                                  * yep it was, we leave the assoc attached
2845                                  * to the socket since the sctp_inpcb_free()
2846                                  * call will send an abort for us.
2847                                  */
2848                                 SCTP_INP_DECR_REF(inp);
2849                                 return (NULL);
2850                         }
2851                         SCTP_INP_DECR_REF(inp);
2852                         /* Switch over to the new guy */
2853                         *inp_p = inp;
2854                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2855                         if (send_int_conf) {
2856                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2857                                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2858                         }
2859                         /*
2860                          * Pull it from the incomplete queue and wake the
2861                          * guy
2862                          */
2863 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2864                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2865                         SCTP_TCB_UNLOCK((*stcb));
2866                         SCTP_SOCKET_LOCK(so, 1);
2867 #endif
2868                         soisconnected(so);
2869 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2870                         SCTP_TCB_LOCK((*stcb));
2871                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2872                         SCTP_SOCKET_UNLOCK(so, 1);
2873 #endif
2874                         return (m);
2875                 }
2876         }
2877         if (notification) {
2878                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2879         }
2880         if (send_int_conf) {
2881                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2882                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2883         }
2884         return (m);
2885 }
2886
2887 static void
2888 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
2889     struct sctp_tcb *stcb, struct sctp_nets *net)
2890 {
2891         /* cp must not be used, others call this without a c-ack :-) */
2892         struct sctp_association *asoc;
2893
2894         SCTPDBG(SCTP_DEBUG_INPUT2,
2895             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2896         if (stcb == NULL)
2897                 return;
2898
2899         asoc = &stcb->asoc;
2900
2901         sctp_stop_all_cookie_timers(stcb);
2902         /* process according to association state */
2903         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2904                 /* state change only needed when I am in right state */
2905                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2906                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2907                 sctp_start_net_timers(stcb);
2908                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2909                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2910                             stcb->sctp_ep, stcb, asoc->primary_destination);
2911
2912                 }
2913                 /* update RTO */
2914                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2915                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2916                 if (asoc->overall_error_count == 0) {
2917                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
2918                             &asoc->time_entered, sctp_align_safe_nocopy,
2919                             SCTP_RTT_FROM_NON_DATA);
2920                 }
2921                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2922                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2923                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2924                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2925 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2926                         struct socket *so;
2927
2928 #endif
2929                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2930 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2931                         so = SCTP_INP_SO(stcb->sctp_ep);
2932                         atomic_add_int(&stcb->asoc.refcnt, 1);
2933                         SCTP_TCB_UNLOCK(stcb);
2934                         SCTP_SOCKET_LOCK(so, 1);
2935                         SCTP_TCB_LOCK(stcb);
2936                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2937 #endif
2938                         if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
2939                                 soisconnected(stcb->sctp_socket);
2940                         }
2941 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2942                         SCTP_SOCKET_UNLOCK(so, 1);
2943 #endif
2944                 }
2945                 /*
2946                  * since we did not send a HB make sure we don't double
2947                  * things
2948                  */
2949                 net->hb_responded = 1;
2950
2951                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2952                         /*
2953                          * We don't need to do the asconf thing, nor hb or
2954                          * autoclose if the socket is closed.
2955                          */
2956                         goto closed_socket;
2957                 }
2958                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2959                     stcb, net);
2960
2961
2962                 if (stcb->asoc.sctp_autoclose_ticks &&
2963                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2964                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2965                             stcb->sctp_ep, stcb, NULL);
2966                 }
2967                 /*
2968                  * send ASCONF if parameters are pending and ASCONFs are
2969                  * allowed (eg. addresses changed when init/cookie echo were
2970                  * in flight)
2971                  */
2972                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
2973                     (stcb->asoc.peer_supports_asconf) &&
2974                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
2975 #ifdef SCTP_TIMER_BASED_ASCONF
2976                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2977                             stcb->sctp_ep, stcb,
2978                             stcb->asoc.primary_destination);
2979 #else
2980                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
2981                             SCTP_ADDR_NOT_LOCKED);
2982 #endif
2983                 }
2984         }
2985 closed_socket:
2986         /* Toss the cookie if I can */
2987         sctp_toss_old_cookies(stcb, asoc);
2988         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
2989                 /* Restart the timer if we have pending data */
2990                 struct sctp_tmit_chunk *chk;
2991
2992                 chk = TAILQ_FIRST(&asoc->sent_queue);
2993                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
2994         }
2995 }
2996
2997 static void
2998 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
2999     struct sctp_tcb *stcb)
3000 {
3001         struct sctp_nets *net;
3002         struct sctp_tmit_chunk *lchk;
3003         struct sctp_ecne_chunk bkup;
3004         uint8_t override_bit;
3005         uint32_t tsn, window_data_tsn;
3006         int len;
3007         unsigned int pkt_cnt;
3008
3009         len = ntohs(cp->ch.chunk_length);
3010         if ((len != sizeof(struct sctp_ecne_chunk)) &&
3011             (len != sizeof(struct old_sctp_ecne_chunk))) {
3012                 return;
3013         }
3014         if (len == sizeof(struct old_sctp_ecne_chunk)) {
3015                 /* Its the old format */
3016                 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
3017                 bkup.num_pkts_since_cwr = htonl(1);
3018                 cp = &bkup;
3019         }
3020         SCTP_STAT_INCR(sctps_recvecne);
3021         tsn = ntohl(cp->tsn);
3022         pkt_cnt = ntohl(cp->num_pkts_since_cwr);
3023         lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
3024         if (lchk == NULL) {
3025                 window_data_tsn = stcb->asoc.sending_seq - 1;
3026         } else {
3027                 window_data_tsn = lchk->rec.data.TSN_seq;
3028         }
3029
3030         /* Find where it was sent to if possible. */
3031         net = NULL;
3032         TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
3033                 if (lchk->rec.data.TSN_seq == tsn) {
3034                         net = lchk->whoTo;
3035                         net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
3036                         break;
3037                 }
3038                 if (SCTP_TSN_GT(lchk->rec.data.TSN_seq, tsn)) {
3039                         break;
3040                 }
3041         }
3042         if (net == NULL) {
3043                 /*
3044                  * What to do. A previous send of a CWR was possibly lost.
3045                  * See how old it is, we may have it marked on the actual
3046                  * net.
3047                  */
3048                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3049                         if (tsn == net->last_cwr_tsn) {
3050                                 /* Found him, send it off */
3051                                 break;
3052                         }
3053                 }
3054                 if (net == NULL) {
3055                         /*
3056                          * If we reach here, we need to send a special CWR
3057                          * that says hey, we did this a long time ago and
3058                          * you lost the response.
3059                          */
3060                         net = TAILQ_FIRST(&stcb->asoc.nets);
3061                         if (net == NULL) {
3062                                 /* TSNH */
3063                                 return;
3064                         }
3065                         override_bit = SCTP_CWR_REDUCE_OVERRIDE;
3066                 } else {
3067                         override_bit = 0;
3068                 }
3069         } else {
3070                 override_bit = 0;
3071         }
3072         if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
3073             ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3074                 /*
3075                  * JRS - Use the congestion control given in the pluggable
3076                  * CC module
3077                  */
3078                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
3079                 /*
3080                  * We reduce once every RTT. So we will only lower cwnd at
3081                  * the next sending seq i.e. the window_data_tsn
3082                  */
3083                 net->cwr_window_tsn = window_data_tsn;
3084                 net->ecn_ce_pkt_cnt += pkt_cnt;
3085                 net->lost_cnt = pkt_cnt;
3086                 net->last_cwr_tsn = tsn;
3087         } else {
3088                 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
3089                 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
3090                     ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3091                         /*
3092                          * Another loss in the same window update how many
3093                          * marks/packets lost we have had.
3094                          */
3095                         int cnt = 1;
3096
3097                         if (pkt_cnt > net->lost_cnt) {
3098                                 /* Should be the case */
3099                                 cnt = (pkt_cnt - net->lost_cnt);
3100                                 net->ecn_ce_pkt_cnt += cnt;
3101                         }
3102                         net->lost_cnt = pkt_cnt;
3103                         net->last_cwr_tsn = tsn;
3104                         /*
3105                          * Most CC functions will ignore this call, since we
3106                          * are in-window yet of the initial CE the peer saw.
3107                          */
3108                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
3109                 }
3110         }
3111         /*
3112          * We always send a CWR this way if our previous one was lost our
3113          * peer will get an update, or if it is not time again to reduce we
3114          * still get the cwr to the peer. Note we set the override when we
3115          * could not find the TSN on the chunk or the destination network.
3116          */
3117         sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
3118 }
3119
3120 static void
3121 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
3122 {
3123         /*
3124          * Here we get a CWR from the peer. We must look in the outqueue and
3125          * make sure that we have a covered ECNE in the control chunk part.
3126          * If so remove it.
3127          */
3128         struct sctp_tmit_chunk *chk;
3129         struct sctp_ecne_chunk *ecne;
3130         int override;
3131         uint32_t cwr_tsn;
3132
3133         cwr_tsn = ntohl(cp->tsn);
3134
3135         override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
3136         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
3137                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
3138                         continue;
3139                 }
3140                 if ((override == 0) && (chk->whoTo != net)) {
3141                         /* Must be from the right src unless override is set */
3142                         continue;
3143                 }
3144                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
3145                 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
3146                         /* this covers this ECNE, we can remove it */
3147                         stcb->asoc.ecn_echo_cnt_onq--;
3148                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
3149                             sctp_next);
3150                         if (chk->data) {
3151                                 sctp_m_freem(chk->data);
3152                                 chk->data = NULL;
3153                         }
3154                         stcb->asoc.ctrl_queue_cnt--;
3155                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3156                         if (override == 0) {
3157                                 break;
3158                         }
3159                 }
3160         }
3161 }
3162
3163 static void
3164 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
3165     struct sctp_tcb *stcb, struct sctp_nets *net)
3166 {
3167         struct sctp_association *asoc;
3168
3169 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3170         struct socket *so;
3171
3172 #endif
3173
3174         SCTPDBG(SCTP_DEBUG_INPUT2,
3175             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
3176         if (stcb == NULL)
3177                 return;
3178
3179         asoc = &stcb->asoc;
3180         /* process according to association state */
3181         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
3182                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
3183                 SCTPDBG(SCTP_DEBUG_INPUT2,
3184                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
3185                 SCTP_TCB_UNLOCK(stcb);
3186                 return;
3187         }
3188         /* notify upper layer protocol */
3189         if (stcb->sctp_socket) {
3190                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3191                 /* are the queues empty? they should be */
3192                 if (!TAILQ_EMPTY(&asoc->send_queue) ||
3193                     !TAILQ_EMPTY(&asoc->sent_queue) ||
3194                     !stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
3195                         sctp_report_all_outbound(stcb, 0, 0, SCTP_SO_NOT_LOCKED);
3196                 }
3197         }
3198         /* stop the timer */
3199         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
3200         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
3201         /* free the TCB */
3202         SCTPDBG(SCTP_DEBUG_INPUT2,
3203             "sctp_handle_shutdown_complete: calls free-asoc\n");
3204 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3205         so = SCTP_INP_SO(stcb->sctp_ep);
3206         atomic_add_int(&stcb->asoc.refcnt, 1);
3207         SCTP_TCB_UNLOCK(stcb);
3208         SCTP_SOCKET_LOCK(so, 1);
3209         SCTP_TCB_LOCK(stcb);
3210         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3211 #endif
3212         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
3213 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3214         SCTP_SOCKET_UNLOCK(so, 1);
3215 #endif
3216         return;
3217 }
3218
3219 static int
3220 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
3221     struct sctp_nets *net, uint8_t flg)
3222 {
3223         switch (desc->chunk_type) {
3224         case SCTP_DATA:
3225                 /* find the tsn to resend (possibly */
3226                 {
3227                         uint32_t tsn;
3228                         struct sctp_tmit_chunk *tp1;
3229
3230                         tsn = ntohl(desc->tsn_ifany);
3231                         TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3232                                 if (tp1->rec.data.TSN_seq == tsn) {
3233                                         /* found it */
3234                                         break;
3235                                 }
3236                                 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, tsn)) {
3237                                         /* not found */
3238                                         tp1 = NULL;
3239                                         break;
3240                                 }
3241                         }
3242                         if (tp1 == NULL) {
3243                                 /*
3244                                  * Do it the other way , aka without paying
3245                                  * attention to queue seq order.
3246                                  */
3247                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
3248                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3249                                         if (tp1->rec.data.TSN_seq == tsn) {
3250                                                 /* found it */
3251                                                 break;
3252                                         }
3253                                 }
3254                         }
3255                         if (tp1 == NULL) {
3256                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
3257                         }
3258                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
3259                                 uint8_t *ddp;
3260
3261                                 if (((flg & SCTP_BADCRC) == 0) &&
3262                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3263                                         return (0);
3264                                 }
3265                                 if ((stcb->asoc.peers_rwnd == 0) &&
3266                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3267                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
3268                                         return (0);
3269                                 }
3270                                 if (stcb->asoc.peers_rwnd == 0 &&
3271                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
3272                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
3273                                         return (0);
3274                                 }
3275                                 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
3276                                     sizeof(struct sctp_data_chunk));
3277                                 {
3278                                         unsigned int iii;
3279
3280                                         for (iii = 0; iii < sizeof(desc->data_bytes);
3281                                             iii++) {
3282                                                 if (ddp[iii] != desc->data_bytes[iii]) {
3283                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
3284                                                         return (-1);
3285                                                 }
3286                                         }
3287                                 }
3288
3289                                 if (tp1->do_rtt) {
3290                                         /*
3291                                          * this guy had a RTO calculation
3292                                          * pending on it, cancel it
3293                                          */
3294                                         if (tp1->whoTo->rto_needed == 0) {
3295                                                 tp1->whoTo->rto_needed = 1;
3296                                         }
3297                                         tp1->do_rtt = 0;
3298                                 }
3299                                 SCTP_STAT_INCR(sctps_pdrpmark);
3300                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
3301                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3302                                 /*
3303                                  * mark it as if we were doing a FR, since
3304                                  * we will be getting gap ack reports behind
3305                                  * the info from the router.
