sys/netinet/sctp_input.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_input.h>
  44 #include <netinet/sctp_auth.h>
  45 #include <netinet/sctp_indata.h>
  46 #include <netinet/sctp_asconf.h>
  47 #include <netinet/sctp_bsd_addr.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/sctp_crc32.h>
  50 #if defined(INET) || defined(INET6)
  51 #include <netinet/udp.h>
  52 #endif
  53 #include <sys/smp.h>
  54
  55
  56
  57 static void
  58 sctp_stop_all_cookie_timers(struct sctp_tcb *stcb)
  59 {
  60         struct sctp_nets *net;
  61
  62         /*
  63          * This now not only stops all cookie timers it also stops any INIT
  64          * timers as well. This will make sure that the timers are stopped
  65          * in all collision cases.
  66          */
  67         SCTP_TCB_LOCK_ASSERT(stcb);
  68         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  69                 if (net->rxt_timer.type == SCTP_TIMER_TYPE_COOKIE) {
  70                         sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE,
  71                             stcb->sctp_ep,
  72                             stcb,
  73                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_1);
  74                 } else if (net->rxt_timer.type == SCTP_TIMER_TYPE_INIT) {
  75                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT,
  76                             stcb->sctp_ep,
  77                             stcb,
  78                             net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_2);
  79                 }
  80         }
  81 }
  82
  83 /* INIT handler */
  84 static void
  85 sctp_handle_init(struct mbuf *m, int iphlen, int offset,
  86     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
  87     struct sctp_init_chunk *cp, struct sctp_inpcb *inp,
  88     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_no_unlock,
  89     uint8_t mflowtype, uint32_t mflowid,
  90     uint32_t vrf_id, uint16_t port)
  91 {
  92         struct sctp_init *init;
  93         struct mbuf *op_err;
  94
  95         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_init: handling INIT tcb:%p\n",
  96             (void *)stcb);
  97         if (stcb == NULL) {
  98                 SCTP_INP_RLOCK(inp);
  99         }
 100         /* validate length */
 101         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_chunk)) {
 102                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 103                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 104                     mflowtype, mflowid,
 105                     vrf_id, port);
 106                 if (stcb)
 107                         *abort_no_unlock = 1;
 108                 goto outnow;
 109         }
 110         /* validate parameters */
 111         init = &cp->init;
 112         if (init->initiate_tag == 0) {
 113                 /* protocol error... send abort */
 114                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 115                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 116                     mflowtype, mflowid,
 117                     vrf_id, port);
 118                 if (stcb)
 119                         *abort_no_unlock = 1;
 120                 goto outnow;
 121         }
 122         if (ntohl(init->a_rwnd) < SCTP_MIN_RWND) {
 123                 /* invalid parameter... send abort */
 124                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 125                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 126                     mflowtype, mflowid,
 127                     vrf_id, port);
 128                 if (stcb)
 129                         *abort_no_unlock = 1;
 130                 goto outnow;
 131         }
 132         if (init->num_inbound_streams == 0) {
 133                 /* protocol error... send abort */
 134                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 135                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 136                     mflowtype, mflowid,
 137                     vrf_id, port);
 138                 if (stcb)
 139                         *abort_no_unlock = 1;
 140                 goto outnow;
 141         }
 142         if (init->num_outbound_streams == 0) {
 143                 /* protocol error... send abort */
 144                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
 145                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 146                     mflowtype, mflowid,
 147                     vrf_id, port);
 148                 if (stcb)
 149                         *abort_no_unlock = 1;
 150                 goto outnow;
 151         }
 152         if (sctp_validate_init_auth_params(m, offset + sizeof(*cp),
 153             offset + ntohs(cp->ch.chunk_length))) {
 154                 /* auth parameter(s) error... send abort */
 155                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 156                     "Problem with AUTH parameters");
 157                 sctp_abort_association(inp, stcb, m, iphlen, src, dst, sh, op_err,
 158                     mflowtype, mflowid,
 159                     vrf_id, port);
 160                 if (stcb)
 161                         *abort_no_unlock = 1;
 162                 goto outnow;
 163         }
 164         /*
 165          * We are only accepting if we have a socket with positive
 166          * so_qlimit.
 167          */
 168         if ((stcb == NULL) &&
 169             ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
 170             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
 171             (inp->sctp_socket == NULL) ||
 172             (inp->sctp_socket->so_qlimit == 0))) {
 173                 /*
 174                  * FIX ME ?? What about TCP model and we have a
 175                  * match/restart case? Actually no fix is needed. the lookup
 176                  * will always find the existing assoc so stcb would not be
 177                  * NULL. It may be questionable to do this since we COULD
 178                  * just send back the INIT-ACK and hope that the app did
 179                  * accept()'s by the time the COOKIE was sent. But there is
 180                  * a price to pay for COOKIE generation and I don't want to
 181                  * pay it on the chance that the app will actually do some
 182                  * accepts(). The App just looses and should NOT be in this
 183                  * state :-)
 184                  */
 185                 if (SCTP_BASE_SYSCTL(sctp_blackhole) == 0) {
 186                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 187                             "No listener");
 188                         sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
 189                             mflowtype, mflowid, inp->fibnum,
 190                             vrf_id, port);
 191                 }
 192                 goto outnow;
 193         }
 194         if ((stcb != NULL) &&
 195             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 196                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending SHUTDOWN-ACK\n");
 197                 sctp_send_shutdown_ack(stcb, NULL);
 198                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
 199         } else {
 200                 SCTPDBG(SCTP_DEBUG_INPUT3, "sctp_handle_init: sending INIT-ACK\n");
 201                 sctp_send_initiate_ack(inp, stcb, net, m, iphlen, offset,
 202                     src, dst, sh, cp,
 203                     mflowtype, mflowid,
 204                     vrf_id, port,
 205                     ((stcb == NULL) ? SCTP_HOLDS_LOCK : SCTP_NOT_LOCKED));
 206         }
 207 outnow:
 208         if (stcb == NULL) {
 209                 SCTP_INP_RUNLOCK(inp);
 210         }
 211 }
 212
 213 /*
 214  * process peer "INIT/INIT-ACK" chunk returns value < 0 on error
 215  */
 216
 217 int
 218 sctp_is_there_unsent_data(struct sctp_tcb *stcb, int so_locked
 219 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
 220     SCTP_UNUSED
 221 #endif
 222 )
 223 {
 224         int unsent_data;
 225         unsigned int i;
 226         struct sctp_stream_queue_pending *sp;
 227         struct sctp_association *asoc;
 228
 229         /*
 230          * This function returns if any stream has true unsent data on it.
 231          * Note that as it looks through it will clean up any places that
 232          * have old data that has been sent but left at top of stream queue.
 233          */
 234         asoc = &stcb->asoc;
 235         unsent_data = 0;
 236         SCTP_TCB_SEND_LOCK(stcb);
 237         if (!stcb->asoc.ss_functions.sctp_ss_is_empty(stcb, asoc)) {
 238                 /* Check to see if some data queued */
 239                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
 240                         /* sa_ignore FREED_MEMORY */
 241                         sp = TAILQ_FIRST(&stcb->asoc.strmout[i].outqueue);
 242                         if (sp == NULL) {
 243                                 continue;
 244                         }
 245                         if ((sp->msg_is_complete) &&
 246                             (sp->length == 0) &&
 247                             (sp->sender_all_done)) {
 248                                 /*
 249                                  * We are doing differed cleanup. Last time
 250                                  * through when we took all the data the
 251                                  * sender_all_done was not set.
 252                                  */
 253                                 if (sp->put_last_out == 0) {
 254                                         SCTP_PRINTF("Gak, put out entire msg with NO end!-1\n");
 255                                         SCTP_PRINTF("sender_done:%d len:%d msg_comp:%d put_last_out:%d\n",
 256                                             sp->sender_all_done,
 257                                             sp->length,
 258                                             sp->msg_is_complete,
 259                                             sp->put_last_out);
 260                                 }
 261                                 atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
 262                                 TAILQ_REMOVE(&stcb->asoc.strmout[i].outqueue, sp, next);
 263                                 stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, &asoc->strmout[i], sp, 1);
 264                                 if (sp->net) {
 265                                         sctp_free_remote_addr(sp->net);
 266                                         sp->net = NULL;
 267                                 }
 268                                 if (sp->data) {
 269                                         sctp_m_freem(sp->data);
 270                                         sp->data = NULL;
 271                                 }
 272                                 sctp_free_a_strmoq(stcb, sp, so_locked);
 273                                 if (!TAILQ_EMPTY(&stcb->asoc.strmout[i].outqueue)) {
 274                                         unsent_data++;
 275                                 }
 276                         } else {
 277                                 unsent_data++;
 278                         }
 279                         if (unsent_data > 0) {
 280                                 break;
 281                         }
 282                 }
 283         }
 284         SCTP_TCB_SEND_UNLOCK(stcb);
 285         return (unsent_data);
 286 }
 287
 288 static int
 289 sctp_process_init(struct sctp_init_chunk *cp, struct sctp_tcb *stcb)
 290 {
 291         struct sctp_init *init;
 292         struct sctp_association *asoc;
 293         struct sctp_nets *lnet;
 294         unsigned int i;
 295
 296         init = &cp->init;
 297         asoc = &stcb->asoc;
 298         /* save off parameters */
 299         asoc->peer_vtag = ntohl(init->initiate_tag);
 300         asoc->peers_rwnd = ntohl(init->a_rwnd);
 301         /* init tsn's */
 302         asoc->highest_tsn_inside_map = asoc->asconf_seq_in = ntohl(init->initial_tsn) - 1;
 303
 304         if (!TAILQ_EMPTY(&asoc->nets)) {
 305                 /* update any ssthresh's that may have a default */
 306                 TAILQ_FOREACH(lnet, &asoc->nets, sctp_next) {
 307                         lnet->ssthresh = asoc->peers_rwnd;
 308                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & (SCTP_CWND_MONITOR_ENABLE | SCTP_CWND_LOGGING_ENABLE)) {
 309                                 sctp_log_cwnd(stcb, lnet, 0, SCTP_CWND_INITIALIZATION);
 310                         }
 311                 }
 312         }
 313         SCTP_TCB_SEND_LOCK(stcb);
 314         if (asoc->pre_open_streams > ntohs(init->num_inbound_streams)) {
 315                 unsigned int newcnt;
 316                 struct sctp_stream_out *outs;
 317                 struct sctp_stream_queue_pending *sp, *nsp;
 318                 struct sctp_tmit_chunk *chk, *nchk;
 319
 320                 /* abandon the upper streams */
 321                 newcnt = ntohs(init->num_inbound_streams);
 322                 TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
 323                         if (chk->rec.data.stream_number >= newcnt) {
 324                                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
 325                                 asoc->send_queue_cnt--;
 326                                 if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
 327                                         asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
 328 #ifdef INVARIANTS
 329                                 } else {
 330                                         panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
 331 #endif
 332                                 }
 333                                 if (chk->data != NULL) {
 334                                         sctp_free_bufspace(stcb, asoc, chk, 1);
 335                                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
 336                                             0, chk, SCTP_SO_NOT_LOCKED);
 337                                         if (chk->data) {
 338                                                 sctp_m_freem(chk->data);
 339                                                 chk->data = NULL;
 340                                         }
 341                                 }
 342                                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
 343                                 /* sa_ignore FREED_MEMORY */
 344                         }
 345                 }
 346                 if (asoc->strmout) {
 347                         for (i = newcnt; i < asoc->pre_open_streams; i++) {
 348                                 outs = &asoc->strmout[i];
 349                                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
 350                                         atomic_subtract_int(&stcb->asoc.stream_queue_cnt, 1);
 351                                         TAILQ_REMOVE(&outs->outqueue, sp, next);
 352                                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
 353                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL,
 354                                             stcb, 0, sp, SCTP_SO_NOT_LOCKED);
 355                                         if (sp->data) {
 356                                                 sctp_m_freem(sp->data);
 357                                                 sp->data = NULL;
 358                                         }
 359                                         if (sp->net) {
 360                                                 sctp_free_remote_addr(sp->net);
 361                                                 sp->net = NULL;
 362                                         }
 363                                         /* Free the chunk */
 364                                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_NOT_LOCKED);
 365                                         /* sa_ignore FREED_MEMORY */
 366                                 }
 367                                 outs->state = SCTP_STREAM_CLOSED;
 368                         }
 369                 }
 370                 /* cut back the count */
 371                 asoc->pre_open_streams = newcnt;
 372         }
 373         SCTP_TCB_SEND_UNLOCK(stcb);
 374         asoc->streamoutcnt = asoc->pre_open_streams;
 375         if (asoc->strmout) {
 376                 for (i = 0; i < asoc->streamoutcnt; i++) {
 377                         asoc->strmout[i].state = SCTP_STREAM_OPEN;
 378                 }
 379         }
 380         /* EY - nr_sack: initialize highest tsn in nr_mapping_array */
 381         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
 382         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
 383                 sctp_log_map(0, 5, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
 384         }
 385         /* This is the next one we expect */
 386         asoc->str_reset_seq_in = asoc->asconf_seq_in + 1;
 387
 388         asoc->mapping_array_base_tsn = ntohl(init->initial_tsn);
 389         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->asconf_seq_in;
 390
 391         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 392         /* open the requested streams */
 393
 394         if (asoc->strmin != NULL) {
 395                 /* Free the old ones */
 396                 for (i = 0; i < asoc->streamincnt; i++) {
 397                         sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
 398                         sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
 399                 }
 400                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
 401         }
 402         if (asoc->max_inbound_streams > ntohs(init->num_outbound_streams)) {
 403                 asoc->streamincnt = ntohs(init->num_outbound_streams);
 404         } else {
 405                 asoc->streamincnt = asoc->max_inbound_streams;
 406         }
 407         SCTP_MALLOC(asoc->strmin, struct sctp_stream_in *, asoc->streamincnt *
 408             sizeof(struct sctp_stream_in), SCTP_M_STRMI);
 409         if (asoc->strmin == NULL) {
 410                 /* we didn't get memory for the streams! */
 411                 SCTPDBG(SCTP_DEBUG_INPUT2, "process_init: couldn't get memory for the streams!\n");
 412                 return (-1);
 413         }
 414         for (i = 0; i < asoc->streamincnt; i++) {
 415                 asoc->strmin[i].stream_no = i;
 416                 asoc->strmin[i].last_sequence_delivered = 0xffffffff;
 417                 TAILQ_INIT(&asoc->strmin[i].inqueue);
 418                 TAILQ_INIT(&asoc->strmin[i].uno_inqueue);
 419                 asoc->strmin[i].pd_api_started = 0;
 420                 asoc->strmin[i].delivery_started = 0;
 421         }
 422         /*
 423          * load_address_from_init will put the addresses into the
 424          * association when the COOKIE is processed or the INIT-ACK is
 425          * processed. Both types of COOKIE's existing and new call this
 426          * routine. It will remove addresses that are no longer in the
 427          * association (for the restarting case where addresses are
 428          * removed). Up front when the INIT arrives we will discard it if it
 429          * is a restart and new addresses have been added.
 430          */
 431         /* sa_ignore MEMLEAK */
 432         return (0);
 433 }
 434
 435 /*
 436  * INIT-ACK message processing/consumption returns value < 0 on error
 437  */
 438 static int
 439 sctp_process_init_ack(struct mbuf *m, int iphlen, int offset,
 440     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
 441     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
 442     struct sctp_nets *net, int *abort_no_unlock,
 443     uint8_t mflowtype, uint32_t mflowid,
 444     uint32_t vrf_id)
 445 {
 446         struct sctp_association *asoc;
 447         struct mbuf *op_err;
 448         int retval, abort_flag;
 449         uint32_t initack_limit;
 450         int nat_friendly = 0;
 451
 452         /* First verify that we have no illegal param's */
 453         abort_flag = 0;
 454
 455         op_err = sctp_arethere_unrecognized_parameters(m,
 456             (offset + sizeof(struct sctp_init_chunk)),
 457             &abort_flag, (struct sctp_chunkhdr *)cp, &nat_friendly);
 458         if (abort_flag) {
 459                 /* Send an abort and notify peer */
 460                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
 461                 *abort_no_unlock = 1;
 462                 return (-1);
 463         }
 464         asoc = &stcb->asoc;
 465         asoc->peer_supports_nat = (uint8_t) nat_friendly;
 466         /* process the peer's parameters in the INIT-ACK */
 467         retval = sctp_process_init((struct sctp_init_chunk *)cp, stcb);
 468         if (retval < 0) {
 469                 return (retval);
 470         }
 471         initack_limit = offset + ntohs(cp->ch.chunk_length);
 472         /* load all addresses */
 473         if ((retval = sctp_load_addresses_from_init(stcb, m,
 474             (offset + sizeof(struct sctp_init_chunk)), initack_limit,
 475             src, dst, NULL, stcb->asoc.port))) {
 476                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
 477                     "Problem with address parameters");
 478                 SCTPDBG(SCTP_DEBUG_INPUT1,
 479                     "Load addresses from INIT causes an abort %d\n",
 480                     retval);
 481                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 482                     src, dst, sh, op_err,
 483                     mflowtype, mflowid,
 484                     vrf_id, net->port);
 485                 *abort_no_unlock = 1;
 486                 return (-1);
 487         }
 488         /* if the peer doesn't support asconf, flush the asconf queue */
 489         if (asoc->asconf_supported == 0) {
 490                 struct sctp_asconf_addr *param, *nparam;
 491
 492                 TAILQ_FOREACH_SAFE(param, &asoc->asconf_queue, next, nparam) {
 493                         TAILQ_REMOVE(&asoc->asconf_queue, param, next);
 494                         SCTP_FREE(param, SCTP_M_ASC_ADDR);
 495                 }
 496         }
 497         stcb->asoc.peer_hmac_id = sctp_negotiate_hmacid(stcb->asoc.peer_hmacs,
 498             stcb->asoc.local_hmacs);
 499         if (op_err) {
 500                 sctp_queue_op_err(stcb, op_err);
 501                 /* queuing will steal away the mbuf chain to the out queue */
 502                 op_err = NULL;
 503         }
 504         /* extract the cookie and queue it to "echo" it back... */
 505         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
 506                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
 507                     stcb->asoc.overall_error_count,
 508                     0,
 509                     SCTP_FROM_SCTP_INPUT,
 510                     __LINE__);
 511         }
 512         stcb->asoc.overall_error_count = 0;
 513         net->error_count = 0;
 514
 515         /*
 516          * Cancel the INIT timer, We do this first before queueing the
 517          * cookie. We always cancel at the primary to assue that we are
 518          * canceling the timer started by the INIT which always goes to the
 519          * primary.
 520          */
 521         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep, stcb,
 522             asoc->primary_destination, SCTP_FROM_SCTP_INPUT + SCTP_LOC_3);
 523
 524         /* calculate the RTO */
 525         net->RTO = sctp_calculate_rto(stcb, asoc, net, &asoc->time_entered, sctp_align_safe_nocopy,
 526             SCTP_RTT_FROM_NON_DATA);
 527         retval = sctp_send_cookie_echo(m, offset, stcb, net);
 528         if (retval < 0) {
 529                 /*
 530                  * No cookie, we probably should send a op error. But in any
 531                  * case if there is no cookie in the INIT-ACK, we can
 532                  * abandon the peer, its broke.
 533                  */
 534                 if (retval == -3) {
 535                         uint16_t len;
 536
 537                         len = (uint16_t) (sizeof(struct sctp_error_missing_param) + sizeof(uint16_t));
 538                         /* We abort with an error of missing mandatory param */
 539                         op_err = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
 540                         if (op_err != NULL) {
 541                                 struct sctp_error_missing_param *cause;
 542
 543                                 SCTP_BUF_LEN(op_err) = len;
 544                                 cause = mtod(op_err, struct sctp_error_missing_param *);
 545                                 /* Subtract the reserved param */
 546                                 cause->cause.code = htons(SCTP_CAUSE_MISSING_PARAM);
 547                                 cause->cause.length = htons(len);
 548                                 cause->num_missing_params = htonl(1);
 549                                 cause->type[0] = htons(SCTP_STATE_COOKIE);
 550                         }
 551                         sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
 552                             src, dst, sh, op_err,
 553                             mflowtype, mflowid,
 554                             vrf_id, net->port);
 555                         *abort_no_unlock = 1;
 556                 }
 557                 return (retval);
 558         }
 559         return (0);
 560 }
 561
 562 static void
 563 sctp_handle_heartbeat_ack(struct sctp_heartbeat_chunk *cp,
 564     struct sctp_tcb *stcb, struct sctp_nets *net)
 565 {
 566         union sctp_sockstore store;
 567         struct sctp_nets *r_net, *f_net;
 568         struct timeval tv;
 569         int req_prim = 0;
 570         uint16_t old_error_counter;
 571
 572         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_heartbeat_chunk)) {
 573                 /* Invalid length */
 574                 return;
 575         }
 576         memset(&store, 0, sizeof(store));
 577         switch (cp->heartbeat.hb_info.addr_family) {
 578 #ifdef INET
 579         case AF_INET:
 580                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in)) {
 581                         store.sin.sin_family = cp->heartbeat.hb_info.addr_family;
 582                         store.sin.sin_len = cp->heartbeat.hb_info.addr_len;
 583                         store.sin.sin_port = stcb->rport;
 584                         memcpy(&store.sin.sin_addr, cp->heartbeat.hb_info.address,
 585                             sizeof(store.sin.sin_addr));
 586                 } else {
 587                         return;
 588                 }
 589                 break;
 590 #endif
 591 #ifdef INET6
 592         case AF_INET6:
 593                 if (cp->heartbeat.hb_info.addr_len == sizeof(struct sockaddr_in6)) {
 594                         store.sin6.sin6_family = cp->heartbeat.hb_info.addr_family;
 595                         store.sin6.sin6_len = cp->heartbeat.hb_info.addr_len;
 596                         store.sin6.sin6_port = stcb->rport;
 597                         memcpy(&store.sin6.sin6_addr, cp->heartbeat.hb_info.address, sizeof(struct in6_addr));
 598                 } else {
 599                         return;
 600                 }
 601                 break;
 602 #endif
 603         default:
 604                 return;
 605         }
 606         r_net = sctp_findnet(stcb, &store.sa);
 607         if (r_net == NULL) {
 608                 SCTPDBG(SCTP_DEBUG_INPUT1, "Huh? I can't find the address I sent it to, discard\n");
 609                 return;
 610         }
 611         if ((r_net && (r_net->dest_state & SCTP_ADDR_UNCONFIRMED)) &&
 612             (r_net->heartbeat_random1 == cp->heartbeat.hb_info.random_value1) &&
 613             (r_net->heartbeat_random2 == cp->heartbeat.hb_info.random_value2)) {
 614                 /*
 615                  * If the its a HB and it's random value is correct when can
 616                  * confirm the destination.
 617                  */
 618                 r_net->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
 619                 if (r_net->dest_state & SCTP_ADDR_REQ_PRIMARY) {
 620                         stcb->asoc.primary_destination = r_net;
 621                         r_net->dest_state &= ~SCTP_ADDR_REQ_PRIMARY;
 622                         f_net = TAILQ_FIRST(&stcb->asoc.nets);
 623                         if (f_net != r_net) {
 624                                 /*
 625                                  * first one on the list is NOT the primary
 626                                  * sctp_cmpaddr() is much more efficient if
 627                                  * the primary is the first on the list,
 628                                  * make it so.
 629                                  */
 630                                 TAILQ_REMOVE(&stcb->asoc.nets, r_net, sctp_next);
 631                                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, r_net, sctp_next);
 632                         }
 633                         req_prim = 1;
 634                 }
 635                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
 636                     stcb, 0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 637                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb,
 638                     r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_4);
 639                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
 640         }
 641         old_error_counter = r_net->error_count;
 642         r_net->error_count = 0;
 643         r_net->hb_responded = 1;
 644         tv.tv_sec = cp->heartbeat.hb_info.time_value_1;
 645         tv.tv_usec = cp->heartbeat.hb_info.time_value_2;
 646         /* Now lets do a RTO with this */
 647         r_net->RTO = sctp_calculate_rto(stcb, &stcb->asoc, r_net, &tv, sctp_align_safe_nocopy,
 648             SCTP_RTT_FROM_NON_DATA);
 649         if (!(r_net->dest_state & SCTP_ADDR_REACHABLE)) {
 650                 r_net->dest_state |= SCTP_ADDR_REACHABLE;
 651                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
 652                     0, (void *)r_net, SCTP_SO_NOT_LOCKED);
 653         }
 654         if (r_net->dest_state & SCTP_ADDR_PF) {
 655                 r_net->dest_state &= ~SCTP_ADDR_PF;
 656                 stcb->asoc.cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
 657         }
 658         if (old_error_counter > 0) {
 659                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 660                     stcb, r_net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_5);
 661                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, r_net);
 662         }
 663         if (r_net == stcb->asoc.primary_destination) {
 664                 if (stcb->asoc.alternate) {
 665                         /* release the alternate, primary is good */
 666                         sctp_free_remote_addr(stcb->asoc.alternate);
 667                         stcb->asoc.alternate = NULL;
 668                 }
 669         }
 670         /* Mobility adaptation */
 671         if (req_prim) {
 672                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 673                     SCTP_MOBILITY_BASE) ||
 674                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 675                     SCTP_MOBILITY_FASTHANDOFF)) &&
 676                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 677                     SCTP_MOBILITY_PRIM_DELETED)) {
 678
 679                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 680                             stcb->sctp_ep, stcb, NULL,
 681                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_6);
 682                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 683                             SCTP_MOBILITY_FASTHANDOFF)) {
 684                                 sctp_assoc_immediate_retrans(stcb,
 685                                     stcb->asoc.primary_destination);
 686                         }
 687                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 688                             SCTP_MOBILITY_BASE)) {
 689                                 sctp_move_chunks_from_net(stcb,
 690                                     stcb->asoc.deleted_primary);
 691                         }
 692                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 693                             stcb->asoc.deleted_primary);
 694                 }
 695         }
 696 }
 697
 698 static int
 699 sctp_handle_nat_colliding_state(struct sctp_tcb *stcb)
 700 {
 701         /*
 702          * return 0 means we want you to proceed with the abort non-zero
 703          * means no abort processing
 704          */
 705         struct sctpasochead *head;
 706
 707         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
 708                 /* generate a new vtag and send init */
 709                 LIST_REMOVE(stcb, sctp_asocs);
 710                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 711                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
 712                 /*
 713                  * put it in the bucket in the vtag hash of assoc's for the
 714                  * system
 715                  */
 716                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 717                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 718                 return (1);
 719         }
 720         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED) {
 721                 /*
 722                  * treat like a case where the cookie expired i.e.: - dump
 723                  * current cookie. - generate a new vtag. - resend init.
 724                  */
 725                 /* generate a new vtag and send init */
 726                 LIST_REMOVE(stcb, sctp_asocs);
 727                 stcb->asoc.state &= ~SCTP_STATE_COOKIE_ECHOED;
 728                 stcb->asoc.state |= SCTP_STATE_COOKIE_WAIT;
 729                 sctp_stop_all_cookie_timers(stcb);
 730                 sctp_toss_old_cookies(stcb, &stcb->asoc);
 731                 stcb->asoc.my_vtag = sctp_select_a_tag(stcb->sctp_ep, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 732                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
 733                 /*
 734                  * put it in the bucket in the vtag hash of assoc's for the
 735                  * system
 736                  */
 737                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 738                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
 739                 return (1);
 740         }
 741         return (0);
 742 }
 743
 744 static int
 745 sctp_handle_nat_missing_state(struct sctp_tcb *stcb,
 746     struct sctp_nets *net)
 747 {
 748         /*
 749          * return 0 means we want you to proceed with the abort non-zero
 750          * means no abort processing
 751          */
 752         if (stcb->asoc.auth_supported == 0) {
 753                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_nat_missing_state: Peer does not support AUTH, cannot send an asconf\n");
 754                 return (0);
 755         }
 756         sctp_asconf_send_nat_state_update(stcb, net);
 757         return (1);
 758 }
 759
 760
 761 static void
 762 sctp_handle_abort(struct sctp_abort_chunk *abort,
 763     struct sctp_tcb *stcb, struct sctp_nets *net)
 764 {
 765 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 766         struct socket *so;
 767
 768 #endif
 769         uint16_t len;
 770         uint16_t error;
 771
 772         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: handling ABORT\n");
 773         if (stcb == NULL)
 774                 return;
 775
 776         len = ntohs(abort->ch.chunk_length);
 777         if (len > sizeof(struct sctp_chunkhdr)) {
 778                 /*
 779                  * Need to check the cause codes for our two magic nat
 780                  * aborts which don't kill the assoc necessarily.
 781                  */
 782                 struct sctp_gen_error_cause *cause;
 783
 784                 cause = (struct sctp_gen_error_cause *)(abort + 1);
 785                 error = ntohs(cause->code);
 786                 if (error == SCTP_CAUSE_NAT_COLLIDING_STATE) {
 787                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
 788                             abort->ch.chunk_flags);
 789                         if (sctp_handle_nat_colliding_state(stcb)) {
 790                                 return;
 791                         }
 792                 } else if (error == SCTP_CAUSE_NAT_MISSING_STATE) {
 793                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
 794                             abort->ch.chunk_flags);
 795                         if (sctp_handle_nat_missing_state(stcb, net)) {
 796                                 return;
 797                         }
 798                 }
 799         } else {
 800                 error = 0;
 801         }
 802         /* stop any receive timers */
 803         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, net,
 804             SCTP_FROM_SCTP_INPUT + SCTP_LOC_7);
 805         /* notify user of the abort and clean up... */
 806         sctp_abort_notification(stcb, 1, error, abort, SCTP_SO_NOT_LOCKED);
 807         /* free the tcb */
 808         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
 809         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
 810             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 811                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 812         }
 813 #ifdef SCTP_ASOCLOG_OF_TSNS
 814         sctp_print_out_track_log(stcb);
 815 #endif
 816 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 817         so = SCTP_INP_SO(stcb->sctp_ep);
 818         atomic_add_int(&stcb->asoc.refcnt, 1);
 819         SCTP_TCB_UNLOCK(stcb);
 820         SCTP_SOCKET_LOCK(so, 1);
 821         SCTP_TCB_LOCK(stcb);
 822         atomic_subtract_int(&stcb->asoc.refcnt, 1);
 823 #endif
 824         stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
 825         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
 826             SCTP_FROM_SCTP_INPUT + SCTP_LOC_8);
 827 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 828         SCTP_SOCKET_UNLOCK(so, 1);
 829 #endif
 830         SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_handle_abort: finished\n");
 831 }
 832
 833 static void
 834 sctp_start_net_timers(struct sctp_tcb *stcb)
 835 {
 836         uint32_t cnt_hb_sent;
 837         struct sctp_nets *net;
 838
 839         cnt_hb_sent = 0;
 840         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 841                 /*
 842                  * For each network start: 1) A pmtu timer. 2) A HB timer 3)
 843                  * If the dest in unconfirmed send a hb as well if under
 844                  * max_hb_burst have been sent.