3306                                  */
3307                                 tp1->rec.data.doing_fast_retransmit = 1;
3308                                 /*
3309                                  * mark the tsn with what sequences can
3310                                  * cause a new FR.
3311                                  */
3312                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
3313                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
3314                                 } else {
3315                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
3316                                 }
3317
3318                                 /* restart the timer */
3319                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3320                                     stcb, tp1->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
3321                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3322                                     stcb, tp1->whoTo);
3323
3324                                 /* fix counts and things */
3325                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3326                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
3327                                             tp1->whoTo->flight_size,
3328                                             tp1->book_size,
3329                                             (uintptr_t) stcb,
3330                                             tp1->rec.data.TSN_seq);
3331                                 }
3332                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3333                                         sctp_flight_size_decrease(tp1);
3334                                         sctp_total_flight_decrease(stcb, tp1);
3335                                 }
3336                                 tp1->sent = SCTP_DATAGRAM_RESEND;
3337                         } {
3338                                 /* audit code */
3339                                 unsigned int audit;
3340
3341                                 audit = 0;
3342                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3343                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
3344                                                 audit++;
3345                                 }
3346                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
3347                                     sctp_next) {
3348                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
3349                                                 audit++;
3350                                 }
3351                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
3352                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
3353                                             audit, stcb->asoc.sent_queue_retran_cnt);
3354 #ifndef SCTP_AUDITING_ENABLED
3355                                         stcb->asoc.sent_queue_retran_cnt = audit;
3356 #endif
3357                                 }
3358                         }
3359                 }
3360                 break;
3361         case SCTP_ASCONF:
3362                 {
3363                         struct sctp_tmit_chunk *asconf;
3364
3365                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3366                             sctp_next) {
3367                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3368                                         break;
3369                                 }
3370                         }
3371                         if (asconf) {
3372                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
3373                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3374                                 asconf->sent = SCTP_DATAGRAM_RESEND;
3375                                 asconf->snd_count--;
3376                         }
3377                 }
3378                 break;
3379         case SCTP_INITIATION:
3380                 /* resend the INIT */
3381                 stcb->asoc.dropped_special_cnt++;
3382                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3383                         /*
3384                          * If we can get it in, in a few attempts we do
3385                          * this, otherwise we let the timer fire.
3386                          */
3387                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3388                             stcb, net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3389                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3390                 }
3391                 break;
3392         case SCTP_SELECTIVE_ACK:
3393         case SCTP_NR_SELECTIVE_ACK:
3394                 /* resend the sack */
3395                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
3396                 break;
3397         case SCTP_HEARTBEAT_REQUEST:
3398                 /* resend a demand HB */
3399                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3400                         /*
3401                          * Only retransmit if we KNOW we wont destroy the
3402                          * tcb
3403                          */
3404                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
3405                 }
3406                 break;
3407         case SCTP_SHUTDOWN:
3408                 sctp_send_shutdown(stcb, net);
3409                 break;
3410         case SCTP_SHUTDOWN_ACK:
3411                 sctp_send_shutdown_ack(stcb, net);
3412                 break;
3413         case SCTP_COOKIE_ECHO:
3414                 {
3415                         struct sctp_tmit_chunk *cookie;
3416
3417                         cookie = NULL;
3418                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3419                             sctp_next) {
3420                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3421                                         break;
3422                                 }
3423                         }
3424                         if (cookie) {
3425                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
3426                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3427                                 cookie->sent = SCTP_DATAGRAM_RESEND;
3428                                 sctp_stop_all_cookie_timers(stcb);
3429                         }
3430                 }
3431                 break;
3432         case SCTP_COOKIE_ACK:
3433                 sctp_send_cookie_ack(stcb);
3434                 break;
3435         case SCTP_ASCONF_ACK:
3436                 /* resend last asconf ack */
3437                 sctp_send_asconf_ack(stcb);
3438                 break;
3439         case SCTP_FORWARD_CUM_TSN:
3440                 send_forward_tsn(stcb, &stcb->asoc);
3441                 break;
3442                 /* can't do anything with these */
3443         case SCTP_PACKET_DROPPED:
3444         case SCTP_INITIATION_ACK:       /* this should not happen */
3445         case SCTP_HEARTBEAT_ACK:
3446         case SCTP_ABORT_ASSOCIATION:
3447         case SCTP_OPERATION_ERROR:
3448         case SCTP_SHUTDOWN_COMPLETE:
3449         case SCTP_ECN_ECHO:
3450         case SCTP_ECN_CWR:
3451         default:
3452                 break;
3453         }
3454         return (0);
3455 }
3456
3457 void
3458 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3459 {
3460         uint32_t i;
3461         uint16_t temp;
3462
3463         /*
3464          * We set things to 0xffff since this is the last delivered sequence
3465          * and we will be sending in 0 after the reset.
3466          */
3467
3468         if (number_entries) {
3469                 for (i = 0; i < number_entries; i++) {
3470                         temp = ntohs(list[i]);
3471                         if (temp >= stcb->asoc.streamincnt) {
3472                                 continue;
3473                         }
3474                         stcb->asoc.strmin[temp].last_sequence_delivered = 0xffff;
3475                 }
3476         } else {
3477                 list = NULL;
3478                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
3479                         stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
3480                 }
3481         }
3482         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3483 }
3484
3485 static void
3486 sctp_reset_out_streams(struct sctp_tcb *stcb, int number_entries, uint16_t * list)
3487 {
3488         int i;
3489
3490         if (number_entries == 0) {
3491                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3492                         stcb->asoc.strmout[i].next_sequence_sent = 0;
3493                 }
3494         } else if (number_entries) {
3495                 for (i = 0; i < number_entries; i++) {
3496                         uint16_t temp;
3497
3498                         temp = ntohs(list[i]);
3499                         if (temp >= stcb->asoc.streamoutcnt) {
3500                                 /* no such stream */
3501                                 continue;
3502                         }
3503                         stcb->asoc.strmout[temp].next_sequence_sent = 0;
3504                 }
3505         }
3506         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3507 }
3508
3509
3510 struct sctp_stream_reset_out_request *
3511 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3512 {
3513         struct sctp_association *asoc;
3514         struct sctp_chunkhdr *ch;
3515         struct sctp_stream_reset_out_request *r;
3516         struct sctp_tmit_chunk *chk;
3517         int len, clen;
3518
3519         asoc = &stcb->asoc;
3520         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
3521                 asoc->stream_reset_outstanding = 0;
3522                 return (NULL);
3523         }
3524         if (stcb->asoc.str_reset == NULL) {
3525                 asoc->stream_reset_outstanding = 0;
3526                 return (NULL);
3527         }
3528         chk = stcb->asoc.str_reset;
3529         if (chk->data == NULL) {
3530                 return (NULL);
3531         }
3532         if (bchk) {
3533                 /* he wants a copy of the chk pointer */
3534                 *bchk = chk;
3535         }
3536         clen = chk->send_size;
3537         ch = mtod(chk->data, struct sctp_chunkhdr *);
3538         r = (struct sctp_stream_reset_out_request *)(ch + 1);
3539         if (ntohl(r->request_seq) == seq) {
3540                 /* found it */
3541                 return (r);
3542         }
3543         len = SCTP_SIZE32(ntohs(r->ph.param_length));
3544         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3545                 /* move to the next one, there can only be a max of two */
3546                 r = (struct sctp_stream_reset_out_request *)((caddr_t)r + len);
3547                 if (ntohl(r->request_seq) == seq) {
3548                         return (r);
3549                 }
3550         }
3551         /* that seq is not here */
3552         return (NULL);
3553 }
3554
3555 static void
3556 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3557 {
3558         struct sctp_association *asoc;
3559         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
3560
3561         if (stcb->asoc.str_reset == NULL) {
3562                 return;
3563         }
3564         asoc = &stcb->asoc;
3565
3566         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3567         TAILQ_REMOVE(&asoc->control_send_queue,
3568             chk,
3569             sctp_next);
3570         if (chk->data) {
3571                 sctp_m_freem(chk->data);
3572                 chk->data = NULL;
3573         }
3574         asoc->ctrl_queue_cnt--;
3575         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3576         /* sa_ignore NO_NULL_CHK */
3577         stcb->asoc.str_reset = NULL;
3578 }
3579
3580
3581 static int
3582 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3583     uint32_t seq, uint32_t action,
3584     struct sctp_stream_reset_response *respin)
3585 {
3586         uint16_t type;
3587         int lparm_len;
3588         struct sctp_association *asoc = &stcb->asoc;
3589         struct sctp_tmit_chunk *chk;
3590         struct sctp_stream_reset_out_request *srparam;
3591         int number_entries;
3592
3593         if (asoc->stream_reset_outstanding == 0) {
3594                 /* duplicate */
3595                 return (0);
3596         }
3597         if (seq == stcb->asoc.str_reset_seq_out) {
3598                 srparam = sctp_find_stream_reset(stcb, seq, &chk);
3599                 if (srparam) {
3600                         stcb->asoc.str_reset_seq_out++;
3601                         type = ntohs(srparam->ph.param_type);
3602                         lparm_len = ntohs(srparam->ph.param_length);
3603                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
3604                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3605                                 asoc->stream_reset_out_is_outstanding = 0;
3606                                 if (asoc->stream_reset_outstanding)
3607                                         asoc->stream_reset_outstanding--;
3608                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3609                                         /* do it */
3610                                         sctp_reset_out_streams(stcb, number_entries, srparam->list_of_streams);
3611                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3612                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
3613                                 } else {
3614                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
3615                                 }
3616                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
3617                                 /* Answered my request */
3618                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3619                                 if (asoc->stream_reset_outstanding)
3620                                         asoc->stream_reset_outstanding--;
3621                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3622                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
3623                                             number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
3624                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3625                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
3626                                             number_entries, srparam->list_of_streams, SCTP_SO_NOT_LOCKED);
3627                                 }
3628                         } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
3629                                 /* Ok we now may have more streams */
3630                                 int num_stream;
3631
3632                                 num_stream = stcb->asoc.strm_pending_add_size;
3633                                 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
3634                                         /* TSNH */
3635                                         num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
3636                                 }
3637                                 stcb->asoc.strm_pending_add_size = 0;
3638                                 if (asoc->stream_reset_outstanding)
3639                                         asoc->stream_reset_outstanding--;
3640                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3641                                         /* Put the new streams into effect */
3642                                         stcb->asoc.streamoutcnt += num_stream;
3643                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3644                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3645                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3646                                             SCTP_STREAM_CHANGE_DENIED);
3647                                 } else {
3648                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3649                                             SCTP_STREAM_CHANGE_FAILED);
3650                                 }
3651                         } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
3652                                 if (asoc->stream_reset_outstanding)
3653                                         asoc->stream_reset_outstanding--;
3654                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3655                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3656                                             SCTP_STREAM_CHANGE_DENIED);
3657                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3658                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3659                                             SCTP_STREAM_CHANGE_FAILED);
3660                                 }
3661                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3662                                 /**
3663                                  * a) Adopt the new in tsn.
3664                                  * b) reset the map
3665                                  * c) Adopt the new out-tsn
3666                                  */
3667                                 struct sctp_stream_reset_response_tsn *resp;
3668                                 struct sctp_forward_tsn_chunk fwdtsn;
3669                                 int abort_flag = 0;
3670
3671                                 if (respin == NULL) {
3672                                         /* huh ? */
3673                                         return (0);
3674                                 }
3675                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3676                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
3677                                         asoc->stream_reset_outstanding--;
3678                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3679                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3680                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3681                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3682                                         if (abort_flag) {
3683                                                 return (1);
3684                                         }
3685                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3686                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3687                                                 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3688                                         }
3689                                         stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3690                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3691                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3692
3693                                         stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
3694                                         memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
3695
3696                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3697                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3698
3699                                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3700                                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3701                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
3702                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3703                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3704                                             SCTP_ASSOC_RESET_DENIED);
3705                                 } else {
3706                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3707                                             SCTP_ASSOC_RESET_FAILED);
3708                                 }
3709                         }
3710                         /* get rid of the request and get the request flags */
3711                         if (asoc->stream_reset_outstanding == 0) {
3712                                 sctp_clean_up_stream_reset(stcb);
3713                         }
3714                 }
3715         }
3716         return (0);
3717 }
3718
3719 static void
3720 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
3721     struct sctp_tmit_chunk *chk,
3722     struct sctp_stream_reset_in_request *req, int trunc)
3723 {
3724         uint32_t seq;
3725         int len, i;
3726         int number_entries;
3727         uint16_t temp;
3728
3729         /*
3730          * peer wants me to send a str-reset to him for my outgoing seq's if
3731          * seq_in is right.
3732          */
3733         struct sctp_association *asoc = &stcb->asoc;
3734
3735         seq = ntohl(req->request_seq);
3736         if (asoc->str_reset_seq_in == seq) {
3737                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3738                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3739                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3740                 } else if (trunc) {
3741                         /* Can't do it, since they exceeded our buffer size  */
3742                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3743                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
3744                         len = ntohs(req->ph.param_length);
3745                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
3746                         for (i = 0; i < number_entries; i++) {
3747                                 temp = ntohs(req->list_of_streams[i]);
3748                                 req->list_of_streams[i] = temp;
3749                         }
3750                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3751                         sctp_add_stream_reset_out(chk, number_entries, req->list_of_streams,
3752                             asoc->str_reset_seq_out,
3753                             seq, (asoc->sending_seq - 1));
3754                         asoc->stream_reset_out_is_outstanding = 1;
3755                         asoc->str_reset = chk;
3756                         sctp_timer_start(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb, chk->whoTo);
3757                         stcb->asoc.stream_reset_outstanding++;
3758                 } else {
3759                         /* Can't do it, since we have sent one out */
3760                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
3761                 }
3762                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3763                 asoc->str_reset_seq_in++;
3764         } else if (asoc->str_reset_seq_in - 1 == seq) {
3765                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3766         } else if (asoc->str_reset_seq_in - 2 == seq) {
3767                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3768         } else {
3769                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3770         }
3771 }
3772
3773 static int
3774 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3775     struct sctp_tmit_chunk *chk,
3776     struct sctp_stream_reset_tsn_request *req)
3777 {
3778         /* reset all in and out and update the tsn */
3779         /*
3780          * A) reset my str-seq's on in and out. B) Select a receive next,
3781          * and set cum-ack to it. Also process this selected number as a
3782          * fwd-tsn as well. C) set in the response my next sending seq.
3783          */
3784         struct sctp_forward_tsn_chunk fwdtsn;
3785         struct sctp_association *asoc = &stcb->asoc;
3786         int abort_flag = 0;
3787         uint32_t seq;
3788
3789         seq = ntohl(req->request_seq);
3790         if (asoc->str_reset_seq_in == seq) {
3791                 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
3792                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
3793                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3794                 } else {
3795                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3796                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3797                         fwdtsn.ch.chunk_flags = 0;
3798                         fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3799                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3800                         if (abort_flag) {
3801                                 return (1);
3802                         }
3803                         asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3804                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3805                                 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3806                         }
3807                         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
3808                         asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
3809                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
3810                         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
3811                         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
3812                         atomic_add_int(&asoc->sending_seq, 1);
3813                         /* save off historical data for retrans */
3814                         asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
3815                         asoc->last_sending_seq[0] = asoc->sending_seq;
3816                         asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
3817                         asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
3818                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3819                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3820                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3821                         sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
3822                 }
3823                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3824                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3825                 asoc->str_reset_seq_in++;
3826         } else if (asoc->str_reset_seq_in - 1 == seq) {
3827                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3828                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3829         } else if (asoc->str_reset_seq_in - 2 == seq) {
3830                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3831                     asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
3832         } else {
3833                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3834         }
3835         return (0);
3836 }
3837
3838 static void
3839 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3840     struct sctp_tmit_chunk *chk,
3841     struct sctp_stream_reset_out_request *req, int trunc)
3842 {
3843         uint32_t seq, tsn;
3844         int number_entries, len;
3845         struct sctp_association *asoc = &stcb->asoc;
3846
3847         seq = ntohl(req->request_seq);
3848
3849         /* now if its not a duplicate we process it */
3850         if (asoc->str_reset_seq_in == seq) {
3851                 len = ntohs(req->ph.param_length);
3852                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3853                 /*
3854                  * the sender is resetting, handle the list issue.. we must
3855                  * a) verify if we can do the reset, if so no problem b) If
3856                  * we can't do the reset we must copy the request. c) queue
3857                  * it, and setup the data in processor to trigger it off
3858                  * when needed and dequeue all the queued data.
3859                  */
3860                 tsn = ntohl(req->send_reset_at_tsn);
3861
3862                 /* move the reset action back one */
3863                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3864                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3865                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3866                 } else if (trunc) {
3867                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3868                 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
3869                         /* we can do it now */
3870                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3871                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3872                 } else {
3873                         /*
3874                          * we must queue it up and thus wait for the TSN's
3875                          * to arrive that are at or before tsn
3876                          */
3877                         struct sctp_stream_reset_list *liste;
3878                         int siz;
3879
3880                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3881                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3882                             siz, SCTP_M_STRESET);
3883                         if (liste == NULL) {
3884                                 /* gak out of memory */
3885                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3886                                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3887                                 return;
3888                         }
3889                         liste->tsn = tsn;
3890                         liste->number_entries = number_entries;
3891                         memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
3892                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3893                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3894                 }
3895                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3896                 asoc->str_reset_seq_in++;
3897         } else if ((asoc->str_reset_seq_in - 1) == seq) {
3898                 /*
3899                  * one seq back, just echo back last action since my
3900                  * response was lost.
3901                  */
3902                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3903         } else if ((asoc->str_reset_seq_in - 2) == seq) {
3904                 /*
3905                  * two seq back, just echo back last action since my
3906                  * response was lost.
3907                  */
3908                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3909         } else {
3910                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3911         }
3912 }
3913
3914 static void
3915 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
3916     struct sctp_stream_reset_add_strm *str_add)
3917 {
3918         /*
3919          * Peer is requesting to add more streams. If its within our
3920          * max-streams we will allow it.
3921          */
3922         uint32_t num_stream, i;
3923         uint32_t seq;
3924         struct sctp_association *asoc = &stcb->asoc;
3925         struct sctp_queued_to_read *ctl, *nctl;
3926
3927         /* Get the number. */
3928         seq = ntohl(str_add->request_seq);
3929         num_stream = ntohs(str_add->number_of_streams);
3930         /* Now what would be the new total? */
3931         if (asoc->str_reset_seq_in == seq) {
3932                 num_stream += stcb->asoc.streamincnt;
3933                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
3934                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
3935                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3936                 } else if ((num_stream > stcb->asoc.max_inbound_streams) ||
3937                     (num_stream > 0xffff)) {
3938                         /* We must reject it they ask for to many */
3939         denied:
3940                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3941                 } else {
3942                         /* Ok, we can do that :-) */
3943                         struct sctp_stream_in *oldstrm;
3944
3945                         /* save off the old */
3946                         oldstrm = stcb->asoc.strmin;
3947                         SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
3948                             (num_stream * sizeof(struct sctp_stream_in)),
3949                             SCTP_M_STRMI);
3950                         if (stcb->asoc.strmin == NULL) {
3951                                 stcb->asoc.strmin = oldstrm;
3952                                 goto denied;
3953                         }
3954                         /* copy off the old data */
3955                         for (i = 0; i < stcb->asoc.streamincnt; i++) {
3956                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
3957                                 stcb->asoc.strmin[i].stream_no = i;
3958                                 stcb->asoc.strmin[i].last_sequence_delivered = oldstrm[i].last_sequence_delivered;
3959                                 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
3960                                 /* now anything on those queues? */
3961                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next, nctl) {
3962                                         TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next);
3963                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next);
3964                                 }
3965                         }
3966                         /* Init the new streams */
3967                         for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
3968                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
3969                                 stcb->asoc.strmin[i].stream_no = i;
3970                                 stcb->asoc.strmin[i].last_sequence_delivered = 0xffff;
3971                                 stcb->asoc.strmin[i].delivery_started = 0;
3972                         }
3973                         SCTP_FREE(oldstrm, SCTP_M_STRMI);
3974                         /* update the size */
3975                         stcb->asoc.streamincnt = num_stream;
3976                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3977                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3978                 }
3979                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3980                 asoc->str_reset_seq_in++;
3981         } else if ((asoc->str_reset_seq_in - 1) == seq) {
3982                 /*
3983                  * one seq back, just echo back last action since my
3984                  * response was lost.
3985                  */
3986                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3987         } else if ((asoc->str_reset_seq_in - 2) == seq) {
3988                 /*
3989                  * two seq back, just echo back last action since my
3990                  * response was lost.
3991                  */
3992                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3993         } else {
3994                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3995
3996         }
3997 }
3998
3999 static void
4000 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4001     struct sctp_stream_reset_add_strm *str_add)
4002 {
4003         /*
4004          * Peer is requesting to add more streams. If its within our
4005          * max-streams we will allow it.
4006          */
4007         uint16_t num_stream;
4008         uint32_t seq;
4009         struct sctp_association *asoc = &stcb->asoc;
4010
4011         /* Get the number. */
4012         seq = ntohl(str_add->request_seq);
4013         num_stream = ntohs(str_add->number_of_streams);
4014         /* Now what would be the new total? */
4015         if (asoc->str_reset_seq_in == seq) {
4016                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4017                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4018                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4019                 } else if (stcb->asoc.stream_reset_outstanding) {
4020                         /* We must reject it we have something pending */
4021                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
4022                 } else {
4023                         /* Ok, we can do that :-) */
4024                         int mychk;
4025
4026                         mychk = stcb->asoc.streamoutcnt;
4027                         mychk += num_stream;
4028                         if (mychk < 0x10000) {
4029                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4030                                 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 0, 1, num_stream, 0, 1)) {
4031                                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4032                                 }
4033                         } else {
4034                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4035                         }
4036                 }
4037                 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
4038                 asoc->str_reset_seq_in++;
4039         } else if ((asoc->str_reset_seq_in - 1) == seq) {
4040                 /*
4041                  * one seq back, just echo back last action since my
4042                  * response was lost.
4043                  */
4044                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4045         } else if ((asoc->str_reset_seq_in - 2) == seq) {
4046                 /*
4047                  * two seq back, just echo back last action since my
4048                  * response was lost.
4049                  */
4050                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4051         } else {
4052                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4053         }
4054 }
4055
4056 #ifdef __GNUC__
4057 __attribute__((noinline))
4058 #endif
4059         static int
4060             sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
4061         struct sctp_chunkhdr *ch_req)
4062 {
4063         int chk_length, param_len, ptype;
4064         struct sctp_paramhdr pstore;
4065         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
4066         uint32_t seq = 0;
4067         int num_req = 0;
4068         int trunc = 0;
4069         struct sctp_tmit_chunk *chk;
4070         struct sctp_chunkhdr *ch;
4071         struct sctp_paramhdr *ph;
4072         int ret_code = 0;
4073         int num_param = 0;
4074
4075         /* now it may be a reset or a reset-response */
4076         chk_length = ntohs(ch_req->chunk_length);
4077
4078         /* setup for adding the response */
4079         sctp_alloc_a_chunk(stcb, chk);
4080         if (chk == NULL) {
4081                 return (ret_code);
4082         }
4083         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
4084         chk->rec.chunk_id.can_take_data = 0;
4085         chk->asoc = &stcb->asoc;
4086         chk->no_fr_allowed = 0;
4087         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
4088         chk->book_size_scale = 0;
4089         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
4090         if (chk->data == NULL) {
4091 strres_nochunk:
4092                 if (chk->data) {
4093                         sctp_m_freem(chk->data);
4094                         chk->data = NULL;
4095                 }
4096                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
4097                 return (ret_code);
4098         }
4099         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
4100
4101         /* setup chunk parameters */
4102         chk->sent = SCTP_DATAGRAM_UNSENT;
4103         chk->snd_count = 0;
4104         chk->whoTo = NULL;
4105
4106         ch = mtod(chk->data, struct sctp_chunkhdr *);
4107         ch->chunk_type = SCTP_STREAM_RESET;
4108         ch->chunk_flags = 0;
4109         ch->chunk_length = htons(chk->send_size);
4110         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
4111         offset += sizeof(struct sctp_chunkhdr);
4112         while ((size_t)chk_length >= sizeof(struct sctp_stream_reset_tsn_request)) {
4113                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *) & pstore);
4114                 if (ph == NULL)
4115                         break;
4116                 param_len = ntohs(ph->param_length);
4117                 if (param_len < (int)sizeof(struct sctp_stream_reset_tsn_request)) {
4118                         /* bad param */
4119                         break;
4120                 }
4121                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, (int)sizeof(cstore)),
4122                     (uint8_t *) & cstore);
4123                 ptype = ntohs(ph->param_type);
4124                 num_param++;
4125                 if (param_len > (int)sizeof(cstore)) {
4126                         trunc = 1;
4127                 } else {
4128                         trunc = 0;
4129                 }
4130                 if (num_param > SCTP_MAX_RESET_PARAMS) {
4131                         /* hit the max of parameters already sorry.. */
4132                         break;
4133                 }
4134                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
4135                         struct sctp_stream_reset_out_request *req_out;
4136
4137                         req_out = (struct sctp_stream_reset_out_request *)ph;
4138                         num_req++;
4139                         if (stcb->asoc.stream_reset_outstanding) {
4140                                 seq = ntohl(req_out->response_seq);
4141                                 if (seq == stcb->asoc.str_reset_seq_out) {
4142                                         /* implicit ack */
4143                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
4144                                 }
4145                         }
4146                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
4147                 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
4148                         struct sctp_stream_reset_add_strm *str_add;
4149
4150                         str_add = (struct sctp_stream_reset_add_strm *)ph;
4151                         num_req++;
4152                         sctp_handle_str_reset_add_strm(stcb, chk, str_add);
4153                 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
4154                         struct sctp_stream_reset_add_strm *str_add;
4155
4156                         str_add = (struct sctp_stream_reset_add_strm *)ph;
4157                         num_req++;
4158                         sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
4159                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
4160                         struct sctp_stream_reset_in_request *req_in;
4161
4162                         num_req++;
4163                         req_in = (struct sctp_stream_reset_in_request *)ph;
4164                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
4165                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
4166                         struct sctp_stream_reset_tsn_request *req_tsn;
4167
4168                         num_req++;
4169                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
4170                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
4171                                 ret_code = 1;
4172                                 goto strres_nochunk;
4173                         }
4174                         /* no more */
4175                         break;
4176                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
4177                         struct sctp_stream_reset_response *resp;
4178                         uint32_t result;
4179
4180                         resp = (struct sctp_stream_reset_response *)ph;
4181                         seq = ntohl(resp->response_seq);
4182                         result = ntohl(resp->result);
4183                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
4184                                 ret_code = 1;
4185                                 goto strres_nochunk;
4186                         }
4187                 } else {
4188                         break;
4189                 }
4190                 offset += SCTP_SIZE32(param_len);
4191                 chk_length -= SCTP_SIZE32(param_len);
4192         }
4193         if (num_req == 0) {
4194                 /* we have no response free the stuff */
4195                 goto strres_nochunk;
4196         }
4197         /* ok we have a chunk to link in */
4198         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
4199             chk,
4200             sctp_next);
4201         stcb->asoc.ctrl_queue_cnt++;
4202         return (ret_code);
4203 }
4204
4205 /*
4206  * Handle a router or endpoints report of a packet loss, there are two ways
4207  * to handle this, either we get the whole packet and must disect it
4208  * ourselves (possibly with truncation and or corruption) or it is a summary
4209  * from a middle box that did the disectting for us.