 845                  */
 846                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 847                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
 848                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
 849                     (cnt_hb_sent < SCTP_BASE_SYSCTL(sctp_hb_maxburst))) {
 850                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 851                         cnt_hb_sent++;
 852                 }
 853         }
 854         if (cnt_hb_sent) {
 855                 sctp_chunk_output(stcb->sctp_ep, stcb,
 856                     SCTP_OUTPUT_FROM_COOKIE_ACK,
 857                     SCTP_SO_NOT_LOCKED);
 858         }
 859 }
 860
 861
 862 static void
 863 sctp_handle_shutdown(struct sctp_shutdown_chunk *cp,
 864     struct sctp_tcb *stcb, struct sctp_nets *net, int *abort_flag)
 865 {
 866         struct sctp_association *asoc;
 867         int some_on_streamwheel;
 868         int old_state;
 869
 870 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 871         struct socket *so;
 872
 873 #endif
 874
 875         SCTPDBG(SCTP_DEBUG_INPUT2,
 876             "sctp_handle_shutdown: handling SHUTDOWN\n");
 877         if (stcb == NULL)
 878                 return;
 879         asoc = &stcb->asoc;
 880         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
 881             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 882                 return;
 883         }
 884         if (ntohs(cp->ch.chunk_length) != sizeof(struct sctp_shutdown_chunk)) {
 885                 /* Shutdown NOT the expected size */
 886                 return;
 887         }
 888         old_state = SCTP_GET_STATE(asoc);
 889         sctp_update_acked(stcb, cp, abort_flag);
 890         if (*abort_flag) {
 891                 return;
 892         }
 893         if (asoc->control_pdapi) {
 894                 /*
 895                  * With a normal shutdown we assume the end of last record.
 896                  */
 897                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
 898                 if (asoc->control_pdapi->on_strm_q) {
 899                         struct sctp_stream_in *strm;
 900
 901                         strm = &asoc->strmin[asoc->control_pdapi->sinfo_stream];
 902                         if (asoc->control_pdapi->on_strm_q == SCTP_ON_UNORDERED) {
 903                                 /* Unordered */
 904                                 TAILQ_REMOVE(&strm->uno_inqueue, asoc->control_pdapi, next_instrm);
 905                                 asoc->control_pdapi->on_strm_q = 0;
 906                         } else if (asoc->control_pdapi->on_strm_q == SCTP_ON_ORDERED) {
 907                                 /* Ordered */
 908                                 TAILQ_REMOVE(&strm->inqueue, asoc->control_pdapi, next_instrm);
 909                                 asoc->control_pdapi->on_strm_q = 0;
 910 #ifdef INVARIANTS
 911                         } else {
 912                                 panic("Unknown state on ctrl:%p on_strm_q:%d",
 913                                     asoc->control_pdapi,
 914                                     asoc->control_pdapi->on_strm_q);
 915 #endif
 916                         }
 917                 }
 918                 asoc->control_pdapi->end_added = 1;
 919                 asoc->control_pdapi->pdapi_aborted = 1;
 920                 asoc->control_pdapi = NULL;
 921                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
 922 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 923                 so = SCTP_INP_SO(stcb->sctp_ep);
 924                 atomic_add_int(&stcb->asoc.refcnt, 1);
 925                 SCTP_TCB_UNLOCK(stcb);
 926                 SCTP_SOCKET_LOCK(so, 1);
 927                 SCTP_TCB_LOCK(stcb);
 928                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
 929                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
 930                         /* assoc was freed while we were unlocked */
 931                         SCTP_SOCKET_UNLOCK(so, 1);
 932                         return;
 933                 }
 934 #endif
 935                 if (stcb->sctp_socket) {
 936                         sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
 937                 }
 938 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 939                 SCTP_SOCKET_UNLOCK(so, 1);
 940 #endif
 941         }
 942         /* goto SHUTDOWN_RECEIVED state to block new requests */
 943         if (stcb->sctp_socket) {
 944                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
 945                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) &&
 946                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
 947                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_RECEIVED);
 948                         SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 949                         /*
 950                          * notify upper layer that peer has initiated a
 951                          * shutdown
 952                          */
 953                         sctp_ulp_notify(SCTP_NOTIFY_PEER_SHUTDOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
 954
 955                         /* reset time */
 956                         (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
 957                 }
 958         }
 959         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_SENT) {
 960                 /*
 961                  * stop the shutdown timer, since we WILL move to
 962                  * SHUTDOWN-ACK-SENT.
 963                  */
 964                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
 965                     net, SCTP_FROM_SCTP_INPUT + SCTP_LOC_9);
 966         }
 967         /* Now is there unsent data on a stream somewhere? */
 968         some_on_streamwheel = sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED);
 969
 970         if (!TAILQ_EMPTY(&asoc->send_queue) ||
 971             !TAILQ_EMPTY(&asoc->sent_queue) ||
 972             some_on_streamwheel) {
 973                 /* By returning we will push more data out */
 974                 return;
 975         } else {
 976                 /* no outstanding data to send, so move on... */
 977                 /* send SHUTDOWN-ACK */
 978                 /* move to SHUTDOWN-ACK-SENT state */
 979                 if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) ||
 980                     (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
 981                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
 982                 }
 983                 SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_SHUTDOWN_PENDING);
 984                 if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
 985                         SCTP_SET_STATE(asoc, SCTP_STATE_SHUTDOWN_ACK_SENT);
 986                         sctp_stop_timers_for_shutdown(stcb);
 987                         sctp_send_shutdown_ack(stcb, net);
 988                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
 989                             stcb->sctp_ep, stcb, net);
 990                 } else if (old_state == SCTP_STATE_SHUTDOWN_ACK_SENT) {
 991                         sctp_send_shutdown_ack(stcb, net);
 992                 }
 993         }
 994 }
 995
 996 static void
 997 sctp_handle_shutdown_ack(struct sctp_shutdown_ack_chunk *cp SCTP_UNUSED,
 998     struct sctp_tcb *stcb,
 999     struct sctp_nets *net)
1000 {
1001         struct sctp_association *asoc;
1002
1003 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1004         struct socket *so;
1005
1006         so = SCTP_INP_SO(stcb->sctp_ep);
1007 #endif
1008         SCTPDBG(SCTP_DEBUG_INPUT2,
1009             "sctp_handle_shutdown_ack: handling SHUTDOWN ACK\n");
1010         if (stcb == NULL)
1011                 return;
1012
1013         asoc = &stcb->asoc;
1014         /* process according to association state */
1015         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_WAIT) ||
1016             (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)) {
1017                 /* unexpected SHUTDOWN-ACK... do OOTB handling... */
1018                 sctp_send_shutdown_complete(stcb, net, 1);
1019                 SCTP_TCB_UNLOCK(stcb);
1020                 return;
1021         }
1022         if ((SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
1023             (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
1024                 /* unexpected SHUTDOWN-ACK... so ignore... */
1025                 SCTP_TCB_UNLOCK(stcb);
1026                 return;
1027         }
1028         if (asoc->control_pdapi) {
1029                 /*
1030                  * With a normal shutdown we assume the end of last record.
1031                  */
1032                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
1033                 asoc->control_pdapi->end_added = 1;
1034                 asoc->control_pdapi->pdapi_aborted = 1;
1035                 asoc->control_pdapi = NULL;
1036                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1037 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1038                 atomic_add_int(&stcb->asoc.refcnt, 1);
1039                 SCTP_TCB_UNLOCK(stcb);
1040                 SCTP_SOCKET_LOCK(so, 1);
1041                 SCTP_TCB_LOCK(stcb);
1042                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1043                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1044                         /* assoc was freed while we were unlocked */
1045                         SCTP_SOCKET_UNLOCK(so, 1);
1046                         return;
1047                 }
1048 #endif
1049                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1050 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1051                 SCTP_SOCKET_UNLOCK(so, 1);
1052 #endif
1053         }
1054 #ifdef INVARIANTS
1055         if (!TAILQ_EMPTY(&asoc->send_queue) ||
1056             !TAILQ_EMPTY(&asoc->sent_queue) ||
1057             sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
1058                 panic("Queues are not empty when handling SHUTDOWN-ACK");
1059         }
1060 #endif
1061         /* stop the timer */
1062         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb, net,
1063             SCTP_FROM_SCTP_INPUT + SCTP_LOC_10);
1064         /* send SHUTDOWN-COMPLETE */
1065         sctp_send_shutdown_complete(stcb, net, 0);
1066         /* notify upper layer protocol */
1067         if (stcb->sctp_socket) {
1068                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1069                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1070                         stcb->sctp_socket->so_snd.sb_cc = 0;
1071                 }
1072                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
1073         }
1074         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
1075         /* free the TCB but first save off the ep */
1076 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1077         atomic_add_int(&stcb->asoc.refcnt, 1);
1078         SCTP_TCB_UNLOCK(stcb);
1079         SCTP_SOCKET_LOCK(so, 1);
1080         SCTP_TCB_LOCK(stcb);
1081         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1082 #endif
1083         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1084             SCTP_FROM_SCTP_INPUT + SCTP_LOC_11);
1085 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1086         SCTP_SOCKET_UNLOCK(so, 1);
1087 #endif
1088 }
1089
1090 /*
1091  * Skip past the param header and then we will find the chunk that caused the
1092  * problem. There are two possibilities ASCONF or FWD-TSN other than that and
1093  * our peer must be broken.
1094  */
1095 static void
1096 sctp_process_unrecog_chunk(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr,
1097     struct sctp_nets *net)
1098 {
1099         struct sctp_chunkhdr *chk;
1100
1101         chk = (struct sctp_chunkhdr *)((caddr_t)phdr + sizeof(*phdr));
1102         switch (chk->chunk_type) {
1103         case SCTP_ASCONF_ACK:
1104         case SCTP_ASCONF:
1105                 sctp_asconf_cleanup(stcb, net);
1106                 break;
1107         case SCTP_IFORWARD_CUM_TSN:
1108         case SCTP_FORWARD_CUM_TSN:
1109                 stcb->asoc.prsctp_supported = 0;
1110                 break;
1111         default:
1112                 SCTPDBG(SCTP_DEBUG_INPUT2,
1113                     "Peer does not support chunk type %d(%x)??\n",
1114                     chk->chunk_type, (uint32_t) chk->chunk_type);
1115                 break;
1116         }
1117 }
1118
1119 /*
1120  * Skip past the param header and then we will find the param that caused the
1121  * problem.  There are a number of param's in a ASCONF OR the prsctp param
1122  * these will turn of specific features.
1123  * XXX: Is this the right thing to do?
1124  */
1125 static void
1126 sctp_process_unrecog_param(struct sctp_tcb *stcb, struct sctp_paramhdr *phdr)
1127 {
1128         struct sctp_paramhdr *pbad;
1129
1130         pbad = phdr + 1;
1131         switch (ntohs(pbad->param_type)) {
1132                 /* pr-sctp draft */
1133         case SCTP_PRSCTP_SUPPORTED:
1134                 stcb->asoc.prsctp_supported = 0;
1135                 break;
1136         case SCTP_SUPPORTED_CHUNK_EXT:
1137                 break;
1138                 /* draft-ietf-tsvwg-addip-sctp */
1139         case SCTP_HAS_NAT_SUPPORT:
1140                 stcb->asoc.peer_supports_nat = 0;
1141                 break;
1142         case SCTP_ADD_IP_ADDRESS:
1143         case SCTP_DEL_IP_ADDRESS:
1144         case SCTP_SET_PRIM_ADDR:
1145                 stcb->asoc.asconf_supported = 0;
1146                 break;
1147         case SCTP_SUCCESS_REPORT:
1148         case SCTP_ERROR_CAUSE_IND:
1149                 SCTPDBG(SCTP_DEBUG_INPUT2, "Huh, the peer does not support success? or error cause?\n");
1150                 SCTPDBG(SCTP_DEBUG_INPUT2,
1151                     "Turning off ASCONF to this strange peer\n");
1152                 stcb->asoc.asconf_supported = 0;
1153                 break;
1154         default:
1155                 SCTPDBG(SCTP_DEBUG_INPUT2,
1156                     "Peer does not support param type %d(%x)??\n",
1157                     pbad->param_type, (uint32_t) pbad->param_type);
1158                 break;
1159         }
1160 }
1161
1162 static int
1163 sctp_handle_error(struct sctp_chunkhdr *ch,
1164     struct sctp_tcb *stcb, struct sctp_nets *net)
1165 {
1166         int chklen;
1167         struct sctp_paramhdr *phdr;
1168         uint16_t error, error_type;
1169         uint16_t error_len;
1170         struct sctp_association *asoc;
1171         int adjust;
1172
1173 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1174         struct socket *so;
1175
1176 #endif
1177
1178         /* parse through all of the errors and process */
1179         asoc = &stcb->asoc;
1180         phdr = (struct sctp_paramhdr *)((caddr_t)ch +
1181             sizeof(struct sctp_chunkhdr));
1182         chklen = ntohs(ch->chunk_length) - sizeof(struct sctp_chunkhdr);
1183         error = 0;
1184         while ((size_t)chklen >= sizeof(struct sctp_paramhdr)) {
1185                 /* Process an Error Cause */
1186                 error_type = ntohs(phdr->param_type);
1187                 error_len = ntohs(phdr->param_length);
1188                 if ((error_len > chklen) || (error_len == 0)) {
1189                         /* invalid param length for this param */
1190                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bogus length in error param- chunk left:%d errorlen:%d\n",
1191                             chklen, error_len);
1192                         return (0);
1193                 }
1194                 if (error == 0) {
1195                         /* report the first error cause */
1196                         error = error_type;
1197                 }
1198                 switch (error_type) {
1199                 case SCTP_CAUSE_INVALID_STREAM:
1200                 case SCTP_CAUSE_MISSING_PARAM:
1201                 case SCTP_CAUSE_INVALID_PARAM:
1202                 case SCTP_CAUSE_NO_USER_DATA:
1203                         SCTPDBG(SCTP_DEBUG_INPUT1, "Software error we got a %d back? We have a bug :/ (or do they?)\n",
1204                             error_type);
1205                         break;
1206                 case SCTP_CAUSE_NAT_COLLIDING_STATE:
1207                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received Colliding state abort flags:%x\n",
1208                             ch->chunk_flags);
1209                         if (sctp_handle_nat_colliding_state(stcb)) {
1210                                 return (0);
1211                         }
1212                         break;
1213                 case SCTP_CAUSE_NAT_MISSING_STATE:
1214                         SCTPDBG(SCTP_DEBUG_INPUT2, "Received missing state abort flags:%x\n",
1215                             ch->chunk_flags);
1216                         if (sctp_handle_nat_missing_state(stcb, net)) {
1217                                 return (0);
1218                         }
1219                         break;
1220                 case SCTP_CAUSE_STALE_COOKIE:
1221                         /*
1222                          * We only act if we have echoed a cookie and are
1223                          * waiting.
1224                          */
1225                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
1226                                 int *p;
1227
1228                                 p = (int *)((caddr_t)phdr + sizeof(*phdr));
1229                                 /* Save the time doubled */
1230                                 asoc->cookie_preserve_req = ntohl(*p) << 1;
1231                                 asoc->stale_cookie_count++;
1232                                 if (asoc->stale_cookie_count >
1233                                     asoc->max_init_times) {
1234                                         sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
1235                                         /* now free the asoc */
1236 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1237                                         so = SCTP_INP_SO(stcb->sctp_ep);
1238                                         atomic_add_int(&stcb->asoc.refcnt, 1);
1239                                         SCTP_TCB_UNLOCK(stcb);
1240                                         SCTP_SOCKET_LOCK(so, 1);
1241                                         SCTP_TCB_LOCK(stcb);
1242                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
1243 #endif
1244                                         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
1245                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_12);
1246 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1247                                         SCTP_SOCKET_UNLOCK(so, 1);
1248 #endif
1249                                         return (-1);
1250                                 }
1251                                 /* blast back to INIT state */
1252                                 sctp_toss_old_cookies(stcb, &stcb->asoc);
1253                                 asoc->state &= ~SCTP_STATE_COOKIE_ECHOED;
1254                                 asoc->state |= SCTP_STATE_COOKIE_WAIT;
1255                                 sctp_stop_all_cookie_timers(stcb);
1256                                 sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1257                         }
1258                         break;
1259                 case SCTP_CAUSE_UNRESOLVABLE_ADDR:
1260                         /*
1261                          * Nothing we can do here, we don't do hostname
1262                          * addresses so if the peer does not like my IPv6
1263                          * (or IPv4 for that matter) it does not matter. If
1264                          * they don't support that type of address, they can
1265                          * NOT possibly get that packet type... i.e. with no
1266                          * IPv6 you can't receive a IPv6 packet. so we can
1267                          * safely ignore this one. If we ever added support
1268                          * for HOSTNAME Addresses, then we would need to do
1269                          * something here.
1270                          */
1271                         break;
1272                 case SCTP_CAUSE_UNRECOG_CHUNK:
1273                         sctp_process_unrecog_chunk(stcb, phdr, net);
1274                         break;
1275                 case SCTP_CAUSE_UNRECOG_PARAM:
1276                         sctp_process_unrecog_param(stcb, phdr);
1277                         break;
1278                 case SCTP_CAUSE_COOKIE_IN_SHUTDOWN:
1279                         /*
1280                          * We ignore this since the timer will drive out a
1281                          * new cookie anyway and there timer will drive us
1282                          * to send a SHUTDOWN_COMPLETE. We can't send one
1283                          * here since we don't have their tag.
1284                          */
1285                         break;
1286                 case SCTP_CAUSE_DELETING_LAST_ADDR:
1287                 case SCTP_CAUSE_RESOURCE_SHORTAGE:
1288                 case SCTP_CAUSE_DELETING_SRC_ADDR:
1289                         /*
1290                          * We should NOT get these here, but in a
1291                          * ASCONF-ACK.
1292                          */
1293                         SCTPDBG(SCTP_DEBUG_INPUT2, "Peer sends ASCONF errors in a Operational Error?<%d>?\n",
1294                             error_type);
1295                         break;
1296                 case SCTP_CAUSE_OUT_OF_RESC:
1297                         /*
1298                          * And what, pray tell do we do with the fact that
1299                          * the peer is out of resources? Not really sure we
1300                          * could do anything but abort. I suspect this
1301                          * should have came WITH an abort instead of in a
1302                          * OP-ERROR.
1303                          */
1304                         break;
1305                 default:
1306                         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_handle_error: unknown error type = 0x%xh\n",
1307                             error_type);
1308                         break;
1309                 }
1310                 adjust = SCTP_SIZE32(error_len);
1311                 chklen -= adjust;
1312                 phdr = (struct sctp_paramhdr *)((caddr_t)phdr + adjust);
1313         }
1314         sctp_ulp_notify(SCTP_NOTIFY_REMOTE_ERROR, stcb, error, ch, SCTP_SO_NOT_LOCKED);
1315         return (0);
1316 }
1317
1318 static int
1319 sctp_handle_init_ack(struct mbuf *m, int iphlen, int offset,
1320     struct sockaddr *src, struct sockaddr *dst, struct sctphdr *sh,
1321     struct sctp_init_ack_chunk *cp, struct sctp_tcb *stcb,
1322     struct sctp_nets *net, int *abort_no_unlock,
1323     uint8_t mflowtype, uint32_t mflowid,
1324     uint32_t vrf_id)
1325 {
1326         struct sctp_init_ack *init_ack;
1327         struct mbuf *op_err;
1328
1329         SCTPDBG(SCTP_DEBUG_INPUT2,
1330             "sctp_handle_init_ack: handling INIT-ACK\n");
1331
1332         if (stcb == NULL) {
1333                 SCTPDBG(SCTP_DEBUG_INPUT2,
1334                     "sctp_handle_init_ack: TCB is null\n");
1335                 return (-1);
1336         }
1337         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_init_ack_chunk)) {
1338                 /* Invalid length */
1339                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1340                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1341                     src, dst, sh, op_err,
1342                     mflowtype, mflowid,
1343                     vrf_id, net->port);
1344                 *abort_no_unlock = 1;
1345                 return (-1);
1346         }
1347         init_ack = &cp->init;
1348         /* validate parameters */
1349         if (init_ack->initiate_tag == 0) {
1350                 /* protocol error... send an abort */
1351                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1352                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1353                     src, dst, sh, op_err,
1354                     mflowtype, mflowid,
1355                     vrf_id, net->port);
1356                 *abort_no_unlock = 1;
1357                 return (-1);
1358         }
1359         if (ntohl(init_ack->a_rwnd) < SCTP_MIN_RWND) {
1360                 /* protocol error... send an abort */
1361                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1362                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1363                     src, dst, sh, op_err,
1364                     mflowtype, mflowid,
1365                     vrf_id, net->port);
1366                 *abort_no_unlock = 1;
1367                 return (-1);
1368         }
1369         if (init_ack->num_inbound_streams == 0) {
1370                 /* protocol error... send an abort */
1371                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1372                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1373                     src, dst, sh, op_err,
1374                     mflowtype, mflowid,
1375                     vrf_id, net->port);
1376                 *abort_no_unlock = 1;
1377                 return (-1);
1378         }
1379         if (init_ack->num_outbound_streams == 0) {
1380                 /* protocol error... send an abort */
1381                 op_err = sctp_generate_cause(SCTP_CAUSE_INVALID_PARAM, "");
1382                 sctp_abort_association(stcb->sctp_ep, stcb, m, iphlen,
1383                     src, dst, sh, op_err,
1384                     mflowtype, mflowid,
1385                     vrf_id, net->port);
1386                 *abort_no_unlock = 1;
1387                 return (-1);
1388         }
1389         /* process according to association state... */
1390         switch (stcb->asoc.state & SCTP_STATE_MASK) {
1391         case SCTP_STATE_COOKIE_WAIT:
1392                 /* this is the expected state for this chunk */
1393                 /* process the INIT-ACK parameters */
1394                 if (stcb->asoc.primary_destination->dest_state &
1395                     SCTP_ADDR_UNCONFIRMED) {
1396                         /*
1397                          * The primary is where we sent the INIT, we can
1398                          * always consider it confirmed when the INIT-ACK is
1399                          * returned. Do this before we load addresses
1400                          * though.
1401                          */
1402                         stcb->asoc.primary_destination->dest_state &=
1403                             ~SCTP_ADDR_UNCONFIRMED;
1404                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
1405                             stcb, 0, (void *)stcb->asoc.primary_destination, SCTP_SO_NOT_LOCKED);
1406                 }
1407                 if (sctp_process_init_ack(m, iphlen, offset, src, dst, sh, cp, stcb,
1408                     net, abort_no_unlock,
1409                     mflowtype, mflowid,
1410                     vrf_id) < 0) {
1411                         /* error in parsing parameters */
1412                         return (-1);
1413                 }
1414                 /* update our state */
1415                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to COOKIE-ECHOED state\n");
1416                 SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_COOKIE_ECHOED);
1417
1418                 /* reset the RTO calc */
1419                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1420                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1421                             stcb->asoc.overall_error_count,
1422                             0,
1423                             SCTP_FROM_SCTP_INPUT,
1424                             __LINE__);
1425                 }
1426                 stcb->asoc.overall_error_count = 0;
1427                 (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1428                 /*
1429                  * collapse the init timer back in case of a exponential
1430                  * backoff
1431                  */
1432                 sctp_timer_start(SCTP_TIMER_TYPE_COOKIE, stcb->sctp_ep,
1433                     stcb, net);
1434                 /*
1435                  * the send at the end of the inbound data processing will
1436                  * cause the cookie to be sent
1437                  */
1438                 break;
1439         case SCTP_STATE_SHUTDOWN_SENT:
1440                 /* incorrect state... discard */
1441                 break;
1442         case SCTP_STATE_COOKIE_ECHOED:
1443                 /* incorrect state... discard */
1444                 break;
1445         case SCTP_STATE_OPEN:
1446                 /* incorrect state... discard */
1447                 break;
1448         case SCTP_STATE_EMPTY:
1449         case SCTP_STATE_INUSE:
1450         default:
1451                 /* incorrect state... discard */
1452                 return (-1);
1453                 break;
1454         }
1455         SCTPDBG(SCTP_DEBUG_INPUT1, "Leaving handle-init-ack end\n");
1456         return (0);
1457 }
1458
1459 static struct sctp_tcb *
1460 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
1461     struct sockaddr *src, struct sockaddr *dst,
1462     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1463     struct sctp_inpcb *inp, struct sctp_nets **netp,
1464     struct sockaddr *init_src, int *notification,
1465     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1466     uint8_t mflowtype, uint32_t mflowid,
1467     uint32_t vrf_id, uint16_t port);
1468
1469
1470 /*
1471  * handle a state cookie for an existing association m: input packet mbuf
1472  * chain-- assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a
1473  * "split" mbuf and the cookie signature does not exist offset: offset into
1474  * mbuf to the cookie-echo chunk
1475  */
1476 static struct sctp_tcb *
1477 sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
1478     struct sockaddr *src, struct sockaddr *dst,
1479     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
1480     struct sctp_inpcb *inp, struct sctp_tcb *stcb, struct sctp_nets **netp,
1481     struct sockaddr *init_src, int *notification,
1482     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
1483     uint8_t mflowtype, uint32_t mflowid,
1484     uint32_t vrf_id, uint16_t port)
1485 {
1486         struct sctp_association *asoc;
1487         struct sctp_init_chunk *init_cp, init_buf;
1488         struct sctp_init_ack_chunk *initack_cp, initack_buf;
1489         struct sctp_nets *net;
1490         struct mbuf *op_err;
1491         int init_offset, initack_offset, i;
1492         int retval;
1493         int spec_flag = 0;
1494         uint32_t how_indx;
1495
1496 #if defined(SCTP_DETAILED_STR_STATS)
1497         int j;
1498
1499 #endif
1500
1501         net = *netp;
1502         /* I know that the TCB is non-NULL from the caller */
1503         asoc = &stcb->asoc;
1504         for (how_indx = 0; how_indx < sizeof(asoc->cookie_how); how_indx++) {
1505                 if (asoc->cookie_how[how_indx] == 0)
1506                         break;
1507         }
1508         if (how_indx < sizeof(asoc->cookie_how)) {
1509                 asoc->cookie_how[how_indx] = 1;
1510         }
1511         if (SCTP_GET_STATE(asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
1512                 /* SHUTDOWN came in after sending INIT-ACK */
1513                 sctp_send_shutdown_ack(stcb, stcb->asoc.primary_destination);
1514                 op_err = sctp_generate_cause(SCTP_CAUSE_COOKIE_IN_SHUTDOWN, "");
1515                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
1516                     mflowtype, mflowid, inp->fibnum,
1517                     vrf_id, net->port);
1518                 if (how_indx < sizeof(asoc->cookie_how))
1519                         asoc->cookie_how[how_indx] = 2;
1520                 return (NULL);
1521         }
1522         /*
1523          * find and validate the INIT chunk in the cookie (peer's info) the
1524          * INIT should start after the cookie-echo header struct (chunk
1525          * header, state cookie header struct)
1526          */
1527         init_offset = offset += sizeof(struct sctp_cookie_echo_chunk);
1528
1529         init_cp = (struct sctp_init_chunk *)
1530             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
1531             (uint8_t *) & init_buf);
1532         if (init_cp == NULL) {
1533                 /* could not pull a INIT chunk in cookie */
1534                 return (NULL);
1535         }
1536         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
1537                 return (NULL);
1538         }
1539         /*
1540          * find and validate the INIT-ACK chunk in the cookie (my info) the
1541          * INIT-ACK follows the INIT chunk
1542          */
1543         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
1544         initack_cp = (struct sctp_init_ack_chunk *)
1545             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
1546             (uint8_t *) & initack_buf);
1547         if (initack_cp == NULL) {
1548                 /* could not pull INIT-ACK chunk in cookie */
1549                 return (NULL);
1550         }
1551         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
1552                 return (NULL);
1553         }
1554         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1555             (ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag)) {
1556                 /*
1557                  * case D in Section 5.2.4 Table 2: MMAA process accordingly
1558                  * to get into the OPEN state
1559                  */
1560                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1561                         /*-
1562                          * Opps, this means that we somehow generated two vtag's
1563                          * the same. I.e. we did:
1564                          *  Us               Peer
1565                          *   <---INIT(tag=a)------
1566                          *   ----INIT-ACK(tag=t)-->
1567                          *   ----INIT(tag=t)------> *1
1568                          *   <---INIT-ACK(tag=a)---
1569                          *   <----CE(tag=t)------------- *2
1570                          *
1571                          * At point *1 we should be generating a different
1572                          * tag t'. Which means we would throw away the CE and send
1573                          * ours instead. Basically this is case C (throw away side).
1574                          */
1575                         if (how_indx < sizeof(asoc->cookie_how))
1576                                 asoc->cookie_how[how_indx] = 17;
1577                         return (NULL);
1578
1579                 }
1580                 switch (SCTP_GET_STATE(asoc)) {
1581                 case SCTP_STATE_COOKIE_WAIT:
1582                 case SCTP_STATE_COOKIE_ECHOED:
1583                         /*
1584                          * INIT was sent but got a COOKIE_ECHO with the
1585                          * correct tags... just accept it...but we must
1586                          * process the init so that we can make sure we have
1587                          * the right seq no's.
1588                          */
1589                         /* First we must process the INIT !! */
1590                         retval = sctp_process_init(init_cp, stcb);
1591                         if (retval < 0) {
1592                                 if (how_indx < sizeof(asoc->cookie_how))
1593                                         asoc->cookie_how[how_indx] = 3;
1594                                 return (NULL);
1595                         }
1596                         /* we have already processed the INIT so no problem */
1597                         sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp,
1598                             stcb, net,
1599                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_13);
1600                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp,
1601                             stcb, net,
1602                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_14);
1603                         /* update current state */
1604                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1605                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1606                         else
1607                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1608
1609                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1610                         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1611                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1612                                     stcb->sctp_ep, stcb, asoc->primary_destination);
1613                         }
1614                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1615                         sctp_stop_all_cookie_timers(stcb);
1616                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1617                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1618                             (inp->sctp_socket->so_qlimit == 0)
1619                             ) {
1620 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1621                                 struct socket *so;
1622
1623 #endif
1624                                 /*
1625                                  * Here is where collision would go if we
1626                                  * did a connect() and instead got a
1627                                  * init/init-ack/cookie done before the
1628                                  * init-ack came back..
1629                                  */
1630                                 stcb->sctp_ep->sctp_flags |=
1631                                     SCTP_PCB_FLAGS_CONNECTED;
1632 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1633                                 so = SCTP_INP_SO(stcb->sctp_ep);
1634                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1635                                 SCTP_TCB_UNLOCK(stcb);
1636                                 SCTP_SOCKET_LOCK(so, 1);
1637                                 SCTP_TCB_LOCK(stcb);
1638                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1639                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1640                                         SCTP_SOCKET_UNLOCK(so, 1);
1641                                         return (NULL);
1642                                 }
1643 #endif
1644                                 soisconnected(stcb->sctp_socket);
1645 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1646                                 SCTP_SOCKET_UNLOCK(so, 1);
1647 #endif
1648                         }
1649                         /* notify upper layer */
1650                         *notification = SCTP_NOTIFY_ASSOC_UP;
1651                         /*
1652                          * since we did not send a HB make sure we don't
1653                          * double things
1654                          */
1655                         net->hb_responded = 1;
1656                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
1657                             &cookie->time_entered,
1658                             sctp_align_unsafe_makecopy,
1659                             SCTP_RTT_FROM_NON_DATA);
1660
1661                         if (stcb->asoc.sctp_autoclose_ticks &&
1662                             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE))) {
1663                                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
1664                                     inp, stcb, NULL);
1665                         }
1666                         break;
1667                 default:
1668                         /*
1669                          * we're in the OPEN state (or beyond), so peer must
1670                          * have simply lost the COOKIE-ACK
1671                          */
1672                         break;
1673                 }               /* end switch */
1674                 sctp_stop_all_cookie_timers(stcb);
1675                 /*
1676                  * We ignore the return code here.. not sure if we should
1677                  * somehow abort.. but we do have an existing asoc. This
1678                  * really should not fail.