4210  */
4211 static void
4212 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
4213     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
4214 {
4215         uint32_t bottle_bw, on_queue;
4216         uint16_t trunc_len;
4217         unsigned int chlen;
4218         unsigned int at;
4219         struct sctp_chunk_desc desc;
4220         struct sctp_chunkhdr *ch;
4221
4222         chlen = ntohs(cp->ch.chunk_length);
4223         chlen -= sizeof(struct sctp_pktdrop_chunk);
4224         /* XXX possible chlen underflow */
4225         if (chlen == 0) {
4226                 ch = NULL;
4227                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
4228                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
4229         } else {
4230                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
4231                 chlen -= sizeof(struct sctphdr);
4232                 /* XXX possible chlen underflow */
4233                 memset(&desc, 0, sizeof(desc));
4234         }
4235         trunc_len = (uint16_t) ntohs(cp->trunc_len);
4236         if (trunc_len > limit) {
4237                 trunc_len = limit;
4238         }
4239         /* now the chunks themselves */
4240         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
4241                 desc.chunk_type = ch->chunk_type;
4242                 /* get amount we need to move */
4243                 at = ntohs(ch->chunk_length);
4244                 if (at < sizeof(struct sctp_chunkhdr)) {
4245                         /* corrupt chunk, maybe at the end? */
4246                         SCTP_STAT_INCR(sctps_pdrpcrupt);
4247                         break;
4248                 }
4249                 if (trunc_len == 0) {
4250                         /* we are supposed to have all of it */
4251                         if (at > chlen) {
4252                                 /* corrupt skip it */
4253                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
4254                                 break;
4255                         }
4256                 } else {
4257                         /* is there enough of it left ? */
4258                         if (desc.chunk_type == SCTP_DATA) {
4259                                 if (chlen < (sizeof(struct sctp_data_chunk) +
4260                                     sizeof(desc.data_bytes))) {
4261                                         break;
4262                                 }
4263                         } else {
4264                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
4265                                         break;
4266                                 }
4267                         }
4268                 }
4269                 if (desc.chunk_type == SCTP_DATA) {
4270                         /* can we get out the tsn? */
4271                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4272                                 SCTP_STAT_INCR(sctps_pdrpmbda);
4273
4274                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
4275                                 /* yep */
4276                                 struct sctp_data_chunk *dcp;
4277                                 uint8_t *ddp;
4278                                 unsigned int iii;
4279
4280                                 dcp = (struct sctp_data_chunk *)ch;
4281                                 ddp = (uint8_t *) (dcp + 1);
4282                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
4283                                         desc.data_bytes[iii] = ddp[iii];
4284                                 }
4285                                 desc.tsn_ifany = dcp->dp.tsn;
4286                         } else {
4287                                 /* nope we are done. */
4288                                 SCTP_STAT_INCR(sctps_pdrpnedat);
4289                                 break;
4290                         }
4291                 } else {
4292                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4293                                 SCTP_STAT_INCR(sctps_pdrpmbct);
4294                 }
4295
4296                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
4297                         SCTP_STAT_INCR(sctps_pdrppdbrk);
4298                         break;
4299                 }
4300                 if (SCTP_SIZE32(at) > chlen) {
4301                         break;
4302                 }
4303                 chlen -= SCTP_SIZE32(at);
4304                 if (chlen < sizeof(struct sctp_chunkhdr)) {
4305                         /* done, none left */
4306                         break;
4307                 }
4308                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
4309         }
4310         /* Now update any rwnd --- possibly */
4311         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
4312                 /* From a peer, we get a rwnd report */
4313                 uint32_t a_rwnd;
4314
4315                 SCTP_STAT_INCR(sctps_pdrpfehos);
4316
4317                 bottle_bw = ntohl(cp->bottle_bw);
4318                 on_queue = ntohl(cp->current_onq);
4319                 if (bottle_bw && on_queue) {
4320                         /* a rwnd report is in here */
4321                         if (bottle_bw > on_queue)
4322                                 a_rwnd = bottle_bw - on_queue;
4323                         else
4324                                 a_rwnd = 0;
4325
4326                         if (a_rwnd == 0)
4327                                 stcb->asoc.peers_rwnd = 0;
4328                         else {
4329                                 if (a_rwnd > stcb->asoc.total_flight) {
4330                                         stcb->asoc.peers_rwnd =
4331                                             a_rwnd - stcb->asoc.total_flight;
4332                                 } else {
4333                                         stcb->asoc.peers_rwnd = 0;
4334                                 }
4335                                 if (stcb->asoc.peers_rwnd <
4336                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4337                                         /* SWS sender side engages */
4338                                         stcb->asoc.peers_rwnd = 0;
4339                                 }
4340                         }
4341                 }
4342         } else {
4343                 SCTP_STAT_INCR(sctps_pdrpfmbox);
4344         }
4345
4346         /* now middle boxes in sat networks get a cwnd bump */
4347         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
4348             (stcb->asoc.sat_t3_loss_recovery == 0) &&
4349             (stcb->asoc.sat_network)) {
4350                 /*
4351                  * This is debateable but for sat networks it makes sense
4352                  * Note if a T3 timer has went off, we will prohibit any
4353                  * changes to cwnd until we exit the t3 loss recovery.
4354                  */
4355                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
4356                     net, cp, &bottle_bw, &on_queue);
4357         }
4358 }
4359
4360 /*
4361  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
4362  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
4363  * offset: offset into the mbuf chain to first chunkhdr - length: is the
4364  * length of the complete packet outputs: - length: modified to remaining
4365  * length after control processing - netp: modified to new sctp_nets after
4366  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
4367  * bad packet,...) otherwise return the tcb for this packet
4368  */
4369 #ifdef __GNUC__
4370 __attribute__((noinline))
4371 #endif
4372         static struct sctp_tcb *
4373                  sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
4374              struct sockaddr *src, struct sockaddr *dst,
4375              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
4376              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
4377              uint8_t use_mflowid, uint32_t mflowid,
4378              uint32_t vrf_id, uint16_t port)
4379 {
4380         struct sctp_association *asoc;
4381         uint32_t vtag_in;
4382         int num_chunks = 0;     /* number of control chunks processed */
4383         uint32_t chk_length;
4384         int ret;
4385         int abort_no_unlock = 0;
4386         int ecne_seen = 0;
4387
4388         /*
4389          * How big should this be, and should it be alloc'd? Lets try the
4390          * d-mtu-ceiling for now (2k) and that should hopefully work ...
4391          * until we get into jumbo grams and such..
4392          */
4393         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
4394         struct sctp_tcb *locked_tcb = stcb;
4395         int got_auth = 0;
4396         uint32_t auth_offset = 0, auth_len = 0;
4397         int auth_skipped = 0;
4398         int asconf_cnt = 0;
4399
4400 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4401         struct socket *so;
4402
4403 #endif
4404
4405         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
4406             iphlen, *offset, length, (void *)stcb);
4407
4408         /* validate chunk header length... */
4409         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
4410                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
4411                     ntohs(ch->chunk_length));
4412                 if (locked_tcb) {
4413                         SCTP_TCB_UNLOCK(locked_tcb);
4414                 }
4415                 return (NULL);
4416         }
4417         /*
4418          * validate the verification tag
4419          */
4420         vtag_in = ntohl(sh->v_tag);
4421
4422         if (locked_tcb) {
4423                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
4424         }
4425         if (ch->chunk_type == SCTP_INITIATION) {
4426                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
4427                     ntohs(ch->chunk_length), vtag_in);
4428                 if (vtag_in != 0) {
4429                         /* protocol error- silently discard... */
4430                         SCTP_STAT_INCR(sctps_badvtag);
4431                         if (locked_tcb) {
4432                                 SCTP_TCB_UNLOCK(locked_tcb);
4433                         }
4434                         return (NULL);
4435                 }
4436         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
4437                 /*
4438                  * If there is no stcb, skip the AUTH chunk and process
4439                  * later after a stcb is found (to validate the lookup was
4440                  * valid.
4441                  */
4442                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
4443                     (stcb == NULL) &&
4444                     !SCTP_BASE_SYSCTL(sctp_auth_disable)) {
4445                         /* save this chunk for later processing */
4446                         auth_skipped = 1;
4447                         auth_offset = *offset;
4448                         auth_len = ntohs(ch->chunk_length);
4449
4450                         /* (temporarily) move past this chunk */
4451                         *offset += SCTP_SIZE32(auth_len);
4452                         if (*offset >= length) {
4453                                 /* no more data left in the mbuf chain */
4454                                 *offset = length;
4455                                 if (locked_tcb) {
4456                                         SCTP_TCB_UNLOCK(locked_tcb);
4457                                 }
4458                                 return (NULL);
4459                         }
4460                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4461                             sizeof(struct sctp_chunkhdr), chunk_buf);
4462                 }
4463                 if (ch == NULL) {
4464                         /* Help */
4465                         *offset = length;
4466                         if (locked_tcb) {
4467                                 SCTP_TCB_UNLOCK(locked_tcb);
4468                         }
4469                         return (NULL);
4470                 }
4471                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
4472                         goto process_control_chunks;
4473                 }
4474                 /*
4475                  * first check if it's an ASCONF with an unknown src addr we
4476                  * need to look inside to find the association
4477                  */
4478                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
4479                         struct sctp_chunkhdr *asconf_ch = ch;
4480                         uint32_t asconf_offset = 0, asconf_len = 0;
4481
4482                         /* inp's refcount may be reduced */
4483                         SCTP_INP_INCR_REF(inp);
4484
4485                         asconf_offset = *offset;
4486                         do {
4487                                 asconf_len = ntohs(asconf_ch->chunk_length);
4488                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
4489                                         break;
4490                                 stcb = sctp_findassociation_ep_asconf(m,
4491                                     *offset,
4492                                     dst,
4493                                     sh, &inp, netp, vrf_id);
4494                                 if (stcb != NULL)
4495                                         break;
4496                                 asconf_offset += SCTP_SIZE32(asconf_len);
4497                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
4498                                     sizeof(struct sctp_chunkhdr), chunk_buf);
4499                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
4500                         if (stcb == NULL) {
4501                                 /*
4502                                  * reduce inp's refcount if not reduced in
4503                                  * sctp_findassociation_ep_asconf().
4504                                  */
4505                                 SCTP_INP_DECR_REF(inp);
4506                         } else {
4507                                 locked_tcb = stcb;
4508                         }
4509
4510                         /* now go back and verify any auth chunk to be sure */
4511                         if (auth_skipped && (stcb != NULL)) {
4512                                 struct sctp_auth_chunk *auth;
4513
4514                                 auth = (struct sctp_auth_chunk *)
4515                                     sctp_m_getptr(m, auth_offset,
4516                                     auth_len, chunk_buf);
4517                                 got_auth = 1;
4518                                 auth_skipped = 0;
4519                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
4520                                     auth_offset)) {
4521                                         /* auth HMAC failed so dump it */
4522                                         *offset = length;
4523                                         if (locked_tcb) {
4524                                                 SCTP_TCB_UNLOCK(locked_tcb);
4525                                         }
4526                                         return (NULL);
4527                                 } else {
4528                                         /* remaining chunks are HMAC checked */
4529                                         stcb->asoc.authenticated = 1;
4530                                 }
4531                         }
4532                 }
4533                 if (stcb == NULL) {
4534                         /* no association, so it's out of the blue... */
4535                         sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp,
4536                             use_mflowid, mflowid,
4537                             vrf_id, port);
4538                         *offset = length;
4539                         if (locked_tcb) {
4540                                 SCTP_TCB_UNLOCK(locked_tcb);
4541                         }
4542                         return (NULL);
4543                 }
4544                 asoc = &stcb->asoc;
4545                 /* ABORT and SHUTDOWN can use either v_tag... */
4546                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
4547                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
4548                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
4549                         if ((vtag_in == asoc->my_vtag) ||
4550                             ((ch->chunk_flags & SCTP_HAD_NO_TCB) &&
4551                             (vtag_in == asoc->peer_vtag))) {
4552                                 /* this is valid */
4553                         } else {
4554                                 /* drop this packet... */
4555                                 SCTP_STAT_INCR(sctps_badvtag);
4556                                 if (locked_tcb) {
4557                                         SCTP_TCB_UNLOCK(locked_tcb);
4558                                 }
4559                                 return (NULL);
4560                         }
4561                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4562                         if (vtag_in != asoc->my_vtag) {
4563                                 /*
4564                                  * this could be a stale SHUTDOWN-ACK or the
4565                                  * peer never got the SHUTDOWN-COMPLETE and
4566                                  * is still hung; we have started a new asoc
4567                                  * but it won't complete until the shutdown
4568                                  * is completed
4569                                  */
4570                                 if (locked_tcb) {
4571                                         SCTP_TCB_UNLOCK(locked_tcb);
4572                                 }
4573                                 sctp_handle_ootb(m, iphlen, *offset, src, dst,
4574                                     sh, inp,
4575                                     use_mflowid, mflowid,
4576                                     vrf_id, port);
4577                                 return (NULL);
4578                         }
4579                 } else {
4580                         /* for all other chunks, vtag must match */
4581                         if (vtag_in != asoc->my_vtag) {
4582                                 /* invalid vtag... */
4583                                 SCTPDBG(SCTP_DEBUG_INPUT3,
4584                                     "invalid vtag: %xh, expect %xh\n",
4585                                     vtag_in, asoc->my_vtag);
4586                                 SCTP_STAT_INCR(sctps_badvtag);
4587                                 if (locked_tcb) {
4588                                         SCTP_TCB_UNLOCK(locked_tcb);
4589                                 }
4590                                 *offset = length;
4591                                 return (NULL);
4592                         }
4593                 }
4594         }                       /* end if !SCTP_COOKIE_ECHO */
4595         /*
4596          * process all control chunks...
4597          */
4598         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4599             (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
4600             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4601             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
4602                 /* implied cookie-ack.. we must have lost the ack */
4603                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4604                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4605                             stcb->asoc.overall_error_count,
4606                             0,
4607                             SCTP_FROM_SCTP_INPUT,
4608                             __LINE__);
4609                 }
4610                 stcb->asoc.overall_error_count = 0;
4611                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4612                     *netp);
4613         }
4614 process_control_chunks:
4615         while (IS_SCTP_CONTROL(ch)) {
4616                 /* validate chunk length */
4617                 chk_length = ntohs(ch->chunk_length);
4618                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4619                     ch->chunk_type, chk_length);
4620                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4621                 if (chk_length < sizeof(*ch) ||
4622                     (*offset + (int)chk_length) > length) {
4623                         *offset = length;
4624                         if (locked_tcb) {
4625                                 SCTP_TCB_UNLOCK(locked_tcb);
4626                         }
4627                         return (NULL);
4628                 }
4629                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4630                 /*
4631                  * INIT-ACK only gets the init ack "header" portion only
4632                  * because we don't have to process the peer's COOKIE. All
4633                  * others get a complete chunk.
4634                  */
4635                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
4636                     (ch->chunk_type == SCTP_INITIATION)) {
4637                         /* get an init-ack chunk */
4638                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4639                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
4640                         if (ch == NULL) {
4641                                 *offset = length;
4642                                 if (locked_tcb) {
4643                                         SCTP_TCB_UNLOCK(locked_tcb);
4644                                 }
4645                                 return (NULL);
4646                         }
4647                 } else {
4648                         /* For cookies and all other chunks. */
4649                         if (chk_length > sizeof(chunk_buf)) {
4650                                 /*
4651                                  * use just the size of the chunk buffer so
4652                                  * the front part of our chunks fit in
4653                                  * contiguous space up to the chunk buffer
4654                                  * size (508 bytes). For chunks that need to
4655                                  * get more than that they must use the
4656                                  * sctp_m_getptr() function or other means
4657                                  * (e.g. know how to parse mbuf chains).
4658                                  * Cookies do this already.
4659                                  */
4660                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4661                                     (sizeof(chunk_buf) - 4),
4662                                     chunk_buf);
4663                                 if (ch == NULL) {
4664                                         *offset = length;
4665                                         if (locked_tcb) {
4666                                                 SCTP_TCB_UNLOCK(locked_tcb);
4667                                         }
4668                                         return (NULL);
4669                                 }
4670                         } else {
4671                                 /* We can fit it all */
4672                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4673                                     chk_length, chunk_buf);
4674                                 if (ch == NULL) {
4675                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
4676                                         *offset = length;
4677                                         if (locked_tcb) {
4678                                                 SCTP_TCB_UNLOCK(locked_tcb);
4679                                         }
4680                                         return (NULL);
4681                                 }
4682                         }
4683                 }
4684                 num_chunks++;
4685                 /* Save off the last place we got a control from */
4686                 if (stcb != NULL) {
4687                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
4688                                 /*
4689                                  * allow last_control to be NULL if
4690                                  * ASCONF... ASCONF processing will find the
4691                                  * right net later
4692                                  */
4693                                 if ((netp != NULL) && (*netp != NULL))
4694                                         stcb->asoc.last_control_chunk_from = *netp;
4695                         }
4696                 }
4697 #ifdef SCTP_AUDITING_ENABLED
4698                 sctp_audit_log(0xB0, ch->chunk_type);
4699 #endif
4700
4701                 /* check to see if this chunk required auth, but isn't */
4702                 if ((stcb != NULL) &&
4703                     !SCTP_BASE_SYSCTL(sctp_auth_disable) &&
4704                     sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
4705                     !stcb->asoc.authenticated) {
4706                         /* "silently" ignore */
4707                         SCTP_STAT_INCR(sctps_recvauthmissing);
4708                         goto next_chunk;
4709                 }
4710                 switch (ch->chunk_type) {
4711                 case SCTP_INITIATION:
4712                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
4713                         /* The INIT chunk must be the only chunk. */
4714                         if ((num_chunks > 1) ||
4715                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4716                                 sctp_abort_association(inp, stcb, m, iphlen,
4717                                     src, dst, sh, NULL,
4718                                     use_mflowid, mflowid,
4719                                     vrf_id, port);
4720                                 *offset = length;
4721                                 return (NULL);
4722                         }
4723                         /* Honor our resource limit. */
4724                         if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
4725                                 struct mbuf *op_err;
4726
4727                                 op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
4728                                 sctp_abort_association(inp, stcb, m, iphlen,
4729                                     src, dst, sh, op_err,
4730                                     use_mflowid, mflowid,
4731                                     vrf_id, port);
4732                                 *offset = length;
4733                                 return (NULL);
4734                         }
4735                         sctp_handle_init(m, iphlen, *offset, src, dst, sh,
4736                             (struct sctp_init_chunk *)ch, inp,
4737                             stcb, &abort_no_unlock,
4738                             use_mflowid, mflowid,
4739                             vrf_id, port);
4740                         *offset = length;
4741                         if ((!abort_no_unlock) && (locked_tcb)) {
4742                                 SCTP_TCB_UNLOCK(locked_tcb);
4743                         }
4744                         return (NULL);
4745                         break;
4746                 case SCTP_PAD_CHUNK:
4747                         break;
4748                 case SCTP_INITIATION_ACK:
4749                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
4750                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4751                                 /* We are not interested anymore */
4752                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4753                                         ;
4754                                 } else {
4755                                         if (locked_tcb != stcb) {
4756                                                 /* Very unlikely */
4757                                                 SCTP_TCB_UNLOCK(locked_tcb);
4758                                         }
4759                                         *offset = length;
4760                                         if (stcb) {
4761 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4762                                                 so = SCTP_INP_SO(inp);
4763                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4764                                                 SCTP_TCB_UNLOCK(stcb);
4765                                                 SCTP_SOCKET_LOCK(so, 1);
4766                                                 SCTP_TCB_LOCK(stcb);
4767                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4768 #endif
4769                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
4770 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4771                                                 SCTP_SOCKET_UNLOCK(so, 1);
4772 #endif
4773                                         }
4774                                         return (NULL);
4775                                 }
4776                         }
4777                         /* The INIT-ACK chunk must be the only chunk. */
4778                         if ((num_chunks > 1) ||
4779                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4780                                 *offset = length;
4781                                 if (locked_tcb) {
4782                                         SCTP_TCB_UNLOCK(locked_tcb);
4783                                 }
4784                                 return (NULL);
4785                         }
4786                         if ((netp) && (*netp)) {
4787                                 ret = sctp_handle_init_ack(m, iphlen, *offset,
4788                                     src, dst, sh,
4789                                     (struct sctp_init_ack_chunk *)ch,
4790                                     stcb, *netp,
4791                                     &abort_no_unlock,
4792                                     use_mflowid, mflowid,
4793                                     vrf_id);
4794                         } else {
4795                                 ret = -1;
4796                         }
4797                         *offset = length;
4798                         if (abort_no_unlock) {
4799                                 return (NULL);
4800                         }
4801                         /*
4802                          * Special case, I must call the output routine to
4803                          * get the cookie echoed
4804                          */
4805                         if ((stcb != NULL) && (ret == 0)) {
4806                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4807                         }
4808                         if (locked_tcb) {
4809                                 SCTP_TCB_UNLOCK(locked_tcb);
4810                         }
4811                         return (NULL);
4812                         break;
4813                 case SCTP_SELECTIVE_ACK:
4814                         {
4815                                 struct sctp_sack_chunk *sack;
4816                                 int abort_now = 0;
4817                                 uint32_t a_rwnd, cum_ack;
4818                                 uint16_t num_seg, num_dup;
4819                                 uint8_t flags;
4820                                 int offset_seg, offset_dup;
4821
4822                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
4823                                 SCTP_STAT_INCR(sctps_recvsacks);
4824                                 if (stcb == NULL) {
4825                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
4826                                         break;
4827                                 }
4828                                 if (chk_length < sizeof(struct sctp_sack_chunk)) {
4829                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
4830                                         break;
4831                                 }
4832                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4833                                         /*-
4834                                          * If we have sent a shutdown-ack, we will pay no
4835                                          * attention to a sack sent in to us since
4836                                          * we don't care anymore.
4837                                          */
4838                                         break;
4839                                 }
4840                                 sack = (struct sctp_sack_chunk *)ch;
4841                                 flags = ch->chunk_flags;
4842                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
4843                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
4844                                 num_dup = ntohs(sack->sack.num_dup_tsns);
4845                                 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
4846                                 if (sizeof(struct sctp_sack_chunk) +
4847                                     num_seg * sizeof(struct sctp_gap_ack_block) +
4848                                     num_dup * sizeof(uint32_t) != chk_length) {
4849                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
4850                                         break;
4851                                 }
4852                                 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
4853                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
4854                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4855                                     cum_ack, num_seg, a_rwnd);
4856                                 stcb->asoc.seen_a_sack_this_pkt = 1;
4857                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
4858                                     (num_seg == 0) &&
4859                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
4860                                     (stcb->asoc.saw_sack_with_frags == 0) &&
4861                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
4862                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
4863                                     ) {
4864                                         /*
4865                                          * We have a SIMPLE sack having no
4866                                          * prior segments and data on sent
4867                                          * queue to be acked.. Use the
4868                                          * faster path sack processing. We
4869                                          * also allow window update sacks
4870                                          * with no missing segments to go
4871                                          * this way too.
4872                                          */
4873                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
4874                                 } else {
4875                                         if (netp && *netp)
4876                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
4877                                                     num_seg, 0, num_dup, &abort_now, flags,
4878                                                     cum_ack, a_rwnd, ecne_seen);
4879                                 }
4880                                 if (abort_now) {
4881                                         /* ABORT signal from sack processing */
4882                                         *offset = length;
4883                                         return (NULL);
4884                                 }
4885                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
4886                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
4887                                     (stcb->asoc.stream_queue_cnt == 0)) {
4888                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
4889                                 }
4890                         }
4891                         break;
4892                         /*
4893                          * EY - nr_sack:  If the received chunk is an
4894                          * nr_sack chunk
4895                          */
4896                 case SCTP_NR_SELECTIVE_ACK:
4897                         {
4898                                 struct sctp_nr_sack_chunk *nr_sack;
4899                                 int abort_now = 0;
4900                                 uint32_t a_rwnd, cum_ack;
4901                                 uint16_t num_seg, num_nr_seg, num_dup;
4902                                 uint8_t flags;
4903                                 int offset_seg, offset_dup;
4904
4905                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
4906                                 SCTP_STAT_INCR(sctps_recvsacks);
4907                                 if (stcb == NULL) {
4908                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
4909                                         break;
4910                                 }
4911                                 if ((stcb->asoc.sctp_nr_sack_on_off == 0) ||
4912                                     (stcb->asoc.peer_supports_nr_sack == 0)) {
4913                                         goto unknown_chunk;
4914                                 }
4915                                 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
4916                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
4917                                         break;
4918                                 }
4919                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4920                                         /*-
4921                                          * If we have sent a shutdown-ack, we will pay no
4922                                          * attention to a sack sent in to us since
4923                                          * we don't care anymore.
4924                                          */
4925                                         break;
4926                                 }
4927                                 nr_sack = (struct sctp_nr_sack_chunk *)ch;
4928                                 flags = ch->chunk_flags;
4929                                 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
4930                                 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
4931                                 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
4932                                 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
4933                                 a_rwnd = (uint32_t) ntohl(nr_sack->nr_sack.a_rwnd);
4934                                 if (sizeof(struct sctp_nr_sack_chunk) +
4935                                     (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
4936                                     num_dup * sizeof(uint32_t) != chk_length) {
4937                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
4938                                         break;
4939                                 }
4940                                 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
4941                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
4942                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4943                                     cum_ack, num_seg, a_rwnd);
4944                                 stcb->asoc.seen_a_sack_this_pkt = 1;
4945                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
4946                                     (num_seg == 0) && (num_nr_seg == 0) &&
4947                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
4948                                     (stcb->asoc.saw_sack_with_frags == 0) &&
4949                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
4950                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
4951                                         /*
4952                                          * We have a SIMPLE sack having no
4953                                          * prior segments and data on sent
4954                                          * queue to be acked. Use the faster
4955                                          * path sack processing. We also
4956                                          * allow window update sacks with no
4957                                          * missing segments to go this way
4958                                          * too.