1679                  */
1680                 if (sctp_load_addresses_from_init(stcb, m,
1681                     init_offset + sizeof(struct sctp_init_chunk),
1682                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
1683                         if (how_indx < sizeof(asoc->cookie_how))
1684                                 asoc->cookie_how[how_indx] = 4;
1685                         return (NULL);
1686                 }
1687                 /* respond with a COOKIE-ACK */
1688                 sctp_toss_old_cookies(stcb, asoc);
1689                 sctp_send_cookie_ack(stcb);
1690                 if (how_indx < sizeof(asoc->cookie_how))
1691                         asoc->cookie_how[how_indx] = 5;
1692                 return (stcb);
1693         }
1694         if (ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1695             ntohl(init_cp->init.initiate_tag) == asoc->peer_vtag &&
1696             cookie->tie_tag_my_vtag == 0 &&
1697             cookie->tie_tag_peer_vtag == 0) {
1698                 /*
1699                  * case C in Section 5.2.4 Table 2: XMOO silently discard
1700                  */
1701                 if (how_indx < sizeof(asoc->cookie_how))
1702                         asoc->cookie_how[how_indx] = 6;
1703                 return (NULL);
1704         }
1705         /*
1706          * If nat support, and the below and stcb is established, send back
1707          * a ABORT(colliding state) if we are established.
1708          */
1709         if ((SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) &&
1710             (asoc->peer_supports_nat) &&
1711             ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1712             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1713             (asoc->peer_vtag == 0)))) {
1714                 /*
1715                  * Special case - Peer's support nat. We may have two init's
1716                  * that we gave out the same tag on since one was not
1717                  * established.. i.e. we get INIT from host-1 behind the nat
1718                  * and we respond tag-a, we get a INIT from host-2 behind
1719                  * the nat and we get tag-a again. Then we bring up host-1
1720                  * (or 2's) assoc, Then comes the cookie from hsot-2 (or 1).
1721                  * Now we have colliding state. We must send an abort here
1722                  * with colliding state indication.
1723                  */
1724                 op_err = sctp_generate_cause(SCTP_CAUSE_NAT_COLLIDING_STATE, "");
1725                 sctp_send_abort(m, iphlen, src, dst, sh, 0, op_err,
1726                     mflowtype, mflowid, inp->fibnum,
1727                     vrf_id, port);
1728                 return (NULL);
1729         }
1730         if ((ntohl(initack_cp->init.initiate_tag) == asoc->my_vtag) &&
1731             ((ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) ||
1732             (asoc->peer_vtag == 0))) {
1733                 /*
1734                  * case B in Section 5.2.4 Table 2: MXAA or MOAA my info
1735                  * should be ok, re-accept peer info
1736                  */
1737                 if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
1738                         /*
1739                          * Extension of case C. If we hit this, then the
1740                          * random number generator returned the same vtag
1741                          * when we first sent our INIT-ACK and when we later
1742                          * sent our INIT. The side with the seq numbers that
1743                          * are different will be the one that normnally
1744                          * would have hit case C. This in effect "extends"
1745                          * our vtags in this collision case to be 64 bits.
1746                          * The same collision could occur aka you get both
1747                          * vtag and seq number the same twice in a row.. but
1748                          * is much less likely. If it did happen then we
1749                          * would proceed through and bring up the assoc.. we
1750                          * may end up with the wrong stream setup however..
1751                          * which would be bad.. but there is no way to
1752                          * tell.. until we send on a stream that does not
1753                          * exist :-)
1754                          */
1755                         if (how_indx < sizeof(asoc->cookie_how))
1756                                 asoc->cookie_how[how_indx] = 7;
1757
1758                         return (NULL);
1759                 }
1760                 if (how_indx < sizeof(asoc->cookie_how))
1761                         asoc->cookie_how[how_indx] = 8;
1762                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1763                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_15);
1764                 sctp_stop_all_cookie_timers(stcb);
1765                 /*
1766                  * since we did not send a HB make sure we don't double
1767                  * things
1768                  */
1769                 net->hb_responded = 1;
1770                 if (stcb->asoc.sctp_autoclose_ticks &&
1771                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
1772                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb,
1773                             NULL);
1774                 }
1775                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1776                 asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
1777
1778                 if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
1779                         /*
1780                          * Ok the peer probably discarded our data (if we
1781                          * echoed a cookie+data). So anything on the
1782                          * sent_queue should be marked for retransmit, we
1783                          * may not get something to kick us so it COULD
1784                          * still take a timeout to move these.. but it can't
1785                          * hurt to mark them.
1786                          */
1787                         struct sctp_tmit_chunk *chk;
1788
1789                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1790                                 if (chk->sent < SCTP_DATAGRAM_RESEND) {
1791                                         chk->sent = SCTP_DATAGRAM_RESEND;
1792                                         sctp_flight_size_decrease(chk);
1793                                         sctp_total_flight_decrease(stcb, chk);
1794                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1795                                         spec_flag++;
1796                                 }
1797                         }
1798
1799                 }
1800                 /* process the INIT info (peer's info) */
1801                 retval = sctp_process_init(init_cp, stcb);
1802                 if (retval < 0) {
1803                         if (how_indx < sizeof(asoc->cookie_how))
1804                                 asoc->cookie_how[how_indx] = 9;
1805                         return (NULL);
1806                 }
1807                 if (sctp_load_addresses_from_init(stcb, m,
1808                     init_offset + sizeof(struct sctp_init_chunk),
1809                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
1810                         if (how_indx < sizeof(asoc->cookie_how))
1811                                 asoc->cookie_how[how_indx] = 10;
1812                         return (NULL);
1813                 }
1814                 if ((asoc->state & SCTP_STATE_COOKIE_WAIT) ||
1815                     (asoc->state & SCTP_STATE_COOKIE_ECHOED)) {
1816                         *notification = SCTP_NOTIFY_ASSOC_UP;
1817
1818                         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1819                             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
1820                             (inp->sctp_socket->so_qlimit == 0)) {
1821 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1822                                 struct socket *so;
1823
1824 #endif
1825                                 stcb->sctp_ep->sctp_flags |=
1826                                     SCTP_PCB_FLAGS_CONNECTED;
1827 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1828                                 so = SCTP_INP_SO(stcb->sctp_ep);
1829                                 atomic_add_int(&stcb->asoc.refcnt, 1);
1830                                 SCTP_TCB_UNLOCK(stcb);
1831                                 SCTP_SOCKET_LOCK(so, 1);
1832                                 SCTP_TCB_LOCK(stcb);
1833                                 atomic_add_int(&stcb->asoc.refcnt, -1);
1834                                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
1835                                         SCTP_SOCKET_UNLOCK(so, 1);
1836                                         return (NULL);
1837                                 }
1838 #endif
1839                                 soisconnected(stcb->sctp_socket);
1840 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1841                                 SCTP_SOCKET_UNLOCK(so, 1);
1842 #endif
1843                         }
1844                         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED)
1845                                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
1846                         else
1847                                 SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1848                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1849                 } else if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1850                         SCTP_STAT_INCR_COUNTER32(sctps_restartestab);
1851                 } else {
1852                         SCTP_STAT_INCR_COUNTER32(sctps_collisionestab);
1853                 }
1854                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1855                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1856                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1857                             stcb->sctp_ep, stcb, asoc->primary_destination);
1858                 }
1859                 sctp_stop_all_cookie_timers(stcb);
1860                 sctp_toss_old_cookies(stcb, asoc);
1861                 sctp_send_cookie_ack(stcb);
1862                 if (spec_flag) {
1863                         /*
1864                          * only if we have retrans set do we do this. What
1865                          * this call does is get only the COOKIE-ACK out and
1866                          * then when we return the normal call to
1867                          * sctp_chunk_output will get the retrans out behind
1868                          * this.
1869                          */
1870                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_COOKIE_ACK, SCTP_SO_NOT_LOCKED);
1871                 }
1872                 if (how_indx < sizeof(asoc->cookie_how))
1873                         asoc->cookie_how[how_indx] = 11;
1874
1875                 return (stcb);
1876         }
1877         if ((ntohl(initack_cp->init.initiate_tag) != asoc->my_vtag &&
1878             ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) &&
1879             cookie->tie_tag_my_vtag == asoc->my_vtag_nonce &&
1880             cookie->tie_tag_peer_vtag == asoc->peer_vtag_nonce &&
1881             cookie->tie_tag_peer_vtag != 0) {
1882                 struct sctpasochead *head;
1883
1884 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1885                 struct socket *so;
1886
1887 #endif
1888
1889                 if (asoc->peer_supports_nat) {
1890                         /*
1891                          * This is a gross gross hack. Just call the
1892                          * cookie_new code since we are allowing a duplicate
1893                          * association. I hope this works...
1894                          */
1895                         return (sctp_process_cookie_new(m, iphlen, offset, src, dst,
1896                             sh, cookie, cookie_len,
1897                             inp, netp, init_src, notification,
1898                             auth_skipped, auth_offset, auth_len,
1899                             mflowtype, mflowid,
1900                             vrf_id, port));
1901                 }
1902                 /*
1903                  * case A in Section 5.2.4 Table 2: XXMM (peer restarted)
1904                  */
1905                 /* temp code */
1906                 if (how_indx < sizeof(asoc->cookie_how))
1907                         asoc->cookie_how[how_indx] = 12;
1908                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
1909                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_16);
1910                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
1911                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_17);
1912
1913                 /* notify upper layer */
1914                 *notification = SCTP_NOTIFY_ASSOC_RESTART;
1915                 atomic_add_int(&stcb->asoc.refcnt, 1);
1916                 if ((SCTP_GET_STATE(asoc) != SCTP_STATE_OPEN) &&
1917                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_RECEIVED) &&
1918                     (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT)) {
1919                         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
1920                 }
1921                 if (SCTP_GET_STATE(asoc) == SCTP_STATE_OPEN) {
1922                         SCTP_STAT_INCR_GAUGE32(sctps_restartestab);
1923                 } else if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_SENT) {
1924                         SCTP_STAT_INCR_GAUGE32(sctps_collisionestab);
1925                 }
1926                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
1927                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1928                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
1929                             stcb->sctp_ep, stcb, asoc->primary_destination);
1930
1931                 } else if (!(asoc->state & SCTP_STATE_SHUTDOWN_SENT)) {
1932                         /* move to OPEN state, if not in SHUTDOWN_SENT */
1933                         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
1934                 }
1935                 asoc->pre_open_streams =
1936                     ntohs(initack_cp->init.num_outbound_streams);
1937                 asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
1938                 asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
1939                 asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1940
1941                 asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
1942
1943                 asoc->str_reset_seq_in = asoc->init_seq_number;
1944
1945                 asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1946                 if (asoc->mapping_array) {
1947                         memset(asoc->mapping_array, 0,
1948                             asoc->mapping_array_size);
1949                 }
1950                 if (asoc->nr_mapping_array) {
1951                         memset(asoc->nr_mapping_array, 0,
1952                             asoc->mapping_array_size);
1953                 }
1954                 SCTP_TCB_UNLOCK(stcb);
1955 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1956                 so = SCTP_INP_SO(stcb->sctp_ep);
1957                 SCTP_SOCKET_LOCK(so, 1);
1958 #endif
1959                 SCTP_INP_INFO_WLOCK();
1960                 SCTP_INP_WLOCK(stcb->sctp_ep);
1961                 SCTP_TCB_LOCK(stcb);
1962                 atomic_add_int(&stcb->asoc.refcnt, -1);
1963                 /* send up all the data */
1964                 SCTP_TCB_SEND_LOCK(stcb);
1965
1966                 sctp_report_all_outbound(stcb, 0, 1, SCTP_SO_LOCKED);
1967                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
1968                         stcb->asoc.strmout[i].chunks_on_queues = 0;
1969 #if defined(SCTP_DETAILED_STR_STATS)
1970                         for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1971                                 asoc->strmout[i].abandoned_sent[j] = 0;
1972                                 asoc->strmout[i].abandoned_unsent[j] = 0;
1973                         }
1974 #else
1975                         asoc->strmout[i].abandoned_sent[0] = 0;
1976                         asoc->strmout[i].abandoned_unsent[0] = 0;
1977 #endif
1978                         stcb->asoc.strmout[i].stream_no = i;
1979                         stcb->asoc.strmout[i].next_mid_ordered = 0;
1980                         stcb->asoc.strmout[i].next_mid_unordered = 0;
1981                         stcb->asoc.strmout[i].last_msg_incomplete = 0;
1982                 }
1983                 /* process the INIT-ACK info (my info) */
1984                 asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
1985                 asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
1986
1987                 /* pull from vtag hash */
1988                 LIST_REMOVE(stcb, sctp_asocs);
1989                 /* re-insert to new vtag position */
1990                 head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
1991                     SCTP_BASE_INFO(hashasocmark))];
1992                 /*
1993                  * put it in the bucket in the vtag hash of assoc's for the
1994                  * system
1995                  */
1996                 LIST_INSERT_HEAD(head, stcb, sctp_asocs);
1997
1998                 SCTP_TCB_SEND_UNLOCK(stcb);
1999                 SCTP_INP_WUNLOCK(stcb->sctp_ep);
2000                 SCTP_INP_INFO_WUNLOCK();
2001 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2002                 SCTP_SOCKET_UNLOCK(so, 1);
2003 #endif
2004                 asoc->total_flight = 0;
2005                 asoc->total_flight_count = 0;
2006                 /* process the INIT info (peer's info) */
2007                 retval = sctp_process_init(init_cp, stcb);
2008                 if (retval < 0) {
2009                         if (how_indx < sizeof(asoc->cookie_how))
2010                                 asoc->cookie_how[how_indx] = 13;
2011
2012                         return (NULL);
2013                 }
2014                 /*
2015                  * since we did not send a HB make sure we don't double
2016                  * things
2017                  */
2018                 net->hb_responded = 1;
2019
2020                 if (sctp_load_addresses_from_init(stcb, m,
2021                     init_offset + sizeof(struct sctp_init_chunk),
2022                     initack_offset, src, dst, init_src, stcb->asoc.port)) {
2023                         if (how_indx < sizeof(asoc->cookie_how))
2024                                 asoc->cookie_how[how_indx] = 14;
2025
2026                         return (NULL);
2027                 }
2028                 /* respond with a COOKIE-ACK */
2029                 sctp_stop_all_cookie_timers(stcb);
2030                 sctp_toss_old_cookies(stcb, asoc);
2031                 sctp_send_cookie_ack(stcb);
2032                 if (how_indx < sizeof(asoc->cookie_how))
2033                         asoc->cookie_how[how_indx] = 15;
2034
2035                 return (stcb);
2036         }
2037         if (how_indx < sizeof(asoc->cookie_how))
2038                 asoc->cookie_how[how_indx] = 16;
2039         /* all other cases... */
2040         return (NULL);
2041 }
2042
2043
2044 /*
2045  * handle a state cookie for a new association m: input packet mbuf chain--
2046  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
2047  * and the cookie signature does not exist offset: offset into mbuf to the
2048  * cookie-echo chunk length: length of the cookie chunk to: where the init
2049  * was from returns a new TCB
2050  */
2051 static struct sctp_tcb *
2052 sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
2053     struct sockaddr *src, struct sockaddr *dst,
2054     struct sctphdr *sh, struct sctp_state_cookie *cookie, int cookie_len,
2055     struct sctp_inpcb *inp, struct sctp_nets **netp,
2056     struct sockaddr *init_src, int *notification,
2057     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2058     uint8_t mflowtype, uint32_t mflowid,
2059     uint32_t vrf_id, uint16_t port)
2060 {
2061         struct sctp_tcb *stcb;
2062         struct sctp_init_chunk *init_cp, init_buf;
2063         struct sctp_init_ack_chunk *initack_cp, initack_buf;
2064         union sctp_sockstore store;
2065         struct sctp_association *asoc;
2066         int init_offset, initack_offset, initack_limit;
2067         int retval;
2068         int error = 0;
2069         uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
2070
2071 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2072         struct socket *so;
2073
2074         so = SCTP_INP_SO(inp);
2075 #endif
2076
2077         /*
2078          * find and validate the INIT chunk in the cookie (peer's info) the
2079          * INIT should start after the cookie-echo header struct (chunk
2080          * header, state cookie header struct)
2081          */
2082         init_offset = offset + sizeof(struct sctp_cookie_echo_chunk);
2083         init_cp = (struct sctp_init_chunk *)
2084             sctp_m_getptr(m, init_offset, sizeof(struct sctp_init_chunk),
2085             (uint8_t *) & init_buf);
2086         if (init_cp == NULL) {
2087                 /* could not pull a INIT chunk in cookie */
2088                 SCTPDBG(SCTP_DEBUG_INPUT1,
2089                     "process_cookie_new: could not pull INIT chunk hdr\n");
2090                 return (NULL);
2091         }
2092         if (init_cp->ch.chunk_type != SCTP_INITIATION) {
2093                 SCTPDBG(SCTP_DEBUG_INPUT1, "HUH? process_cookie_new: could not find INIT chunk!\n");
2094                 return (NULL);
2095         }
2096         initack_offset = init_offset + SCTP_SIZE32(ntohs(init_cp->ch.chunk_length));
2097         /*
2098          * find and validate the INIT-ACK chunk in the cookie (my info) the
2099          * INIT-ACK follows the INIT chunk
2100          */
2101         initack_cp = (struct sctp_init_ack_chunk *)
2102             sctp_m_getptr(m, initack_offset, sizeof(struct sctp_init_ack_chunk),
2103             (uint8_t *) & initack_buf);
2104         if (initack_cp == NULL) {
2105                 /* could not pull INIT-ACK chunk in cookie */
2106                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: could not pull INIT-ACK chunk hdr\n");
2107                 return (NULL);
2108         }
2109         if (initack_cp->ch.chunk_type != SCTP_INITIATION_ACK) {
2110                 return (NULL);
2111         }
2112         /*
2113          * NOTE: We can't use the INIT_ACK's chk_length to determine the
2114          * "initack_limit" value.  This is because the chk_length field
2115          * includes the length of the cookie, but the cookie is omitted when
2116          * the INIT and INIT_ACK are tacked onto the cookie...
2117          */
2118         initack_limit = offset + cookie_len;
2119
2120         /*
2121          * now that we know the INIT/INIT-ACK are in place, create a new TCB
2122          * and popluate
2123          */
2124
2125         /*
2126          * Here we do a trick, we set in NULL for the proc/thread argument.
2127          * We do this since in effect we only use the p argument when the
2128          * socket is unbound and we must do an implicit bind. Since we are
2129          * getting a cookie, we cannot be unbound.
2130          */
2131         stcb = sctp_aloc_assoc(inp, init_src, &error,
2132             ntohl(initack_cp->init.initiate_tag), vrf_id,
2133             ntohs(initack_cp->init.num_outbound_streams),
2134             port,
2135             (struct thread *)NULL
2136             );
2137         if (stcb == NULL) {
2138                 struct mbuf *op_err;
2139
2140                 /* memory problem? */
2141                 SCTPDBG(SCTP_DEBUG_INPUT1,
2142                     "process_cookie_new: no room for another TCB!\n");
2143                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2144                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2145                     src, dst, sh, op_err,
2146                     mflowtype, mflowid,
2147                     vrf_id, port);
2148                 return (NULL);
2149         }
2150         /* get the correct sctp_nets */
2151         if (netp)
2152                 *netp = sctp_findnet(stcb, init_src);
2153
2154         asoc = &stcb->asoc;
2155         /* get scope variables out of cookie */
2156         asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
2157         asoc->scope.site_scope = cookie->site_scope;
2158         asoc->scope.local_scope = cookie->local_scope;
2159         asoc->scope.loopback_scope = cookie->loopback_scope;
2160
2161         if ((asoc->scope.ipv4_addr_legal != cookie->ipv4_addr_legal) ||
2162             (asoc->scope.ipv6_addr_legal != cookie->ipv6_addr_legal)) {
2163                 struct mbuf *op_err;
2164
2165                 /*
2166                  * Houston we have a problem. The EP changed while the
2167                  * cookie was in flight. Only recourse is to abort the
2168                  * association.
2169                  */
2170                 atomic_add_int(&stcb->asoc.refcnt, 1);
2171                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2172                 sctp_abort_association(inp, (struct sctp_tcb *)NULL, m, iphlen,
2173                     src, dst, sh, op_err,
2174                     mflowtype, mflowid,
2175                     vrf_id, port);
2176 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2177                 SCTP_TCB_UNLOCK(stcb);
2178                 SCTP_SOCKET_LOCK(so, 1);
2179                 SCTP_TCB_LOCK(stcb);
2180 #endif
2181                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2182                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_18);
2183 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2184                 SCTP_SOCKET_UNLOCK(so, 1);
2185 #endif
2186                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2187                 return (NULL);
2188         }
2189         /* process the INIT-ACK info (my info) */
2190         asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
2191         asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
2192         asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
2193         asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
2194         asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
2195         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
2196         asoc->asconf_seq_in = asoc->last_acked_seq = asoc->init_seq_number - 1;
2197         asoc->str_reset_seq_in = asoc->init_seq_number;
2198
2199         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
2200
2201         /* process the INIT info (peer's info) */
2202         if (netp)
2203                 retval = sctp_process_init(init_cp, stcb);
2204         else
2205                 retval = 0;
2206         if (retval < 0) {
2207                 atomic_add_int(&stcb->asoc.refcnt, 1);
2208 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2209                 SCTP_TCB_UNLOCK(stcb);
2210                 SCTP_SOCKET_LOCK(so, 1);
2211                 SCTP_TCB_LOCK(stcb);
2212 #endif
2213                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2214                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
2215 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2216                 SCTP_SOCKET_UNLOCK(so, 1);
2217 #endif
2218                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2219                 return (NULL);
2220         }
2221         /* load all addresses */
2222         if (sctp_load_addresses_from_init(stcb, m,
2223             init_offset + sizeof(struct sctp_init_chunk), initack_offset,
2224             src, dst, init_src, port)) {
2225                 atomic_add_int(&stcb->asoc.refcnt, 1);
2226 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2227                 SCTP_TCB_UNLOCK(stcb);
2228                 SCTP_SOCKET_LOCK(so, 1);
2229                 SCTP_TCB_LOCK(stcb);
2230 #endif
2231                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2232                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_20);
2233 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2234                 SCTP_SOCKET_UNLOCK(so, 1);
2235 #endif
2236                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2237                 return (NULL);
2238         }
2239         /*
2240          * verify any preceding AUTH chunk that was skipped
2241          */
2242         /* pull the local authentication parameters from the cookie/init-ack */
2243         sctp_auth_get_cookie_params(stcb, m,
2244             initack_offset + sizeof(struct sctp_init_ack_chunk),
2245             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)));
2246         if (auth_skipped) {
2247                 struct sctp_auth_chunk *auth;
2248
2249                 auth = (struct sctp_auth_chunk *)
2250                     sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
2251                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m, auth_offset)) {
2252                         /* auth HMAC failed, dump the assoc and packet */
2253                         SCTPDBG(SCTP_DEBUG_AUTH1,
2254                             "COOKIE-ECHO: AUTH failed\n");
2255                         atomic_add_int(&stcb->asoc.refcnt, 1);
2256 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2257                         SCTP_TCB_UNLOCK(stcb);
2258                         SCTP_SOCKET_LOCK(so, 1);
2259                         SCTP_TCB_LOCK(stcb);
2260 #endif
2261                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2262                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_21);
2263 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2264                         SCTP_SOCKET_UNLOCK(so, 1);
2265 #endif
2266                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2267                         return (NULL);
2268                 } else {
2269                         /* remaining chunks checked... good to go */
2270                         stcb->asoc.authenticated = 1;
2271                 }
2272         }
2273         /* update current state */
2274         SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2275         SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2276         if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2277                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2278                     stcb->sctp_ep, stcb, asoc->primary_destination);
2279         }
2280         sctp_stop_all_cookie_timers(stcb);
2281         SCTP_STAT_INCR_COUNTER32(sctps_passiveestab);
2282         SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2283
2284         /*
2285          * if we're doing ASCONFs, check to see if we have any new local
2286          * addresses that need to get added to the peer (eg. addresses
2287          * changed while cookie echo in flight).  This needs to be done
2288          * after we go to the OPEN state to do the correct asconf
2289          * processing. else, make sure we have the correct addresses in our
2290          * lists
2291          */
2292
2293         /* warning, we re-use sin, sin6, sa_store here! */
2294         /* pull in local_address (our "from" address) */
2295         switch (cookie->laddr_type) {
2296 #ifdef INET
2297         case SCTP_IPV4_ADDRESS:
2298                 /* source addr is IPv4 */
2299                 memset(&store.sin, 0, sizeof(struct sockaddr_in));
2300                 store.sin.sin_family = AF_INET;
2301                 store.sin.sin_len = sizeof(struct sockaddr_in);
2302                 store.sin.sin_addr.s_addr = cookie->laddress[0];
2303                 break;
2304 #endif
2305 #ifdef INET6
2306         case SCTP_IPV6_ADDRESS:
2307                 /* source addr is IPv6 */
2308                 memset(&store.sin6, 0, sizeof(struct sockaddr_in6));
2309                 store.sin6.sin6_family = AF_INET6;
2310                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2311                 store.sin6.sin6_scope_id = cookie->scope_id;
2312                 memcpy(&store.sin6.sin6_addr, cookie->laddress, sizeof(struct in6_addr));
2313                 break;
2314 #endif
2315         default:
2316                 atomic_add_int(&stcb->asoc.refcnt, 1);
2317 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2318                 SCTP_TCB_UNLOCK(stcb);
2319                 SCTP_SOCKET_LOCK(so, 1);
2320                 SCTP_TCB_LOCK(stcb);
2321 #endif
2322                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2323                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_22);
2324 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2325                 SCTP_SOCKET_UNLOCK(so, 1);
2326 #endif
2327                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2328                 return (NULL);
2329         }
2330
2331         /* set up to notify upper layer */
2332         *notification = SCTP_NOTIFY_ASSOC_UP;
2333         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2334             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2335             (inp->sctp_socket->so_qlimit == 0)) {
2336                 /*
2337                  * This is an endpoint that called connect() how it got a
2338                  * cookie that is NEW is a bit of a mystery. It must be that
2339                  * the INIT was sent, but before it got there.. a complete
2340                  * INIT/INIT-ACK/COOKIE arrived. But of course then it
2341                  * should have went to the other code.. not here.. oh well..
2342                  * a bit of protection is worth having..
2343                  */
2344                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2345 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2346                 atomic_add_int(&stcb->asoc.refcnt, 1);
2347                 SCTP_TCB_UNLOCK(stcb);
2348                 SCTP_SOCKET_LOCK(so, 1);
2349                 SCTP_TCB_LOCK(stcb);
2350                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2351                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2352                         SCTP_SOCKET_UNLOCK(so, 1);
2353                         return (NULL);
2354                 }
2355 #endif
2356                 soisconnected(stcb->sctp_socket);
2357 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2358                 SCTP_SOCKET_UNLOCK(so, 1);
2359 #endif
2360         } else if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
2361             (inp->sctp_socket->so_qlimit)) {
2362                 /*
2363                  * We don't want to do anything with this one. Since it is
2364                  * the listening guy. The timer will get started for
2365                  * accepted connections in the caller.
2366                  */
2367                 ;
2368         }
2369         /* since we did not send a HB make sure we don't double things */
2370         if ((netp) && (*netp))
2371                 (*netp)->hb_responded = 1;
2372
2373         if (stcb->asoc.sctp_autoclose_ticks &&
2374             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2375                 sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
2376         }
2377         (void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
2378         if ((netp != NULL) && (*netp != NULL)) {
2379                 /* calculate the RTT and set the encaps port */
2380                 (*netp)->RTO = sctp_calculate_rto(stcb, asoc, *netp,
2381                     &cookie->time_entered, sctp_align_unsafe_makecopy,
2382                     SCTP_RTT_FROM_NON_DATA);
2383         }
2384         /* respond with a COOKIE-ACK */
2385         sctp_send_cookie_ack(stcb);
2386
2387         /*
2388          * check the address lists for any ASCONFs that need to be sent
2389          * AFTER the cookie-ack is sent
2390          */
2391         sctp_check_address_list(stcb, m,
2392             initack_offset + sizeof(struct sctp_init_ack_chunk),
2393             initack_limit - (initack_offset + sizeof(struct sctp_init_ack_chunk)),
2394             &store.sa, cookie->local_scope, cookie->site_scope,
2395             cookie->ipv4_scope, cookie->loopback_scope);
2396
2397
2398         return (stcb);
2399 }
2400
2401 /*
2402  * CODE LIKE THIS NEEDS TO RUN IF the peer supports the NAT extension, i.e
2403  * we NEED to make sure we are not already using the vtag. If so we
2404  * need to send back an ABORT-TRY-AGAIN-WITH-NEW-TAG No middle box bit!
2405         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
2406                                                             SCTP_BASE_INFO(hashasocmark))];
2407         LIST_FOREACH(stcb, head, sctp_asocs) {
2408                 if ((stcb->asoc.my_vtag == tag) && (stcb->rport == rport) && (inp == stcb->sctp_ep))  {
2409                        -- SEND ABORT - TRY AGAIN --
2410                 }
2411         }
2412 */
2413
2414 /*
2415  * handles a COOKIE-ECHO message stcb: modified to either a new or left as
2416  * existing (non-NULL) TCB
2417  */
2418 static struct mbuf *
2419 sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
2420     struct sockaddr *src, struct sockaddr *dst,
2421     struct sctphdr *sh, struct sctp_cookie_echo_chunk *cp,
2422     struct sctp_inpcb **inp_p, struct sctp_tcb **stcb, struct sctp_nets **netp,
2423     int auth_skipped, uint32_t auth_offset, uint32_t auth_len,
2424     struct sctp_tcb **locked_tcb,
2425     uint8_t mflowtype, uint32_t mflowid,
2426     uint32_t vrf_id, uint16_t port)
2427 {
2428         struct sctp_state_cookie *cookie;
2429         struct sctp_tcb *l_stcb = *stcb;
2430         struct sctp_inpcb *l_inp;
2431         struct sockaddr *to;
2432         struct sctp_pcb *ep;
2433         struct mbuf *m_sig;
2434         uint8_t calc_sig[SCTP_SIGNATURE_SIZE], tmp_sig[SCTP_SIGNATURE_SIZE];
2435         uint8_t *sig;
2436         uint8_t cookie_ok = 0;
2437         unsigned int sig_offset, cookie_offset;
2438         unsigned int cookie_len;
2439         struct timeval now;
2440         struct timeval time_expires;
2441         int notification = 0;
2442         struct sctp_nets *netl;
2443         int had_a_existing_tcb = 0;
2444         int send_int_conf = 0;
2445
2446 #ifdef INET
2447         struct sockaddr_in sin;
2448
2449 #endif
2450 #ifdef INET6
2451         struct sockaddr_in6 sin6;
2452
2453 #endif
2454
2455         SCTPDBG(SCTP_DEBUG_INPUT2,
2456             "sctp_handle_cookie: handling COOKIE-ECHO\n");
2457
2458         if (inp_p == NULL) {
2459                 return (NULL);
2460         }
2461         cookie = &cp->cookie;
2462         cookie_offset = offset + sizeof(struct sctp_chunkhdr);
2463         cookie_len = ntohs(cp->ch.chunk_length);
2464
2465         if ((cookie->peerport != sh->src_port) ||
2466             (cookie->myport != sh->dest_port) ||
2467             (cookie->my_vtag != sh->v_tag)) {
2468                 /*
2469                  * invalid ports or bad tag.  Note that we always leave the
2470                  * v_tag in the header in network order and when we stored
2471                  * it in the my_vtag slot we also left it in network order.