4959                                          */
4960                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
4961                                             &abort_now, ecne_seen);
4962                                 } else {
4963                                         if (netp && *netp)
4964                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
4965                                                     num_seg, num_nr_seg, num_dup, &abort_now, flags,
4966                                                     cum_ack, a_rwnd, ecne_seen);
4967                                 }
4968                                 if (abort_now) {
4969                                         /* ABORT signal from sack processing */
4970                                         *offset = length;
4971                                         return (NULL);
4972                                 }
4973                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
4974                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
4975                                     (stcb->asoc.stream_queue_cnt == 0)) {
4976                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
4977                                 }
4978                         }
4979                         break;
4980
4981                 case SCTP_HEARTBEAT_REQUEST:
4982                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
4983                         if ((stcb) && netp && *netp) {
4984                                 SCTP_STAT_INCR(sctps_recvheartbeat);
4985                                 sctp_send_heartbeat_ack(stcb, m, *offset,
4986                                     chk_length, *netp);
4987
4988                                 /* He's alive so give him credit */
4989                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4990                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4991                                             stcb->asoc.overall_error_count,
4992                                             0,
4993                                             SCTP_FROM_SCTP_INPUT,
4994                                             __LINE__);
4995                                 }
4996                                 stcb->asoc.overall_error_count = 0;
4997                         }
4998                         break;
4999                 case SCTP_HEARTBEAT_ACK:
5000                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
5001                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
5002                                 /* Its not ours */
5003                                 *offset = length;
5004                                 if (locked_tcb) {
5005                                         SCTP_TCB_UNLOCK(locked_tcb);
5006                                 }
5007                                 return (NULL);
5008                         }
5009                         /* He's alive so give him credit */
5010                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5011                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5012                                     stcb->asoc.overall_error_count,
5013                                     0,
5014                                     SCTP_FROM_SCTP_INPUT,
5015                                     __LINE__);
5016                         }
5017                         stcb->asoc.overall_error_count = 0;
5018                         SCTP_STAT_INCR(sctps_recvheartbeatack);
5019                         if (netp && *netp)
5020                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
5021                                     stcb, *netp);
5022                         break;
5023                 case SCTP_ABORT_ASSOCIATION:
5024                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
5025                             (void *)stcb);
5026                         if ((stcb) && netp && *netp)
5027                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
5028                                     stcb, *netp);
5029                         *offset = length;
5030                         return (NULL);
5031                         break;
5032                 case SCTP_SHUTDOWN:
5033                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
5034                             (void *)stcb);
5035                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
5036                                 *offset = length;
5037                                 if (locked_tcb) {
5038                                         SCTP_TCB_UNLOCK(locked_tcb);
5039                                 }
5040                                 return (NULL);
5041                         }
5042                         if (netp && *netp) {
5043                                 int abort_flag = 0;
5044
5045                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
5046                                     stcb, *netp, &abort_flag);
5047                                 if (abort_flag) {
5048                                         *offset = length;
5049                                         return (NULL);
5050                                 }
5051                         }
5052                         break;
5053                 case SCTP_SHUTDOWN_ACK:
5054                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb);
5055                         if ((stcb) && (netp) && (*netp))
5056                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
5057                         *offset = length;
5058                         return (NULL);
5059                         break;
5060
5061                 case SCTP_OPERATION_ERROR:
5062                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
5063                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
5064                                 *offset = length;
5065                                 return (NULL);
5066                         }
5067                         break;
5068                 case SCTP_COOKIE_ECHO:
5069                         SCTPDBG(SCTP_DEBUG_INPUT3,
5070                             "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb);
5071                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5072                                 ;
5073                         } else {
5074                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5075                                         /* We are not interested anymore */
5076                         abend:
5077                                         if (stcb) {
5078                                                 SCTP_TCB_UNLOCK(stcb);
5079                                         }
5080                                         *offset = length;
5081                                         return (NULL);
5082                                 }
5083                         }
5084                         /*
5085                          * First are we accepting? We do this again here
5086                          * since it is possible that a previous endpoint WAS
5087                          * listening responded to a INIT-ACK and then
5088                          * closed. We opened and bound.. and are now no
5089                          * longer listening.
5090                          */
5091
5092                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
5093                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
5094                                     (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
5095                                         struct mbuf *op_err;
5096
5097                                         op_err = sctp_generate_invmanparam(SCTP_CAUSE_OUT_OF_RESC);
5098                                         sctp_abort_association(inp, stcb, m, iphlen,
5099                                             src, dst, sh, op_err,
5100                                             use_mflowid, mflowid,
5101                                             vrf_id, port);
5102                                 }
5103                                 *offset = length;
5104                                 return (NULL);
5105                         } else {
5106                                 struct mbuf *ret_buf;
5107                                 struct sctp_inpcb *linp;
5108
5109                                 if (stcb) {
5110                                         linp = NULL;
5111                                 } else {
5112                                         linp = inp;
5113                                 }
5114
5115                                 if (linp) {
5116                                         SCTP_ASOC_CREATE_LOCK(linp);
5117                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5118                                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5119                                                 SCTP_ASOC_CREATE_UNLOCK(linp);
5120                                                 goto abend;
5121                                         }
5122                                 }
5123                                 if (netp) {
5124                                         ret_buf =
5125                                             sctp_handle_cookie_echo(m, iphlen,
5126                                             *offset,
5127                                             src, dst,
5128                                             sh,
5129                                             (struct sctp_cookie_echo_chunk *)ch,
5130                                             &inp, &stcb, netp,
5131                                             auth_skipped,
5132                                             auth_offset,
5133                                             auth_len,
5134                                             &locked_tcb,
5135                                             use_mflowid,
5136                                             mflowid,
5137                                             vrf_id,
5138                                             port);
5139                                 } else {
5140                                         ret_buf = NULL;
5141                                 }
5142                                 if (linp) {
5143                                         SCTP_ASOC_CREATE_UNLOCK(linp);
5144                                 }
5145                                 if (ret_buf == NULL) {
5146                                         if (locked_tcb) {
5147                                                 SCTP_TCB_UNLOCK(locked_tcb);
5148                                         }
5149                                         SCTPDBG(SCTP_DEBUG_INPUT3,
5150                                             "GAK, null buffer\n");
5151                                         *offset = length;
5152                                         return (NULL);
5153                                 }
5154                                 /* if AUTH skipped, see if it verified... */
5155                                 if (auth_skipped) {
5156                                         got_auth = 1;
5157                                         auth_skipped = 0;
5158                                 }
5159                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
5160                                         /*
5161                                          * Restart the timer if we have
5162                                          * pending data
5163                                          */
5164                                         struct sctp_tmit_chunk *chk;
5165
5166                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
5167                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
5168                                 }
5169                         }
5170                         break;
5171                 case SCTP_COOKIE_ACK:
5172                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb);
5173                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
5174                                 if (locked_tcb) {
5175                                         SCTP_TCB_UNLOCK(locked_tcb);
5176                                 }
5177                                 return (NULL);
5178                         }
5179                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5180                                 /* We are not interested anymore */
5181                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5182                                         ;
5183                                 } else if (stcb) {
5184 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5185                                         so = SCTP_INP_SO(inp);
5186                                         atomic_add_int(&stcb->asoc.refcnt, 1);
5187                                         SCTP_TCB_UNLOCK(stcb);
5188                                         SCTP_SOCKET_LOCK(so, 1);
5189                                         SCTP_TCB_LOCK(stcb);
5190                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5191 #endif
5192                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
5193 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5194                                         SCTP_SOCKET_UNLOCK(so, 1);
5195 #endif
5196                                         *offset = length;
5197                                         return (NULL);
5198                                 }
5199                         }
5200                         /* He's alive so give him credit */
5201                         if ((stcb) && netp && *netp) {
5202                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5203                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5204                                             stcb->asoc.overall_error_count,
5205                                             0,
5206                                             SCTP_FROM_SCTP_INPUT,
5207                                             __LINE__);
5208                                 }
5209                                 stcb->asoc.overall_error_count = 0;
5210                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
5211                         }
5212                         break;
5213                 case SCTP_ECN_ECHO:
5214                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
5215                         /* He's alive so give him credit */
5216                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
5217                                 /* Its not ours */
5218                                 if (locked_tcb) {
5219                                         SCTP_TCB_UNLOCK(locked_tcb);
5220                                 }
5221                                 *offset = length;
5222                                 return (NULL);
5223                         }
5224                         if (stcb) {
5225                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5226                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5227                                             stcb->asoc.overall_error_count,
5228                                             0,
5229                                             SCTP_FROM_SCTP_INPUT,
5230                                             __LINE__);
5231                                 }
5232                                 stcb->asoc.overall_error_count = 0;
5233                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
5234                                     stcb);
5235                                 ecne_seen = 1;
5236                         }
5237                         break;
5238                 case SCTP_ECN_CWR:
5239                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
5240                         /* He's alive so give him credit */
5241                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
5242                                 /* Its not ours */
5243                                 if (locked_tcb) {
5244                                         SCTP_TCB_UNLOCK(locked_tcb);
5245                                 }
5246                                 *offset = length;
5247                                 return (NULL);
5248                         }
5249                         if (stcb) {
5250                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5251                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5252                                             stcb->asoc.overall_error_count,
5253                                             0,
5254                                             SCTP_FROM_SCTP_INPUT,
5255                                             __LINE__);
5256                                 }
5257                                 stcb->asoc.overall_error_count = 0;
5258                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
5259                         }
5260                         break;
5261                 case SCTP_SHUTDOWN_COMPLETE:
5262                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb);
5263                         /* must be first and only chunk */
5264                         if ((num_chunks > 1) ||
5265                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5266                                 *offset = length;
5267                                 if (locked_tcb) {
5268                                         SCTP_TCB_UNLOCK(locked_tcb);
5269                                 }
5270                                 return (NULL);
5271                         }
5272                         if ((stcb) && netp && *netp) {
5273                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
5274                                     stcb, *netp);
5275                         }
5276                         *offset = length;
5277                         return (NULL);
5278                         break;
5279                 case SCTP_ASCONF:
5280                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
5281                         /* He's alive so give him credit */
5282                         if (stcb) {
5283                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5284                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5285                                             stcb->asoc.overall_error_count,
5286                                             0,
5287                                             SCTP_FROM_SCTP_INPUT,
5288                                             __LINE__);
5289                                 }
5290                                 stcb->asoc.overall_error_count = 0;
5291                                 sctp_handle_asconf(m, *offset, src,
5292                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
5293                                 asconf_cnt++;
5294                         }
5295                         break;
5296                 case SCTP_ASCONF_ACK:
5297                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
5298                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5299                                 /* Its not ours */
5300                                 if (locked_tcb) {
5301                                         SCTP_TCB_UNLOCK(locked_tcb);
5302                                 }
5303                                 *offset = length;
5304                                 return (NULL);
5305                         }
5306                         if ((stcb) && netp && *netp) {
5307                                 /* He's alive so give him credit */
5308                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5309                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5310                                             stcb->asoc.overall_error_count,
5311                                             0,
5312                                             SCTP_FROM_SCTP_INPUT,
5313                                             __LINE__);
5314                                 }
5315                                 stcb->asoc.overall_error_count = 0;
5316                                 sctp_handle_asconf_ack(m, *offset,
5317                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
5318                                 if (abort_no_unlock)
5319                                         return (NULL);
5320                         }
5321                         break;
5322                 case SCTP_FORWARD_CUM_TSN:
5323                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
5324                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5325                                 /* Its not ours */
5326                                 if (locked_tcb) {
5327                                         SCTP_TCB_UNLOCK(locked_tcb);
5328                                 }
5329                                 *offset = length;
5330                                 return (NULL);
5331                         }
5332                         /* He's alive so give him credit */
5333                         if (stcb) {
5334                                 int abort_flag = 0;
5335
5336                                 stcb->asoc.overall_error_count = 0;
5337                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5338                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5339                                             stcb->asoc.overall_error_count,
5340                                             0,
5341                                             SCTP_FROM_SCTP_INPUT,
5342                                             __LINE__);
5343                                 }
5344                                 *fwd_tsn_seen = 1;
5345                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5346                                         /* We are not interested anymore */
5347 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5348                                         so = SCTP_INP_SO(inp);
5349                                         atomic_add_int(&stcb->asoc.refcnt, 1);
5350                                         SCTP_TCB_UNLOCK(stcb);
5351                                         SCTP_SOCKET_LOCK(so, 1);
5352                                         SCTP_TCB_LOCK(stcb);
5353                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5354 #endif
5355                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
5356 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5357                                         SCTP_SOCKET_UNLOCK(so, 1);
5358 #endif
5359                                         *offset = length;
5360                                         return (NULL);
5361                                 }
5362                                 sctp_handle_forward_tsn(stcb,
5363                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
5364                                 if (abort_flag) {
5365                                         *offset = length;
5366                                         return (NULL);
5367                                 } else {
5368                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5369                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5370                                                     stcb->asoc.overall_error_count,
5371                                                     0,
5372                                                     SCTP_FROM_SCTP_INPUT,
5373                                                     __LINE__);
5374                                         }
5375                                         stcb->asoc.overall_error_count = 0;
5376                                 }
5377
5378                         }
5379                         break;
5380                 case SCTP_STREAM_RESET:
5381                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
5382                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
5383                                 /* Its not ours */
5384                                 if (locked_tcb) {
5385                                         SCTP_TCB_UNLOCK(locked_tcb);
5386                                 }
5387                                 *offset = length;
5388                                 return (NULL);
5389                         }
5390                         if (stcb->asoc.peer_supports_strreset == 0) {
5391                                 /*
5392                                  * hmm, peer should have announced this, but
5393                                  * we will turn it on since he is sending us
5394                                  * a stream reset.