2472                  * This maintains the match even though it may be in the
2473                  * opposite byte order of the machine :->
2474                  */
2475                 return (NULL);
2476         }
2477         if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
2478             sizeof(struct sctp_init_chunk) +
2479             sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
2480                 /* cookie too small */
2481                 return (NULL);
2482         }
2483         /*
2484          * split off the signature into its own mbuf (since it should not be
2485          * calculated in the sctp_hmac_m() call).
2486          */
2487         sig_offset = offset + cookie_len - SCTP_SIGNATURE_SIZE;
2488         m_sig = m_split(m, sig_offset, M_NOWAIT);
2489         if (m_sig == NULL) {
2490                 /* out of memory or ?? */
2491                 return (NULL);
2492         }
2493 #ifdef SCTP_MBUF_LOGGING
2494         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2495                 sctp_log_mbc(m_sig, SCTP_MBUF_SPLIT);
2496         }
2497 #endif
2498
2499         /*
2500          * compute the signature/digest for the cookie
2501          */
2502         ep = &(*inp_p)->sctp_ep;
2503         l_inp = *inp_p;
2504         if (l_stcb) {
2505                 SCTP_TCB_UNLOCK(l_stcb);
2506         }
2507         SCTP_INP_RLOCK(l_inp);
2508         if (l_stcb) {
2509                 SCTP_TCB_LOCK(l_stcb);
2510         }
2511         /* which cookie is it? */
2512         if ((cookie->time_entered.tv_sec < (long)ep->time_of_secret_change) &&
2513             (ep->current_secret_number != ep->last_secret_number)) {
2514                 /* it's the old cookie */
2515                 (void)sctp_hmac_m(SCTP_HMAC,
2516                     (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2517                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2518         } else {
2519                 /* it's the current cookie */
2520                 (void)sctp_hmac_m(SCTP_HMAC,
2521                     (uint8_t *) ep->secret_key[(int)ep->current_secret_number],
2522                     SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2523         }
2524         /* get the signature */
2525         SCTP_INP_RUNLOCK(l_inp);
2526         sig = (uint8_t *) sctp_m_getptr(m_sig, 0, SCTP_SIGNATURE_SIZE, (uint8_t *) & tmp_sig);
2527         if (sig == NULL) {
2528                 /* couldn't find signature */
2529                 sctp_m_freem(m_sig);
2530                 return (NULL);
2531         }
2532         /* compare the received digest with the computed digest */
2533         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) != 0) {
2534                 /* try the old cookie? */
2535                 if ((cookie->time_entered.tv_sec == (long)ep->time_of_secret_change) &&
2536                     (ep->current_secret_number != ep->last_secret_number)) {
2537                         /* compute digest with old */
2538                         (void)sctp_hmac_m(SCTP_HMAC,
2539                             (uint8_t *) ep->secret_key[(int)ep->last_secret_number],
2540                             SCTP_SECRET_SIZE, m, cookie_offset, calc_sig, 0);
2541                         /* compare */
2542                         if (memcmp(calc_sig, sig, SCTP_SIGNATURE_SIZE) == 0)
2543                                 cookie_ok = 1;
2544                 }
2545         } else {
2546                 cookie_ok = 1;
2547         }
2548
2549         /*
2550          * Now before we continue we must reconstruct our mbuf so that
2551          * normal processing of any other chunks will work.
2552          */
2553         {
2554                 struct mbuf *m_at;
2555
2556                 m_at = m;
2557                 while (SCTP_BUF_NEXT(m_at) != NULL) {
2558                         m_at = SCTP_BUF_NEXT(m_at);
2559                 }
2560                 SCTP_BUF_NEXT(m_at) = m_sig;
2561         }
2562
2563         if (cookie_ok == 0) {
2564                 SCTPDBG(SCTP_DEBUG_INPUT2, "handle_cookie_echo: cookie signature validation failed!\n");
2565                 SCTPDBG(SCTP_DEBUG_INPUT2,
2566                     "offset = %u, cookie_offset = %u, sig_offset = %u\n",
2567                     (uint32_t) offset, cookie_offset, sig_offset);
2568                 return (NULL);
2569         }
2570         /*
2571          * check the cookie timestamps to be sure it's not stale
2572          */
2573         (void)SCTP_GETTIME_TIMEVAL(&now);
2574         /* Expire time is in Ticks, so we convert to seconds */
2575         time_expires.tv_sec = cookie->time_entered.tv_sec + TICKS_TO_SEC(cookie->cookie_life);
2576         time_expires.tv_usec = cookie->time_entered.tv_usec;
2577         /*
2578          * TODO sctp_constants.h needs alternative time macros when _KERNEL
2579          * is undefined.
2580          */
2581         if (timevalcmp(&now, &time_expires, >)) {
2582                 /* cookie is stale! */
2583                 struct mbuf *op_err;
2584                 struct sctp_error_stale_cookie *cause;
2585                 uint32_t tim;
2586
2587                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_stale_cookie),
2588                     0, M_NOWAIT, 1, MT_DATA);
2589                 if (op_err == NULL) {
2590                         /* FOOBAR */
2591                         return (NULL);
2592                 }
2593                 /* Set the len */
2594                 SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_stale_cookie);
2595                 cause = mtod(op_err, struct sctp_error_stale_cookie *);
2596                 cause->cause.code = htons(SCTP_CAUSE_STALE_COOKIE);
2597                 cause->cause.length = htons((sizeof(struct sctp_paramhdr) +
2598                     (sizeof(uint32_t))));
2599                 /* seconds to usec */
2600                 tim = (now.tv_sec - time_expires.tv_sec) * 1000000;
2601                 /* add in usec */
2602                 if (tim == 0)
2603                         tim = now.tv_usec - cookie->time_entered.tv_usec;
2604                 cause->stale_time = htonl(tim);
2605                 sctp_send_operr_to(src, dst, sh, cookie->peers_vtag, op_err,
2606                     mflowtype, mflowid, l_inp->fibnum,
2607                     vrf_id, port);
2608                 return (NULL);
2609         }
2610         /*
2611          * Now we must see with the lookup address if we have an existing
2612          * asoc. This will only happen if we were in the COOKIE-WAIT state
2613          * and a INIT collided with us and somewhere the peer sent the
2614          * cookie on another address besides the single address our assoc
2615          * had for him. In this case we will have one of the tie-tags set at
2616          * least AND the address field in the cookie can be used to look it
2617          * up.
2618          */
2619         to = NULL;
2620         switch (cookie->addr_type) {
2621 #ifdef INET6
2622         case SCTP_IPV6_ADDRESS:
2623                 memset(&sin6, 0, sizeof(sin6));
2624                 sin6.sin6_family = AF_INET6;
2625                 sin6.sin6_len = sizeof(sin6);
2626                 sin6.sin6_port = sh->src_port;
2627                 sin6.sin6_scope_id = cookie->scope_id;
2628                 memcpy(&sin6.sin6_addr.s6_addr, cookie->address,
2629                     sizeof(sin6.sin6_addr.s6_addr));
2630                 to = (struct sockaddr *)&sin6;
2631                 break;
2632 #endif
2633 #ifdef INET
2634         case SCTP_IPV4_ADDRESS:
2635                 memset(&sin, 0, sizeof(sin));
2636                 sin.sin_family = AF_INET;
2637                 sin.sin_len = sizeof(sin);
2638                 sin.sin_port = sh->src_port;
2639                 sin.sin_addr.s_addr = cookie->address[0];
2640                 to = (struct sockaddr *)&sin;
2641                 break;
2642 #endif
2643         default:
2644                 /* This should not happen */
2645                 return (NULL);
2646         }
2647         if (*stcb == NULL) {
2648                 /* Yep, lets check */
2649                 *stcb = sctp_findassociation_ep_addr(inp_p, to, netp, dst, NULL);
2650                 if (*stcb == NULL) {
2651                         /*
2652                          * We should have only got back the same inp. If we
2653                          * got back a different ep we have a problem. The
2654                          * original findep got back l_inp and now
2655                          */
2656                         if (l_inp != *inp_p) {
2657                                 SCTP_PRINTF("Bad problem find_ep got a diff inp then special_locate?\n");
2658                         }
2659                 } else {
2660                         if (*locked_tcb == NULL) {
2661                                 /*
2662                                  * In this case we found the assoc only
2663                                  * after we locked the create lock. This
2664                                  * means we are in a colliding case and we
2665                                  * must make sure that we unlock the tcb if
2666                                  * its one of the cases where we throw away
2667                                  * the incoming packets.
2668                                  */
2669                                 *locked_tcb = *stcb;
2670
2671                                 /*
2672                                  * We must also increment the inp ref count
2673                                  * since the ref_count flags was set when we
2674                                  * did not find the TCB, now we found it
2675                                  * which reduces the refcount.. we must
2676                                  * raise it back out to balance it all :-)
2677                                  */
2678                                 SCTP_INP_INCR_REF((*stcb)->sctp_ep);
2679                                 if ((*stcb)->sctp_ep != l_inp) {
2680                                         SCTP_PRINTF("Huh? ep:%p diff then l_inp:%p?\n",
2681                                             (void *)(*stcb)->sctp_ep, (void *)l_inp);
2682                                 }
2683                         }
2684                 }
2685         }
2686         cookie_len -= SCTP_SIGNATURE_SIZE;
2687         if (*stcb == NULL) {
2688                 /* this is the "normal" case... get a new TCB */
2689                 *stcb = sctp_process_cookie_new(m, iphlen, offset, src, dst, sh,
2690                     cookie, cookie_len, *inp_p,
2691                     netp, to, &notification,
2692                     auth_skipped, auth_offset, auth_len,
2693                     mflowtype, mflowid,
2694                     vrf_id, port);
2695         } else {
2696                 /* this is abnormal... cookie-echo on existing TCB */
2697                 had_a_existing_tcb = 1;
2698                 *stcb = sctp_process_cookie_existing(m, iphlen, offset,
2699                     src, dst, sh,
2700                     cookie, cookie_len, *inp_p, *stcb, netp, to,
2701                     &notification, auth_skipped, auth_offset, auth_len,
2702                     mflowtype, mflowid,
2703                     vrf_id, port);
2704         }
2705
2706         if (*stcb == NULL) {
2707                 /* still no TCB... must be bad cookie-echo */
2708                 return (NULL);
2709         }
2710         if (*netp != NULL) {
2711                 (*netp)->flowtype = mflowtype;
2712                 (*netp)->flowid = mflowid;
2713         }
2714         /*
2715          * Ok, we built an association so confirm the address we sent the
2716          * INIT-ACK to.
2717          */
2718         netl = sctp_findnet(*stcb, to);
2719         /*
2720          * This code should in theory NOT run but
2721          */
2722         if (netl == NULL) {
2723                 /* TSNH! Huh, why do I need to add this address here? */
2724                 if (sctp_add_remote_addr(*stcb, to, NULL, port,
2725                     SCTP_DONOT_SETSCOPE, SCTP_IN_COOKIE_PROC)) {
2726                         return (NULL);
2727                 }
2728                 netl = sctp_findnet(*stcb, to);
2729         }
2730         if (netl) {
2731                 if (netl->dest_state & SCTP_ADDR_UNCONFIRMED) {
2732                         netl->dest_state &= ~SCTP_ADDR_UNCONFIRMED;
2733                         (void)sctp_set_primary_addr((*stcb), (struct sockaddr *)NULL,
2734                             netl);
2735                         send_int_conf = 1;
2736                 }
2737         }
2738         sctp_start_net_timers(*stcb);
2739         if ((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
2740                 if (!had_a_existing_tcb ||
2741                     (((*inp_p)->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0)) {
2742                         /*
2743                          * If we have a NEW cookie or the connect never
2744                          * reached the connected state during collision we
2745                          * must do the TCP accept thing.
2746                          */
2747                         struct socket *so, *oso;
2748                         struct sctp_inpcb *inp;
2749
2750                         if (notification == SCTP_NOTIFY_ASSOC_RESTART) {
2751                                 /*
2752                                  * For a restart we will keep the same
2753                                  * socket, no need to do anything. I THINK!!
2754                                  */
2755                                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2756                                 if (send_int_conf) {
2757                                         sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2758                                             (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2759                                 }
2760                                 return (m);
2761                         }
2762                         oso = (*inp_p)->sctp_socket;
2763                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2764                         SCTP_TCB_UNLOCK((*stcb));
2765                         CURVNET_SET(oso->so_vnet);
2766                         so = sonewconn(oso, 0
2767                             );
2768                         CURVNET_RESTORE();
2769                         SCTP_TCB_LOCK((*stcb));
2770                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2771
2772                         if (so == NULL) {
2773                                 struct mbuf *op_err;
2774
2775 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2776                                 struct socket *pcb_so;
2777
2778 #endif
2779                                 /* Too many sockets */
2780                                 SCTPDBG(SCTP_DEBUG_INPUT1, "process_cookie_new: no room for another socket!\n");
2781                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
2782                                 sctp_abort_association(*inp_p, NULL, m, iphlen,
2783                                     src, dst, sh, op_err,
2784                                     mflowtype, mflowid,
2785                                     vrf_id, port);
2786 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2787                                 pcb_so = SCTP_INP_SO(*inp_p);
2788                                 atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2789                                 SCTP_TCB_UNLOCK((*stcb));
2790                                 SCTP_SOCKET_LOCK(pcb_so, 1);
2791                                 SCTP_TCB_LOCK((*stcb));
2792                                 atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2793 #endif
2794                                 (void)sctp_free_assoc(*inp_p, *stcb, SCTP_NORMAL_PROC,
2795                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_23);
2796 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2797                                 SCTP_SOCKET_UNLOCK(pcb_so, 1);
2798 #endif
2799                                 return (NULL);
2800                         }
2801                         inp = (struct sctp_inpcb *)so->so_pcb;
2802                         SCTP_INP_INCR_REF(inp);
2803                         /*
2804                          * We add the unbound flag here so that if we get an
2805                          * soabort() before we get the move_pcb done, we
2806                          * will properly cleanup.
2807                          */
2808                         inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2809                             SCTP_PCB_FLAGS_CONNECTED |
2810                             SCTP_PCB_FLAGS_IN_TCPPOOL |
2811                             SCTP_PCB_FLAGS_UNBOUND |
2812                             (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
2813                             SCTP_PCB_FLAGS_DONT_WAKE);
2814                         inp->sctp_features = (*inp_p)->sctp_features;
2815                         inp->sctp_mobility_features = (*inp_p)->sctp_mobility_features;
2816                         inp->sctp_socket = so;
2817                         inp->sctp_frag_point = (*inp_p)->sctp_frag_point;
2818                         inp->max_cwnd = (*inp_p)->max_cwnd;
2819                         inp->sctp_cmt_on_off = (*inp_p)->sctp_cmt_on_off;
2820                         inp->ecn_supported = (*inp_p)->ecn_supported;
2821                         inp->prsctp_supported = (*inp_p)->prsctp_supported;
2822                         inp->auth_supported = (*inp_p)->auth_supported;
2823                         inp->asconf_supported = (*inp_p)->asconf_supported;
2824                         inp->reconfig_supported = (*inp_p)->reconfig_supported;
2825                         inp->nrsack_supported = (*inp_p)->nrsack_supported;
2826                         inp->pktdrop_supported = (*inp_p)->pktdrop_supported;
2827                         inp->partial_delivery_point = (*inp_p)->partial_delivery_point;
2828                         inp->sctp_context = (*inp_p)->sctp_context;
2829                         inp->local_strreset_support = (*inp_p)->local_strreset_support;
2830                         inp->fibnum = (*inp_p)->fibnum;
2831                         inp->inp_starting_point_for_iterator = NULL;
2832                         /*
2833                          * copy in the authentication parameters from the
2834                          * original endpoint
2835                          */
2836                         if (inp->sctp_ep.local_hmacs)
2837                                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2838                         inp->sctp_ep.local_hmacs =
2839                             sctp_copy_hmaclist((*inp_p)->sctp_ep.local_hmacs);
2840                         if (inp->sctp_ep.local_auth_chunks)
2841                                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2842                         inp->sctp_ep.local_auth_chunks =
2843                             sctp_copy_chunklist((*inp_p)->sctp_ep.local_auth_chunks);
2844
2845                         /*
2846                          * Now we must move it from one hash table to
2847                          * another and get the tcb in the right place.
2848                          */
2849
2850                         /*
2851                          * This is where the one-2-one socket is put into
2852                          * the accept state waiting for the accept!
2853                          */
2854                         if (*stcb) {
2855                                 (*stcb)->asoc.state |= SCTP_STATE_IN_ACCEPT_QUEUE;
2856                         }
2857                         sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
2858
2859                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2860                         SCTP_TCB_UNLOCK((*stcb));
2861
2862                         sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb,
2863                             0);
2864                         SCTP_TCB_LOCK((*stcb));
2865                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2866
2867
2868                         /*
2869                          * now we must check to see if we were aborted while
2870                          * the move was going on and the lock/unlock
2871                          * happened.
2872                          */
2873                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2874                                 /*
2875                                  * yep it was, we leave the assoc attached
2876                                  * to the socket since the sctp_inpcb_free()
2877                                  * call will send an abort for us.
2878                                  */
2879                                 SCTP_INP_DECR_REF(inp);
2880                                 return (NULL);
2881                         }
2882                         SCTP_INP_DECR_REF(inp);
2883                         /* Switch over to the new guy */
2884                         *inp_p = inp;
2885                         sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2886                         if (send_int_conf) {
2887                                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2888                                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2889                         }
2890                         /*
2891                          * Pull it from the incomplete queue and wake the
2892                          * guy
2893                          */
2894 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2895                         atomic_add_int(&(*stcb)->asoc.refcnt, 1);
2896                         SCTP_TCB_UNLOCK((*stcb));
2897                         SCTP_SOCKET_LOCK(so, 1);
2898 #endif
2899                         soisconnected(so);
2900 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2901                         SCTP_TCB_LOCK((*stcb));
2902                         atomic_subtract_int(&(*stcb)->asoc.refcnt, 1);
2903                         SCTP_SOCKET_UNLOCK(so, 1);
2904 #endif
2905                         return (m);
2906                 }
2907         }
2908         if (notification) {
2909                 sctp_ulp_notify(notification, *stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2910         }
2911         if (send_int_conf) {
2912                 sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_CONFIRMED,
2913                     (*stcb), 0, (void *)netl, SCTP_SO_NOT_LOCKED);
2914         }
2915         return (m);
2916 }
2917
2918 static void
2919 sctp_handle_cookie_ack(struct sctp_cookie_ack_chunk *cp SCTP_UNUSED,
2920     struct sctp_tcb *stcb, struct sctp_nets *net)
2921 {
2922         /* cp must not be used, others call this without a c-ack :-) */
2923         struct sctp_association *asoc;
2924
2925         SCTPDBG(SCTP_DEBUG_INPUT2,
2926             "sctp_handle_cookie_ack: handling COOKIE-ACK\n");
2927         if ((stcb == NULL) || (net == NULL)) {
2928                 return;
2929         }
2930         asoc = &stcb->asoc;
2931
2932         sctp_stop_all_cookie_timers(stcb);
2933         /* process according to association state */
2934         if (SCTP_GET_STATE(asoc) == SCTP_STATE_COOKIE_ECHOED) {
2935                 /* state change only needed when I am in right state */
2936                 SCTPDBG(SCTP_DEBUG_INPUT2, "moving to OPEN state\n");
2937                 SCTP_SET_STATE(asoc, SCTP_STATE_OPEN);
2938                 sctp_start_net_timers(stcb);
2939                 if (asoc->state & SCTP_STATE_SHUTDOWN_PENDING) {
2940                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
2941                             stcb->sctp_ep, stcb, asoc->primary_destination);
2942
2943                 }
2944                 /* update RTO */
2945                 SCTP_STAT_INCR_COUNTER32(sctps_activeestab);
2946                 SCTP_STAT_INCR_GAUGE32(sctps_currestab);
2947                 if (asoc->overall_error_count == 0) {
2948                         net->RTO = sctp_calculate_rto(stcb, asoc, net,
2949                             &asoc->time_entered, sctp_align_safe_nocopy,
2950                             SCTP_RTT_FROM_NON_DATA);
2951                 }
2952                 (void)SCTP_GETTIME_TIMEVAL(&asoc->time_entered);
2953                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_UP, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
2954                 if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2955                     (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2956 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2957                         struct socket *so;
2958
2959 #endif
2960                         stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
2961 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2962                         so = SCTP_INP_SO(stcb->sctp_ep);
2963                         atomic_add_int(&stcb->asoc.refcnt, 1);
2964                         SCTP_TCB_UNLOCK(stcb);
2965                         SCTP_SOCKET_LOCK(so, 1);
2966                         SCTP_TCB_LOCK(stcb);
2967                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2968 #endif
2969                         if ((stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) == 0) {
2970                                 soisconnected(stcb->sctp_socket);
2971                         }
2972 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2973                         SCTP_SOCKET_UNLOCK(so, 1);
2974 #endif
2975                 }
2976                 /*
2977                  * since we did not send a HB make sure we don't double
2978                  * things
2979                  */
2980                 net->hb_responded = 1;
2981
2982                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2983                         /*
2984                          * We don't need to do the asconf thing, nor hb or
2985                          * autoclose if the socket is closed.
2986                          */
2987                         goto closed_socket;
2988                 }
2989                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
2990                     stcb, net);
2991
2992
2993                 if (stcb->asoc.sctp_autoclose_ticks &&
2994                     sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_AUTOCLOSE)) {
2995                         sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE,
2996                             stcb->sctp_ep, stcb, NULL);
2997                 }
2998                 /*
2999                  * send ASCONF if parameters are pending and ASCONFs are
3000                  * allowed (eg. addresses changed when init/cookie echo were
3001                  * in flight)
3002                  */
3003                 if ((sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_DO_ASCONF)) &&
3004                     (stcb->asoc.asconf_supported == 1) &&
3005                     (!TAILQ_EMPTY(&stcb->asoc.asconf_queue))) {
3006 #ifdef SCTP_TIMER_BASED_ASCONF
3007                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
3008                             stcb->sctp_ep, stcb,
3009                             stcb->asoc.primary_destination);
3010 #else
3011                         sctp_send_asconf(stcb, stcb->asoc.primary_destination,
3012                             SCTP_ADDR_NOT_LOCKED);
3013 #endif
3014                 }
3015         }
3016 closed_socket:
3017         /* Toss the cookie if I can */
3018         sctp_toss_old_cookies(stcb, asoc);
3019         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3020                 /* Restart the timer if we have pending data */
3021                 struct sctp_tmit_chunk *chk;
3022
3023                 chk = TAILQ_FIRST(&asoc->sent_queue);
3024                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
3025         }
3026 }
3027
3028 static void
3029 sctp_handle_ecn_echo(struct sctp_ecne_chunk *cp,
3030     struct sctp_tcb *stcb)
3031 {
3032         struct sctp_nets *net;
3033         struct sctp_tmit_chunk *lchk;
3034         struct sctp_ecne_chunk bkup;
3035         uint8_t override_bit;
3036         uint32_t tsn, window_data_tsn;
3037         int len;
3038         unsigned int pkt_cnt;
3039
3040         len = ntohs(cp->ch.chunk_length);
3041         if ((len != sizeof(struct sctp_ecne_chunk)) &&
3042             (len != sizeof(struct old_sctp_ecne_chunk))) {
3043                 return;
3044         }
3045         if (len == sizeof(struct old_sctp_ecne_chunk)) {
3046                 /* Its the old format */
3047                 memcpy(&bkup, cp, sizeof(struct old_sctp_ecne_chunk));
3048                 bkup.num_pkts_since_cwr = htonl(1);
3049                 cp = &bkup;
3050         }
3051         SCTP_STAT_INCR(sctps_recvecne);
3052         tsn = ntohl(cp->tsn);
3053         pkt_cnt = ntohl(cp->num_pkts_since_cwr);
3054         lchk = TAILQ_LAST(&stcb->asoc.send_queue, sctpchunk_listhead);
3055         if (lchk == NULL) {
3056                 window_data_tsn = stcb->asoc.sending_seq - 1;
3057         } else {
3058                 window_data_tsn = lchk->rec.data.TSN_seq;
3059         }
3060
3061         /* Find where it was sent to if possible. */
3062         net = NULL;
3063         TAILQ_FOREACH(lchk, &stcb->asoc.sent_queue, sctp_next) {
3064                 if (lchk->rec.data.TSN_seq == tsn) {
3065                         net = lchk->whoTo;
3066                         net->ecn_prev_cwnd = lchk->rec.data.cwnd_at_send;
3067                         break;
3068                 }
3069                 if (SCTP_TSN_GT(lchk->rec.data.TSN_seq, tsn)) {
3070                         break;
3071                 }
3072         }
3073         if (net == NULL) {
3074                 /*
3075                  * What to do. A previous send of a CWR was possibly lost.
3076                  * See how old it is, we may have it marked on the actual
3077                  * net.
3078                  */
3079                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3080                         if (tsn == net->last_cwr_tsn) {
3081                                 /* Found him, send it off */
3082                                 break;
3083                         }
3084                 }
3085                 if (net == NULL) {
3086                         /*
3087                          * If we reach here, we need to send a special CWR
3088                          * that says hey, we did this a long time ago and
3089                          * you lost the response.
3090                          */
3091                         net = TAILQ_FIRST(&stcb->asoc.nets);
3092                         if (net == NULL) {
3093                                 /* TSNH */
3094                                 return;
3095                         }
3096                         override_bit = SCTP_CWR_REDUCE_OVERRIDE;
3097                 } else {
3098                         override_bit = 0;
3099                 }
3100         } else {
3101                 override_bit = 0;
3102         }
3103         if (SCTP_TSN_GT(tsn, net->cwr_window_tsn) &&
3104             ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3105                 /*
3106                  * JRS - Use the congestion control given in the pluggable
3107                  * CC module
3108                  */
3109                 stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 0, pkt_cnt);
3110                 /*
3111                  * We reduce once every RTT. So we will only lower cwnd at
3112                  * the next sending seq i.e. the window_data_tsn
3113                  */
3114                 net->cwr_window_tsn = window_data_tsn;
3115                 net->ecn_ce_pkt_cnt += pkt_cnt;
3116                 net->lost_cnt = pkt_cnt;
3117                 net->last_cwr_tsn = tsn;
3118         } else {
3119                 override_bit |= SCTP_CWR_IN_SAME_WINDOW;
3120                 if (SCTP_TSN_GT(tsn, net->last_cwr_tsn) &&
3121                     ((override_bit & SCTP_CWR_REDUCE_OVERRIDE) == 0)) {
3122                         /*
3123                          * Another loss in the same window update how many
3124                          * marks/packets lost we have had.
3125                          */
3126                         int cnt = 1;
3127
3128                         if (pkt_cnt > net->lost_cnt) {
3129                                 /* Should be the case */
3130                                 cnt = (pkt_cnt - net->lost_cnt);
3131                                 net->ecn_ce_pkt_cnt += cnt;
3132                         }
3133                         net->lost_cnt = pkt_cnt;
3134                         net->last_cwr_tsn = tsn;
3135                         /*
3136                          * Most CC functions will ignore this call, since we
3137                          * are in-window yet of the initial CE the peer saw.
3138                          */
3139                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo(stcb, net, 1, cnt);
3140                 }
3141         }
3142         /*
3143          * We always send a CWR this way if our previous one was lost our
3144          * peer will get an update, or if it is not time again to reduce we
3145          * still get the cwr to the peer. Note we set the override when we
3146          * could not find the TSN on the chunk or the destination network.
3147          */
3148         sctp_send_cwr(stcb, net, net->last_cwr_tsn, override_bit);
3149 }
3150
3151 static void
3152 sctp_handle_ecn_cwr(struct sctp_cwr_chunk *cp, struct sctp_tcb *stcb, struct sctp_nets *net)
3153 {
3154         /*
3155          * Here we get a CWR from the peer. We must look in the outqueue and
3156          * make sure that we have a covered ECNE in the control chunk part.
3157          * If so remove it.
3158          */
3159         struct sctp_tmit_chunk *chk;
3160         struct sctp_ecne_chunk *ecne;
3161         int override;
3162         uint32_t cwr_tsn;
3163
3164         cwr_tsn = ntohl(cp->tsn);
3165         override = cp->ch.chunk_flags & SCTP_CWR_REDUCE_OVERRIDE;
3166         TAILQ_FOREACH(chk, &stcb->asoc.control_send_queue, sctp_next) {
3167                 if (chk->rec.chunk_id.id != SCTP_ECN_ECHO) {
3168                         continue;
3169                 }
3170                 if ((override == 0) && (chk->whoTo != net)) {
3171                         /* Must be from the right src unless override is set */
3172                         continue;
3173                 }
3174                 ecne = mtod(chk->data, struct sctp_ecne_chunk *);
3175                 if (SCTP_TSN_GE(cwr_tsn, ntohl(ecne->tsn))) {
3176                         /* this covers this ECNE, we can remove it */
3177                         stcb->asoc.ecn_echo_cnt_onq--;
3178                         TAILQ_REMOVE(&stcb->asoc.control_send_queue, chk,
3179                             sctp_next);
3180                         sctp_m_freem(chk->data);
3181                         chk->data = NULL;
3182                         stcb->asoc.ctrl_queue_cnt--;
3183                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3184                         if (override == 0) {
3185                                 break;
3186                         }
3187                 }
3188         }
3189 }
3190
3191 static void
3192 sctp_handle_shutdown_complete(struct sctp_shutdown_complete_chunk *cp SCTP_UNUSED,
3193     struct sctp_tcb *stcb, struct sctp_nets *net)
3194 {
3195         struct sctp_association *asoc;
3196
3197 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3198         struct socket *so;
3199
3200 #endif
3201
3202         SCTPDBG(SCTP_DEBUG_INPUT2,
3203             "sctp_handle_shutdown_complete: handling SHUTDOWN-COMPLETE\n");
3204         if (stcb == NULL)
3205                 return;
3206
3207         asoc = &stcb->asoc;
3208         /* process according to association state */
3209         if (SCTP_GET_STATE(asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT) {
3210                 /* unexpected SHUTDOWN-COMPLETE... so ignore... */
3211                 SCTPDBG(SCTP_DEBUG_INPUT2,
3212                     "sctp_handle_shutdown_complete: not in SCTP_STATE_SHUTDOWN_ACK_SENT --- ignore\n");
3213                 SCTP_TCB_UNLOCK(stcb);
3214                 return;
3215         }
3216         /* notify upper layer protocol */
3217         if (stcb->sctp_socket) {
3218                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_DOWN, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
3219         }
3220 #ifdef INVARIANTS
3221         if (!TAILQ_EMPTY(&asoc->send_queue) ||
3222             !TAILQ_EMPTY(&asoc->sent_queue) ||
3223             sctp_is_there_unsent_data(stcb, SCTP_SO_NOT_LOCKED)) {
3224                 panic("Queues are not empty when handling SHUTDOWN-COMPLETE");
3225         }
3226 #endif
3227         /* stop the timer */
3228         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, stcb->sctp_ep, stcb, net,
3229             SCTP_FROM_SCTP_INPUT + SCTP_LOC_24);
3230         SCTP_STAT_INCR_COUNTER32(sctps_shutdown);
3231         /* free the TCB */
3232         SCTPDBG(SCTP_DEBUG_INPUT2,
3233             "sctp_handle_shutdown_complete: calls free-asoc\n");
3234 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3235         so = SCTP_INP_SO(stcb->sctp_ep);
3236         atomic_add_int(&stcb->asoc.refcnt, 1);
3237         SCTP_TCB_UNLOCK(stcb);
3238         SCTP_SOCKET_LOCK(so, 1);
3239         SCTP_TCB_LOCK(stcb);
3240         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3241 #endif
3242         (void)sctp_free_assoc(stcb->sctp_ep, stcb, SCTP_NORMAL_PROC,
3243             SCTP_FROM_SCTP_INPUT + SCTP_LOC_25);
3244 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3245         SCTP_SOCKET_UNLOCK(so, 1);
3246 #endif
3247         return;
3248 }
3249
3250 static int
3251 process_chunk_drop(struct sctp_tcb *stcb, struct sctp_chunk_desc *desc,
3252     struct sctp_nets *net, uint8_t flg)
3253 {
3254         switch (desc->chunk_type) {
3255         case SCTP_DATA:
3256                 /* find the tsn to resend (possibly */
3257                 {
3258                         uint32_t tsn;
3259                         struct sctp_tmit_chunk *tp1;
3260
3261                         tsn = ntohl(desc->tsn_ifany);
3262                         TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3263                                 if (tp1->rec.data.TSN_seq == tsn) {
3264                                         /* found it */
3265                                         break;
3266                                 }
3267                                 if (SCTP_TSN_GT(tp1->rec.data.TSN_seq, tsn)) {
3268                                         /* not found */
3269                                         tp1 = NULL;
3270                                         break;
3271                                 }
3272                         }
3273                         if (tp1 == NULL) {
3274                                 /*
3275                                  * Do it the other way , aka without paying
3276                                  * attention to queue seq order.
3277                                  */
3278                                 SCTP_STAT_INCR(sctps_pdrpdnfnd);
3279                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3280                                         if (tp1->rec.data.TSN_seq == tsn) {
3281                                                 /* found it */
3282                                                 break;
3283                                         }
3284                                 }
3285                         }
3286                         if (tp1 == NULL) {
3287                                 SCTP_STAT_INCR(sctps_pdrptsnnf);
3288                         }
3289                         if ((tp1) && (tp1->sent < SCTP_DATAGRAM_ACKED)) {
3290                                 uint8_t *ddp;
3291
3292                                 if (((flg & SCTP_BADCRC) == 0) &&
3293                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3294                                         return (0);
3295                                 }
3296                                 if ((stcb->asoc.peers_rwnd == 0) &&
3297                                     ((flg & SCTP_FROM_MIDDLE_BOX) == 0)) {
3298                                         SCTP_STAT_INCR(sctps_pdrpdiwnp);
3299                                         return (0);
3300                                 }
3301                                 if (stcb->asoc.peers_rwnd == 0 &&
3302                                     (flg & SCTP_FROM_MIDDLE_BOX)) {
3303                                         SCTP_STAT_INCR(sctps_pdrpdizrw);
3304                                         return (0);
3305                                 }
3306                                 ddp = (uint8_t *) (mtod(tp1->data, caddr_t)+
3307                                     sizeof(struct sctp_data_chunk));
3308                                 {
3309                                         unsigned int iii;
3310
3311                                         for (iii = 0; iii < sizeof(desc->data_bytes);
3312                                             iii++) {
3313                                                 if (ddp[iii] != desc->data_bytes[iii]) {
3314                                                         SCTP_STAT_INCR(sctps_pdrpbadd);
3315                                                         return (-1);
3316                                                 }
3317                                         }
3318                                 }
3319
3320                                 if (tp1->do_rtt) {
3321                                         /*
3322                                          * this guy had a RTO calculation
3323                                          * pending on it, cancel it
3324                                          */
3325                                         if (tp1->whoTo->rto_needed == 0) {
3326                                                 tp1->whoTo->rto_needed = 1;
3327                                         }
3328                                         tp1->do_rtt = 0;
3329                                 }
3330                                 SCTP_STAT_INCR(sctps_pdrpmark);
3331                                 if (tp1->sent != SCTP_DATAGRAM_RESEND)
3332                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3333                                 /*
3334                                  * mark it as if we were doing a FR, since
3335                                  * we will be getting gap ack reports behind
3336                                  * the info from the router.
3337                                  */
3338                                 tp1->rec.data.doing_fast_retransmit = 1;
3339                                 /*
3340                                  * mark the tsn with what sequences can
3341                                  * cause a new FR.
3342                                  */
3343                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue)) {
3344                                         tp1->rec.data.fast_retran_tsn = stcb->asoc.sending_seq;
3345                                 } else {
3346                                         tp1->rec.data.fast_retran_tsn = (TAILQ_FIRST(&stcb->asoc.send_queue))->rec.data.TSN_seq;
3347                                 }
3348
3349                                 /* restart the timer */
3350                                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3351                                     stcb, tp1->whoTo,
3352                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_26);
3353                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
3354                                     stcb, tp1->whoTo);
3355
3356                                 /* fix counts and things */
3357                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3358                                         sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_PDRP,
3359                                             tp1->whoTo->flight_size,
3360                                             tp1->book_size,
3361                                             (uint32_t) (uintptr_t) stcb,
3362                                             tp1->rec.data.TSN_seq);
3363                                 }
3364                                 if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3365                                         sctp_flight_size_decrease(tp1);
3366                                         sctp_total_flight_decrease(stcb, tp1);
3367                                 }
3368                                 tp1->sent = SCTP_DATAGRAM_RESEND;
3369                         } {
3370                                 /* audit code */
3371                                 unsigned int audit;
3372
3373                                 audit = 0;
3374                                 TAILQ_FOREACH(tp1, &stcb->asoc.sent_queue, sctp_next) {
3375                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
3376                                                 audit++;
3377                                 }
3378                                 TAILQ_FOREACH(tp1, &stcb->asoc.control_send_queue,
3379                                     sctp_next) {
3380                                         if (tp1->sent == SCTP_DATAGRAM_RESEND)
3381                                                 audit++;
3382                                 }
3383                                 if (audit != stcb->asoc.sent_queue_retran_cnt) {
3384                                         SCTP_PRINTF("**Local Audit finds cnt:%d asoc cnt:%d\n",
3385                                             audit, stcb->asoc.sent_queue_retran_cnt);
3386 #ifndef SCTP_AUDITING_ENABLED
3387                                         stcb->asoc.sent_queue_retran_cnt = audit;
3388 #endif
3389                                 }
3390                         }
3391                 }
3392                 break;
3393         case SCTP_ASCONF:
3394                 {
3395                         struct sctp_tmit_chunk *asconf;
3396
3397                         TAILQ_FOREACH(asconf, &stcb->asoc.control_send_queue,
3398                             sctp_next) {
3399                                 if (asconf->rec.chunk_id.id == SCTP_ASCONF) {
3400                                         break;
3401                                 }
3402                         }
3403                         if (asconf) {
3404                                 if (asconf->sent != SCTP_DATAGRAM_RESEND)
3405                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3406                                 asconf->sent = SCTP_DATAGRAM_RESEND;
3407                                 asconf->snd_count--;
3408                         }
3409                 }
3410                 break;
3411         case SCTP_INITIATION:
3412                 /* resend the INIT */
3413                 stcb->asoc.dropped_special_cnt++;
3414                 if (stcb->asoc.dropped_special_cnt < SCTP_RETRY_DROPPED_THRESH) {
3415                         /*
3416                          * If we can get it in, in a few attempts we do
3417                          * this, otherwise we let the timer fire.
3418                          */
3419                         sctp_timer_stop(SCTP_TIMER_TYPE_INIT, stcb->sctp_ep,
3420                             stcb, net,
3421                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_27);
3422                         sctp_send_initiate(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
3423                 }
3424                 break;
3425         case SCTP_SELECTIVE_ACK:
3426         case SCTP_NR_SELECTIVE_ACK:
3427                 /* resend the sack */
3428                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
3429                 break;
3430         case SCTP_HEARTBEAT_REQUEST:
3431                 /* resend a demand HB */
3432                 if ((stcb->asoc.overall_error_count + 3) < stcb->asoc.max_send_times) {
3433                         /*
3434                          * Only retransmit if we KNOW we wont destroy the
3435                          * tcb
3436                          */
3437                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
3438                 }
3439                 break;
3440         case SCTP_SHUTDOWN:
3441                 sctp_send_shutdown(stcb, net);
3442                 break;
3443         case SCTP_SHUTDOWN_ACK:
3444                 sctp_send_shutdown_ack(stcb, net);
3445                 break;
3446         case SCTP_COOKIE_ECHO:
3447                 {
3448                         struct sctp_tmit_chunk *cookie;
3449
3450                         cookie = NULL;
3451                         TAILQ_FOREACH(cookie, &stcb->asoc.control_send_queue,
3452                             sctp_next) {
3453                                 if (cookie->rec.chunk_id.id == SCTP_COOKIE_ECHO) {
3454                                         break;
3455                                 }
3456                         }
3457                         if (cookie) {
3458                                 if (cookie->sent != SCTP_DATAGRAM_RESEND)
3459                                         sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3460                                 cookie->sent = SCTP_DATAGRAM_RESEND;
3461                                 sctp_stop_all_cookie_timers(stcb);
3462                         }
3463                 }
3464                 break;
3465         case SCTP_COOKIE_ACK:
3466                 sctp_send_cookie_ack(stcb);
3467                 break;
3468         case SCTP_ASCONF_ACK:
3469                 /* resend last asconf ack */
3470                 sctp_send_asconf_ack(stcb);
3471                 break;
3472         case SCTP_IFORWARD_CUM_TSN:
3473         case SCTP_FORWARD_CUM_TSN:
3474                 send_forward_tsn(stcb, &stcb->asoc);
3475                 break;
3476                 /* can't do anything with these */
3477         case SCTP_PACKET_DROPPED:
3478         case SCTP_INITIATION_ACK:       /* this should not happen */
3479         case SCTP_HEARTBEAT_ACK:
3480         case SCTP_ABORT_ASSOCIATION:
3481         case SCTP_OPERATION_ERROR:
3482         case SCTP_SHUTDOWN_COMPLETE:
3483         case SCTP_ECN_ECHO:
3484         case SCTP_ECN_CWR:
3485         default:
3486                 break;
3487         }
3488         return (0);
3489 }
3490
3491 void
3492 sctp_reset_in_stream(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3493 {
3494         uint32_t i;
3495         uint16_t temp;
3496
3497         /*
3498          * We set things to 0xffffffff since this is the last delivered
3499          * sequence and we will be sending in 0 after the reset.
3500          */
3501
3502         if (number_entries) {
3503                 for (i = 0; i < number_entries; i++) {
3504                         temp = ntohs(list[i]);
3505                         if (temp >= stcb->asoc.streamincnt) {
3506                                 continue;
3507                         }
3508                         stcb->asoc.strmin[temp].last_sequence_delivered = 0xffffffff;
3509                 }
3510         } else {
3511                 list = NULL;
3512                 for (i = 0; i < stcb->asoc.streamincnt; i++) {
3513                         stcb->asoc.strmin[i].last_sequence_delivered = 0xffffffff;
3514                 }
3515         }
3516         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_RECV, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3517 }
3518
3519 static void
3520 sctp_reset_out_streams(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3521 {
3522         uint32_t i;
3523         uint16_t temp;
3524
3525         if (number_entries > 0) {
3526                 for (i = 0; i < number_entries; i++) {
3527                         temp = ntohs(list[i]);
3528                         if (temp >= stcb->asoc.streamoutcnt) {
3529                                 /* no such stream */
3530                                 continue;
3531                         }
3532                         stcb->asoc.strmout[temp].next_mid_ordered = 0;
3533                         stcb->asoc.strmout[temp].next_mid_unordered = 0;
3534                 }
3535         } else {
3536                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3537                         stcb->asoc.strmout[i].next_mid_ordered = 0;
3538                         stcb->asoc.strmout[i].next_mid_unordered = 0;
3539                 }
3540         }
3541         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_SEND, stcb, number_entries, (void *)list, SCTP_SO_NOT_LOCKED);
3542 }
3543
3544 static void
3545 sctp_reset_clear_pending(struct sctp_tcb *stcb, uint32_t number_entries, uint16_t * list)
3546 {
3547         uint32_t i;
3548         uint16_t temp;
3549
3550         if (number_entries > 0) {
3551                 for (i = 0; i < number_entries; i++) {
3552                         temp = ntohs(list[i]);
3553                         if (temp >= stcb->asoc.streamoutcnt) {
3554                                 /* no such stream */
3555                                 continue;
3556                         }
3557                         stcb->asoc.strmout[temp].state = SCTP_STREAM_OPEN;
3558                 }
3559         } else {
3560                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3561                         stcb->asoc.strmout[i].state = SCTP_STREAM_OPEN;
3562                 }
3563         }
3564 }
3565
3566
3567 struct sctp_stream_reset_request *
3568 sctp_find_stream_reset(struct sctp_tcb *stcb, uint32_t seq, struct sctp_tmit_chunk **bchk)
3569 {
3570         struct sctp_association *asoc;
3571         struct sctp_chunkhdr *ch;
3572         struct sctp_stream_reset_request *r;
3573         struct sctp_tmit_chunk *chk;
3574         int len, clen;
3575
3576         asoc = &stcb->asoc;
3577         if (TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
3578                 asoc->stream_reset_outstanding = 0;
3579                 return (NULL);
3580         }
3581         if (stcb->asoc.str_reset == NULL) {
3582                 asoc->stream_reset_outstanding = 0;
3583                 return (NULL);
3584         }
3585         chk = stcb->asoc.str_reset;
3586         if (chk->data == NULL) {
3587                 return (NULL);
3588         }
3589         if (bchk) {
3590                 /* he wants a copy of the chk pointer */
3591                 *bchk = chk;
3592         }
3593         clen = chk->send_size;
3594         ch = mtod(chk->data, struct sctp_chunkhdr *);
3595         r = (struct sctp_stream_reset_request *)(ch + 1);
3596         if (ntohl(r->request_seq) == seq) {
3597                 /* found it */
3598                 return (r);
3599         }
3600         len = SCTP_SIZE32(ntohs(r->ph.param_length));
3601         if (clen > (len + (int)sizeof(struct sctp_chunkhdr))) {
3602                 /* move to the next one, there can only be a max of two */
3603                 r = (struct sctp_stream_reset_request *)((caddr_t)r + len);
3604                 if (ntohl(r->request_seq) == seq) {
3605                         return (r);
3606                 }
3607         }
3608         /* that seq is not here */
3609         return (NULL);
3610 }
3611
3612 static void
3613 sctp_clean_up_stream_reset(struct sctp_tcb *stcb)
3614 {
3615         struct sctp_association *asoc;
3616         struct sctp_tmit_chunk *chk = stcb->asoc.str_reset;
3617
3618         if (stcb->asoc.str_reset == NULL) {
3619                 return;
3620         }
3621         asoc = &stcb->asoc;
3622
3623         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, stcb->sctp_ep, stcb,
3624             chk->whoTo, SCTP_FROM_SCTP_INPUT + SCTP_LOC_28);
3625         TAILQ_REMOVE(&asoc->control_send_queue,
3626             chk,
3627             sctp_next);
3628         if (chk->data) {
3629                 sctp_m_freem(chk->data);
3630                 chk->data = NULL;
3631         }
3632         asoc->ctrl_queue_cnt--;
3633         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
3634         /* sa_ignore NO_NULL_CHK */
3635         stcb->asoc.str_reset = NULL;
3636 }
3637
3638
3639 static int
3640 sctp_handle_stream_reset_response(struct sctp_tcb *stcb,
3641     uint32_t seq, uint32_t action,
3642     struct sctp_stream_reset_response *respin)
3643 {
3644         uint16_t type;
3645         int lparm_len;
3646         struct sctp_association *asoc = &stcb->asoc;
3647         struct sctp_tmit_chunk *chk;
3648         struct sctp_stream_reset_request *req_param;
3649         struct sctp_stream_reset_out_request *req_out_param;
3650         struct sctp_stream_reset_in_request *req_in_param;
3651         uint32_t number_entries;
3652
3653         if (asoc->stream_reset_outstanding == 0) {
3654                 /* duplicate */
3655                 return (0);
3656         }
3657         if (seq == stcb->asoc.str_reset_seq_out) {
3658                 req_param = sctp_find_stream_reset(stcb, seq, &chk);
3659                 if (req_param != NULL) {
3660                         stcb->asoc.str_reset_seq_out++;
3661                         type = ntohs(req_param->ph.param_type);
3662                         lparm_len = ntohs(req_param->ph.param_length);
3663                         if (type == SCTP_STR_RESET_OUT_REQUEST) {
3664                                 int no_clear = 0;
3665
3666                                 req_out_param = (struct sctp_stream_reset_out_request *)req_param;
3667                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t);
3668                                 asoc->stream_reset_out_is_outstanding = 0;
3669                                 if (asoc->stream_reset_outstanding)
3670                                         asoc->stream_reset_outstanding--;
3671                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3672                                         /* do it */
3673                                         sctp_reset_out_streams(stcb, number_entries, req_out_param->list_of_streams);
3674                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3675                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3676                                 } else if (action == SCTP_STREAM_RESET_RESULT_IN_PROGRESS) {
3677                                         /*
3678                                          * Set it up so we don't stop
3679                                          * retransmitting
3680                                          */
3681                                         asoc->stream_reset_outstanding++;
3682                                         stcb->asoc.str_reset_seq_out--;
3683                                         asoc->stream_reset_out_is_outstanding = 1;
3684                                         no_clear = 1;
3685                                 } else {
3686                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_OUT, stcb, number_entries, req_out_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3687                                 }
3688                                 if (no_clear == 0) {
3689                                         sctp_reset_clear_pending(stcb, number_entries, req_out_param->list_of_streams);
3690                                 }
3691                         } else if (type == SCTP_STR_RESET_IN_REQUEST) {
3692                                 req_in_param = (struct sctp_stream_reset_in_request *)req_param;
3693                                 number_entries = (lparm_len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t);
3694                                 if (asoc->stream_reset_outstanding)
3695                                         asoc->stream_reset_outstanding--;
3696                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3697                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_DENIED_IN, stcb,
3698                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3699                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3700                                         sctp_ulp_notify(SCTP_NOTIFY_STR_RESET_FAILED_IN, stcb,
3701                                             number_entries, req_in_param->list_of_streams, SCTP_SO_NOT_LOCKED);
3702                                 }
3703                         } else if (type == SCTP_STR_RESET_ADD_OUT_STREAMS) {
3704                                 /* Ok we now may have more streams */
3705                                 int num_stream;
3706
3707                                 num_stream = stcb->asoc.strm_pending_add_size;
3708                                 if (num_stream > (stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt)) {
3709                                         /* TSNH */
3710                                         num_stream = stcb->asoc.strm_realoutsize - stcb->asoc.streamoutcnt;
3711                                 }
3712                                 stcb->asoc.strm_pending_add_size = 0;
3713                                 if (asoc->stream_reset_outstanding)
3714                                         asoc->stream_reset_outstanding--;
3715                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3716                                         /* Put the new streams into effect */
3717                                         int i;
3718
3719                                         for (i = asoc->streamoutcnt; i < (asoc->streamoutcnt + num_stream); i++) {
3720                                                 asoc->strmout[i].state = SCTP_STREAM_OPEN;
3721                                         }
3722                                         asoc->streamoutcnt += num_stream;
3723                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
3724                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3725                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3726                                             SCTP_STREAM_CHANGE_DENIED);
3727                                 } else {
3728                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3729                                             SCTP_STREAM_CHANGE_FAILED);
3730                                 }
3731                         } else if (type == SCTP_STR_RESET_ADD_IN_STREAMS) {
3732                                 if (asoc->stream_reset_outstanding)
3733                                         asoc->stream_reset_outstanding--;
3734                                 if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3735                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3736                                             SCTP_STREAM_CHANGE_DENIED);
3737                                 } else if (action != SCTP_STREAM_RESET_RESULT_PERFORMED) {
3738                                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt,
3739                                             SCTP_STREAM_CHANGE_FAILED);
3740                                 }
3741                         } else if (type == SCTP_STR_RESET_TSN_REQUEST) {
3742                                 /**
3743                                  * a) Adopt the new in tsn.
3744                                  * b) reset the map
3745                                  * c) Adopt the new out-tsn
3746                                  */
3747                                 struct sctp_stream_reset_response_tsn *resp;
3748                                 struct sctp_forward_tsn_chunk fwdtsn;
3749                                 int abort_flag = 0;
3750
3751                                 if (respin == NULL) {
3752                                         /* huh ? */
3753                                         return (0);
3754                                 }
3755                                 if (ntohs(respin->ph.param_length) < sizeof(struct sctp_stream_reset_response_tsn)) {
3756                                         return (0);
3757                                 }
3758                                 if (action == SCTP_STREAM_RESET_RESULT_PERFORMED) {
3759                                         resp = (struct sctp_stream_reset_response_tsn *)respin;
3760                                         asoc->stream_reset_outstanding--;
3761                                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3762                                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3763                                         fwdtsn.new_cumulative_tsn = htonl(ntohl(resp->senders_next_tsn) - 1);
3764                                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3765                                         if (abort_flag) {
3766                                                 return (1);
3767                                         }
3768                                         stcb->asoc.highest_tsn_inside_map = (ntohl(resp->senders_next_tsn) - 1);
3769                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3770                                                 sctp_log_map(0, 7, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3771                                         }
3772                                         stcb->asoc.tsn_last_delivered = stcb->asoc.cumulative_tsn = stcb->asoc.highest_tsn_inside_map;
3773                                         stcb->asoc.mapping_array_base_tsn = ntohl(resp->senders_next_tsn);
3774                                         memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
3775
3776                                         stcb->asoc.highest_tsn_inside_nr_map = stcb->asoc.highest_tsn_inside_map;
3777                                         memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
3778
3779                                         stcb->asoc.sending_seq = ntohl(resp->receivers_next_tsn);
3780                                         stcb->asoc.last_acked_seq = stcb->asoc.cumulative_tsn;
3781
3782                                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3783                                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3784                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1), 0);
3785                                 } else if (action == SCTP_STREAM_RESET_RESULT_DENIED) {
3786                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3787                                             SCTP_ASSOC_RESET_DENIED);
3788                                 } else {
3789                                         sctp_notify_stream_reset_tsn(stcb, stcb->asoc.sending_seq, (stcb->asoc.mapping_array_base_tsn + 1),
3790                                             SCTP_ASSOC_RESET_FAILED);
3791                                 }
3792                         }
3793                         /* get rid of the request and get the request flags */
3794                         if (asoc->stream_reset_outstanding == 0) {
3795                                 sctp_clean_up_stream_reset(stcb);
3796                         }
3797                 }
3798         }
3799         if (asoc->stream_reset_outstanding == 0) {
3800                 sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3801         }
3802         return (0);
3803 }
3804
3805 static void
3806 sctp_handle_str_reset_request_in(struct sctp_tcb *stcb,
3807     struct sctp_tmit_chunk *chk,
3808     struct sctp_stream_reset_in_request *req, int trunc)
3809 {
3810         uint32_t seq;
3811         int len, i;
3812         int number_entries;
3813         uint16_t temp;
3814
3815         /*
3816          * peer wants me to send a str-reset to him for my outgoing seq's if
3817          * seq_in is right.
3818          */
3819         struct sctp_association *asoc = &stcb->asoc;
3820
3821         seq = ntohl(req->request_seq);
3822         if (asoc->str_reset_seq_in == seq) {
3823                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3824                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3825                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3826                 } else if (trunc) {
3827                         /* Can't do it, since they exceeded our buffer size  */
3828                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3829                 } else if (stcb->asoc.stream_reset_out_is_outstanding == 0) {
3830                         len = ntohs(req->ph.param_length);
3831                         number_entries = ((len - sizeof(struct sctp_stream_reset_in_request)) / sizeof(uint16_t));
3832                         if (number_entries) {
3833                                 for (i = 0; i < number_entries; i++) {
3834                                         temp = ntohs(req->list_of_streams[i]);
3835                                         if (temp >= stcb->asoc.streamoutcnt) {
3836                                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3837                                                 goto bad_boy;
3838                                         }
3839                                         req->list_of_streams[i] = temp;
3840                                 }
3841                                 for (i = 0; i < number_entries; i++) {
3842                                         if (stcb->asoc.strmout[req->list_of_streams[i]].state == SCTP_STREAM_OPEN) {
3843                                                 stcb->asoc.strmout[req->list_of_streams[i]].state = SCTP_STREAM_RESET_PENDING;
3844                                         }
3845                                 }
3846                         } else {
3847                                 /* Its all */
3848                                 for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3849                                         if (stcb->asoc.strmout[i].state == SCTP_STREAM_OPEN)
3850                                                 stcb->asoc.strmout[i].state = SCTP_STREAM_RESET_PENDING;
3851                                 }
3852                         }
3853                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3854                 } else {
3855                         /* Can't do it, since we have sent one out */
3856                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
3857                 }
3858 bad_boy:
3859                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3860                 asoc->str_reset_seq_in++;
3861         } else if (asoc->str_reset_seq_in - 1 == seq) {
3862                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3863         } else if (asoc->str_reset_seq_in - 2 == seq) {
3864                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
3865         } else {
3866                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3867         }
3868         sctp_send_stream_reset_out_if_possible(stcb, SCTP_SO_NOT_LOCKED);
3869 }
3870
3871 static int
3872 sctp_handle_str_reset_request_tsn(struct sctp_tcb *stcb,
3873     struct sctp_tmit_chunk *chk,
3874     struct sctp_stream_reset_tsn_request *req)
3875 {
3876         /* reset all in and out and update the tsn */
3877         /*
3878          * A) reset my str-seq's on in and out. B) Select a receive next,
3879          * and set cum-ack to it. Also process this selected number as a
3880          * fwd-tsn as well. C) set in the response my next sending seq.
3881          */
3882         struct sctp_forward_tsn_chunk fwdtsn;
3883         struct sctp_association *asoc = &stcb->asoc;
3884         int abort_flag = 0;
3885         uint32_t seq;
3886
3887         seq = ntohl(req->request_seq);
3888         if (asoc->str_reset_seq_in == seq) {
3889                 asoc->last_reset_action[1] = stcb->asoc.last_reset_action[0];
3890                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
3891                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3892                 } else {
3893                         fwdtsn.ch.chunk_length = htons(sizeof(struct sctp_forward_tsn_chunk));
3894                         fwdtsn.ch.chunk_type = SCTP_FORWARD_CUM_TSN;
3895                         fwdtsn.ch.chunk_flags = 0;
3896                         fwdtsn.new_cumulative_tsn = htonl(stcb->asoc.highest_tsn_inside_map + 1);
3897                         sctp_handle_forward_tsn(stcb, &fwdtsn, &abort_flag, NULL, 0);
3898                         if (abort_flag) {
3899                                 return (1);
3900                         }
3901                         asoc->highest_tsn_inside_map += SCTP_STREAM_RESET_TSN_DELTA;
3902                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
3903                                 sctp_log_map(0, 10, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
3904                         }
3905                         asoc->tsn_last_delivered = asoc->cumulative_tsn = asoc->highest_tsn_inside_map;
3906                         asoc->mapping_array_base_tsn = asoc->highest_tsn_inside_map + 1;
3907                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
3908                         asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map;
3909                         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
3910                         atomic_add_int(&asoc->sending_seq, 1);
3911                         /* save off historical data for retrans */
3912                         asoc->last_sending_seq[1] = asoc->last_sending_seq[0];
3913                         asoc->last_sending_seq[0] = asoc->sending_seq;
3914                         asoc->last_base_tsnsent[1] = asoc->last_base_tsnsent[0];
3915                         asoc->last_base_tsnsent[0] = asoc->mapping_array_base_tsn;
3916                         sctp_reset_out_streams(stcb, 0, (uint16_t *) NULL);
3917                         sctp_reset_in_stream(stcb, 0, (uint16_t *) NULL);
3918                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3919                         sctp_notify_stream_reset_tsn(stcb, asoc->sending_seq, (asoc->mapping_array_base_tsn + 1), 0);
3920                 }
3921                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3922                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3923                 asoc->str_reset_seq_in++;
3924         } else if (asoc->str_reset_seq_in - 1 == seq) {
3925                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[0],
3926                     asoc->last_sending_seq[0], asoc->last_base_tsnsent[0]);
3927         } else if (asoc->str_reset_seq_in - 2 == seq) {
3928                 sctp_add_stream_reset_result_tsn(chk, seq, asoc->last_reset_action[1],
3929                     asoc->last_sending_seq[1], asoc->last_base_tsnsent[1]);
3930         } else {
3931                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
3932         }
3933         return (0);
3934 }
3935
3936 static void
3937 sctp_handle_str_reset_request_out(struct sctp_tcb *stcb,
3938     struct sctp_tmit_chunk *chk,
3939     struct sctp_stream_reset_out_request *req, int trunc)
3940 {
3941         uint32_t seq, tsn;
3942         int number_entries, len;
3943         struct sctp_association *asoc = &stcb->asoc;
3944
3945         seq = ntohl(req->request_seq);
3946
3947         /* now if its not a duplicate we process it */
3948         if (asoc->str_reset_seq_in == seq) {
3949                 len = ntohs(req->ph.param_length);
3950                 number_entries = ((len - sizeof(struct sctp_stream_reset_out_request)) / sizeof(uint16_t));
3951                 /*
3952                  * the sender is resetting, handle the list issue.. we must
3953                  * a) verify if we can do the reset, if so no problem b) If
3954                  * we can't do the reset we must copy the request. c) queue
3955                  * it, and setup the data in processor to trigger it off
3956                  * when needed and dequeue all the queued data.