5395                                  */
5396                                 stcb->asoc.peer_supports_strreset = 1;
5397                         }
5398                         if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
5399                                 /* stop processing */
5400                                 *offset = length;
5401                                 return (NULL);
5402                         }
5403                         break;
5404                 case SCTP_PACKET_DROPPED:
5405                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
5406                         /* re-get it all please */
5407                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5408                                 /* Its not ours */
5409                                 if (locked_tcb) {
5410                                         SCTP_TCB_UNLOCK(locked_tcb);
5411                                 }
5412                                 *offset = length;
5413                                 return (NULL);
5414                         }
5415                         if (ch && (stcb) && netp && (*netp)) {
5416                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
5417                                     stcb, *netp,
5418                                     min(chk_length, (sizeof(chunk_buf) - 4)));
5419
5420                         }
5421                         break;
5422
5423                 case SCTP_AUTHENTICATION:
5424                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
5425                         if (SCTP_BASE_SYSCTL(sctp_auth_disable))
5426                                 goto unknown_chunk;
5427
5428                         if (stcb == NULL) {
5429                                 /* save the first AUTH for later processing */
5430                                 if (auth_skipped == 0) {
5431                                         auth_offset = *offset;
5432                                         auth_len = chk_length;
5433                                         auth_skipped = 1;
5434                                 }
5435                                 /* skip this chunk (temporarily) */
5436                                 goto next_chunk;
5437                         }
5438                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5439                             (chk_length > (sizeof(struct sctp_auth_chunk) +
5440                             SCTP_AUTH_DIGEST_LEN_MAX))) {
5441                                 /* Its not ours */
5442                                 if (locked_tcb) {
5443                                         SCTP_TCB_UNLOCK(locked_tcb);
5444                                 }
5445                                 *offset = length;
5446                                 return (NULL);
5447                         }
5448                         if (got_auth == 1) {
5449                                 /* skip this chunk... it's already auth'd */
5450                                 goto next_chunk;
5451                         }
5452                         got_auth = 1;
5453                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
5454                             m, *offset)) {
5455                                 /* auth HMAC failed so dump the packet */
5456                                 *offset = length;
5457                                 return (stcb);
5458                         } else {
5459                                 /* remaining chunks are HMAC checked */
5460                                 stcb->asoc.authenticated = 1;
5461                         }
5462                         break;
5463
5464                 default:
5465         unknown_chunk:
5466                         /* it's an unknown chunk! */
5467                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
5468                                 struct mbuf *mm;
5469                                 struct sctp_paramhdr *phd;
5470
5471                                 mm = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr),
5472                                     0, M_DONTWAIT, 1, MT_DATA);
5473                                 if (mm) {
5474                                         phd = mtod(mm, struct sctp_paramhdr *);
5475                                         /*
5476                                          * We cheat and use param type since
5477                                          * we did not bother to define a
5478                                          * error cause struct. They are the
5479                                          * same basic format with different
5480                                          * names.
5481                                          */
5482                                         phd->param_type = htons(SCTP_CAUSE_UNRECOG_CHUNK);
5483                                         phd->param_length = htons(chk_length + sizeof(*phd));
5484                                         SCTP_BUF_LEN(mm) = sizeof(*phd);
5485                                         SCTP_BUF_NEXT(mm) = SCTP_M_COPYM(m, *offset, chk_length, M_DONTWAIT);
5486                                         if (SCTP_BUF_NEXT(mm)) {
5487                                                 if (sctp_pad_lastmbuf(SCTP_BUF_NEXT(mm), SCTP_SIZE32(chk_length) - chk_length, NULL)) {
5488                                                         sctp_m_freem(mm);
5489                                                 } else {
5490 #ifdef SCTP_MBUF_LOGGING
5491                                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5492                                                                 struct mbuf *mat;
5493
5494                                                                 for (mat = SCTP_BUF_NEXT(mm); mat; mat = SCTP_BUF_NEXT(mat)) {
5495                                                                         if (SCTP_BUF_IS_EXTENDED(mat)) {
5496                                                                                 sctp_log_mb(mat, SCTP_MBUF_ICOPY);
5497                                                                         }
5498                                                                 }
5499                                                         }
5500 #endif
5501                                                         sctp_queue_op_err(stcb, mm);
5502                                                 }
5503                                         } else {
5504                                                 sctp_m_freem(mm);
5505                                         }
5506                                 }
5507                         }
5508                         if ((ch->chunk_type & 0x80) == 0) {
5509                                 /* discard this packet */
5510                                 *offset = length;
5511                                 return (stcb);
5512                         }       /* else skip this bad chunk and continue... */
5513                         break;
5514                 }               /* switch (ch->chunk_type) */
5515
5516
5517 next_chunk:
5518                 /* get the next chunk */
5519                 *offset += SCTP_SIZE32(chk_length);
5520                 if (*offset >= length) {
5521                         /* no more data left in the mbuf chain */
5522                         break;
5523                 }
5524                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
5525                     sizeof(struct sctp_chunkhdr), chunk_buf);
5526                 if (ch == NULL) {
5527                         if (locked_tcb) {
5528                                 SCTP_TCB_UNLOCK(locked_tcb);
5529                         }
5530                         *offset = length;
5531                         return (NULL);
5532                 }
5533         }                       /* while */
5534
5535         if (asconf_cnt > 0 && stcb != NULL) {
5536                 sctp_send_asconf_ack(stcb);
5537         }
5538         return (stcb);
5539 }
5540
5541
5542 #ifdef INVARIANTS
5543 #ifdef __GNUC__
5544 __attribute__((noinline))
5545 #endif
5546         void
5547              sctp_validate_no_locks(struct sctp_inpcb *inp)
5548 {
5549         struct sctp_tcb *lstcb;
5550
5551         LIST_FOREACH(lstcb, &inp->sctp_asoc_list, sctp_tcblist) {
5552                 if (mtx_owned(&lstcb->tcb_mtx)) {
5553                         panic("Own lock on stcb at return from input");
5554                 }
5555         }
5556         if (mtx_owned(&inp->inp_create_mtx)) {
5557                 panic("Own create lock on inp");
5558         }
5559         if (mtx_owned(&inp->inp_mtx)) {
5560                 panic("Own inp lock on inp");
5561         }
5562 }
5563
5564 #endif
5565
5566 /*
5567  * common input chunk processing (v4 and v6)
5568  */
5569 void
5570 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
5571     struct sockaddr *src, struct sockaddr *dst,
5572     struct sctphdr *sh, struct sctp_chunkhdr *ch,
5573 #if !defined(SCTP_WITH_NO_CSUM)
5574     uint8_t compute_crc,
5575 #endif
5576     uint8_t ecn_bits,
5577     uint8_t use_mflowid, uint32_t mflowid,
5578     uint32_t vrf_id, uint16_t port)
5579 {
5580         uint32_t high_tsn;
5581         int fwd_tsn_seen = 0, data_processed = 0;
5582         struct mbuf *m = *mm;
5583         int un_sent;
5584         int cnt_ctrl_ready = 0;
5585         struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
5586         struct sctp_tcb *stcb = NULL;
5587         struct sctp_nets *net = NULL;
5588
5589         SCTP_STAT_INCR(sctps_recvdatagrams);
5590 #ifdef SCTP_AUDITING_ENABLED
5591         sctp_audit_log(0xE0, 1);
5592         sctp_auditing(0, inp, stcb, net);
5593 #endif
5594 #if !defined(SCTP_WITH_NO_CSUM)
5595         if (compute_crc != 0) {
5596                 uint32_t check, calc_check;
5597
5598                 check = sh->checksum;
5599                 sh->checksum = 0;
5600                 calc_check = sctp_calculate_cksum(m, iphlen);
5601                 sh->checksum = check;
5602                 if (calc_check != check) {
5603                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
5604                             calc_check, check, (void *)m, length, iphlen);
5605                         stcb = sctp_findassociation_addr(m, offset, src, dst,
5606                             sh, ch, &inp, &net, vrf_id);
5607                         if ((net != NULL) && (port != 0)) {
5608                                 if (net->port == 0) {
5609                                         sctp_pathmtu_adjustment(stcb, net->mtu - sizeof(struct udphdr));
5610                                 }
5611                                 net->port = port;
5612                         }
5613                         if ((net != NULL) && (use_mflowid != 0)) {
5614                                 net->flowid = mflowid;
5615 #ifdef INVARIANTS
5616                                 net->flowidset = 1;
5617 #endif
5618                         }
5619                         if ((inp != NULL) && (stcb != NULL)) {
5620                                 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
5621                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5622                         } else if ((inp != NULL) && (stcb == NULL)) {
5623                                 inp_decr = inp;
5624                         }
5625                         SCTP_STAT_INCR(sctps_badsum);
5626                         SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5627                         goto out;
5628                 }
5629         }
5630 #endif
5631         /* Destination port of 0 is illegal, based on RFC4960. */
5632         if (sh->dest_port == 0) {
5633                 SCTP_STAT_INCR(sctps_hdrops);
5634                 goto out;
5635         }
5636         stcb = sctp_findassociation_addr(m, offset, src, dst,
5637             sh, ch, &inp, &net, vrf_id);
5638         if ((net != NULL) && (port != 0)) {
5639                 if (net->port == 0) {
5640                         sctp_pathmtu_adjustment(stcb, net->mtu - sizeof(struct udphdr));
5641                 }
5642                 net->port = port;
5643         }
5644         if ((net != NULL) && (use_mflowid != 0)) {
5645                 net->flowid = mflowid;
5646 #ifdef INVARIANTS
5647                 net->flowidset = 1;
5648 #endif
5649         }
5650         if (inp == NULL) {
5651                 SCTP_STAT_INCR(sctps_noport);
5652                 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
5653                         goto out;
5654                 }
5655                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5656                         sctp_send_shutdown_complete2(src, dst, sh,
5657                             use_mflowid, mflowid,
5658                             vrf_id, port);
5659                         goto out;
5660                 }
5661                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5662                         goto out;
5663                 }
5664                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
5665                         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
5666                             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
5667                             (ch->chunk_type != SCTP_INIT))) {
5668                                 sctp_send_abort(m, iphlen, src, dst,
5669                                     sh, 0, NULL,
5670                                     use_mflowid, mflowid,
5671                                     vrf_id, port);
5672                         }
5673                 }
5674                 goto out;
5675         } else if (stcb == NULL) {
5676                 inp_decr = inp;
5677         }
5678 #ifdef IPSEC
5679         /*-
5680          * I very much doubt any of the IPSEC stuff will work but I have no
5681          * idea, so I will leave it in place.
5682          */
5683         if (inp != NULL) {
5684                 switch (dst->sa_family) {
5685 #ifdef INET
5686                 case AF_INET:
5687                         if (ipsec4_in_reject(m, &inp->ip_inp.inp)) {
5688                                 MODULE_GLOBAL(ipsec4stat).in_polvio++;
5689                                 SCTP_STAT_INCR(sctps_hdrops);
5690                                 goto out;
5691                         }
5692                         break;
5693 #endif
5694 #ifdef INET6
5695                 case AF_INET6:
5696                         if (ipsec6_in_reject(m, &inp->ip_inp.inp)) {
5697                                 MODULE_GLOBAL(ipsec6stat).in_polvio++;
5698                                 SCTP_STAT_INCR(sctps_hdrops);
5699                                 goto out;
5700                         }
5701                         break;
5702 #endif
5703                 default:
5704                         break;
5705                 }
5706         }
5707 #endif
5708         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
5709             (void *)m, iphlen, offset, length, (void *)stcb);
5710         if (stcb) {
5711                 /* always clear this before beginning a packet */
5712                 stcb->asoc.authenticated = 0;
5713                 stcb->asoc.seen_a_sack_this_pkt = 0;
5714                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5715                     (void *)stcb, stcb->asoc.state);
5716
5717                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5718                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5719                         /*-
5720                          * If we hit here, we had a ref count
5721                          * up when the assoc was aborted and the
5722                          * timer is clearing out the assoc, we should
5723                          * NOT respond to any packet.. its OOTB.
5724                          */
5725                         SCTP_TCB_UNLOCK(stcb);
5726                         stcb = NULL;
5727                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp,
5728                             use_mflowid, mflowid,
5729                             vrf_id, port);
5730                         goto out;
5731                 }
5732         }
5733         if (IS_SCTP_CONTROL(ch)) {
5734                 /* process the control portion of the SCTP packet */
5735                 /* sa_ignore NO_NULL_CHK */
5736                 stcb = sctp_process_control(m, iphlen, &offset, length,
5737                     src, dst, sh, ch,
5738                     inp, stcb, &net, &fwd_tsn_seen,
5739                     use_mflowid, mflowid,
5740                     vrf_id, port);
5741                 if (stcb) {
5742                         /*
5743                          * This covers us if the cookie-echo was there and
5744                          * it changes our INP.