3957                  */
3958                 tsn = ntohl(req->send_reset_at_tsn);
3959
3960                 /* move the reset action back one */
3961                 asoc->last_reset_action[1] = asoc->last_reset_action[0];
3962                 if (!(asoc->local_strreset_support & SCTP_ENABLE_RESET_STREAM_REQ)) {
3963                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3964                 } else if (trunc) {
3965                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3966                 } else if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
3967                         /* we can do it now */
3968                         sctp_reset_in_stream(stcb, number_entries, req->list_of_streams);
3969                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
3970                 } else {
3971                         /*
3972                          * we must queue it up and thus wait for the TSN's
3973                          * to arrive that are at or before tsn
3974                          */
3975                         struct sctp_stream_reset_list *liste;
3976                         int siz;
3977
3978                         siz = sizeof(struct sctp_stream_reset_list) + (number_entries * sizeof(uint16_t));
3979                         SCTP_MALLOC(liste, struct sctp_stream_reset_list *,
3980                             siz, SCTP_M_STRESET);
3981                         if (liste == NULL) {
3982                                 /* gak out of memory */
3983                                 asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
3984                                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3985                                 return;
3986                         }
3987                         liste->seq = seq;
3988                         liste->tsn = tsn;
3989                         liste->number_entries = number_entries;
3990                         memcpy(&liste->list_of_streams, req->list_of_streams, number_entries * sizeof(uint16_t));
3991                         TAILQ_INSERT_TAIL(&asoc->resetHead, liste, next_resp);
3992                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_IN_PROGRESS;
3993                 }
3994                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
3995                 asoc->str_reset_seq_in++;
3996         } else if ((asoc->str_reset_seq_in - 1) == seq) {
3997                 /*
3998                  * one seq back, just echo back last action since my
3999                  * response was lost.
4000                  */
4001                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4002         } else if ((asoc->str_reset_seq_in - 2) == seq) {
4003                 /*
4004                  * two seq back, just echo back last action since my
4005                  * response was lost.
4006                  */
4007                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4008         } else {
4009                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4010         }
4011 }
4012
4013 static void
4014 sctp_handle_str_reset_add_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4015     struct sctp_stream_reset_add_strm *str_add)
4016 {
4017         /*
4018          * Peer is requesting to add more streams. If its within our
4019          * max-streams we will allow it.
4020          */
4021         uint32_t num_stream, i;
4022         uint32_t seq;
4023         struct sctp_association *asoc = &stcb->asoc;
4024         struct sctp_queued_to_read *ctl, *nctl;
4025
4026         /* Get the number. */
4027         seq = ntohl(str_add->request_seq);
4028         num_stream = ntohs(str_add->number_of_streams);
4029         /* Now what would be the new total? */
4030         if (asoc->str_reset_seq_in == seq) {
4031                 num_stream += stcb->asoc.streamincnt;
4032                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4033                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4034                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4035                 } else if ((num_stream > stcb->asoc.max_inbound_streams) ||
4036                     (num_stream > 0xffff)) {
4037                         /* We must reject it they ask for to many */
4038         denied:
4039                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4040                 } else {
4041                         /* Ok, we can do that :-) */
4042                         struct sctp_stream_in *oldstrm;
4043
4044                         /* save off the old */
4045                         oldstrm = stcb->asoc.strmin;
4046                         SCTP_MALLOC(stcb->asoc.strmin, struct sctp_stream_in *,
4047                             (num_stream * sizeof(struct sctp_stream_in)),
4048                             SCTP_M_STRMI);
4049                         if (stcb->asoc.strmin == NULL) {
4050                                 stcb->asoc.strmin = oldstrm;
4051                                 goto denied;
4052                         }
4053                         /* copy off the old data */
4054                         for (i = 0; i < stcb->asoc.streamincnt; i++) {
4055                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4056                                 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4057                                 stcb->asoc.strmin[i].stream_no = i;
4058                                 stcb->asoc.strmin[i].last_sequence_delivered = oldstrm[i].last_sequence_delivered;
4059                                 stcb->asoc.strmin[i].delivery_started = oldstrm[i].delivery_started;
4060                                 stcb->asoc.strmin[i].pd_api_started = oldstrm[i].pd_api_started;
4061                                 /* now anything on those queues? */
4062                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].inqueue, next_instrm, nctl) {
4063                                         TAILQ_REMOVE(&oldstrm[i].inqueue, ctl, next_instrm);
4064                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].inqueue, ctl, next_instrm);
4065                                 }
4066                                 TAILQ_FOREACH_SAFE(ctl, &oldstrm[i].uno_inqueue, next_instrm, nctl) {
4067                                         TAILQ_REMOVE(&oldstrm[i].uno_inqueue, ctl, next_instrm);
4068                                         TAILQ_INSERT_TAIL(&stcb->asoc.strmin[i].uno_inqueue, ctl, next_instrm);
4069                                 }
4070                         }
4071                         /* Init the new streams */
4072                         for (i = stcb->asoc.streamincnt; i < num_stream; i++) {
4073                                 TAILQ_INIT(&stcb->asoc.strmin[i].inqueue);
4074                                 TAILQ_INIT(&stcb->asoc.strmin[i].uno_inqueue);
4075                                 stcb->asoc.strmin[i].stream_no = i;
4076                                 stcb->asoc.strmin[i].last_sequence_delivered = 0xffffffff;
4077                                 stcb->asoc.strmin[i].pd_api_started = 0;
4078                                 stcb->asoc.strmin[i].delivery_started = 0;
4079                         }
4080                         SCTP_FREE(oldstrm, SCTP_M_STRMI);
4081                         /* update the size */
4082                         stcb->asoc.streamincnt = num_stream;
4083                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4084                         sctp_notify_stream_reset_add(stcb, stcb->asoc.streamincnt, stcb->asoc.streamoutcnt, 0);
4085                 }
4086                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4087                 asoc->str_reset_seq_in++;
4088         } else if ((asoc->str_reset_seq_in - 1) == seq) {
4089                 /*
4090                  * one seq back, just echo back last action since my
4091                  * response was lost.
4092                  */
4093                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4094         } else if ((asoc->str_reset_seq_in - 2) == seq) {
4095                 /*
4096                  * two seq back, just echo back last action since my
4097                  * response was lost.
4098                  */
4099                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4100         } else {
4101                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4102
4103         }
4104 }
4105
4106 static void
4107 sctp_handle_str_reset_add_out_strm(struct sctp_tcb *stcb, struct sctp_tmit_chunk *chk,
4108     struct sctp_stream_reset_add_strm *str_add)
4109 {
4110         /*
4111          * Peer is requesting to add more streams. If its within our
4112          * max-streams we will allow it.
4113          */
4114         uint16_t num_stream;
4115         uint32_t seq;
4116         struct sctp_association *asoc = &stcb->asoc;
4117
4118         /* Get the number. */
4119         seq = ntohl(str_add->request_seq);
4120         num_stream = ntohs(str_add->number_of_streams);
4121         /* Now what would be the new total? */
4122         if (asoc->str_reset_seq_in == seq) {
4123                 stcb->asoc.last_reset_action[1] = stcb->asoc.last_reset_action[0];
4124                 if (!(asoc->local_strreset_support & SCTP_ENABLE_CHANGE_ASSOC_REQ)) {
4125                         asoc->last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4126                 } else if (stcb->asoc.stream_reset_outstanding) {
4127                         /* We must reject it we have something pending */
4128                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_ERR_IN_PROGRESS;
4129                 } else {
4130                         /* Ok, we can do that :-) */
4131                         int mychk;
4132
4133                         mychk = stcb->asoc.streamoutcnt;
4134                         mychk += num_stream;
4135                         if (mychk < 0x10000) {
4136                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_PERFORMED;
4137                                 if (sctp_send_str_reset_req(stcb, 0, NULL, 0, 0, 1, num_stream, 0, 1)) {
4138                                         stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4139                                 }
4140                         } else {
4141                                 stcb->asoc.last_reset_action[0] = SCTP_STREAM_RESET_RESULT_DENIED;
4142                         }
4143                 }
4144                 sctp_add_stream_reset_result(chk, seq, stcb->asoc.last_reset_action[0]);
4145                 asoc->str_reset_seq_in++;
4146         } else if ((asoc->str_reset_seq_in - 1) == seq) {
4147                 /*
4148                  * one seq back, just echo back last action since my
4149                  * response was lost.
4150                  */
4151                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[0]);
4152         } else if ((asoc->str_reset_seq_in - 2) == seq) {
4153                 /*
4154                  * two seq back, just echo back last action since my
4155                  * response was lost.
4156                  */
4157                 sctp_add_stream_reset_result(chk, seq, asoc->last_reset_action[1]);
4158         } else {
4159                 sctp_add_stream_reset_result(chk, seq, SCTP_STREAM_RESET_RESULT_ERR_BAD_SEQNO);
4160         }
4161 }
4162
4163 #ifdef __GNUC__
4164 __attribute__((noinline))
4165 #endif
4166         static int
4167             sctp_handle_stream_reset(struct sctp_tcb *stcb, struct mbuf *m, int offset,
4168         struct sctp_chunkhdr *ch_req)
4169 {
4170         uint16_t remaining_length, param_len, ptype;
4171         struct sctp_paramhdr pstore;
4172         uint8_t cstore[SCTP_CHUNK_BUFFER_SIZE];
4173         uint32_t seq = 0;
4174         int num_req = 0;
4175         int trunc = 0;
4176         struct sctp_tmit_chunk *chk;
4177         struct sctp_chunkhdr *ch;
4178         struct sctp_paramhdr *ph;
4179         int ret_code = 0;
4180         int num_param = 0;
4181
4182         /* now it may be a reset or a reset-response */
4183         remaining_length = ntohs(ch_req->chunk_length) - sizeof(struct sctp_chunkhdr);
4184
4185         /* setup for adding the response */
4186         sctp_alloc_a_chunk(stcb, chk);
4187         if (chk == NULL) {
4188                 return (ret_code);
4189         }
4190         chk->copy_by_ref = 0;
4191         chk->rec.chunk_id.id = SCTP_STREAM_RESET;
4192         chk->rec.chunk_id.can_take_data = 0;
4193         chk->flags = 0;
4194         chk->asoc = &stcb->asoc;
4195         chk->no_fr_allowed = 0;
4196         chk->book_size = chk->send_size = sizeof(struct sctp_chunkhdr);
4197         chk->book_size_scale = 0;
4198         chk->data = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
4199         if (chk->data == NULL) {
4200 strres_nochunk:
4201                 if (chk->data) {
4202                         sctp_m_freem(chk->data);
4203                         chk->data = NULL;
4204                 }
4205                 sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
4206                 return (ret_code);
4207         }
4208         SCTP_BUF_RESV_UF(chk->data, SCTP_MIN_OVERHEAD);
4209
4210         /* setup chunk parameters */
4211         chk->sent = SCTP_DATAGRAM_UNSENT;
4212         chk->snd_count = 0;
4213         chk->whoTo = NULL;
4214
4215         ch = mtod(chk->data, struct sctp_chunkhdr *);
4216         ch->chunk_type = SCTP_STREAM_RESET;
4217         ch->chunk_flags = 0;
4218         ch->chunk_length = htons(chk->send_size);
4219         SCTP_BUF_LEN(chk->data) = SCTP_SIZE32(chk->send_size);
4220         offset += sizeof(struct sctp_chunkhdr);
4221         while (remaining_length >= sizeof(struct sctp_paramhdr)) {
4222                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, sizeof(pstore), (uint8_t *) & pstore);
4223                 if (ph == NULL) {
4224                         /* TSNH */
4225                         break;
4226                 }
4227                 param_len = ntohs(ph->param_length);
4228                 if ((param_len > remaining_length) ||
4229                     (param_len < (sizeof(struct sctp_paramhdr) + sizeof(uint32_t)))) {
4230                         /* bad parameter length */
4231                         break;
4232                 }
4233                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset, min(param_len, sizeof(cstore)),
4234                     (uint8_t *) & cstore);
4235                 if (ph == NULL) {
4236                         /* TSNH */
4237                         break;
4238                 }
4239                 ptype = ntohs(ph->param_type);
4240                 num_param++;
4241                 if (param_len > sizeof(cstore)) {
4242                         trunc = 1;
4243                 } else {
4244                         trunc = 0;
4245                 }
4246                 if (num_param > SCTP_MAX_RESET_PARAMS) {
4247                         /* hit the max of parameters already sorry.. */
4248                         break;
4249                 }
4250                 if (ptype == SCTP_STR_RESET_OUT_REQUEST) {
4251                         struct sctp_stream_reset_out_request *req_out;
4252
4253                         if (param_len < sizeof(struct sctp_stream_reset_out_request)) {
4254                                 break;
4255                         }
4256                         req_out = (struct sctp_stream_reset_out_request *)ph;
4257                         num_req++;
4258                         if (stcb->asoc.stream_reset_outstanding) {
4259                                 seq = ntohl(req_out->response_seq);
4260                                 if (seq == stcb->asoc.str_reset_seq_out) {
4261                                         /* implicit ack */
4262                                         (void)sctp_handle_stream_reset_response(stcb, seq, SCTP_STREAM_RESET_RESULT_PERFORMED, NULL);
4263                                 }
4264                         }
4265                         sctp_handle_str_reset_request_out(stcb, chk, req_out, trunc);
4266                 } else if (ptype == SCTP_STR_RESET_ADD_OUT_STREAMS) {
4267                         struct sctp_stream_reset_add_strm *str_add;
4268
4269                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4270                                 break;
4271                         }
4272                         str_add = (struct sctp_stream_reset_add_strm *)ph;
4273                         num_req++;
4274                         sctp_handle_str_reset_add_strm(stcb, chk, str_add);
4275                 } else if (ptype == SCTP_STR_RESET_ADD_IN_STREAMS) {
4276                         struct sctp_stream_reset_add_strm *str_add;
4277
4278                         if (param_len < sizeof(struct sctp_stream_reset_add_strm)) {
4279                                 break;
4280                         }
4281                         str_add = (struct sctp_stream_reset_add_strm *)ph;
4282                         num_req++;
4283                         sctp_handle_str_reset_add_out_strm(stcb, chk, str_add);
4284                 } else if (ptype == SCTP_STR_RESET_IN_REQUEST) {
4285                         struct sctp_stream_reset_in_request *req_in;
4286
4287                         num_req++;
4288                         req_in = (struct sctp_stream_reset_in_request *)ph;
4289                         sctp_handle_str_reset_request_in(stcb, chk, req_in, trunc);
4290                 } else if (ptype == SCTP_STR_RESET_TSN_REQUEST) {
4291                         struct sctp_stream_reset_tsn_request *req_tsn;
4292
4293                         num_req++;
4294                         req_tsn = (struct sctp_stream_reset_tsn_request *)ph;
4295                         if (sctp_handle_str_reset_request_tsn(stcb, chk, req_tsn)) {
4296                                 ret_code = 1;
4297                                 goto strres_nochunk;
4298                         }
4299                         /* no more */
4300                         break;
4301                 } else if (ptype == SCTP_STR_RESET_RESPONSE) {
4302                         struct sctp_stream_reset_response *resp;
4303                         uint32_t result;
4304
4305                         if (param_len < sizeof(struct sctp_stream_reset_response)) {
4306                                 break;
4307                         }
4308                         resp = (struct sctp_stream_reset_response *)ph;
4309                         seq = ntohl(resp->response_seq);
4310                         result = ntohl(resp->result);
4311                         if (sctp_handle_stream_reset_response(stcb, seq, result, resp)) {
4312                                 ret_code = 1;
4313                                 goto strres_nochunk;
4314                         }
4315                 } else {
4316                         break;
4317                 }
4318                 offset += SCTP_SIZE32(param_len);
4319                 if (remaining_length >= SCTP_SIZE32(param_len)) {
4320                         remaining_length -= SCTP_SIZE32(param_len);
4321                 } else {
4322                         remaining_length = 0;
4323                 }
4324         }
4325         if (num_req == 0) {
4326                 /* we have no response free the stuff */
4327                 goto strres_nochunk;
4328         }
4329         /* ok we have a chunk to link in */
4330         TAILQ_INSERT_TAIL(&stcb->asoc.control_send_queue,
4331             chk,
4332             sctp_next);
4333         stcb->asoc.ctrl_queue_cnt++;
4334         return (ret_code);
4335 }
4336
4337 /*
4338  * Handle a router or endpoints report of a packet loss, there are two ways
4339  * to handle this, either we get the whole packet and must disect it
4340  * ourselves (possibly with truncation and or corruption) or it is a summary
4341  * from a middle box that did the disectting for us.
4342  */
4343 static void
4344 sctp_handle_packet_dropped(struct sctp_pktdrop_chunk *cp,
4345     struct sctp_tcb *stcb, struct sctp_nets *net, uint32_t limit)
4346 {
4347         uint32_t bottle_bw, on_queue;
4348         uint16_t trunc_len;
4349         unsigned int chlen;
4350         unsigned int at;
4351         struct sctp_chunk_desc desc;
4352         struct sctp_chunkhdr *ch;
4353
4354         chlen = ntohs(cp->ch.chunk_length);
4355         chlen -= sizeof(struct sctp_pktdrop_chunk);
4356         /* XXX possible chlen underflow */
4357         if (chlen == 0) {
4358                 ch = NULL;
4359                 if (cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX)
4360                         SCTP_STAT_INCR(sctps_pdrpbwrpt);
4361         } else {
4362                 ch = (struct sctp_chunkhdr *)(cp->data + sizeof(struct sctphdr));
4363                 chlen -= sizeof(struct sctphdr);
4364                 /* XXX possible chlen underflow */
4365                 memset(&desc, 0, sizeof(desc));
4366         }
4367         trunc_len = (uint16_t) ntohs(cp->trunc_len);
4368         if (trunc_len > limit) {
4369                 trunc_len = limit;
4370         }
4371         /* now the chunks themselves */
4372         while ((ch != NULL) && (chlen >= sizeof(struct sctp_chunkhdr))) {
4373                 desc.chunk_type = ch->chunk_type;
4374                 /* get amount we need to move */
4375                 at = ntohs(ch->chunk_length);
4376                 if (at < sizeof(struct sctp_chunkhdr)) {
4377                         /* corrupt chunk, maybe at the end? */
4378                         SCTP_STAT_INCR(sctps_pdrpcrupt);
4379                         break;
4380                 }
4381                 if (trunc_len == 0) {
4382                         /* we are supposed to have all of it */
4383                         if (at > chlen) {
4384                                 /* corrupt skip it */
4385                                 SCTP_STAT_INCR(sctps_pdrpcrupt);
4386                                 break;
4387                         }
4388                 } else {
4389                         /* is there enough of it left ? */
4390                         if (desc.chunk_type == SCTP_DATA) {
4391                                 if (chlen < (sizeof(struct sctp_data_chunk) +
4392                                     sizeof(desc.data_bytes))) {
4393                                         break;
4394                                 }
4395                         } else {
4396                                 if (chlen < sizeof(struct sctp_chunkhdr)) {
4397                                         break;
4398                                 }
4399                         }
4400                 }
4401                 if (desc.chunk_type == SCTP_DATA) {
4402                         /* can we get out the tsn? */
4403                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4404                                 SCTP_STAT_INCR(sctps_pdrpmbda);
4405
4406                         if (chlen >= (sizeof(struct sctp_data_chunk) + sizeof(uint32_t))) {
4407                                 /* yep */
4408                                 struct sctp_data_chunk *dcp;
4409                                 uint8_t *ddp;
4410                                 unsigned int iii;
4411
4412                                 dcp = (struct sctp_data_chunk *)ch;
4413                                 ddp = (uint8_t *) (dcp + 1);
4414                                 for (iii = 0; iii < sizeof(desc.data_bytes); iii++) {
4415                                         desc.data_bytes[iii] = ddp[iii];
4416                                 }
4417                                 desc.tsn_ifany = dcp->dp.tsn;
4418                         } else {
4419                                 /* nope we are done. */
4420                                 SCTP_STAT_INCR(sctps_pdrpnedat);
4421                                 break;
4422                         }
4423                 } else {
4424                         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX))
4425                                 SCTP_STAT_INCR(sctps_pdrpmbct);
4426                 }
4427
4428                 if (process_chunk_drop(stcb, &desc, net, cp->ch.chunk_flags)) {
4429                         SCTP_STAT_INCR(sctps_pdrppdbrk);
4430                         break;
4431                 }
4432                 if (SCTP_SIZE32(at) > chlen) {
4433                         break;
4434                 }
4435                 chlen -= SCTP_SIZE32(at);
4436                 if (chlen < sizeof(struct sctp_chunkhdr)) {
4437                         /* done, none left */
4438                         break;
4439                 }
4440                 ch = (struct sctp_chunkhdr *)((caddr_t)ch + SCTP_SIZE32(at));
4441         }
4442         /* Now update any rwnd --- possibly */
4443         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) == 0) {
4444                 /* From a peer, we get a rwnd report */
4445                 uint32_t a_rwnd;
4446
4447                 SCTP_STAT_INCR(sctps_pdrpfehos);
4448
4449                 bottle_bw = ntohl(cp->bottle_bw);
4450                 on_queue = ntohl(cp->current_onq);
4451                 if (bottle_bw && on_queue) {
4452                         /* a rwnd report is in here */
4453                         if (bottle_bw > on_queue)
4454                                 a_rwnd = bottle_bw - on_queue;
4455                         else
4456                                 a_rwnd = 0;
4457
4458                         if (a_rwnd == 0)
4459                                 stcb->asoc.peers_rwnd = 0;
4460                         else {
4461                                 if (a_rwnd > stcb->asoc.total_flight) {
4462                                         stcb->asoc.peers_rwnd =
4463                                             a_rwnd - stcb->asoc.total_flight;
4464                                 } else {
4465                                         stcb->asoc.peers_rwnd = 0;
4466                                 }
4467                                 if (stcb->asoc.peers_rwnd <
4468                                     stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4469                                         /* SWS sender side engages */
4470                                         stcb->asoc.peers_rwnd = 0;
4471                                 }
4472                         }
4473                 }
4474         } else {
4475                 SCTP_STAT_INCR(sctps_pdrpfmbox);
4476         }
4477
4478         /* now middle boxes in sat networks get a cwnd bump */
4479         if ((cp->ch.chunk_flags & SCTP_FROM_MIDDLE_BOX) &&
4480             (stcb->asoc.sat_t3_loss_recovery == 0) &&
4481             (stcb->asoc.sat_network)) {
4482                 /*
4483                  * This is debatable but for sat networks it makes sense
4484                  * Note if a T3 timer has went off, we will prohibit any
4485                  * changes to cwnd until we exit the t3 loss recovery.
4486                  */
4487                 stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped(stcb,
4488                     net, cp, &bottle_bw, &on_queue);
4489         }
4490 }
4491
4492 /*
4493  * handles all control chunks in a packet inputs: - m: mbuf chain, assumed to
4494  * still contain IP/SCTP header - stcb: is the tcb found for this packet -
4495  * offset: offset into the mbuf chain to first chunkhdr - length: is the
4496  * length of the complete packet outputs: - length: modified to remaining
4497  * length after control processing - netp: modified to new sctp_nets after
4498  * cookie-echo processing - return NULL to discard the packet (ie. no asoc,
4499  * bad packet,...) otherwise return the tcb for this packet
4500  */
4501 #ifdef __GNUC__
4502 __attribute__((noinline))
4503 #endif
4504         static struct sctp_tcb *
4505                  sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
4506              struct sockaddr *src, struct sockaddr *dst,
4507              struct sctphdr *sh, struct sctp_chunkhdr *ch, struct sctp_inpcb *inp,
4508              struct sctp_tcb *stcb, struct sctp_nets **netp, int *fwd_tsn_seen,
4509              uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4510              uint32_t vrf_id, uint16_t port)
4511 {
4512         struct sctp_association *asoc;
4513         struct mbuf *op_err;
4514         char msg[SCTP_DIAG_INFO_LEN];
4515         uint32_t vtag_in;
4516         int num_chunks = 0;     /* number of control chunks processed */
4517         uint32_t chk_length;
4518         int ret;
4519         int abort_no_unlock = 0;
4520         int ecne_seen = 0;
4521
4522         /*
4523          * How big should this be, and should it be alloc'd? Lets try the
4524          * d-mtu-ceiling for now (2k) and that should hopefully work ...
4525          * until we get into jumbo grams and such..
4526          */
4527         uint8_t chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
4528         struct sctp_tcb *locked_tcb = stcb;
4529         int got_auth = 0;
4530         uint32_t auth_offset = 0, auth_len = 0;
4531         int auth_skipped = 0;
4532         int asconf_cnt = 0;
4533
4534 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4535         struct socket *so;
4536
4537 #endif
4538
4539         SCTPDBG(SCTP_DEBUG_INPUT1, "sctp_process_control: iphlen=%u, offset=%u, length=%u stcb:%p\n",
4540             iphlen, *offset, length, (void *)stcb);
4541
4542         /* validate chunk header length... */
4543         if (ntohs(ch->chunk_length) < sizeof(*ch)) {
4544                 SCTPDBG(SCTP_DEBUG_INPUT1, "Invalid header length %d\n",
4545                     ntohs(ch->chunk_length));
4546                 if (locked_tcb) {
4547                         SCTP_TCB_UNLOCK(locked_tcb);
4548                 }
4549                 return (NULL);
4550         }
4551         /*
4552          * validate the verification tag
4553          */
4554         vtag_in = ntohl(sh->v_tag);
4555
4556         if (locked_tcb) {
4557                 SCTP_TCB_LOCK_ASSERT(locked_tcb);
4558         }
4559         if (ch->chunk_type == SCTP_INITIATION) {
4560                 SCTPDBG(SCTP_DEBUG_INPUT1, "Its an INIT of len:%d vtag:%x\n",
4561                     ntohs(ch->chunk_length), vtag_in);
4562                 if (vtag_in != 0) {
4563                         /* protocol error- silently discard... */
4564                         SCTP_STAT_INCR(sctps_badvtag);
4565                         if (locked_tcb) {
4566                                 SCTP_TCB_UNLOCK(locked_tcb);
4567                         }
4568                         return (NULL);
4569                 }
4570         } else if (ch->chunk_type != SCTP_COOKIE_ECHO) {
4571                 /*
4572                  * If there is no stcb, skip the AUTH chunk and process
4573                  * later after a stcb is found (to validate the lookup was
4574                  * valid.
4575                  */
4576                 if ((ch->chunk_type == SCTP_AUTHENTICATION) &&
4577                     (stcb == NULL) &&
4578                     (inp->auth_supported == 1)) {
4579                         /* save this chunk for later processing */
4580                         auth_skipped = 1;
4581                         auth_offset = *offset;
4582                         auth_len = ntohs(ch->chunk_length);
4583
4584                         /* (temporarily) move past this chunk */
4585                         *offset += SCTP_SIZE32(auth_len);
4586                         if (*offset >= length) {
4587                                 /* no more data left in the mbuf chain */
4588                                 *offset = length;
4589                                 if (locked_tcb) {
4590                                         SCTP_TCB_UNLOCK(locked_tcb);
4591                                 }
4592                                 return (NULL);
4593                         }
4594                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4595                             sizeof(struct sctp_chunkhdr), chunk_buf);
4596                 }
4597                 if (ch == NULL) {
4598                         /* Help */
4599                         *offset = length;
4600                         if (locked_tcb) {
4601                                 SCTP_TCB_UNLOCK(locked_tcb);
4602                         }
4603                         return (NULL);
4604                 }
4605                 if (ch->chunk_type == SCTP_COOKIE_ECHO) {
4606                         goto process_control_chunks;
4607                 }
4608                 /*
4609                  * first check if it's an ASCONF with an unknown src addr we
4610                  * need to look inside to find the association
4611                  */
4612                 if (ch->chunk_type == SCTP_ASCONF && stcb == NULL) {
4613                         struct sctp_chunkhdr *asconf_ch = ch;
4614                         uint32_t asconf_offset = 0, asconf_len = 0;
4615
4616                         /* inp's refcount may be reduced */
4617                         SCTP_INP_INCR_REF(inp);
4618
4619                         asconf_offset = *offset;
4620                         do {
4621                                 asconf_len = ntohs(asconf_ch->chunk_length);
4622                                 if (asconf_len < sizeof(struct sctp_asconf_paramhdr))
4623                                         break;
4624                                 stcb = sctp_findassociation_ep_asconf(m,
4625                                     *offset,
4626                                     dst,
4627                                     sh, &inp, netp, vrf_id);
4628                                 if (stcb != NULL)
4629                                         break;
4630                                 asconf_offset += SCTP_SIZE32(asconf_len);
4631                                 asconf_ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, asconf_offset,
4632                                     sizeof(struct sctp_chunkhdr), chunk_buf);
4633                         } while (asconf_ch != NULL && asconf_ch->chunk_type == SCTP_ASCONF);
4634                         if (stcb == NULL) {
4635                                 /*
4636                                  * reduce inp's refcount if not reduced in
4637                                  * sctp_findassociation_ep_asconf().
4638                                  */
4639                                 SCTP_INP_DECR_REF(inp);
4640                         } else {
4641                                 locked_tcb = stcb;
4642                         }
4643
4644                         /* now go back and verify any auth chunk to be sure */
4645                         if (auth_skipped && (stcb != NULL)) {
4646                                 struct sctp_auth_chunk *auth;
4647
4648                                 auth = (struct sctp_auth_chunk *)
4649                                     sctp_m_getptr(m, auth_offset,
4650                                     auth_len, chunk_buf);
4651                                 got_auth = 1;
4652                                 auth_skipped = 0;
4653                                 if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
4654                                     auth_offset)) {
4655                                         /* auth HMAC failed so dump it */
4656                                         *offset = length;
4657                                         if (locked_tcb) {
4658                                                 SCTP_TCB_UNLOCK(locked_tcb);
4659                                         }
4660                                         return (NULL);
4661                                 } else {
4662                                         /* remaining chunks are HMAC checked */
4663                                         stcb->asoc.authenticated = 1;
4664                                 }
4665                         }
4666                 }
4667                 if (stcb == NULL) {
4668                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4669                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4670                             msg);
4671                         /* no association, so it's out of the blue... */
4672                         sctp_handle_ootb(m, iphlen, *offset, src, dst, sh, inp, op_err,
4673                             mflowtype, mflowid, inp->fibnum,
4674                             vrf_id, port);
4675                         *offset = length;
4676                         if (locked_tcb) {
4677                                 SCTP_TCB_UNLOCK(locked_tcb);
4678                         }
4679                         return (NULL);
4680                 }
4681                 asoc = &stcb->asoc;
4682                 /* ABORT and SHUTDOWN can use either v_tag... */
4683                 if ((ch->chunk_type == SCTP_ABORT_ASSOCIATION) ||
4684                     (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) ||
4685                     (ch->chunk_type == SCTP_PACKET_DROPPED)) {
4686                         /* Take the T-bit always into account. */
4687                         if ((((ch->chunk_flags & SCTP_HAD_NO_TCB) == 0) &&
4688                             (vtag_in == asoc->my_vtag)) ||
4689                             (((ch->chunk_flags & SCTP_HAD_NO_TCB) == SCTP_HAD_NO_TCB) &&
4690                             (vtag_in == asoc->peer_vtag))) {
4691                                 /* this is valid */
4692                         } else {
4693                                 /* drop this packet... */
4694                                 SCTP_STAT_INCR(sctps_badvtag);
4695                                 if (locked_tcb) {
4696                                         SCTP_TCB_UNLOCK(locked_tcb);
4697                                 }
4698                                 return (NULL);
4699                         }
4700                 } else if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
4701                         if (vtag_in != asoc->my_vtag) {
4702                                 /*
4703                                  * this could be a stale SHUTDOWN-ACK or the
4704                                  * peer never got the SHUTDOWN-COMPLETE and
4705                                  * is still hung; we have started a new asoc
4706                                  * but it won't complete until the shutdown
4707                                  * is completed
4708                                  */
4709                                 if (locked_tcb) {
4710                                         SCTP_TCB_UNLOCK(locked_tcb);
4711                                 }
4712                                 snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
4713                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
4714                                     msg);
4715                                 sctp_handle_ootb(m, iphlen, *offset, src, dst,
4716                                     sh, inp, op_err,
4717                                     mflowtype, mflowid, fibnum,
4718                                     vrf_id, port);
4719                                 return (NULL);
4720                         }
4721                 } else {
4722                         /* for all other chunks, vtag must match */
4723                         if (vtag_in != asoc->my_vtag) {
4724                                 /* invalid vtag... */
4725                                 SCTPDBG(SCTP_DEBUG_INPUT3,
4726                                     "invalid vtag: %xh, expect %xh\n",
4727                                     vtag_in, asoc->my_vtag);
4728                                 SCTP_STAT_INCR(sctps_badvtag);
4729                                 if (locked_tcb) {
4730                                         SCTP_TCB_UNLOCK(locked_tcb);
4731                                 }
4732                                 *offset = length;
4733                                 return (NULL);
4734                         }
4735                 }
4736         }                       /* end if !SCTP_COOKIE_ECHO */
4737         /*
4738          * process all control chunks...
4739          */
4740         if (((ch->chunk_type == SCTP_SELECTIVE_ACK) ||
4741             (ch->chunk_type == SCTP_NR_SELECTIVE_ACK) ||
4742             (ch->chunk_type == SCTP_HEARTBEAT_REQUEST)) &&
4743             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
4744                 /* implied cookie-ack.. we must have lost the ack */
4745                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4746                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4747                             stcb->asoc.overall_error_count,
4748                             0,
4749                             SCTP_FROM_SCTP_INPUT,
4750                             __LINE__);
4751                 }
4752                 stcb->asoc.overall_error_count = 0;
4753                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb,
4754                     *netp);
4755         }
4756 process_control_chunks:
4757         while (IS_SCTP_CONTROL(ch)) {
4758                 /* validate chunk length */
4759                 chk_length = ntohs(ch->chunk_length);
4760                 SCTPDBG(SCTP_DEBUG_INPUT2, "sctp_process_control: processing a chunk type=%u, len=%u\n",
4761                     ch->chunk_type, chk_length);
4762                 SCTP_LTRACE_CHK(inp, stcb, ch->chunk_type, chk_length);
4763                 if (chk_length < sizeof(*ch) ||
4764                     (*offset + (int)chk_length) > length) {
4765                         *offset = length;
4766                         if (locked_tcb) {
4767                                 SCTP_TCB_UNLOCK(locked_tcb);
4768                         }
4769                         return (NULL);
4770                 }
4771                 SCTP_STAT_INCR_COUNTER64(sctps_incontrolchunks);
4772                 /*
4773                  * INIT-ACK only gets the init ack "header" portion only
4774                  * because we don't have to process the peer's COOKIE. All
4775                  * others get a complete chunk.
4776                  */
4777                 if ((ch->chunk_type == SCTP_INITIATION_ACK) ||
4778                     (ch->chunk_type == SCTP_INITIATION)) {
4779                         /* get an init-ack chunk */
4780                         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4781                             sizeof(struct sctp_init_ack_chunk), chunk_buf);
4782                         if (ch == NULL) {
4783                                 *offset = length;
4784                                 if (locked_tcb) {
4785                                         SCTP_TCB_UNLOCK(locked_tcb);
4786                                 }
4787                                 return (NULL);
4788                         }
4789                 } else {
4790                         /* For cookies and all other chunks. */
4791                         if (chk_length > sizeof(chunk_buf)) {
4792                                 /*
4793                                  * use just the size of the chunk buffer so
4794                                  * the front part of our chunks fit in
4795                                  * contiguous space up to the chunk buffer
4796                                  * size (508 bytes). For chunks that need to
4797                                  * get more than that they must use the
4798                                  * sctp_m_getptr() function or other means
4799                                  * (e.g. know how to parse mbuf chains).
4800                                  * Cookies do this already.
4801                                  */
4802                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4803                                     (sizeof(chunk_buf) - 4),
4804                                     chunk_buf);
4805                                 if (ch == NULL) {
4806                                         *offset = length;
4807                                         if (locked_tcb) {
4808                                                 SCTP_TCB_UNLOCK(locked_tcb);
4809                                         }
4810                                         return (NULL);
4811                                 }
4812                         } else {
4813                                 /* We can fit it all */
4814                                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
4815                                     chk_length, chunk_buf);
4816                                 if (ch == NULL) {
4817                                         SCTP_PRINTF("sctp_process_control: Can't get the all data....\n");
4818                                         *offset = length;
4819                                         if (locked_tcb) {
4820                                                 SCTP_TCB_UNLOCK(locked_tcb);
4821                                         }
4822                                         return (NULL);
4823                                 }
4824                         }
4825                 }
4826                 num_chunks++;
4827                 /* Save off the last place we got a control from */
4828                 if (stcb != NULL) {
4829                         if (((netp != NULL) && (*netp != NULL)) || (ch->chunk_type == SCTP_ASCONF)) {
4830                                 /*
4831                                  * allow last_control to be NULL if
4832                                  * ASCONF... ASCONF processing will find the
4833                                  * right net later
4834                                  */
4835                                 if ((netp != NULL) && (*netp != NULL))
4836                                         stcb->asoc.last_control_chunk_from = *netp;
4837                         }
4838                 }
4839 #ifdef SCTP_AUDITING_ENABLED
4840                 sctp_audit_log(0xB0, ch->chunk_type);
4841 #endif
4842
4843                 /* check to see if this chunk required auth, but isn't */
4844                 if ((stcb != NULL) &&
4845                     (stcb->asoc.auth_supported == 1) &&
4846                     sctp_auth_is_required_chunk(ch->chunk_type, stcb->asoc.local_auth_chunks) &&
4847                     !stcb->asoc.authenticated) {
4848                         /* "silently" ignore */
4849                         SCTP_STAT_INCR(sctps_recvauthmissing);
4850                         goto next_chunk;
4851                 }
4852                 switch (ch->chunk_type) {
4853                 case SCTP_INITIATION:
4854                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT\n");
4855                         /* The INIT chunk must be the only chunk. */
4856                         if ((num_chunks > 1) ||
4857                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4858                                 /* RFC 4960 requires that no ABORT is sent */
4859                                 *offset = length;
4860                                 if (locked_tcb) {
4861                                         SCTP_TCB_UNLOCK(locked_tcb);
4862                                 }
4863                                 return (NULL);
4864                         }
4865                         /* Honor our resource limit. */
4866                         if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {
4867                                 op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
4868                                 sctp_abort_association(inp, stcb, m, iphlen,
4869                                     src, dst, sh, op_err,
4870                                     mflowtype, mflowid,
4871                                     vrf_id, port);
4872                                 *offset = length;
4873                                 return (NULL);
4874                         }
4875                         sctp_handle_init(m, iphlen, *offset, src, dst, sh,
4876                             (struct sctp_init_chunk *)ch, inp,
4877                             stcb, *netp, &abort_no_unlock,
4878                             mflowtype, mflowid,
4879                             vrf_id, port);
4880                         *offset = length;
4881                         if ((!abort_no_unlock) && (locked_tcb)) {
4882                                 SCTP_TCB_UNLOCK(locked_tcb);
4883                         }
4884                         return (NULL);
4885                         break;
4886                 case SCTP_PAD_CHUNK:
4887                         break;
4888                 case SCTP_INITIATION_ACK:
4889                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_INIT-ACK\n");
4890                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4891                                 /* We are not interested anymore */
4892                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
4893                                         ;
4894                                 } else {
4895                                         if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
4896                                                 /* Very unlikely */
4897                                                 SCTP_TCB_UNLOCK(locked_tcb);
4898                                         }
4899                                         *offset = length;
4900                                         if (stcb) {
4901 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4902                                                 so = SCTP_INP_SO(inp);
4903                                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4904                                                 SCTP_TCB_UNLOCK(stcb);
4905                                                 SCTP_SOCKET_LOCK(so, 1);
4906                                                 SCTP_TCB_LOCK(stcb);
4907                                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4908 #endif
4909                                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4910                                                     SCTP_FROM_SCTP_INPUT + SCTP_LOC_29);
4911 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4912                                                 SCTP_SOCKET_UNLOCK(so, 1);
4913 #endif
4914                                         }
4915                                         return (NULL);
4916                                 }
4917                         }
4918                         /* The INIT-ACK chunk must be the only chunk. */
4919                         if ((num_chunks > 1) ||
4920                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
4921                                 *offset = length;
4922                                 if (locked_tcb) {
4923                                         SCTP_TCB_UNLOCK(locked_tcb);
4924                                 }
4925                                 return (NULL);
4926                         }
4927                         if ((netp) && (*netp)) {
4928                                 ret = sctp_handle_init_ack(m, iphlen, *offset,
4929                                     src, dst, sh,
4930                                     (struct sctp_init_ack_chunk *)ch,
4931                                     stcb, *netp,
4932                                     &abort_no_unlock,
4933                                     mflowtype, mflowid,
4934                                     vrf_id);
4935                         } else {
4936                                 ret = -1;
4937                         }
4938                         *offset = length;
4939                         if (abort_no_unlock) {
4940                                 return (NULL);
4941                         }
4942                         /*
4943                          * Special case, I must call the output routine to
4944                          * get the cookie echoed
4945                          */
4946                         if ((stcb != NULL) && (ret == 0)) {
4947                                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
4948                         }
4949                         if (locked_tcb) {
4950                                 SCTP_TCB_UNLOCK(locked_tcb);
4951                         }
4952                         return (NULL);
4953                         break;
4954                 case SCTP_SELECTIVE_ACK:
4955                         {
4956                                 struct sctp_sack_chunk *sack;
4957                                 int abort_now = 0;
4958                                 uint32_t a_rwnd, cum_ack;
4959                                 uint16_t num_seg, num_dup;
4960                                 uint8_t flags;
4961                                 int offset_seg, offset_dup;
4962
4963                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK\n");
4964                                 SCTP_STAT_INCR(sctps_recvsacks);
4965                                 if (stcb == NULL) {
4966                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing SACK chunk\n");
4967                                         break;
4968                                 }
4969                                 if (chk_length < sizeof(struct sctp_sack_chunk)) {
4970                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on SACK chunk, too small\n");
4971                                         break;
4972                                 }
4973                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
4974                                         /*-
4975                                          * If we have sent a shutdown-ack, we will pay no
4976                                          * attention to a sack sent in to us since
4977                                          * we don't care anymore.
4978                                          */
4979                                         break;
4980                                 }
4981                                 sack = (struct sctp_sack_chunk *)ch;
4982                                 flags = ch->chunk_flags;
4983                                 cum_ack = ntohl(sack->sack.cum_tsn_ack);
4984                                 num_seg = ntohs(sack->sack.num_gap_ack_blks);
4985                                 num_dup = ntohs(sack->sack.num_dup_tsns);
4986                                 a_rwnd = (uint32_t) ntohl(sack->sack.a_rwnd);
4987                                 if (sizeof(struct sctp_sack_chunk) +
4988                                     num_seg * sizeof(struct sctp_gap_ack_block) +
4989                                     num_dup * sizeof(uint32_t) != chk_length) {
4990                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of SACK chunk\n");
4991                                         break;
4992                                 }
4993                                 offset_seg = *offset + sizeof(struct sctp_sack_chunk);
4994                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
4995                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
4996                                     cum_ack, num_seg, a_rwnd);
4997                                 stcb->asoc.seen_a_sack_this_pkt = 1;
4998                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
4999                                     (num_seg == 0) &&
5000                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
5001                                     (stcb->asoc.saw_sack_with_frags == 0) &&
5002                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
5003                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))
5004                                     ) {
5005                                         /*
5006                                          * We have a SIMPLE sack having no
5007                                          * prior segments and data on sent
5008                                          * queue to be acked.. Use the
5009                                          * faster path sack processing. We
5010                                          * also allow window update sacks
5011                                          * with no missing segments to go
5012                                          * this way too.
5013                                          */
5014                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd, &abort_now, ecne_seen);
5015                                 } else {
5016                                         if (netp && *netp)
5017                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
5018                                                     num_seg, 0, num_dup, &abort_now, flags,
5019                                                     cum_ack, a_rwnd, ecne_seen);
5020                                 }
5021                                 if (abort_now) {
5022                                         /* ABORT signal from sack processing */
5023                                         *offset = length;
5024                                         return (NULL);
5025                                 }
5026                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
5027                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
5028                                     (stcb->asoc.stream_queue_cnt == 0)) {
5029                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
5030                                 }
5031                         }
5032                         break;
5033                         /*
5034                          * EY - nr_sack:  If the received chunk is an
5035                          * nr_sack chunk
5036                          */
5037                 case SCTP_NR_SELECTIVE_ACK:
5038                         {
5039                                 struct sctp_nr_sack_chunk *nr_sack;
5040                                 int abort_now = 0;
5041                                 uint32_t a_rwnd, cum_ack;
5042                                 uint16_t num_seg, num_nr_seg, num_dup;
5043                                 uint8_t flags;
5044                                 int offset_seg, offset_dup;
5045
5046                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK\n");
5047                                 SCTP_STAT_INCR(sctps_recvsacks);
5048                                 if (stcb == NULL) {
5049                                         SCTPDBG(SCTP_DEBUG_INDATA1, "No stcb when processing NR-SACK chunk\n");
5050                                         break;
5051                                 }
5052                                 if (stcb->asoc.nrsack_supported == 0) {
5053                                         goto unknown_chunk;
5054                                 }
5055                                 if (chk_length < sizeof(struct sctp_nr_sack_chunk)) {
5056                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size on NR-SACK chunk, too small\n");
5057                                         break;
5058                                 }
5059                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_ACK_SENT) {
5060                                         /*-
5061                                          * If we have sent a shutdown-ack, we will pay no
5062                                          * attention to a sack sent in to us since
5063                                          * we don't care anymore.
5064                                          */
5065                                         break;
5066                                 }
5067                                 nr_sack = (struct sctp_nr_sack_chunk *)ch;
5068                                 flags = ch->chunk_flags;
5069                                 cum_ack = ntohl(nr_sack->nr_sack.cum_tsn_ack);
5070                                 num_seg = ntohs(nr_sack->nr_sack.num_gap_ack_blks);
5071                                 num_nr_seg = ntohs(nr_sack->nr_sack.num_nr_gap_ack_blks);
5072                                 num_dup = ntohs(nr_sack->nr_sack.num_dup_tsns);
5073                                 a_rwnd = (uint32_t) ntohl(nr_sack->nr_sack.a_rwnd);
5074                                 if (sizeof(struct sctp_nr_sack_chunk) +
5075                                     (num_seg + num_nr_seg) * sizeof(struct sctp_gap_ack_block) +
5076                                     num_dup * sizeof(uint32_t) != chk_length) {
5077                                         SCTPDBG(SCTP_DEBUG_INDATA1, "Bad size of NR_SACK chunk\n");
5078                                         break;
5079                                 }
5080                                 offset_seg = *offset + sizeof(struct sctp_nr_sack_chunk);
5081                                 offset_dup = offset_seg + num_seg * sizeof(struct sctp_gap_ack_block);
5082                                 SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_NR_SACK process cum_ack:%x num_seg:%d a_rwnd:%d\n",
5083                                     cum_ack, num_seg, a_rwnd);
5084                                 stcb->asoc.seen_a_sack_this_pkt = 1;
5085                                 if ((stcb->asoc.pr_sctp_cnt == 0) &&
5086                                     (num_seg == 0) && (num_nr_seg == 0) &&
5087                                     SCTP_TSN_GE(cum_ack, stcb->asoc.last_acked_seq) &&
5088                                     (stcb->asoc.saw_sack_with_frags == 0) &&
5089                                     (stcb->asoc.saw_sack_with_nr_frags == 0) &&
5090                                     (!TAILQ_EMPTY(&stcb->asoc.sent_queue))) {
5091                                         /*
5092                                          * We have a SIMPLE sack having no
5093                                          * prior segments and data on sent
5094                                          * queue to be acked. Use the faster
5095                                          * path sack processing. We also
5096                                          * allow window update sacks with no
5097                                          * missing segments to go this way
5098                                          * too.
5099                                          */
5100                                         sctp_express_handle_sack(stcb, cum_ack, a_rwnd,
5101                                             &abort_now, ecne_seen);
5102                                 } else {
5103                                         if (netp && *netp)
5104                                                 sctp_handle_sack(m, offset_seg, offset_dup, stcb,
5105                                                     num_seg, num_nr_seg, num_dup, &abort_now, flags,
5106                                                     cum_ack, a_rwnd, ecne_seen);
5107                                 }
5108                                 if (abort_now) {
5109                                         /* ABORT signal from sack processing */
5110                                         *offset = length;
5111                                         return (NULL);
5112                                 }
5113                                 if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
5114                                     TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
5115                                     (stcb->asoc.stream_queue_cnt == 0)) {
5116                                         sctp_ulp_notify(SCTP_NOTIFY_SENDER_DRY, stcb, 0, NULL, SCTP_SO_NOT_LOCKED);
5117                                 }
5118                         }
5119                         break;
5120
5121                 case SCTP_HEARTBEAT_REQUEST:
5122                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT\n");
5123                         if ((stcb) && netp && *netp) {
5124                                 SCTP_STAT_INCR(sctps_recvheartbeat);
5125                                 sctp_send_heartbeat_ack(stcb, m, *offset,
5126                                     chk_length, *netp);
5127
5128                                 /* He's alive so give him credit */
5129                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5130                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5131                                             stcb->asoc.overall_error_count,
5132                                             0,
5133                                             SCTP_FROM_SCTP_INPUT,
5134                                             __LINE__);
5135                                 }
5136                                 stcb->asoc.overall_error_count = 0;
5137                         }
5138                         break;
5139                 case SCTP_HEARTBEAT_ACK:
5140                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_HEARTBEAT-ACK\n");
5141                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_heartbeat_chunk))) {
5142                                 /* Its not ours */
5143                                 *offset = length;
5144                                 if (locked_tcb) {
5145                                         SCTP_TCB_UNLOCK(locked_tcb);
5146                                 }
5147                                 return (NULL);
5148                         }
5149                         /* He's alive so give him credit */
5150                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5151                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5152                                     stcb->asoc.overall_error_count,
5153                                     0,
5154                                     SCTP_FROM_SCTP_INPUT,
5155                                     __LINE__);
5156                         }
5157                         stcb->asoc.overall_error_count = 0;
5158                         SCTP_STAT_INCR(sctps_recvheartbeatack);
5159                         if (netp && *netp)
5160                                 sctp_handle_heartbeat_ack((struct sctp_heartbeat_chunk *)ch,
5161                                     stcb, *netp);
5162                         break;
5163                 case SCTP_ABORT_ASSOCIATION:
5164                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ABORT, stcb %p\n",
5165                             (void *)stcb);
5166                         if ((stcb) && netp && *netp)
5167                                 sctp_handle_abort((struct sctp_abort_chunk *)ch,
5168                                     stcb, *netp);
5169                         *offset = length;
5170                         return (NULL);
5171                         break;
5172                 case SCTP_SHUTDOWN:
5173                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN, stcb %p\n",
5174                             (void *)stcb);
5175                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_shutdown_chunk))) {
5176                                 *offset = length;
5177                                 if (locked_tcb) {
5178                                         SCTP_TCB_UNLOCK(locked_tcb);
5179                                 }
5180                                 return (NULL);
5181                         }
5182                         if (netp && *netp) {
5183                                 int abort_flag = 0;
5184
5185                                 sctp_handle_shutdown((struct sctp_shutdown_chunk *)ch,
5186                                     stcb, *netp, &abort_flag);
5187                                 if (abort_flag) {
5188                                         *offset = length;
5189                                         return (NULL);
5190                                 }
5191                         }
5192                         break;
5193                 case SCTP_SHUTDOWN_ACK:
5194                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-ACK, stcb %p\n", (void *)stcb);
5195                         if ((stcb) && (netp) && (*netp))
5196                                 sctp_handle_shutdown_ack((struct sctp_shutdown_ack_chunk *)ch, stcb, *netp);
5197                         *offset = length;
5198                         return (NULL);
5199                         break;
5200
5201                 case SCTP_OPERATION_ERROR:
5202                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_OP-ERR\n");
5203                         if ((stcb) && netp && *netp && sctp_handle_error(ch, stcb, *netp) < 0) {
5204                                 *offset = length;
5205                                 return (NULL);
5206                         }
5207                         break;
5208                 case SCTP_COOKIE_ECHO:
5209                         SCTPDBG(SCTP_DEBUG_INPUT3,
5210                             "SCTP_COOKIE-ECHO, stcb %p\n", (void *)stcb);
5211                         if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5212                                 ;
5213                         } else {
5214                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5215                                         /* We are not interested anymore */
5216                         abend:
5217                                         if (stcb) {
5218                                                 SCTP_TCB_UNLOCK(stcb);
5219                                         }
5220                                         *offset = length;
5221                                         return (NULL);
5222                                 }
5223                         }
5224                         /*
5225                          * First are we accepting? We do this again here
5226                          * since it is possible that a previous endpoint WAS
5227                          * listening responded to a INIT-ACK and then
5228                          * closed. We opened and bound.. and are now no
5229                          * longer listening.