5745                          */
5746                         inp = stcb->sctp_ep;
5747                         if ((net) && (port)) {
5748                                 if (net->port == 0) {
5749                                         sctp_pathmtu_adjustment(stcb, net->mtu - sizeof(struct udphdr));
5750                                 }
5751                                 net->port = port;
5752                         }
5753                 }
5754         } else {
5755                 /*
5756                  * no control chunks, so pre-process DATA chunks (these
5757                  * checks are taken care of by control processing)
5758                  */
5759
5760                 /*
5761                  * if DATA only packet, and auth is required, then punt...
5762                  * can't have authenticated without any AUTH (control)
5763                  * chunks
5764                  */
5765                 if ((stcb != NULL) &&
5766                     !SCTP_BASE_SYSCTL(sctp_auth_disable) &&
5767                     sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
5768                         /* "silently" ignore */
5769                         SCTP_STAT_INCR(sctps_recvauthmissing);
5770                         goto out;
5771                 }
5772                 if (stcb == NULL) {
5773                         /* out of the blue DATA chunk */
5774                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp,
5775                             use_mflowid, mflowid,
5776                             vrf_id, port);
5777                         goto out;
5778                 }
5779                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5780                         /* v_tag mismatch! */
5781                         SCTP_STAT_INCR(sctps_badvtag);
5782                         goto out;
5783                 }
5784         }
5785
5786         if (stcb == NULL) {
5787                 /*
5788                  * no valid TCB for this packet, or we found it's a bad
5789                  * packet while processing control, or we're done with this
5790                  * packet (done or skip rest of data), so we drop it...
5791                  */
5792                 goto out;
5793         }
5794         /*
5795          * DATA chunk processing
5796          */
5797         /* plow through the data chunks while length > offset */
5798
5799         /*
5800          * Rest should be DATA only.  Check authentication state if AUTH for
5801          * DATA is required.
5802          */
5803         if ((length > offset) &&
5804             (stcb != NULL) &&
5805             !SCTP_BASE_SYSCTL(sctp_auth_disable) &&
5806             sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
5807             !stcb->asoc.authenticated) {
5808                 /* "silently" ignore */
5809                 SCTP_STAT_INCR(sctps_recvauthmissing);
5810                 SCTPDBG(SCTP_DEBUG_AUTH1,
5811                     "Data chunk requires AUTH, skipped\n");
5812                 goto trigger_send;
5813         }
5814         if (length > offset) {
5815                 int retval;
5816
5817                 /*
5818                  * First check to make sure our state is correct. We would
5819                  * not get here unless we really did have a tag, so we don't
5820                  * abort if this happens, just dump the chunk silently.
5821                  */
5822                 switch (SCTP_GET_STATE(&stcb->asoc)) {
5823                 case SCTP_STATE_COOKIE_ECHOED:
5824                         /*
5825                          * we consider data with valid tags in this state
5826                          * shows us the cookie-ack was lost. Imply it was
5827                          * there.
5828                          */
5829                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5830                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5831                                     stcb->asoc.overall_error_count,
5832                                     0,
5833                                     SCTP_FROM_SCTP_INPUT,
5834                                     __LINE__);
5835                         }
5836                         stcb->asoc.overall_error_count = 0;
5837                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
5838                         break;
5839                 case SCTP_STATE_COOKIE_WAIT:
5840                         /*
5841                          * We consider OOTB any data sent during asoc setup.
5842                          */
5843                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp,
5844                             use_mflowid, mflowid,
5845                             vrf_id, port);
5846                         goto out;
5847                         /* sa_ignore NOTREACHED */
5848                         break;
5849                 case SCTP_STATE_EMPTY:  /* should not happen */
5850                 case SCTP_STATE_INUSE:  /* should not happen */
5851                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
5852                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
5853                 default:
5854                         goto out;
5855                         /* sa_ignore NOTREACHED */
5856                         break;
5857                 case SCTP_STATE_OPEN:
5858                 case SCTP_STATE_SHUTDOWN_SENT:
5859                         break;
5860                 }
5861                 /* plow through the data chunks while length > offset */
5862                 retval = sctp_process_data(mm, iphlen, &offset, length,
5863                     src, dst, sh,
5864                     inp, stcb, net, &high_tsn,
5865                     use_mflowid, mflowid,
5866                     vrf_id, port);
5867                 if (retval == 2) {
5868                         /*
5869                          * The association aborted, NO UNLOCK needed since
5870                          * the association is destroyed.
5871                          */
5872                         stcb = NULL;
5873                         goto out;
5874                 }
5875                 data_processed = 1;
5876                 /*
5877                  * Anything important needs to have been m_copy'ed in
5878                  * process_data
5879                  */
5880         }
5881         /* take care of ecn */
5882         if ((data_processed == 1) &&
5883             (stcb->asoc.ecn_allowed == 1) &&
5884             ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
5885                 /* Yep, we need to add a ECNE */
5886                 sctp_send_ecn_echo(stcb, net, high_tsn);
5887         }
5888         if ((data_processed == 0) && (fwd_tsn_seen)) {
5889                 int was_a_gap;
5890                 uint32_t highest_tsn;
5891
5892                 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
5893                         highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
5894                 } else {
5895                         highest_tsn = stcb->asoc.highest_tsn_inside_map;
5896                 }
5897                 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
5898                 stcb->asoc.send_sack = 1;
5899                 sctp_sack_check(stcb, was_a_gap);
5900         } else if (fwd_tsn_seen) {
5901                 stcb->asoc.send_sack = 1;
5902         }
5903         /* trigger send of any chunks in queue... */
5904 trigger_send:
5905 #ifdef SCTP_AUDITING_ENABLED
5906         sctp_audit_log(0xE0, 2);
5907         sctp_auditing(1, inp, stcb, net);
5908 #endif
5909         SCTPDBG(SCTP_DEBUG_INPUT1,
5910             "Check for chunk output prw:%d tqe:%d tf=%d\n",
5911             stcb->asoc.peers_rwnd,
5912             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
5913             stcb->asoc.total_flight);
5914         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
5915         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
5916                 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
5917         }
5918         if (cnt_ctrl_ready ||
5919             ((un_sent) &&
5920             (stcb->asoc.peers_rwnd > 0 ||
5921             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
5922                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
5923                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
5924                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
5925         }
5926 #ifdef SCTP_AUDITING_ENABLED
5927         sctp_audit_log(0xE0, 3);
5928         sctp_auditing(2, inp, stcb, net);
5929 #endif
5930 out:
5931         if (stcb != NULL) {
5932                 SCTP_TCB_UNLOCK(stcb);
5933         }
5934         if (inp_decr != NULL) {
5935                 /* reduce ref-count */
5936                 SCTP_INP_WLOCK(inp_decr);
5937                 SCTP_INP_DECR_REF(inp_decr);
5938                 SCTP_INP_WUNLOCK(inp_decr);
5939         }
5940 #ifdef INVARIANTS
5941         if (inp != NULL) {
5942                 sctp_validate_no_locks(inp);
5943         }
5944 #endif
5945         return;
5946 }
5947
5948 #if 0
5949 static void
5950 sctp_print_mbuf_chain(struct mbuf *m)
5951 {
5952         for (; m; m = SCTP_BUF_NEXT(m)) {
5953                 SCTP_PRINTF("%p: m_len = %ld\n", (void *)m, SCTP_BUF_LEN(m));
5954                 if (SCTP_BUF_IS_EXTENDED(m))
5955                         SCTP_PRINTF("%p: extend_size = %d\n", (void *)m, SCTP_BUF_EXTEND_SIZE(m));
5956         }
5957 }
5958
5959 #endif
5960
5961 #ifdef INET
5962 void
5963 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
5964 {
5965         struct mbuf *m;
5966         int iphlen;
5967         uint32_t vrf_id = 0;
5968         uint8_t ecn_bits;
5969         struct sockaddr_in src, dst;
5970         struct ip *ip;
5971         struct sctphdr *sh;
5972         struct sctp_chunkhdr *ch;
5973         int length, offset;
5974
5975 #if !defined(SCTP_WITH_NO_CSUM)
5976         uint8_t compute_crc;
5977
5978 #endif
5979         uint32_t mflowid;
5980         uint8_t use_mflowid;
5981
5982         iphlen = off;
5983         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
5984                 SCTP_RELEASE_PKT(i_pak);
5985                 return;
5986         }
5987         m = SCTP_HEADER_TO_CHAIN(i_pak);
5988 #ifdef SCTP_MBUF_LOGGING
5989         /* Log in any input mbufs */
5990         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5991                 struct mbuf *mat;
5992
5993                 for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
5994                         if (SCTP_BUF_IS_EXTENDED(mat)) {
5995                                 sctp_log_mb(mat, SCTP_MBUF_INPUT);
5996                         }
5997                 }
5998         }
5999 #endif
6000 #ifdef SCTP_PACKET_LOGGING
6001         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
6002                 sctp_packet_log(m);
6003         }
6004 #endif
6005         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6006             "sctp_input(): Packet of length %d received on %s with csum_flags 0x%x.\n",
6007             m->m_pkthdr.len,
6008             if_name(m->m_pkthdr.rcvif),
6009             m->m_pkthdr.csum_flags);
6010         if (m->m_flags & M_FLOWID) {
6011                 mflowid = m->m_pkthdr.flowid;
6012                 use_mflowid = 1;
6013         } else {
6014                 mflowid = 0;
6015                 use_mflowid = 0;
6016         }
6017         SCTP_STAT_INCR(sctps_recvpackets);
6018         SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
6019         /* Get IP, SCTP, and first chunk header together in the first mbuf. */
6020         offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6021         if (SCTP_BUF_LEN(m) < offset) {
6022                 if ((m = m_pullup(m, offset)) == NULL) {
6023                         SCTP_STAT_INCR(sctps_hdrops);
6024                         return;
6025                 }
6026         }
6027         ip = mtod(m, struct ip *);
6028         sh = (struct sctphdr *)((caddr_t)ip + iphlen);
6029         ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
6030         offset -= sizeof(struct sctp_chunkhdr);
6031         memset(&src, 0, sizeof(struct sockaddr_in));
6032         src.sin_family = AF_INET;
6033         src.sin_len = sizeof(struct sockaddr_in);
6034         src.sin_port = sh->src_port;
6035         src.sin_addr = ip->ip_src;
6036         memset(&dst, 0, sizeof(struct sockaddr_in));
6037         dst.sin_family = AF_INET;
6038         dst.sin_len = sizeof(struct sockaddr_in);
6039         dst.sin_port = sh->dest_port;
6040         dst.sin_addr = ip->ip_dst;
6041         length = ip->ip_len + iphlen;
6042         /* Validate mbuf chain length with IP payload length. */
6043         if (SCTP_HEADER_LEN(m) != length) {
6044                 SCTPDBG(SCTP_DEBUG_INPUT1,
6045                     "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
6046                 SCTP_STAT_INCR(sctps_hdrops);
6047                 goto out;
6048         }
6049         /* SCTP does not allow broadcasts or multicasts */
6050         if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
6051                 goto out;
6052         }
6053         if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
6054                 goto out;
6055         }
6056         ecn_bits = ip->ip_tos;
6057 #if defined(SCTP_WITH_NO_CSUM)
6058         SCTP_STAT_INCR(sctps_recvnocrc);
6059 #else
6060         if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
6061                 SCTP_STAT_INCR(sctps_recvhwcrc);
6062                 compute_crc = 0;
6063         } else {
6064                 SCTP_STAT_INCR(sctps_recvswcrc);
6065                 compute_crc = 1;
6066         }
6067 #endif
6068         sctp_common_input_processing(&m, iphlen, offset, length,
6069             (struct sockaddr *)&src,
6070             (struct sockaddr *)&dst,
6071             sh, ch,
6072 #if !defined(SCTP_WITH_NO_CSUM)
6073             compute_crc,
6074 #endif
6075             ecn_bits,
6076             use_mflowid, mflowid,
6077             vrf_id, port);
6078 out:
6079         if (m) {
6080                 sctp_m_freem(m);
6081         }
6082         return;
6083 }
6084
6085 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6086 extern int *sctp_cpuarry;
6087
6088 #endif
6089
6090 void
6091 sctp_input(struct mbuf *m, int off)
6092 {
6093 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6094         struct ip *ip;
6095         struct sctphdr *sh;
6096         int offset;
6097         int cpu_to_use;
6098         uint32_t flowid, tag;
6099
6100         if (mp_ncpus > 1) {
6101                 if (m->m_flags & M_FLOWID) {
6102                         flowid = m->m_pkthdr.flowid;
6103                 } else {
6104                         /*
6105                          * No flow id built by lower layers fix it so we
6106                          * create one.
6107                          */
6108                         offset = off + sizeof(struct sctphdr);
6109                         if (SCTP_BUF_LEN(m) < offset) {
6110                                 if ((m = m_pullup(m, offset)) == NULL) {
6111                                         SCTP_STAT_INCR(sctps_hdrops);
6112                                         return;
6113                                 }
6114                         }
6115                         ip = mtod(m, struct ip *);
6116                         sh = (struct sctphdr *)((caddr_t)ip + off);
6117                         tag = htonl(sh->v_tag);
6118                         flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
6119                         m->m_pkthdr.flowid = flowid;
6120                         m->m_flags |= M_FLOWID;
6121                 }
6122                 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
6123                 sctp_queue_to_mcore(m, off, cpu_to_use);
6124                 return;
6125         }
6126 #endif
6127         sctp_input_with_port(m, off, 0);
6128 }
6129
6130 #endif