5230                          */
5231
5232                         if ((stcb == NULL) && (inp->sctp_socket->so_qlen >= inp->sctp_socket->so_qlimit)) {
5233                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
5234                                     (SCTP_BASE_SYSCTL(sctp_abort_if_one_2_one_hits_limit))) {
5235                                         op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
5236                                         sctp_abort_association(inp, stcb, m, iphlen,
5237                                             src, dst, sh, op_err,
5238                                             mflowtype, mflowid,
5239                                             vrf_id, port);
5240                                 }
5241                                 *offset = length;
5242                                 return (NULL);
5243                         } else {
5244                                 struct mbuf *ret_buf;
5245                                 struct sctp_inpcb *linp;
5246
5247                                 if (stcb) {
5248                                         linp = NULL;
5249                                 } else {
5250                                         linp = inp;
5251                                 }
5252
5253                                 if (linp) {
5254                                         SCTP_ASOC_CREATE_LOCK(linp);
5255                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5256                                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5257                                                 SCTP_ASOC_CREATE_UNLOCK(linp);
5258                                                 goto abend;
5259                                         }
5260                                 }
5261                                 if (netp) {
5262                                         ret_buf =
5263                                             sctp_handle_cookie_echo(m, iphlen,
5264                                             *offset,
5265                                             src, dst,
5266                                             sh,
5267                                             (struct sctp_cookie_echo_chunk *)ch,
5268                                             &inp, &stcb, netp,
5269                                             auth_skipped,
5270                                             auth_offset,
5271                                             auth_len,
5272                                             &locked_tcb,
5273                                             mflowtype,
5274                                             mflowid,
5275                                             vrf_id,
5276                                             port);
5277                                 } else {
5278                                         ret_buf = NULL;
5279                                 }
5280                                 if (linp) {
5281                                         SCTP_ASOC_CREATE_UNLOCK(linp);
5282                                 }
5283                                 if (ret_buf == NULL) {
5284                                         if (locked_tcb) {
5285                                                 SCTP_TCB_UNLOCK(locked_tcb);
5286                                         }
5287                                         SCTPDBG(SCTP_DEBUG_INPUT3,
5288                                             "GAK, null buffer\n");
5289                                         *offset = length;
5290                                         return (NULL);
5291                                 }
5292                                 /* if AUTH skipped, see if it verified... */
5293                                 if (auth_skipped) {
5294                                         got_auth = 1;
5295                                         auth_skipped = 0;
5296                                 }
5297                                 if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
5298                                         /*
5299                                          * Restart the timer if we have
5300                                          * pending data
5301                                          */
5302                                         struct sctp_tmit_chunk *chk;
5303
5304                                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
5305                                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
5306                                 }
5307                         }
5308                         break;
5309                 case SCTP_COOKIE_ACK:
5310                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_COOKIE-ACK, stcb %p\n", (void *)stcb);
5311                         if ((stcb == NULL) || chk_length != sizeof(struct sctp_cookie_ack_chunk)) {
5312                                 if (locked_tcb) {
5313                                         SCTP_TCB_UNLOCK(locked_tcb);
5314                                 }
5315                                 return (NULL);
5316                         }
5317                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5318                                 /* We are not interested anymore */
5319                                 if ((stcb) && (stcb->asoc.total_output_queue_size)) {
5320                                         ;
5321                                 } else if (stcb) {
5322 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5323                                         so = SCTP_INP_SO(inp);
5324                                         atomic_add_int(&stcb->asoc.refcnt, 1);
5325                                         SCTP_TCB_UNLOCK(stcb);
5326                                         SCTP_SOCKET_LOCK(so, 1);
5327                                         SCTP_TCB_LOCK(stcb);
5328                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5329 #endif
5330                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5331                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_30);
5332 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5333                                         SCTP_SOCKET_UNLOCK(so, 1);
5334 #endif
5335                                         *offset = length;
5336                                         return (NULL);
5337                                 }
5338                         }
5339                         /* He's alive so give him credit */
5340                         if ((stcb) && netp && *netp) {
5341                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5342                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5343                                             stcb->asoc.overall_error_count,
5344                                             0,
5345                                             SCTP_FROM_SCTP_INPUT,
5346                                             __LINE__);
5347                                 }
5348                                 stcb->asoc.overall_error_count = 0;
5349                                 sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, *netp);
5350                         }
5351                         break;
5352                 case SCTP_ECN_ECHO:
5353                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-ECHO\n");
5354                         /* He's alive so give him credit */
5355                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_ecne_chunk))) {
5356                                 /* Its not ours */
5357                                 if (locked_tcb) {
5358                                         SCTP_TCB_UNLOCK(locked_tcb);
5359                                 }
5360                                 *offset = length;
5361                                 return (NULL);
5362                         }
5363                         if (stcb) {
5364                                 if (stcb->asoc.ecn_supported == 0) {
5365                                         goto unknown_chunk;
5366                                 }
5367                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5368                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5369                                             stcb->asoc.overall_error_count,
5370                                             0,
5371                                             SCTP_FROM_SCTP_INPUT,
5372                                             __LINE__);
5373                                 }
5374                                 stcb->asoc.overall_error_count = 0;
5375                                 sctp_handle_ecn_echo((struct sctp_ecne_chunk *)ch,
5376                                     stcb);
5377                                 ecne_seen = 1;
5378                         }
5379                         break;
5380                 case SCTP_ECN_CWR:
5381                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ECN-CWR\n");
5382                         /* He's alive so give him credit */
5383                         if ((stcb == NULL) || (chk_length != sizeof(struct sctp_cwr_chunk))) {
5384                                 /* Its not ours */
5385                                 if (locked_tcb) {
5386                                         SCTP_TCB_UNLOCK(locked_tcb);
5387                                 }
5388                                 *offset = length;
5389                                 return (NULL);
5390                         }
5391                         if (stcb) {
5392                                 if (stcb->asoc.ecn_supported == 0) {
5393                                         goto unknown_chunk;
5394                                 }
5395                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5396                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5397                                             stcb->asoc.overall_error_count,
5398                                             0,
5399                                             SCTP_FROM_SCTP_INPUT,
5400                                             __LINE__);
5401                                 }
5402                                 stcb->asoc.overall_error_count = 0;
5403                                 sctp_handle_ecn_cwr((struct sctp_cwr_chunk *)ch, stcb, *netp);
5404                         }
5405                         break;
5406                 case SCTP_SHUTDOWN_COMPLETE:
5407                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_SHUTDOWN-COMPLETE, stcb %p\n", (void *)stcb);
5408                         /* must be first and only chunk */
5409                         if ((num_chunks > 1) ||
5410                             (length - *offset > (int)SCTP_SIZE32(chk_length))) {
5411                                 *offset = length;
5412                                 if (locked_tcb) {
5413                                         SCTP_TCB_UNLOCK(locked_tcb);
5414                                 }
5415                                 return (NULL);
5416                         }
5417                         if ((stcb) && netp && *netp) {
5418                                 sctp_handle_shutdown_complete((struct sctp_shutdown_complete_chunk *)ch,
5419                                     stcb, *netp);
5420                         }
5421                         *offset = length;
5422                         return (NULL);
5423                         break;
5424                 case SCTP_ASCONF:
5425                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF\n");
5426                         /* He's alive so give him credit */
5427                         if (stcb) {
5428                                 if (stcb->asoc.asconf_supported == 0) {
5429                                         goto unknown_chunk;
5430                                 }
5431                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5432                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5433                                             stcb->asoc.overall_error_count,
5434                                             0,
5435                                             SCTP_FROM_SCTP_INPUT,
5436                                             __LINE__);
5437                                 }
5438                                 stcb->asoc.overall_error_count = 0;
5439                                 sctp_handle_asconf(m, *offset, src,
5440                                     (struct sctp_asconf_chunk *)ch, stcb, asconf_cnt == 0);
5441                                 asconf_cnt++;
5442                         }
5443                         break;
5444                 case SCTP_ASCONF_ACK:
5445                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_ASCONF-ACK\n");
5446                         if (chk_length < sizeof(struct sctp_asconf_ack_chunk)) {
5447                                 /* Its not ours */
5448                                 if (locked_tcb) {
5449                                         SCTP_TCB_UNLOCK(locked_tcb);
5450                                 }
5451                                 *offset = length;
5452                                 return (NULL);
5453                         }
5454                         if ((stcb) && netp && *netp) {
5455                                 if (stcb->asoc.asconf_supported == 0) {
5456                                         goto unknown_chunk;
5457                                 }
5458                                 /* He's alive so give him credit */
5459                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5460                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5461                                             stcb->asoc.overall_error_count,
5462                                             0,
5463                                             SCTP_FROM_SCTP_INPUT,
5464                                             __LINE__);
5465                                 }
5466                                 stcb->asoc.overall_error_count = 0;
5467                                 sctp_handle_asconf_ack(m, *offset,
5468                                     (struct sctp_asconf_ack_chunk *)ch, stcb, *netp, &abort_no_unlock);
5469                                 if (abort_no_unlock)
5470                                         return (NULL);
5471                         }
5472                         break;
5473                 case SCTP_FORWARD_CUM_TSN:
5474                 case SCTP_IFORWARD_CUM_TSN:
5475                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD-TSN\n");
5476                         if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
5477                                 /* Its not ours */
5478                                 if (locked_tcb) {
5479                                         SCTP_TCB_UNLOCK(locked_tcb);
5480                                 }
5481                                 *offset = length;
5482                                 return (NULL);
5483                         }
5484                         /* He's alive so give him credit */
5485                         if (stcb) {
5486                                 int abort_flag = 0;
5487
5488                                 if (stcb->asoc.prsctp_supported == 0) {
5489                                         goto unknown_chunk;
5490                                 }
5491                                 stcb->asoc.overall_error_count = 0;
5492                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5493                                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5494                                             stcb->asoc.overall_error_count,
5495                                             0,
5496                                             SCTP_FROM_SCTP_INPUT,
5497                                             __LINE__);
5498                                 }
5499                                 *fwd_tsn_seen = 1;
5500                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5501                                         /* We are not interested anymore */
5502 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5503                                         so = SCTP_INP_SO(inp);
5504                                         atomic_add_int(&stcb->asoc.refcnt, 1);
5505                                         SCTP_TCB_UNLOCK(stcb);
5506                                         SCTP_SOCKET_LOCK(so, 1);
5507                                         SCTP_TCB_LOCK(stcb);
5508                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5509 #endif
5510                                         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
5511                                             SCTP_FROM_SCTP_INPUT + SCTP_LOC_31);
5512 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
5513                                         SCTP_SOCKET_UNLOCK(so, 1);
5514 #endif
5515                                         *offset = length;
5516                                         return (NULL);
5517                                 }
5518                                 sctp_handle_forward_tsn(stcb,
5519                                     (struct sctp_forward_tsn_chunk *)ch, &abort_flag, m, *offset);
5520                                 if (abort_flag) {
5521                                         *offset = length;
5522                                         return (NULL);
5523                                 } else {
5524                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5525                                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5526                                                     stcb->asoc.overall_error_count,
5527                                                     0,
5528                                                     SCTP_FROM_SCTP_INPUT,
5529                                                     __LINE__);
5530                                         }
5531                                         stcb->asoc.overall_error_count = 0;
5532                                 }
5533
5534                         }
5535                         break;
5536                 case SCTP_STREAM_RESET:
5537                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_STREAM_RESET\n");
5538                         if (((stcb == NULL) || (ch == NULL) || (chk_length < sizeof(struct sctp_stream_reset_tsn_req)))) {
5539                                 /* Its not ours */
5540                                 if (locked_tcb) {
5541                                         SCTP_TCB_UNLOCK(locked_tcb);
5542                                 }
5543                                 *offset = length;
5544                                 return (NULL);
5545                         }
5546                         if (stcb->asoc.reconfig_supported == 0) {
5547                                 goto unknown_chunk;
5548                         }
5549                         if (sctp_handle_stream_reset(stcb, m, *offset, ch)) {
5550                                 /* stop processing */
5551                                 *offset = length;
5552                                 return (NULL);
5553                         }
5554                         break;
5555                 case SCTP_PACKET_DROPPED:
5556                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_PACKET_DROPPED\n");
5557                         /* re-get it all please */
5558                         if (chk_length < sizeof(struct sctp_pktdrop_chunk)) {
5559                                 /* Its not ours */
5560                                 if (locked_tcb) {
5561                                         SCTP_TCB_UNLOCK(locked_tcb);
5562                                 }
5563                                 *offset = length;
5564                                 return (NULL);
5565                         }
5566                         if (ch && (stcb) && netp && (*netp)) {
5567                                 if (stcb->asoc.pktdrop_supported == 0) {
5568                                         goto unknown_chunk;
5569                                 }
5570                                 sctp_handle_packet_dropped((struct sctp_pktdrop_chunk *)ch,
5571                                     stcb, *netp,
5572                                     min(chk_length, (sizeof(chunk_buf) - 4)));
5573
5574                         }
5575                         break;
5576                 case SCTP_AUTHENTICATION:
5577                         SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_AUTHENTICATION\n");
5578                         if (stcb == NULL) {
5579                                 /* save the first AUTH for later processing */
5580                                 if (auth_skipped == 0) {
5581                                         auth_offset = *offset;
5582                                         auth_len = chk_length;
5583                                         auth_skipped = 1;
5584                                 }
5585                                 /* skip this chunk (temporarily) */
5586                                 goto next_chunk;
5587                         }
5588                         if (stcb->asoc.auth_supported == 0) {
5589                                 goto unknown_chunk;
5590                         }
5591                         if ((chk_length < (sizeof(struct sctp_auth_chunk))) ||
5592                             (chk_length > (sizeof(struct sctp_auth_chunk) +
5593                             SCTP_AUTH_DIGEST_LEN_MAX))) {
5594                                 /* Its not ours */
5595                                 if (locked_tcb) {
5596                                         SCTP_TCB_UNLOCK(locked_tcb);
5597                                 }
5598                                 *offset = length;
5599                                 return (NULL);
5600                         }
5601                         if (got_auth == 1) {
5602                                 /* skip this chunk... it's already auth'd */
5603                                 goto next_chunk;
5604                         }
5605                         got_auth = 1;
5606                         if ((ch == NULL) || sctp_handle_auth(stcb, (struct sctp_auth_chunk *)ch,
5607                             m, *offset)) {
5608                                 /* auth HMAC failed so dump the packet */
5609                                 *offset = length;
5610                                 return (stcb);
5611                         } else {
5612                                 /* remaining chunks are HMAC checked */
5613                                 stcb->asoc.authenticated = 1;
5614                         }
5615                         break;
5616
5617                 default:
5618         unknown_chunk:
5619                         /* it's an unknown chunk! */
5620                         if ((ch->chunk_type & 0x40) && (stcb != NULL)) {
5621                                 struct sctp_gen_error_cause *cause;
5622                                 int len;
5623
5624                                 op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
5625                                     0, M_NOWAIT, 1, MT_DATA);
5626                                 if (op_err != NULL) {
5627                                         len = min(SCTP_SIZE32(chk_length), (uint32_t) (length - *offset));
5628                                         cause = mtod(op_err, struct sctp_gen_error_cause *);
5629                                         cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
5630                                         cause->length = htons((uint16_t) (len + sizeof(struct sctp_gen_error_cause)));
5631                                         SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
5632                                         SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, len, M_NOWAIT);
5633                                         if (SCTP_BUF_NEXT(op_err) != NULL) {
5634 #ifdef SCTP_MBUF_LOGGING
5635                                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
5636                                                         sctp_log_mbc(SCTP_BUF_NEXT(op_err), SCTP_MBUF_ICOPY);
5637                                                 }
5638 #endif
5639                                                 sctp_queue_op_err(stcb, op_err);
5640                                         } else {
5641                                                 sctp_m_freem(op_err);
5642                                         }
5643                                 }
5644                         }
5645                         if ((ch->chunk_type & 0x80) == 0) {
5646                                 /* discard this packet */
5647                                 *offset = length;
5648                                 return (stcb);
5649                         }       /* else skip this bad chunk and continue... */
5650                         break;
5651                 }               /* switch (ch->chunk_type) */
5652
5653
5654 next_chunk:
5655                 /* get the next chunk */
5656                 *offset += SCTP_SIZE32(chk_length);
5657                 if (*offset >= length) {
5658                         /* no more data left in the mbuf chain */
5659                         break;
5660                 }
5661                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
5662                     sizeof(struct sctp_chunkhdr), chunk_buf);
5663                 if (ch == NULL) {
5664                         if (locked_tcb) {
5665                                 SCTP_TCB_UNLOCK(locked_tcb);
5666                         }
5667                         *offset = length;
5668                         return (NULL);
5669                 }
5670         }                       /* while */
5671
5672         if (asconf_cnt > 0 && stcb != NULL) {
5673                 sctp_send_asconf_ack(stcb);
5674         }
5675         return (stcb);
5676 }
5677
5678
5679 /*
5680  * common input chunk processing (v4 and v6)
5681  */
5682 void
5683 sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int length,
5684     struct sockaddr *src, struct sockaddr *dst,
5685     struct sctphdr *sh, struct sctp_chunkhdr *ch,
5686 #if !defined(SCTP_WITH_NO_CSUM)
5687     uint8_t compute_crc,
5688 #endif
5689     uint8_t ecn_bits,
5690     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
5691     uint32_t vrf_id, uint16_t port)
5692 {
5693         uint32_t high_tsn;
5694         int fwd_tsn_seen = 0, data_processed = 0;
5695         struct mbuf *m = *mm, *op_err;
5696         char msg[SCTP_DIAG_INFO_LEN];
5697         int un_sent;
5698         int cnt_ctrl_ready = 0;
5699         struct sctp_inpcb *inp = NULL, *inp_decr = NULL;
5700         struct sctp_tcb *stcb = NULL;
5701         struct sctp_nets *net = NULL;
5702
5703         SCTP_STAT_INCR(sctps_recvdatagrams);
5704 #ifdef SCTP_AUDITING_ENABLED
5705         sctp_audit_log(0xE0, 1);
5706         sctp_auditing(0, inp, stcb, net);
5707 #endif
5708 #if !defined(SCTP_WITH_NO_CSUM)
5709         if (compute_crc != 0) {
5710                 uint32_t check, calc_check;
5711
5712                 check = sh->checksum;
5713                 sh->checksum = 0;
5714                 calc_check = sctp_calculate_cksum(m, iphlen);
5715                 sh->checksum = check;
5716                 if (calc_check != check) {
5717                         SCTPDBG(SCTP_DEBUG_INPUT1, "Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
5718                             calc_check, check, (void *)m, length, iphlen);
5719                         stcb = sctp_findassociation_addr(m, offset, src, dst,
5720                             sh, ch, &inp, &net, vrf_id);
5721 #if defined(INET) || defined(INET6)
5722                         if ((ch->chunk_type != SCTP_INITIATION) &&
5723                             (net != NULL) && (net->port != port)) {
5724                                 if (net->port == 0) {
5725                                         /* UDP encapsulation turned on. */
5726                                         net->mtu -= sizeof(struct udphdr);
5727                                         if (stcb->asoc.smallest_mtu > net->mtu) {
5728                                                 sctp_pathmtu_adjustment(stcb, net->mtu);
5729                                         }
5730                                 } else if (port == 0) {
5731                                         /* UDP encapsulation turned off. */
5732                                         net->mtu += sizeof(struct udphdr);
5733                                         /* XXX Update smallest_mtu */
5734                                 }
5735                                 net->port = port;
5736                         }
5737 #endif
5738                         if (net != NULL) {
5739                                 net->flowtype = mflowtype;
5740                                 net->flowid = mflowid;
5741                         }
5742                         if ((inp != NULL) && (stcb != NULL)) {
5743                                 sctp_send_packet_dropped(stcb, net, m, length, iphlen, 1);
5744                                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_INPUT_ERROR, SCTP_SO_NOT_LOCKED);
5745                         } else if ((inp != NULL) && (stcb == NULL)) {
5746                                 inp_decr = inp;
5747                         }
5748                         SCTP_STAT_INCR(sctps_badsum);
5749                         SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
5750                         goto out;
5751                 }
5752         }
5753 #endif
5754         /* Destination port of 0 is illegal, based on RFC4960. */
5755         if (sh->dest_port == 0) {
5756                 SCTP_STAT_INCR(sctps_hdrops);
5757                 goto out;
5758         }
5759         stcb = sctp_findassociation_addr(m, offset, src, dst,
5760             sh, ch, &inp, &net, vrf_id);
5761 #if defined(INET) || defined(INET6)
5762         if ((ch->chunk_type != SCTP_INITIATION) &&
5763             (net != NULL) && (net->port != port)) {
5764                 if (net->port == 0) {
5765                         /* UDP encapsulation turned on. */
5766                         net->mtu -= sizeof(struct udphdr);
5767                         if (stcb->asoc.smallest_mtu > net->mtu) {
5768                                 sctp_pathmtu_adjustment(stcb, net->mtu);
5769                         }
5770                 } else if (port == 0) {
5771                         /* UDP encapsulation turned off. */
5772                         net->mtu += sizeof(struct udphdr);
5773                         /* XXX Update smallest_mtu */
5774                 }
5775                 net->port = port;
5776         }
5777 #endif
5778         if (net != NULL) {
5779                 net->flowtype = mflowtype;
5780                 net->flowid = mflowid;
5781         }
5782         if (inp == NULL) {
5783                 SCTP_STAT_INCR(sctps_noport);
5784                 if (badport_bandlim(BANDLIM_SCTP_OOTB) < 0) {
5785                         goto out;
5786                 }
5787                 if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
5788                         sctp_send_shutdown_complete2(src, dst, sh,
5789                             mflowtype, mflowid, fibnum,
5790                             vrf_id, port);
5791                         goto out;
5792                 }
5793                 if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
5794                         goto out;
5795                 }
5796                 if (ch->chunk_type != SCTP_ABORT_ASSOCIATION) {
5797                         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
5798                             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
5799                             (ch->chunk_type != SCTP_INIT))) {
5800                                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5801                                     "Out of the blue");
5802                                 sctp_send_abort(m, iphlen, src, dst,
5803                                     sh, 0, op_err,
5804                                     mflowtype, mflowid, fibnum,
5805                                     vrf_id, port);
5806                         }
5807                 }
5808                 goto out;
5809         } else if (stcb == NULL) {
5810                 inp_decr = inp;
5811         }
5812 #ifdef IPSEC
5813         /*-
5814          * I very much doubt any of the IPSEC stuff will work but I have no
5815          * idea, so I will leave it in place.
5816          */
5817         if (inp != NULL) {
5818                 switch (dst->sa_family) {
5819 #ifdef INET
5820                 case AF_INET:
5821                         if (ipsec4_in_reject(m, &inp->ip_inp.inp)) {
5822                                 SCTP_STAT_INCR(sctps_hdrops);
5823                                 goto out;
5824                         }
5825                         break;
5826 #endif
5827 #ifdef INET6
5828                 case AF_INET6:
5829                         if (ipsec6_in_reject(m, &inp->ip_inp.inp)) {
5830                                 SCTP_STAT_INCR(sctps_hdrops);
5831                                 goto out;
5832                         }
5833                         break;
5834 #endif
5835                 default:
5836                         break;
5837                 }
5838         }
5839 #endif
5840         SCTPDBG(SCTP_DEBUG_INPUT1, "Ok, Common input processing called, m:%p iphlen:%d offset:%d length:%d stcb:%p\n",
5841             (void *)m, iphlen, offset, length, (void *)stcb);
5842         if (stcb) {
5843                 /* always clear this before beginning a packet */
5844                 stcb->asoc.authenticated = 0;
5845                 stcb->asoc.seen_a_sack_this_pkt = 0;
5846                 SCTPDBG(SCTP_DEBUG_INPUT1, "stcb:%p state:%x\n",
5847                     (void *)stcb, stcb->asoc.state);
5848
5849                 if ((stcb->asoc.state & SCTP_STATE_WAS_ABORTED) ||
5850                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5851                         /*-
5852                          * If we hit here, we had a ref count
5853                          * up when the assoc was aborted and the
5854                          * timer is clearing out the assoc, we should
5855                          * NOT respond to any packet.. its OOTB.
5856                          */
5857                         SCTP_TCB_UNLOCK(stcb);
5858                         stcb = NULL;
5859                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5860                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5861                             msg);
5862                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5863                             mflowtype, mflowid, inp->fibnum,
5864                             vrf_id, port);
5865                         goto out;
5866                 }
5867         }
5868         if (IS_SCTP_CONTROL(ch)) {
5869                 /* process the control portion of the SCTP packet */
5870                 /* sa_ignore NO_NULL_CHK */
5871                 stcb = sctp_process_control(m, iphlen, &offset, length,
5872                     src, dst, sh, ch,
5873                     inp, stcb, &net, &fwd_tsn_seen,
5874                     mflowtype, mflowid, fibnum,
5875                     vrf_id, port);
5876                 if (stcb) {
5877                         /*
5878                          * This covers us if the cookie-echo was there and
5879                          * it changes our INP.
5880                          */
5881                         inp = stcb->sctp_ep;
5882 #if defined(INET) || defined(INET6)
5883                         if ((ch->chunk_type != SCTP_INITIATION) &&
5884                             (net != NULL) && (net->port != port)) {
5885                                 if (net->port == 0) {
5886                                         /* UDP encapsulation turned on. */
5887                                         net->mtu -= sizeof(struct udphdr);
5888                                         if (stcb->asoc.smallest_mtu > net->mtu) {
5889                                                 sctp_pathmtu_adjustment(stcb, net->mtu);
5890                                         }
5891                                 } else if (port == 0) {
5892                                         /* UDP encapsulation turned off. */
5893                                         net->mtu += sizeof(struct udphdr);
5894                                         /* XXX Update smallest_mtu */
5895                                 }
5896                                 net->port = port;
5897                         }
5898 #endif
5899                 }
5900         } else {
5901                 /*
5902                  * no control chunks, so pre-process DATA chunks (these
5903                  * checks are taken care of by control processing)
5904                  */
5905
5906                 /*
5907                  * if DATA only packet, and auth is required, then punt...
5908                  * can't have authenticated without any AUTH (control)
5909                  * chunks
5910                  */
5911                 if ((stcb != NULL) &&
5912                     (stcb->asoc.auth_supported == 1) &&
5913                     sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks)) {
5914                         /* "silently" ignore */
5915                         SCTP_STAT_INCR(sctps_recvauthmissing);
5916                         goto out;
5917                 }
5918                 if (stcb == NULL) {
5919                         /* out of the blue DATA chunk */
5920                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5921                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5922                             msg);
5923                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5924                             mflowtype, mflowid, fibnum,
5925                             vrf_id, port);
5926                         goto out;
5927                 }
5928                 if (stcb->asoc.my_vtag != ntohl(sh->v_tag)) {
5929                         /* v_tag mismatch! */
5930                         SCTP_STAT_INCR(sctps_badvtag);
5931                         goto out;
5932                 }
5933         }
5934
5935         if (stcb == NULL) {
5936                 /*
5937                  * no valid TCB for this packet, or we found it's a bad
5938                  * packet while processing control, or we're done with this
5939                  * packet (done or skip rest of data), so we drop it...
5940                  */
5941                 goto out;
5942         }
5943         /*
5944          * DATA chunk processing
5945          */
5946         /* plow through the data chunks while length > offset */
5947
5948         /*
5949          * Rest should be DATA only.  Check authentication state if AUTH for
5950          * DATA is required.
5951          */
5952         if ((length > offset) &&
5953             (stcb != NULL) &&
5954             (stcb->asoc.auth_supported == 1) &&
5955             sctp_auth_is_required_chunk(SCTP_DATA, stcb->asoc.local_auth_chunks) &&
5956             !stcb->asoc.authenticated) {
5957                 /* "silently" ignore */
5958                 SCTP_STAT_INCR(sctps_recvauthmissing);
5959                 SCTPDBG(SCTP_DEBUG_AUTH1,
5960                     "Data chunk requires AUTH, skipped\n");
5961                 goto trigger_send;
5962         }
5963         if (length > offset) {
5964                 int retval;
5965
5966                 /*
5967                  * First check to make sure our state is correct. We would
5968                  * not get here unless we really did have a tag, so we don't
5969                  * abort if this happens, just dump the chunk silently.
5970                  */
5971                 switch (SCTP_GET_STATE(&stcb->asoc)) {
5972                 case SCTP_STATE_COOKIE_ECHOED:
5973                         /*
5974                          * we consider data with valid tags in this state
5975                          * shows us the cookie-ack was lost. Imply it was
5976                          * there.
5977                          */
5978                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
5979                                 sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
5980                                     stcb->asoc.overall_error_count,
5981                                     0,
5982                                     SCTP_FROM_SCTP_INPUT,
5983                                     __LINE__);
5984                         }
5985                         stcb->asoc.overall_error_count = 0;
5986                         sctp_handle_cookie_ack((struct sctp_cookie_ack_chunk *)ch, stcb, net);
5987                         break;
5988                 case SCTP_STATE_COOKIE_WAIT:
5989                         /*
5990                          * We consider OOTB any data sent during asoc setup.
5991                          */
5992                         snprintf(msg, sizeof(msg), "OOTB, %s:%d at %s", __FILE__, __LINE__, __func__);
5993                         op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
5994                             msg);
5995                         sctp_handle_ootb(m, iphlen, offset, src, dst, sh, inp, op_err,
5996                             mflowtype, mflowid, inp->fibnum,
5997                             vrf_id, port);
5998                         goto out;
5999                         /* sa_ignore NOTREACHED */
6000                         break;
6001                 case SCTP_STATE_EMPTY:  /* should not happen */
6002                 case SCTP_STATE_INUSE:  /* should not happen */
6003                 case SCTP_STATE_SHUTDOWN_RECEIVED:      /* This is a peer error */
6004                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
6005                 default:
6006                         goto out;
6007                         /* sa_ignore NOTREACHED */
6008                         break;
6009                 case SCTP_STATE_OPEN:
6010                 case SCTP_STATE_SHUTDOWN_SENT:
6011                         break;
6012                 }
6013                 /* plow through the data chunks while length > offset */
6014                 retval = sctp_process_data(mm, iphlen, &offset, length,
6015                     inp, stcb, net, &high_tsn);
6016                 if (retval == 2) {
6017                         /*
6018                          * The association aborted, NO UNLOCK needed since
6019                          * the association is destroyed.
6020                          */
6021                         stcb = NULL;
6022                         goto out;
6023                 }
6024                 data_processed = 1;
6025                 /*
6026                  * Anything important needs to have been m_copy'ed in
6027                  * process_data
6028                  */
6029         }
6030         /* take care of ecn */
6031         if ((data_processed == 1) &&
6032             (stcb->asoc.ecn_supported == 1) &&
6033             ((ecn_bits & SCTP_CE_BITS) == SCTP_CE_BITS)) {
6034                 /* Yep, we need to add a ECNE */
6035                 sctp_send_ecn_echo(stcb, net, high_tsn);
6036         }
6037         if ((data_processed == 0) && (fwd_tsn_seen)) {
6038                 int was_a_gap;
6039                 uint32_t highest_tsn;
6040
6041                 if (SCTP_TSN_GT(stcb->asoc.highest_tsn_inside_nr_map, stcb->asoc.highest_tsn_inside_map)) {
6042                         highest_tsn = stcb->asoc.highest_tsn_inside_nr_map;
6043                 } else {
6044                         highest_tsn = stcb->asoc.highest_tsn_inside_map;
6045                 }
6046                 was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
6047                 stcb->asoc.send_sack = 1;
6048                 sctp_sack_check(stcb, was_a_gap);
6049         } else if (fwd_tsn_seen) {
6050                 stcb->asoc.send_sack = 1;
6051         }
6052         /* trigger send of any chunks in queue... */
6053 trigger_send:
6054 #ifdef SCTP_AUDITING_ENABLED
6055         sctp_audit_log(0xE0, 2);
6056         sctp_auditing(1, inp, stcb, net);
6057 #endif
6058         SCTPDBG(SCTP_DEBUG_INPUT1,
6059             "Check for chunk output prw:%d tqe:%d tf=%d\n",
6060             stcb->asoc.peers_rwnd,
6061             TAILQ_EMPTY(&stcb->asoc.control_send_queue),
6062             stcb->asoc.total_flight);
6063         un_sent = (stcb->asoc.total_output_queue_size - stcb->asoc.total_flight);
6064         if (!TAILQ_EMPTY(&stcb->asoc.control_send_queue)) {
6065                 cnt_ctrl_ready = stcb->asoc.ctrl_queue_cnt - stcb->asoc.ecn_echo_cnt_onq;
6066         }
6067         if (!TAILQ_EMPTY(&stcb->asoc.asconf_send_queue) ||
6068             cnt_ctrl_ready ||
6069             stcb->asoc.trigger_reset ||
6070             ((un_sent) &&
6071             (stcb->asoc.peers_rwnd > 0 ||
6072             (stcb->asoc.peers_rwnd <= 0 && stcb->asoc.total_flight == 0)))) {
6073                 SCTPDBG(SCTP_DEBUG_INPUT3, "Calling chunk OUTPUT\n");
6074                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CONTROL_PROC, SCTP_SO_NOT_LOCKED);
6075                 SCTPDBG(SCTP_DEBUG_INPUT3, "chunk OUTPUT returns\n");
6076         }
6077 #ifdef SCTP_AUDITING_ENABLED
6078         sctp_audit_log(0xE0, 3);
6079         sctp_auditing(2, inp, stcb, net);
6080 #endif
6081 out:
6082         if (stcb != NULL) {
6083                 SCTP_TCB_UNLOCK(stcb);
6084         }
6085         if (inp_decr != NULL) {
6086                 /* reduce ref-count */
6087                 SCTP_INP_WLOCK(inp_decr);
6088                 SCTP_INP_DECR_REF(inp_decr);
6089                 SCTP_INP_WUNLOCK(inp_decr);
6090         }
6091         return;
6092 }
6093
6094 #ifdef INET
6095 void
6096 sctp_input_with_port(struct mbuf *i_pak, int off, uint16_t port)
6097 {
6098         struct mbuf *m;
6099         int iphlen;
6100         uint32_t vrf_id = 0;
6101         uint8_t ecn_bits;
6102         struct sockaddr_in src, dst;
6103         struct ip *ip;
6104         struct sctphdr *sh;
6105         struct sctp_chunkhdr *ch;
6106         int length, offset;
6107
6108 #if !defined(SCTP_WITH_NO_CSUM)
6109         uint8_t compute_crc;
6110
6111 #endif
6112         uint32_t mflowid;
6113         uint8_t mflowtype;
6114         uint16_t fibnum;
6115
6116         iphlen = off;
6117         if (SCTP_GET_PKT_VRFID(i_pak, vrf_id)) {
6118                 SCTP_RELEASE_PKT(i_pak);
6119                 return;
6120         }
6121         m = SCTP_HEADER_TO_CHAIN(i_pak);
6122 #ifdef SCTP_MBUF_LOGGING
6123         /* Log in any input mbufs */
6124         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6125                 sctp_log_mbc(m, SCTP_MBUF_INPUT);
6126         }
6127 #endif
6128 #ifdef SCTP_PACKET_LOGGING
6129         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LAST_PACKET_TRACING) {
6130                 sctp_packet_log(m);
6131         }
6132 #endif
6133         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6134             "sctp_input(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6135             m->m_pkthdr.len,
6136             if_name(m->m_pkthdr.rcvif),
6137             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6138         mflowid = m->m_pkthdr.flowid;
6139         mflowtype = M_HASHTYPE_GET(m);
6140         fibnum = M_GETFIB(m);
6141         SCTP_STAT_INCR(sctps_recvpackets);
6142         SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
6143         /* Get IP, SCTP, and first chunk header together in the first mbuf. */
6144         offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
6145         if (SCTP_BUF_LEN(m) < offset) {
6146                 if ((m = m_pullup(m, offset)) == NULL) {
6147                         SCTP_STAT_INCR(sctps_hdrops);
6148                         return;
6149                 }
6150         }
6151         ip = mtod(m, struct ip *);
6152         sh = (struct sctphdr *)((caddr_t)ip + iphlen);
6153         ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
6154         offset -= sizeof(struct sctp_chunkhdr);
6155         memset(&src, 0, sizeof(struct sockaddr_in));
6156         src.sin_family = AF_INET;
6157         src.sin_len = sizeof(struct sockaddr_in);
6158         src.sin_port = sh->src_port;
6159         src.sin_addr = ip->ip_src;
6160         memset(&dst, 0, sizeof(struct sockaddr_in));
6161         dst.sin_family = AF_INET;
6162         dst.sin_len = sizeof(struct sockaddr_in);
6163         dst.sin_port = sh->dest_port;
6164         dst.sin_addr = ip->ip_dst;
6165         length = ntohs(ip->ip_len);
6166         /* Validate mbuf chain length with IP payload length. */
6167         if (SCTP_HEADER_LEN(m) != length) {
6168                 SCTPDBG(SCTP_DEBUG_INPUT1,
6169                     "sctp_input() length:%d reported length:%d\n", length, SCTP_HEADER_LEN(m));
6170                 SCTP_STAT_INCR(sctps_hdrops);
6171                 goto out;
6172         }
6173         /* SCTP does not allow broadcasts or multicasts */
6174         if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
6175                 goto out;
6176         }
6177         if (SCTP_IS_IT_BROADCAST(dst.sin_addr, m)) {
6178                 goto out;
6179         }
6180         ecn_bits = ip->ip_tos;
6181 #if defined(SCTP_WITH_NO_CSUM)
6182         SCTP_STAT_INCR(sctps_recvnocrc);
6183 #else
6184         if (m->m_pkthdr.csum_flags & CSUM_SCTP_VALID) {
6185                 SCTP_STAT_INCR(sctps_recvhwcrc);
6186                 compute_crc = 0;
6187         } else {
6188                 SCTP_STAT_INCR(sctps_recvswcrc);
6189                 compute_crc = 1;
6190         }
6191 #endif
6192         sctp_common_input_processing(&m, iphlen, offset, length,
6193             (struct sockaddr *)&src,
6194             (struct sockaddr *)&dst,
6195             sh, ch,
6196 #if !defined(SCTP_WITH_NO_CSUM)
6197             compute_crc,
6198 #endif
6199             ecn_bits,
6200             mflowtype, mflowid, fibnum,
6201             vrf_id, port);
6202 out:
6203         if (m) {
6204                 sctp_m_freem(m);
6205         }
6206         return;
6207 }
6208
6209 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6210 extern int *sctp_cpuarry;
6211
6212 #endif
6213
6214 int
6215 sctp_input(struct mbuf **mp, int *offp, int proto SCTP_UNUSED)
6216 {
6217         struct mbuf *m;
6218         int off;
6219
6220         m = *mp;
6221         off = *offp;
6222 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6223         if (mp_ncpus > 1) {
6224                 struct ip *ip;
6225                 struct sctphdr *sh;
6226                 int offset;
6227                 int cpu_to_use;
6228                 uint32_t flowid, tag;
6229
6230                 if (M_HASHTYPE_GET(m) != M_HASHTYPE_NONE) {
6231                         flowid = m->m_pkthdr.flowid;
6232                 } else {
6233                         /*
6234                          * No flow id built by lower layers fix it so we
6235                          * create one.
6236                          */
6237                         offset = off + sizeof(struct sctphdr);
6238                         if (SCTP_BUF_LEN(m) < offset) {
6239                                 if ((m = m_pullup(m, offset)) == NULL) {
6240                                         SCTP_STAT_INCR(sctps_hdrops);
6241                                         return (IPPROTO_DONE);
6242                                 }
6243                         }
6244                         ip = mtod(m, struct ip *);
6245                         sh = (struct sctphdr *)((caddr_t)ip + off);
6246                         tag = htonl(sh->v_tag);
6247                         flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
6248                         m->m_pkthdr.flowid = flowid;
6249                         M_HASHTYPE_SET(m, M_HASHTYPE_OPAQUE_HASH);
6250                 }
6251                 cpu_to_use = sctp_cpuarry[flowid % mp_ncpus];
6252                 sctp_queue_to_mcore(m, off, cpu_to_use);
6253                 return (IPPROTO_DONE);
6254         }
6255 #endif
6256         sctp_input_with_port(m, off, 0);
6257         return (IPPROTO_DONE);
6258 }
6259
6260 #endif